xref: /openbmc/linux/drivers/scsi/lpfc/lpfc_bsg.c (revision 15d90a6a)
1 /*******************************************************************
2  * This file is part of the Emulex Linux Device Driver for         *
3  * Fibre Channel Host Bus Adapters.                                *
4  * Copyright (C) 2017-2018 Broadcom. All Rights Reserved. The term *
5  * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.     *
6  * Copyright (C) 2009-2015 Emulex.  All rights reserved.           *
7  * EMULEX and SLI are trademarks of Emulex.                        *
8  * www.broadcom.com                                                *
9  *                                                                 *
10  * This program is free software; you can redistribute it and/or   *
11  * modify it under the terms of version 2 of the GNU General       *
12  * Public License as published by the Free Software Foundation.    *
13  * This program is distributed in the hope that it will be useful. *
14  * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
15  * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
16  * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
17  * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
18  * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
19  * more details, a copy of which can be found in the file COPYING  *
20  * included with this package.                                     *
21  *******************************************************************/
22 
23 #include <linux/interrupt.h>
24 #include <linux/mempool.h>
25 #include <linux/pci.h>
26 #include <linux/slab.h>
27 #include <linux/delay.h>
28 #include <linux/list.h>
29 #include <linux/bsg-lib.h>
30 #include <linux/vmalloc.h>
31 
32 #include <scsi/scsi.h>
33 #include <scsi/scsi_host.h>
34 #include <scsi/scsi_transport_fc.h>
35 #include <scsi/scsi_bsg_fc.h>
36 #include <scsi/fc/fc_fs.h>
37 
38 #include "lpfc_hw4.h"
39 #include "lpfc_hw.h"
40 #include "lpfc_sli.h"
41 #include "lpfc_sli4.h"
42 #include "lpfc_nl.h"
43 #include "lpfc_bsg.h"
44 #include "lpfc_disc.h"
45 #include "lpfc_scsi.h"
46 #include "lpfc.h"
47 #include "lpfc_logmsg.h"
48 #include "lpfc_crtn.h"
49 #include "lpfc_debugfs.h"
50 #include "lpfc_vport.h"
51 #include "lpfc_version.h"
52 
53 struct lpfc_bsg_event {
54 	struct list_head node;
55 	struct kref kref;
56 	wait_queue_head_t wq;
57 
58 	/* Event type and waiter identifiers */
59 	uint32_t type_mask;
60 	uint32_t req_id;
61 	uint32_t reg_id;
62 
63 	/* next two flags are here for the auto-delete logic */
64 	unsigned long wait_time_stamp;
65 	int waiting;
66 
67 	/* seen and not seen events */
68 	struct list_head events_to_get;
69 	struct list_head events_to_see;
70 
71 	/* driver data associated with the job */
72 	void *dd_data;
73 };
74 
75 struct lpfc_bsg_iocb {
76 	struct lpfc_iocbq *cmdiocbq;
77 	struct lpfc_dmabuf *rmp;
78 	struct lpfc_nodelist *ndlp;
79 };
80 
81 struct lpfc_bsg_mbox {
82 	LPFC_MBOXQ_t *pmboxq;
83 	MAILBOX_t *mb;
84 	struct lpfc_dmabuf *dmabuffers; /* for BIU diags */
85 	uint8_t *ext; /* extended mailbox data */
86 	uint32_t mbOffset; /* from app */
87 	uint32_t inExtWLen; /* from app */
88 	uint32_t outExtWLen; /* from app */
89 };
90 
91 #define MENLO_DID 0x0000FC0E
92 
93 struct lpfc_bsg_menlo {
94 	struct lpfc_iocbq *cmdiocbq;
95 	struct lpfc_dmabuf *rmp;
96 };
97 
98 #define TYPE_EVT 	1
99 #define TYPE_IOCB	2
100 #define TYPE_MBOX	3
101 #define TYPE_MENLO	4
102 struct bsg_job_data {
103 	uint32_t type;
104 	struct bsg_job *set_job; /* job waiting for this iocb to finish */
105 	union {
106 		struct lpfc_bsg_event *evt;
107 		struct lpfc_bsg_iocb iocb;
108 		struct lpfc_bsg_mbox mbox;
109 		struct lpfc_bsg_menlo menlo;
110 	} context_un;
111 };
112 
113 struct event_data {
114 	struct list_head node;
115 	uint32_t type;
116 	uint32_t immed_dat;
117 	void *data;
118 	uint32_t len;
119 };
120 
121 #define BUF_SZ_4K 4096
122 #define SLI_CT_ELX_LOOPBACK 0x10
123 
124 enum ELX_LOOPBACK_CMD {
125 	ELX_LOOPBACK_XRI_SETUP,
126 	ELX_LOOPBACK_DATA,
127 };
128 
129 #define ELX_LOOPBACK_HEADER_SZ \
130 	(size_t)(&((struct lpfc_sli_ct_request *)NULL)->un)
131 
132 struct lpfc_dmabufext {
133 	struct lpfc_dmabuf dma;
134 	uint32_t size;
135 	uint32_t flag;
136 };
137 
138 static void
139 lpfc_free_bsg_buffers(struct lpfc_hba *phba, struct lpfc_dmabuf *mlist)
140 {
141 	struct lpfc_dmabuf *mlast, *next_mlast;
142 
143 	if (mlist) {
144 		list_for_each_entry_safe(mlast, next_mlast, &mlist->list,
145 					 list) {
146 			lpfc_mbuf_free(phba, mlast->virt, mlast->phys);
147 			list_del(&mlast->list);
148 			kfree(mlast);
149 		}
150 		lpfc_mbuf_free(phba, mlist->virt, mlist->phys);
151 		kfree(mlist);
152 	}
153 	return;
154 }
155 
156 static struct lpfc_dmabuf *
157 lpfc_alloc_bsg_buffers(struct lpfc_hba *phba, unsigned int size,
158 		       int outbound_buffers, struct ulp_bde64 *bpl,
159 		       int *bpl_entries)
160 {
161 	struct lpfc_dmabuf *mlist = NULL;
162 	struct lpfc_dmabuf *mp;
163 	unsigned int bytes_left = size;
164 
165 	/* Verify we can support the size specified */
166 	if (!size || (size > (*bpl_entries * LPFC_BPL_SIZE)))
167 		return NULL;
168 
169 	/* Determine the number of dma buffers to allocate */
170 	*bpl_entries = (size % LPFC_BPL_SIZE ? size/LPFC_BPL_SIZE + 1 :
171 			size/LPFC_BPL_SIZE);
172 
173 	/* Allocate dma buffer and place in BPL passed */
174 	while (bytes_left) {
175 		/* Allocate dma buffer  */
176 		mp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
177 		if (!mp) {
178 			if (mlist)
179 				lpfc_free_bsg_buffers(phba, mlist);
180 			return NULL;
181 		}
182 
183 		INIT_LIST_HEAD(&mp->list);
184 		mp->virt = lpfc_mbuf_alloc(phba, MEM_PRI, &(mp->phys));
185 
186 		if (!mp->virt) {
187 			kfree(mp);
188 			if (mlist)
189 				lpfc_free_bsg_buffers(phba, mlist);
190 			return NULL;
191 		}
192 
193 		/* Queue it to a linked list */
194 		if (!mlist)
195 			mlist = mp;
196 		else
197 			list_add_tail(&mp->list, &mlist->list);
198 
199 		/* Add buffer to buffer pointer list */
200 		if (outbound_buffers)
201 			bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
202 		else
203 			bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
204 		bpl->addrLow = le32_to_cpu(putPaddrLow(mp->phys));
205 		bpl->addrHigh = le32_to_cpu(putPaddrHigh(mp->phys));
206 		bpl->tus.f.bdeSize = (uint16_t)
207 			(bytes_left >= LPFC_BPL_SIZE ? LPFC_BPL_SIZE :
208 			 bytes_left);
209 		bytes_left -= bpl->tus.f.bdeSize;
210 		bpl->tus.w = le32_to_cpu(bpl->tus.w);
211 		bpl++;
212 	}
213 	return mlist;
214 }
215 
216 static unsigned int
217 lpfc_bsg_copy_data(struct lpfc_dmabuf *dma_buffers,
218 		   struct bsg_buffer *bsg_buffers,
219 		   unsigned int bytes_to_transfer, int to_buffers)
220 {
221 
222 	struct lpfc_dmabuf *mp;
223 	unsigned int transfer_bytes, bytes_copied = 0;
224 	unsigned int sg_offset, dma_offset;
225 	unsigned char *dma_address, *sg_address;
226 	LIST_HEAD(temp_list);
227 	struct sg_mapping_iter miter;
228 	unsigned long flags;
229 	unsigned int sg_flags = SG_MITER_ATOMIC;
230 	bool sg_valid;
231 
232 	list_splice_init(&dma_buffers->list, &temp_list);
233 	list_add(&dma_buffers->list, &temp_list);
234 	sg_offset = 0;
235 	if (to_buffers)
236 		sg_flags |= SG_MITER_FROM_SG;
237 	else
238 		sg_flags |= SG_MITER_TO_SG;
239 	sg_miter_start(&miter, bsg_buffers->sg_list, bsg_buffers->sg_cnt,
240 		       sg_flags);
241 	local_irq_save(flags);
242 	sg_valid = sg_miter_next(&miter);
243 	list_for_each_entry(mp, &temp_list, list) {
244 		dma_offset = 0;
245 		while (bytes_to_transfer && sg_valid &&
246 		       (dma_offset < LPFC_BPL_SIZE)) {
247 			dma_address = mp->virt + dma_offset;
248 			if (sg_offset) {
249 				/* Continue previous partial transfer of sg */
250 				sg_address = miter.addr + sg_offset;
251 				transfer_bytes = miter.length - sg_offset;
252 			} else {
253 				sg_address = miter.addr;
254 				transfer_bytes = miter.length;
255 			}
256 			if (bytes_to_transfer < transfer_bytes)
257 				transfer_bytes = bytes_to_transfer;
258 			if (transfer_bytes > (LPFC_BPL_SIZE - dma_offset))
259 				transfer_bytes = LPFC_BPL_SIZE - dma_offset;
260 			if (to_buffers)
261 				memcpy(dma_address, sg_address, transfer_bytes);
262 			else
263 				memcpy(sg_address, dma_address, transfer_bytes);
264 			dma_offset += transfer_bytes;
265 			sg_offset += transfer_bytes;
266 			bytes_to_transfer -= transfer_bytes;
267 			bytes_copied += transfer_bytes;
268 			if (sg_offset >= miter.length) {
269 				sg_offset = 0;
270 				sg_valid = sg_miter_next(&miter);
271 			}
272 		}
273 	}
274 	sg_miter_stop(&miter);
275 	local_irq_restore(flags);
276 	list_del_init(&dma_buffers->list);
277 	list_splice(&temp_list, &dma_buffers->list);
278 	return bytes_copied;
279 }
280 
281 /**
282  * lpfc_bsg_send_mgmt_cmd_cmp - lpfc_bsg_send_mgmt_cmd's completion handler
283  * @phba: Pointer to HBA context object.
284  * @cmdiocbq: Pointer to command iocb.
285  * @rspiocbq: Pointer to response iocb.
286  *
287  * This function is the completion handler for iocbs issued using
288  * lpfc_bsg_send_mgmt_cmd function. This function is called by the
289  * ring event handler function without any lock held. This function
290  * can be called from both worker thread context and interrupt
291  * context. This function also can be called from another thread which
292  * cleans up the SLI layer objects.
293  * This function copies the contents of the response iocb to the
294  * response iocb memory object provided by the caller of
295  * lpfc_sli_issue_iocb_wait and then wakes up the thread which
296  * sleeps for the iocb completion.
297  **/
298 static void
299 lpfc_bsg_send_mgmt_cmd_cmp(struct lpfc_hba *phba,
300 			struct lpfc_iocbq *cmdiocbq,
301 			struct lpfc_iocbq *rspiocbq)
302 {
303 	struct bsg_job_data *dd_data;
304 	struct bsg_job *job;
305 	struct fc_bsg_reply *bsg_reply;
306 	IOCB_t *rsp;
307 	struct lpfc_dmabuf *bmp, *cmp, *rmp;
308 	struct lpfc_nodelist *ndlp;
309 	struct lpfc_bsg_iocb *iocb;
310 	unsigned long flags;
311 	unsigned int rsp_size;
312 	int rc = 0;
313 
314 	dd_data = cmdiocbq->context1;
315 
316 	/* Determine if job has been aborted */
317 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
318 	job = dd_data->set_job;
319 	if (job) {
320 		bsg_reply = job->reply;
321 		/* Prevent timeout handling from trying to abort job */
322 		job->dd_data = NULL;
323 	}
324 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
325 
326 	/* Close the timeout handler abort window */
327 	spin_lock_irqsave(&phba->hbalock, flags);
328 	cmdiocbq->iocb_flag &= ~LPFC_IO_CMD_OUTSTANDING;
329 	spin_unlock_irqrestore(&phba->hbalock, flags);
330 
331 	iocb = &dd_data->context_un.iocb;
332 	ndlp = iocb->ndlp;
333 	rmp = iocb->rmp;
334 	cmp = cmdiocbq->context2;
335 	bmp = cmdiocbq->context3;
336 	rsp = &rspiocbq->iocb;
337 
338 	/* Copy the completed data or set the error status */
339 
340 	if (job) {
341 		if (rsp->ulpStatus) {
342 			if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
343 				switch (rsp->un.ulpWord[4] & IOERR_PARAM_MASK) {
344 				case IOERR_SEQUENCE_TIMEOUT:
345 					rc = -ETIMEDOUT;
346 					break;
347 				case IOERR_INVALID_RPI:
348 					rc = -EFAULT;
349 					break;
350 				default:
351 					rc = -EACCES;
352 					break;
353 				}
354 			} else {
355 				rc = -EACCES;
356 			}
357 		} else {
358 			rsp_size = rsp->un.genreq64.bdl.bdeSize;
359 			bsg_reply->reply_payload_rcv_len =
360 				lpfc_bsg_copy_data(rmp, &job->reply_payload,
361 						   rsp_size, 0);
362 		}
363 	}
364 
365 	lpfc_free_bsg_buffers(phba, cmp);
366 	lpfc_free_bsg_buffers(phba, rmp);
367 	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
368 	kfree(bmp);
369 	lpfc_sli_release_iocbq(phba, cmdiocbq);
370 	lpfc_nlp_put(ndlp);
371 	kfree(dd_data);
372 
373 	/* Complete the job if the job is still active */
374 
375 	if (job) {
376 		bsg_reply->result = rc;
377 		bsg_job_done(job, bsg_reply->result,
378 			       bsg_reply->reply_payload_rcv_len);
379 	}
380 	return;
381 }
382 
383 /**
384  * lpfc_bsg_send_mgmt_cmd - send a CT command from a bsg request
385  * @job: fc_bsg_job to handle
386  **/
387 static int
388 lpfc_bsg_send_mgmt_cmd(struct bsg_job *job)
389 {
390 	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
391 	struct lpfc_hba *phba = vport->phba;
392 	struct lpfc_rport_data *rdata = fc_bsg_to_rport(job)->dd_data;
393 	struct lpfc_nodelist *ndlp = rdata->pnode;
394 	struct fc_bsg_reply *bsg_reply = job->reply;
395 	struct ulp_bde64 *bpl = NULL;
396 	uint32_t timeout;
397 	struct lpfc_iocbq *cmdiocbq = NULL;
398 	IOCB_t *cmd;
399 	struct lpfc_dmabuf *bmp = NULL, *cmp = NULL, *rmp = NULL;
400 	int request_nseg;
401 	int reply_nseg;
402 	struct bsg_job_data *dd_data;
403 	unsigned long flags;
404 	uint32_t creg_val;
405 	int rc = 0;
406 	int iocb_stat;
407 
408 	/* in case no data is transferred */
409 	bsg_reply->reply_payload_rcv_len = 0;
410 
411 	/* allocate our bsg tracking structure */
412 	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
413 	if (!dd_data) {
414 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
415 				"2733 Failed allocation of dd_data\n");
416 		rc = -ENOMEM;
417 		goto no_dd_data;
418 	}
419 
420 	if (!lpfc_nlp_get(ndlp)) {
421 		rc = -ENODEV;
422 		goto no_ndlp;
423 	}
424 
425 	if (ndlp->nlp_flag & NLP_ELS_SND_MASK) {
426 		rc = -ENODEV;
427 		goto free_ndlp;
428 	}
429 
430 	cmdiocbq = lpfc_sli_get_iocbq(phba);
431 	if (!cmdiocbq) {
432 		rc = -ENOMEM;
433 		goto free_ndlp;
434 	}
435 
436 	cmd = &cmdiocbq->iocb;
437 
438 	bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
439 	if (!bmp) {
440 		rc = -ENOMEM;
441 		goto free_cmdiocbq;
442 	}
443 	bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
444 	if (!bmp->virt) {
445 		rc = -ENOMEM;
446 		goto free_bmp;
447 	}
448 
449 	INIT_LIST_HEAD(&bmp->list);
450 
451 	bpl = (struct ulp_bde64 *) bmp->virt;
452 	request_nseg = LPFC_BPL_SIZE/sizeof(struct ulp_bde64);
453 	cmp = lpfc_alloc_bsg_buffers(phba, job->request_payload.payload_len,
454 				     1, bpl, &request_nseg);
455 	if (!cmp) {
456 		rc = -ENOMEM;
457 		goto free_bmp;
458 	}
459 	lpfc_bsg_copy_data(cmp, &job->request_payload,
460 			   job->request_payload.payload_len, 1);
461 
462 	bpl += request_nseg;
463 	reply_nseg = LPFC_BPL_SIZE/sizeof(struct ulp_bde64) - request_nseg;
464 	rmp = lpfc_alloc_bsg_buffers(phba, job->reply_payload.payload_len, 0,
465 				     bpl, &reply_nseg);
466 	if (!rmp) {
467 		rc = -ENOMEM;
468 		goto free_cmp;
469 	}
470 
471 	cmd->un.genreq64.bdl.ulpIoTag32 = 0;
472 	cmd->un.genreq64.bdl.addrHigh = putPaddrHigh(bmp->phys);
473 	cmd->un.genreq64.bdl.addrLow = putPaddrLow(bmp->phys);
474 	cmd->un.genreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
475 	cmd->un.genreq64.bdl.bdeSize =
476 		(request_nseg + reply_nseg) * sizeof(struct ulp_bde64);
477 	cmd->ulpCommand = CMD_GEN_REQUEST64_CR;
478 	cmd->un.genreq64.w5.hcsw.Fctl = (SI | LA);
479 	cmd->un.genreq64.w5.hcsw.Dfctl = 0;
480 	cmd->un.genreq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL;
481 	cmd->un.genreq64.w5.hcsw.Type = FC_TYPE_CT;
482 	cmd->ulpBdeCount = 1;
483 	cmd->ulpLe = 1;
484 	cmd->ulpClass = CLASS3;
485 	cmd->ulpContext = ndlp->nlp_rpi;
486 	if (phba->sli_rev == LPFC_SLI_REV4)
487 		cmd->ulpContext = phba->sli4_hba.rpi_ids[ndlp->nlp_rpi];
488 	cmd->ulpOwner = OWN_CHIP;
489 	cmdiocbq->vport = phba->pport;
490 	cmdiocbq->context3 = bmp;
491 	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
492 	timeout = phba->fc_ratov * 2;
493 	cmd->ulpTimeout = timeout;
494 
495 	cmdiocbq->iocb_cmpl = lpfc_bsg_send_mgmt_cmd_cmp;
496 	cmdiocbq->context1 = dd_data;
497 	cmdiocbq->context2 = cmp;
498 	cmdiocbq->context3 = bmp;
499 	cmdiocbq->context_un.ndlp = ndlp;
500 	dd_data->type = TYPE_IOCB;
501 	dd_data->set_job = job;
502 	dd_data->context_un.iocb.cmdiocbq = cmdiocbq;
503 	dd_data->context_un.iocb.ndlp = ndlp;
504 	dd_data->context_un.iocb.rmp = rmp;
505 	job->dd_data = dd_data;
506 
507 	if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
508 		if (lpfc_readl(phba->HCregaddr, &creg_val)) {
509 			rc = -EIO ;
510 			goto free_rmp;
511 		}
512 		creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
513 		writel(creg_val, phba->HCregaddr);
514 		readl(phba->HCregaddr); /* flush */
515 	}
516 
517 	iocb_stat = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0);
518 
519 	if (iocb_stat == IOCB_SUCCESS) {
520 		spin_lock_irqsave(&phba->hbalock, flags);
521 		/* make sure the I/O had not been completed yet */
522 		if (cmdiocbq->iocb_flag & LPFC_IO_LIBDFC) {
523 			/* open up abort window to timeout handler */
524 			cmdiocbq->iocb_flag |= LPFC_IO_CMD_OUTSTANDING;
525 		}
526 		spin_unlock_irqrestore(&phba->hbalock, flags);
527 		return 0; /* done for now */
528 	} else if (iocb_stat == IOCB_BUSY) {
529 		rc = -EAGAIN;
530 	} else {
531 		rc = -EIO;
532 	}
533 
534 	/* iocb failed so cleanup */
535 	job->dd_data = NULL;
536 
537 free_rmp:
538 	lpfc_free_bsg_buffers(phba, rmp);
539 free_cmp:
540 	lpfc_free_bsg_buffers(phba, cmp);
541 free_bmp:
542 	if (bmp->virt)
543 		lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
544 	kfree(bmp);
545 free_cmdiocbq:
546 	lpfc_sli_release_iocbq(phba, cmdiocbq);
547 free_ndlp:
548 	lpfc_nlp_put(ndlp);
549 no_ndlp:
550 	kfree(dd_data);
551 no_dd_data:
552 	/* make error code available to userspace */
553 	bsg_reply->result = rc;
554 	job->dd_data = NULL;
555 	return rc;
556 }
557 
558 /**
559  * lpfc_bsg_rport_els_cmp - lpfc_bsg_rport_els's completion handler
560  * @phba: Pointer to HBA context object.
561  * @cmdiocbq: Pointer to command iocb.
562  * @rspiocbq: Pointer to response iocb.
563  *
564  * This function is the completion handler for iocbs issued using
565  * lpfc_bsg_rport_els_cmp function. This function is called by the
566  * ring event handler function without any lock held. This function
567  * can be called from both worker thread context and interrupt
568  * context. This function also can be called from other thread which
569  * cleans up the SLI layer objects.
570  * This function copies the contents of the response iocb to the
571  * response iocb memory object provided by the caller of
572  * lpfc_sli_issue_iocb_wait and then wakes up the thread which
573  * sleeps for the iocb completion.
574  **/
575 static void
576 lpfc_bsg_rport_els_cmp(struct lpfc_hba *phba,
577 			struct lpfc_iocbq *cmdiocbq,
578 			struct lpfc_iocbq *rspiocbq)
579 {
580 	struct bsg_job_data *dd_data;
581 	struct bsg_job *job;
582 	struct fc_bsg_reply *bsg_reply;
583 	IOCB_t *rsp;
584 	struct lpfc_nodelist *ndlp;
585 	struct lpfc_dmabuf *pcmd = NULL, *prsp = NULL;
586 	struct fc_bsg_ctels_reply *els_reply;
587 	uint8_t *rjt_data;
588 	unsigned long flags;
589 	unsigned int rsp_size;
590 	int rc = 0;
591 
592 	dd_data = cmdiocbq->context1;
593 	ndlp = dd_data->context_un.iocb.ndlp;
594 	cmdiocbq->context1 = ndlp;
595 
596 	/* Determine if job has been aborted */
597 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
598 	job = dd_data->set_job;
599 	if (job) {
600 		bsg_reply = job->reply;
601 		/* Prevent timeout handling from trying to abort job  */
602 		job->dd_data = NULL;
603 	}
604 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
605 
606 	/* Close the timeout handler abort window */
607 	spin_lock_irqsave(&phba->hbalock, flags);
608 	cmdiocbq->iocb_flag &= ~LPFC_IO_CMD_OUTSTANDING;
609 	spin_unlock_irqrestore(&phba->hbalock, flags);
610 
611 	rsp = &rspiocbq->iocb;
612 	pcmd = (struct lpfc_dmabuf *)cmdiocbq->context2;
613 	prsp = (struct lpfc_dmabuf *)pcmd->list.next;
614 
615 	/* Copy the completed job data or determine the job status if job is
616 	 * still active
617 	 */
618 
619 	if (job) {
620 		if (rsp->ulpStatus == IOSTAT_SUCCESS) {
621 			rsp_size = rsp->un.elsreq64.bdl.bdeSize;
622 			bsg_reply->reply_payload_rcv_len =
623 				sg_copy_from_buffer(job->reply_payload.sg_list,
624 						    job->reply_payload.sg_cnt,
625 						    prsp->virt,
626 						    rsp_size);
627 		} else if (rsp->ulpStatus == IOSTAT_LS_RJT) {
628 			bsg_reply->reply_payload_rcv_len =
629 				sizeof(struct fc_bsg_ctels_reply);
630 			/* LS_RJT data returned in word 4 */
631 			rjt_data = (uint8_t *)&rsp->un.ulpWord[4];
632 			els_reply = &bsg_reply->reply_data.ctels_reply;
633 			els_reply->status = FC_CTELS_STATUS_REJECT;
634 			els_reply->rjt_data.action = rjt_data[3];
635 			els_reply->rjt_data.reason_code = rjt_data[2];
636 			els_reply->rjt_data.reason_explanation = rjt_data[1];
637 			els_reply->rjt_data.vendor_unique = rjt_data[0];
638 		} else {
639 			rc = -EIO;
640 		}
641 	}
642 
643 	lpfc_nlp_put(ndlp);
644 	lpfc_els_free_iocb(phba, cmdiocbq);
645 	kfree(dd_data);
646 
647 	/* Complete the job if the job is still active */
648 
649 	if (job) {
650 		bsg_reply->result = rc;
651 		bsg_job_done(job, bsg_reply->result,
652 			       bsg_reply->reply_payload_rcv_len);
653 	}
654 	return;
655 }
656 
657 /**
658  * lpfc_bsg_rport_els - send an ELS command from a bsg request
659  * @job: fc_bsg_job to handle
660  **/
661 static int
662 lpfc_bsg_rport_els(struct bsg_job *job)
663 {
664 	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
665 	struct lpfc_hba *phba = vport->phba;
666 	struct lpfc_rport_data *rdata = fc_bsg_to_rport(job)->dd_data;
667 	struct lpfc_nodelist *ndlp = rdata->pnode;
668 	struct fc_bsg_request *bsg_request = job->request;
669 	struct fc_bsg_reply *bsg_reply = job->reply;
670 	uint32_t elscmd;
671 	uint32_t cmdsize;
672 	struct lpfc_iocbq *cmdiocbq;
673 	uint16_t rpi = 0;
674 	struct bsg_job_data *dd_data;
675 	unsigned long flags;
676 	uint32_t creg_val;
677 	int rc = 0;
678 
679 	/* in case no data is transferred */
680 	bsg_reply->reply_payload_rcv_len = 0;
681 
682 	/* verify the els command is not greater than the
683 	 * maximum ELS transfer size.
684 	 */
685 
686 	if (job->request_payload.payload_len > FCELSSIZE) {
687 		rc = -EINVAL;
688 		goto no_dd_data;
689 	}
690 
691 	/* allocate our bsg tracking structure */
692 	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
693 	if (!dd_data) {
694 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
695 				"2735 Failed allocation of dd_data\n");
696 		rc = -ENOMEM;
697 		goto no_dd_data;
698 	}
699 
700 	elscmd = bsg_request->rqst_data.r_els.els_code;
701 	cmdsize = job->request_payload.payload_len;
702 
703 	if (!lpfc_nlp_get(ndlp)) {
704 		rc = -ENODEV;
705 		goto free_dd_data;
706 	}
707 
708 	/* We will use the allocated dma buffers by prep els iocb for command
709 	 * and response to ensure if the job times out and the request is freed,
710 	 * we won't be dma into memory that is no longer allocated to for the
711 	 * request.
712 	 */
713 
714 	cmdiocbq = lpfc_prep_els_iocb(vport, 1, cmdsize, 0, ndlp,
715 				      ndlp->nlp_DID, elscmd);
716 	if (!cmdiocbq) {
717 		rc = -EIO;
718 		goto release_ndlp;
719 	}
720 
721 	rpi = ndlp->nlp_rpi;
722 
723 	/* Transfer the request payload to allocated command dma buffer */
724 
725 	sg_copy_to_buffer(job->request_payload.sg_list,
726 			  job->request_payload.sg_cnt,
727 			  ((struct lpfc_dmabuf *)cmdiocbq->context2)->virt,
728 			  cmdsize);
729 
730 	if (phba->sli_rev == LPFC_SLI_REV4)
731 		cmdiocbq->iocb.ulpContext = phba->sli4_hba.rpi_ids[rpi];
732 	else
733 		cmdiocbq->iocb.ulpContext = rpi;
734 	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
735 	cmdiocbq->context1 = dd_data;
736 	cmdiocbq->context_un.ndlp = ndlp;
737 	cmdiocbq->iocb_cmpl = lpfc_bsg_rport_els_cmp;
738 	dd_data->type = TYPE_IOCB;
739 	dd_data->set_job = job;
740 	dd_data->context_un.iocb.cmdiocbq = cmdiocbq;
741 	dd_data->context_un.iocb.ndlp = ndlp;
742 	dd_data->context_un.iocb.rmp = NULL;
743 	job->dd_data = dd_data;
744 
745 	if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
746 		if (lpfc_readl(phba->HCregaddr, &creg_val)) {
747 			rc = -EIO;
748 			goto linkdown_err;
749 		}
750 		creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
751 		writel(creg_val, phba->HCregaddr);
752 		readl(phba->HCregaddr); /* flush */
753 	}
754 
755 	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0);
756 
757 	if (rc == IOCB_SUCCESS) {
758 		spin_lock_irqsave(&phba->hbalock, flags);
759 		/* make sure the I/O had not been completed/released */
760 		if (cmdiocbq->iocb_flag & LPFC_IO_LIBDFC) {
761 			/* open up abort window to timeout handler */
762 			cmdiocbq->iocb_flag |= LPFC_IO_CMD_OUTSTANDING;
763 		}
764 		spin_unlock_irqrestore(&phba->hbalock, flags);
765 		return 0; /* done for now */
766 	} else if (rc == IOCB_BUSY) {
767 		rc = -EAGAIN;
768 	} else {
769 		rc = -EIO;
770 	}
771 
772 	/* iocb failed so cleanup */
773 	job->dd_data = NULL;
774 
775 linkdown_err:
776 	cmdiocbq->context1 = ndlp;
777 	lpfc_els_free_iocb(phba, cmdiocbq);
778 
779 release_ndlp:
780 	lpfc_nlp_put(ndlp);
781 
782 free_dd_data:
783 	kfree(dd_data);
784 
785 no_dd_data:
786 	/* make error code available to userspace */
787 	bsg_reply->result = rc;
788 	job->dd_data = NULL;
789 	return rc;
790 }
791 
792 /**
793  * lpfc_bsg_event_free - frees an allocated event structure
794  * @kref: Pointer to a kref.
795  *
796  * Called from kref_put. Back cast the kref into an event structure address.
797  * Free any events to get, delete associated nodes, free any events to see,
798  * free any data then free the event itself.
799  **/
800 static void
801 lpfc_bsg_event_free(struct kref *kref)
802 {
803 	struct lpfc_bsg_event *evt = container_of(kref, struct lpfc_bsg_event,
804 						  kref);
805 	struct event_data *ed;
806 
807 	list_del(&evt->node);
808 
809 	while (!list_empty(&evt->events_to_get)) {
810 		ed = list_entry(evt->events_to_get.next, typeof(*ed), node);
811 		list_del(&ed->node);
812 		kfree(ed->data);
813 		kfree(ed);
814 	}
815 
816 	while (!list_empty(&evt->events_to_see)) {
817 		ed = list_entry(evt->events_to_see.next, typeof(*ed), node);
818 		list_del(&ed->node);
819 		kfree(ed->data);
820 		kfree(ed);
821 	}
822 
823 	kfree(evt->dd_data);
824 	kfree(evt);
825 }
826 
827 /**
828  * lpfc_bsg_event_ref - increments the kref for an event
829  * @evt: Pointer to an event structure.
830  **/
831 static inline void
832 lpfc_bsg_event_ref(struct lpfc_bsg_event *evt)
833 {
834 	kref_get(&evt->kref);
835 }
836 
837 /**
838  * lpfc_bsg_event_unref - Uses kref_put to free an event structure
839  * @evt: Pointer to an event structure.
840  **/
841 static inline void
842 lpfc_bsg_event_unref(struct lpfc_bsg_event *evt)
843 {
844 	kref_put(&evt->kref, lpfc_bsg_event_free);
845 }
846 
847 /**
848  * lpfc_bsg_event_new - allocate and initialize a event structure
849  * @ev_mask: Mask of events.
850  * @ev_reg_id: Event reg id.
851  * @ev_req_id: Event request id.
852  **/
853 static struct lpfc_bsg_event *
854 lpfc_bsg_event_new(uint32_t ev_mask, int ev_reg_id, uint32_t ev_req_id)
855 {
856 	struct lpfc_bsg_event *evt = kzalloc(sizeof(*evt), GFP_KERNEL);
857 
858 	if (!evt)
859 		return NULL;
860 
861 	INIT_LIST_HEAD(&evt->events_to_get);
862 	INIT_LIST_HEAD(&evt->events_to_see);
863 	evt->type_mask = ev_mask;
864 	evt->req_id = ev_req_id;
865 	evt->reg_id = ev_reg_id;
866 	evt->wait_time_stamp = jiffies;
867 	evt->dd_data = NULL;
868 	init_waitqueue_head(&evt->wq);
869 	kref_init(&evt->kref);
870 	return evt;
871 }
872 
873 /**
874  * diag_cmd_data_free - Frees an lpfc dma buffer extension
875  * @phba: Pointer to HBA context object.
876  * @mlist: Pointer to an lpfc dma buffer extension.
877  **/
878 static int
879 diag_cmd_data_free(struct lpfc_hba *phba, struct lpfc_dmabufext *mlist)
880 {
881 	struct lpfc_dmabufext *mlast;
882 	struct pci_dev *pcidev;
883 	struct list_head head, *curr, *next;
884 
885 	if ((!mlist) || (!lpfc_is_link_up(phba) &&
886 		(phba->link_flag & LS_LOOPBACK_MODE))) {
887 		return 0;
888 	}
889 
890 	pcidev = phba->pcidev;
891 	list_add_tail(&head, &mlist->dma.list);
892 
893 	list_for_each_safe(curr, next, &head) {
894 		mlast = list_entry(curr, struct lpfc_dmabufext , dma.list);
895 		if (mlast->dma.virt)
896 			dma_free_coherent(&pcidev->dev,
897 					  mlast->size,
898 					  mlast->dma.virt,
899 					  mlast->dma.phys);
900 		kfree(mlast);
901 	}
902 	return 0;
903 }
904 
905 /**
906  * lpfc_bsg_ct_unsol_event - process an unsolicited CT command
907  * @phba:
908  * @pring:
909  * @piocbq:
910  *
911  * This function is called when an unsolicited CT command is received.  It
912  * forwards the event to any processes registered to receive CT events.
913  **/
914 int
915 lpfc_bsg_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
916 			struct lpfc_iocbq *piocbq)
917 {
918 	uint32_t evt_req_id = 0;
919 	uint32_t cmd;
920 	struct lpfc_dmabuf *dmabuf = NULL;
921 	struct lpfc_bsg_event *evt;
922 	struct event_data *evt_dat = NULL;
923 	struct lpfc_iocbq *iocbq;
924 	size_t offset = 0;
925 	struct list_head head;
926 	struct ulp_bde64 *bde;
927 	dma_addr_t dma_addr;
928 	int i;
929 	struct lpfc_dmabuf *bdeBuf1 = piocbq->context2;
930 	struct lpfc_dmabuf *bdeBuf2 = piocbq->context3;
931 	struct lpfc_hbq_entry *hbqe;
932 	struct lpfc_sli_ct_request *ct_req;
933 	struct bsg_job *job = NULL;
934 	struct fc_bsg_reply *bsg_reply;
935 	struct bsg_job_data *dd_data = NULL;
936 	unsigned long flags;
937 	int size = 0;
938 
939 	INIT_LIST_HEAD(&head);
940 	list_add_tail(&head, &piocbq->list);
941 
942 	if (piocbq->iocb.ulpBdeCount == 0 ||
943 	    piocbq->iocb.un.cont64[0].tus.f.bdeSize == 0)
944 		goto error_ct_unsol_exit;
945 
946 	if (phba->link_state == LPFC_HBA_ERROR ||
947 		(!(phba->sli.sli_flag & LPFC_SLI_ACTIVE)))
948 		goto error_ct_unsol_exit;
949 
950 	if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED)
951 		dmabuf = bdeBuf1;
952 	else {
953 		dma_addr = getPaddr(piocbq->iocb.un.cont64[0].addrHigh,
954 				    piocbq->iocb.un.cont64[0].addrLow);
955 		dmabuf = lpfc_sli_ringpostbuf_get(phba, pring, dma_addr);
956 	}
957 	if (dmabuf == NULL)
958 		goto error_ct_unsol_exit;
959 	ct_req = (struct lpfc_sli_ct_request *)dmabuf->virt;
960 	evt_req_id = ct_req->FsType;
961 	cmd = ct_req->CommandResponse.bits.CmdRsp;
962 	if (!(phba->sli3_options & LPFC_SLI3_HBQ_ENABLED))
963 		lpfc_sli_ringpostbuf_put(phba, pring, dmabuf);
964 
965 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
966 	list_for_each_entry(evt, &phba->ct_ev_waiters, node) {
967 		if (!(evt->type_mask & FC_REG_CT_EVENT) ||
968 			evt->req_id != evt_req_id)
969 			continue;
970 
971 		lpfc_bsg_event_ref(evt);
972 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
973 		evt_dat = kzalloc(sizeof(*evt_dat), GFP_KERNEL);
974 		if (evt_dat == NULL) {
975 			spin_lock_irqsave(&phba->ct_ev_lock, flags);
976 			lpfc_bsg_event_unref(evt);
977 			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
978 					"2614 Memory allocation failed for "
979 					"CT event\n");
980 			break;
981 		}
982 
983 		if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
984 			/* take accumulated byte count from the last iocbq */
985 			iocbq = list_entry(head.prev, typeof(*iocbq), list);
986 			evt_dat->len = iocbq->iocb.unsli3.rcvsli3.acc_len;
987 		} else {
988 			list_for_each_entry(iocbq, &head, list) {
989 				for (i = 0; i < iocbq->iocb.ulpBdeCount; i++)
990 					evt_dat->len +=
991 					iocbq->iocb.un.cont64[i].tus.f.bdeSize;
992 			}
993 		}
994 
995 		evt_dat->data = kzalloc(evt_dat->len, GFP_KERNEL);
996 		if (evt_dat->data == NULL) {
997 			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
998 					"2615 Memory allocation failed for "
999 					"CT event data, size %d\n",
1000 					evt_dat->len);
1001 			kfree(evt_dat);
1002 			spin_lock_irqsave(&phba->ct_ev_lock, flags);
1003 			lpfc_bsg_event_unref(evt);
1004 			spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1005 			goto error_ct_unsol_exit;
1006 		}
1007 
1008 		list_for_each_entry(iocbq, &head, list) {
1009 			size = 0;
1010 			if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
1011 				bdeBuf1 = iocbq->context2;
1012 				bdeBuf2 = iocbq->context3;
1013 			}
1014 			for (i = 0; i < iocbq->iocb.ulpBdeCount; i++) {
1015 				if (phba->sli3_options &
1016 				    LPFC_SLI3_HBQ_ENABLED) {
1017 					if (i == 0) {
1018 						hbqe = (struct lpfc_hbq_entry *)
1019 						  &iocbq->iocb.un.ulpWord[0];
1020 						size = hbqe->bde.tus.f.bdeSize;
1021 						dmabuf = bdeBuf1;
1022 					} else if (i == 1) {
1023 						hbqe = (struct lpfc_hbq_entry *)
1024 							&iocbq->iocb.unsli3.
1025 							sli3Words[4];
1026 						size = hbqe->bde.tus.f.bdeSize;
1027 						dmabuf = bdeBuf2;
1028 					}
1029 					if ((offset + size) > evt_dat->len)
1030 						size = evt_dat->len - offset;
1031 				} else {
1032 					size = iocbq->iocb.un.cont64[i].
1033 						tus.f.bdeSize;
1034 					bde = &iocbq->iocb.un.cont64[i];
1035 					dma_addr = getPaddr(bde->addrHigh,
1036 							    bde->addrLow);
1037 					dmabuf = lpfc_sli_ringpostbuf_get(phba,
1038 							pring, dma_addr);
1039 				}
1040 				if (!dmabuf) {
1041 					lpfc_printf_log(phba, KERN_ERR,
1042 						LOG_LIBDFC, "2616 No dmabuf "
1043 						"found for iocbq 0x%p\n",
1044 						iocbq);
1045 					kfree(evt_dat->data);
1046 					kfree(evt_dat);
1047 					spin_lock_irqsave(&phba->ct_ev_lock,
1048 						flags);
1049 					lpfc_bsg_event_unref(evt);
1050 					spin_unlock_irqrestore(
1051 						&phba->ct_ev_lock, flags);
1052 					goto error_ct_unsol_exit;
1053 				}
1054 				memcpy((char *)(evt_dat->data) + offset,
1055 				       dmabuf->virt, size);
1056 				offset += size;
1057 				if (evt_req_id != SLI_CT_ELX_LOOPBACK &&
1058 				    !(phba->sli3_options &
1059 				      LPFC_SLI3_HBQ_ENABLED)) {
1060 					lpfc_sli_ringpostbuf_put(phba, pring,
1061 								 dmabuf);
1062 				} else {
1063 					switch (cmd) {
1064 					case ELX_LOOPBACK_DATA:
1065 						if (phba->sli_rev <
1066 						    LPFC_SLI_REV4)
1067 							diag_cmd_data_free(phba,
1068 							(struct lpfc_dmabufext
1069 							 *)dmabuf);
1070 						break;
1071 					case ELX_LOOPBACK_XRI_SETUP:
1072 						if ((phba->sli_rev ==
1073 							LPFC_SLI_REV2) ||
1074 							(phba->sli3_options &
1075 							LPFC_SLI3_HBQ_ENABLED
1076 							)) {
1077 							lpfc_in_buf_free(phba,
1078 									dmabuf);
1079 						} else {
1080 							lpfc_post_buffer(phba,
1081 									 pring,
1082 									 1);
1083 						}
1084 						break;
1085 					default:
1086 						if (!(phba->sli3_options &
1087 						      LPFC_SLI3_HBQ_ENABLED))
1088 							lpfc_post_buffer(phba,
1089 									 pring,
1090 									 1);
1091 						break;
1092 					}
1093 				}
1094 			}
1095 		}
1096 
1097 		spin_lock_irqsave(&phba->ct_ev_lock, flags);
1098 		if (phba->sli_rev == LPFC_SLI_REV4) {
1099 			evt_dat->immed_dat = phba->ctx_idx;
1100 			phba->ctx_idx = (phba->ctx_idx + 1) % LPFC_CT_CTX_MAX;
1101 			/* Provide warning for over-run of the ct_ctx array */
1102 			if (phba->ct_ctx[evt_dat->immed_dat].valid ==
1103 			    UNSOL_VALID)
1104 				lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
1105 						"2717 CT context array entry "
1106 						"[%d] over-run: oxid:x%x, "
1107 						"sid:x%x\n", phba->ctx_idx,
1108 						phba->ct_ctx[
1109 						    evt_dat->immed_dat].oxid,
1110 						phba->ct_ctx[
1111 						    evt_dat->immed_dat].SID);
1112 			phba->ct_ctx[evt_dat->immed_dat].rxid =
1113 				piocbq->iocb.ulpContext;
1114 			phba->ct_ctx[evt_dat->immed_dat].oxid =
1115 				piocbq->iocb.unsli3.rcvsli3.ox_id;
1116 			phba->ct_ctx[evt_dat->immed_dat].SID =
1117 				piocbq->iocb.un.rcvels.remoteID;
1118 			phba->ct_ctx[evt_dat->immed_dat].valid = UNSOL_VALID;
1119 		} else
1120 			evt_dat->immed_dat = piocbq->iocb.ulpContext;
1121 
1122 		evt_dat->type = FC_REG_CT_EVENT;
1123 		list_add(&evt_dat->node, &evt->events_to_see);
1124 		if (evt_req_id == SLI_CT_ELX_LOOPBACK) {
1125 			wake_up_interruptible(&evt->wq);
1126 			lpfc_bsg_event_unref(evt);
1127 			break;
1128 		}
1129 
1130 		list_move(evt->events_to_see.prev, &evt->events_to_get);
1131 
1132 		dd_data = (struct bsg_job_data *)evt->dd_data;
1133 		job = dd_data->set_job;
1134 		dd_data->set_job = NULL;
1135 		lpfc_bsg_event_unref(evt);
1136 		if (job) {
1137 			bsg_reply = job->reply;
1138 			bsg_reply->reply_payload_rcv_len = size;
1139 			/* make error code available to userspace */
1140 			bsg_reply->result = 0;
1141 			job->dd_data = NULL;
1142 			/* complete the job back to userspace */
1143 			spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1144 			bsg_job_done(job, bsg_reply->result,
1145 				       bsg_reply->reply_payload_rcv_len);
1146 			spin_lock_irqsave(&phba->ct_ev_lock, flags);
1147 		}
1148 	}
1149 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1150 
1151 error_ct_unsol_exit:
1152 	if (!list_empty(&head))
1153 		list_del(&head);
1154 	if ((phba->sli_rev < LPFC_SLI_REV4) &&
1155 	    (evt_req_id == SLI_CT_ELX_LOOPBACK))
1156 		return 0;
1157 	return 1;
1158 }
1159 
1160 /**
1161  * lpfc_bsg_ct_unsol_abort - handler ct abort to management plane
1162  * @phba: Pointer to HBA context object.
1163  * @dmabuf: pointer to a dmabuf that describes the FC sequence
1164  *
1165  * This function handles abort to the CT command toward management plane
1166  * for SLI4 port.
1167  *
1168  * If the pending context of a CT command to management plane present, clears
1169  * such context and returns 1 for handled; otherwise, it returns 0 indicating
1170  * no context exists.
1171  **/
1172 int
1173 lpfc_bsg_ct_unsol_abort(struct lpfc_hba *phba, struct hbq_dmabuf *dmabuf)
1174 {
1175 	struct fc_frame_header fc_hdr;
1176 	struct fc_frame_header *fc_hdr_ptr = &fc_hdr;
1177 	int ctx_idx, handled = 0;
1178 	uint16_t oxid, rxid;
1179 	uint32_t sid;
1180 
1181 	memcpy(fc_hdr_ptr, dmabuf->hbuf.virt, sizeof(struct fc_frame_header));
1182 	sid = sli4_sid_from_fc_hdr(fc_hdr_ptr);
1183 	oxid = be16_to_cpu(fc_hdr_ptr->fh_ox_id);
1184 	rxid = be16_to_cpu(fc_hdr_ptr->fh_rx_id);
1185 
1186 	for (ctx_idx = 0; ctx_idx < LPFC_CT_CTX_MAX; ctx_idx++) {
1187 		if (phba->ct_ctx[ctx_idx].valid != UNSOL_VALID)
1188 			continue;
1189 		if (phba->ct_ctx[ctx_idx].rxid != rxid)
1190 			continue;
1191 		if (phba->ct_ctx[ctx_idx].oxid != oxid)
1192 			continue;
1193 		if (phba->ct_ctx[ctx_idx].SID != sid)
1194 			continue;
1195 		phba->ct_ctx[ctx_idx].valid = UNSOL_INVALID;
1196 		handled = 1;
1197 	}
1198 	return handled;
1199 }
1200 
1201 /**
1202  * lpfc_bsg_hba_set_event - process a SET_EVENT bsg vendor command
1203  * @job: SET_EVENT fc_bsg_job
1204  **/
1205 static int
1206 lpfc_bsg_hba_set_event(struct bsg_job *job)
1207 {
1208 	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
1209 	struct lpfc_hba *phba = vport->phba;
1210 	struct fc_bsg_request *bsg_request = job->request;
1211 	struct set_ct_event *event_req;
1212 	struct lpfc_bsg_event *evt;
1213 	int rc = 0;
1214 	struct bsg_job_data *dd_data = NULL;
1215 	uint32_t ev_mask;
1216 	unsigned long flags;
1217 
1218 	if (job->request_len <
1219 	    sizeof(struct fc_bsg_request) + sizeof(struct set_ct_event)) {
1220 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1221 				"2612 Received SET_CT_EVENT below minimum "
1222 				"size\n");
1223 		rc = -EINVAL;
1224 		goto job_error;
1225 	}
1226 
1227 	event_req = (struct set_ct_event *)
1228 		bsg_request->rqst_data.h_vendor.vendor_cmd;
1229 	ev_mask = ((uint32_t)(unsigned long)event_req->type_mask &
1230 				FC_REG_EVENT_MASK);
1231 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1232 	list_for_each_entry(evt, &phba->ct_ev_waiters, node) {
1233 		if (evt->reg_id == event_req->ev_reg_id) {
1234 			lpfc_bsg_event_ref(evt);
1235 			evt->wait_time_stamp = jiffies;
1236 			dd_data = (struct bsg_job_data *)evt->dd_data;
1237 			break;
1238 		}
1239 	}
1240 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1241 
1242 	if (&evt->node == &phba->ct_ev_waiters) {
1243 		/* no event waiting struct yet - first call */
1244 		dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
1245 		if (dd_data == NULL) {
1246 			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1247 					"2734 Failed allocation of dd_data\n");
1248 			rc = -ENOMEM;
1249 			goto job_error;
1250 		}
1251 		evt = lpfc_bsg_event_new(ev_mask, event_req->ev_reg_id,
1252 					event_req->ev_req_id);
1253 		if (!evt) {
1254 			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1255 					"2617 Failed allocation of event "
1256 					"waiter\n");
1257 			rc = -ENOMEM;
1258 			goto job_error;
1259 		}
1260 		dd_data->type = TYPE_EVT;
1261 		dd_data->set_job = NULL;
1262 		dd_data->context_un.evt = evt;
1263 		evt->dd_data = (void *)dd_data;
1264 		spin_lock_irqsave(&phba->ct_ev_lock, flags);
1265 		list_add(&evt->node, &phba->ct_ev_waiters);
1266 		lpfc_bsg_event_ref(evt);
1267 		evt->wait_time_stamp = jiffies;
1268 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1269 	}
1270 
1271 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1272 	evt->waiting = 1;
1273 	dd_data->set_job = job; /* for unsolicited command */
1274 	job->dd_data = dd_data; /* for fc transport timeout callback*/
1275 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1276 	return 0; /* call job done later */
1277 
1278 job_error:
1279 	if (dd_data != NULL)
1280 		kfree(dd_data);
1281 
1282 	job->dd_data = NULL;
1283 	return rc;
1284 }
1285 
1286 /**
1287  * lpfc_bsg_hba_get_event - process a GET_EVENT bsg vendor command
1288  * @job: GET_EVENT fc_bsg_job
1289  **/
1290 static int
1291 lpfc_bsg_hba_get_event(struct bsg_job *job)
1292 {
1293 	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
1294 	struct lpfc_hba *phba = vport->phba;
1295 	struct fc_bsg_request *bsg_request = job->request;
1296 	struct fc_bsg_reply *bsg_reply = job->reply;
1297 	struct get_ct_event *event_req;
1298 	struct get_ct_event_reply *event_reply;
1299 	struct lpfc_bsg_event *evt, *evt_next;
1300 	struct event_data *evt_dat = NULL;
1301 	unsigned long flags;
1302 	uint32_t rc = 0;
1303 
1304 	if (job->request_len <
1305 	    sizeof(struct fc_bsg_request) + sizeof(struct get_ct_event)) {
1306 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1307 				"2613 Received GET_CT_EVENT request below "
1308 				"minimum size\n");
1309 		rc = -EINVAL;
1310 		goto job_error;
1311 	}
1312 
1313 	event_req = (struct get_ct_event *)
1314 		bsg_request->rqst_data.h_vendor.vendor_cmd;
1315 
1316 	event_reply = (struct get_ct_event_reply *)
1317 		bsg_reply->reply_data.vendor_reply.vendor_rsp;
1318 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1319 	list_for_each_entry_safe(evt, evt_next, &phba->ct_ev_waiters, node) {
1320 		if (evt->reg_id == event_req->ev_reg_id) {
1321 			if (list_empty(&evt->events_to_get))
1322 				break;
1323 			lpfc_bsg_event_ref(evt);
1324 			evt->wait_time_stamp = jiffies;
1325 			evt_dat = list_entry(evt->events_to_get.prev,
1326 					     struct event_data, node);
1327 			list_del(&evt_dat->node);
1328 			break;
1329 		}
1330 	}
1331 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1332 
1333 	/* The app may continue to ask for event data until it gets
1334 	 * an error indicating that there isn't anymore
1335 	 */
1336 	if (evt_dat == NULL) {
1337 		bsg_reply->reply_payload_rcv_len = 0;
1338 		rc = -ENOENT;
1339 		goto job_error;
1340 	}
1341 
1342 	if (evt_dat->len > job->request_payload.payload_len) {
1343 		evt_dat->len = job->request_payload.payload_len;
1344 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1345 				"2618 Truncated event data at %d "
1346 				"bytes\n",
1347 				job->request_payload.payload_len);
1348 	}
1349 
1350 	event_reply->type = evt_dat->type;
1351 	event_reply->immed_data = evt_dat->immed_dat;
1352 	if (evt_dat->len > 0)
1353 		bsg_reply->reply_payload_rcv_len =
1354 			sg_copy_from_buffer(job->request_payload.sg_list,
1355 					    job->request_payload.sg_cnt,
1356 					    evt_dat->data, evt_dat->len);
1357 	else
1358 		bsg_reply->reply_payload_rcv_len = 0;
1359 
1360 	if (evt_dat) {
1361 		kfree(evt_dat->data);
1362 		kfree(evt_dat);
1363 	}
1364 
1365 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1366 	lpfc_bsg_event_unref(evt);
1367 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1368 	job->dd_data = NULL;
1369 	bsg_reply->result = 0;
1370 	bsg_job_done(job, bsg_reply->result,
1371 		       bsg_reply->reply_payload_rcv_len);
1372 	return 0;
1373 
1374 job_error:
1375 	job->dd_data = NULL;
1376 	bsg_reply->result = rc;
1377 	return rc;
1378 }
1379 
1380 /**
1381  * lpfc_issue_ct_rsp_cmp - lpfc_issue_ct_rsp's completion handler
1382  * @phba: Pointer to HBA context object.
1383  * @cmdiocbq: Pointer to command iocb.
1384  * @rspiocbq: Pointer to response iocb.
1385  *
1386  * This function is the completion handler for iocbs issued using
1387  * lpfc_issue_ct_rsp_cmp function. This function is called by the
1388  * ring event handler function without any lock held. This function
1389  * can be called from both worker thread context and interrupt
1390  * context. This function also can be called from other thread which
1391  * cleans up the SLI layer objects.
1392  * This function copy the contents of the response iocb to the
1393  * response iocb memory object provided by the caller of
1394  * lpfc_sli_issue_iocb_wait and then wakes up the thread which
1395  * sleeps for the iocb completion.
1396  **/
1397 static void
1398 lpfc_issue_ct_rsp_cmp(struct lpfc_hba *phba,
1399 			struct lpfc_iocbq *cmdiocbq,
1400 			struct lpfc_iocbq *rspiocbq)
1401 {
1402 	struct bsg_job_data *dd_data;
1403 	struct bsg_job *job;
1404 	struct fc_bsg_reply *bsg_reply;
1405 	IOCB_t *rsp;
1406 	struct lpfc_dmabuf *bmp, *cmp;
1407 	struct lpfc_nodelist *ndlp;
1408 	unsigned long flags;
1409 	int rc = 0;
1410 
1411 	dd_data = cmdiocbq->context1;
1412 
1413 	/* Determine if job has been aborted */
1414 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1415 	job = dd_data->set_job;
1416 	if (job) {
1417 		/* Prevent timeout handling from trying to abort job  */
1418 		job->dd_data = NULL;
1419 	}
1420 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1421 
1422 	/* Close the timeout handler abort window */
1423 	spin_lock_irqsave(&phba->hbalock, flags);
1424 	cmdiocbq->iocb_flag &= ~LPFC_IO_CMD_OUTSTANDING;
1425 	spin_unlock_irqrestore(&phba->hbalock, flags);
1426 
1427 	ndlp = dd_data->context_un.iocb.ndlp;
1428 	cmp = cmdiocbq->context2;
1429 	bmp = cmdiocbq->context3;
1430 	rsp = &rspiocbq->iocb;
1431 
1432 	/* Copy the completed job data or set the error status */
1433 
1434 	if (job) {
1435 		bsg_reply = job->reply;
1436 		if (rsp->ulpStatus) {
1437 			if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
1438 				switch (rsp->un.ulpWord[4] & IOERR_PARAM_MASK) {
1439 				case IOERR_SEQUENCE_TIMEOUT:
1440 					rc = -ETIMEDOUT;
1441 					break;
1442 				case IOERR_INVALID_RPI:
1443 					rc = -EFAULT;
1444 					break;
1445 				default:
1446 					rc = -EACCES;
1447 					break;
1448 				}
1449 			} else {
1450 				rc = -EACCES;
1451 			}
1452 		} else {
1453 			bsg_reply->reply_payload_rcv_len = 0;
1454 		}
1455 	}
1456 
1457 	lpfc_free_bsg_buffers(phba, cmp);
1458 	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
1459 	kfree(bmp);
1460 	lpfc_sli_release_iocbq(phba, cmdiocbq);
1461 	lpfc_nlp_put(ndlp);
1462 	kfree(dd_data);
1463 
1464 	/* Complete the job if the job is still active */
1465 
1466 	if (job) {
1467 		bsg_reply->result = rc;
1468 		bsg_job_done(job, bsg_reply->result,
1469 			       bsg_reply->reply_payload_rcv_len);
1470 	}
1471 	return;
1472 }
1473 
1474 /**
1475  * lpfc_issue_ct_rsp - issue a ct response
1476  * @phba: Pointer to HBA context object.
1477  * @job: Pointer to the job object.
1478  * @tag: tag index value into the ports context exchange array.
1479  * @bmp: Pointer to a dma buffer descriptor.
1480  * @num_entry: Number of enties in the bde.
1481  **/
1482 static int
1483 lpfc_issue_ct_rsp(struct lpfc_hba *phba, struct bsg_job *job, uint32_t tag,
1484 		  struct lpfc_dmabuf *cmp, struct lpfc_dmabuf *bmp,
1485 		  int num_entry)
1486 {
1487 	IOCB_t *icmd;
1488 	struct lpfc_iocbq *ctiocb = NULL;
1489 	int rc = 0;
1490 	struct lpfc_nodelist *ndlp = NULL;
1491 	struct bsg_job_data *dd_data;
1492 	unsigned long flags;
1493 	uint32_t creg_val;
1494 
1495 	/* allocate our bsg tracking structure */
1496 	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
1497 	if (!dd_data) {
1498 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1499 				"2736 Failed allocation of dd_data\n");
1500 		rc = -ENOMEM;
1501 		goto no_dd_data;
1502 	}
1503 
1504 	/* Allocate buffer for  command iocb */
1505 	ctiocb = lpfc_sli_get_iocbq(phba);
1506 	if (!ctiocb) {
1507 		rc = -ENOMEM;
1508 		goto no_ctiocb;
1509 	}
1510 
1511 	icmd = &ctiocb->iocb;
1512 	icmd->un.xseq64.bdl.ulpIoTag32 = 0;
1513 	icmd->un.xseq64.bdl.addrHigh = putPaddrHigh(bmp->phys);
1514 	icmd->un.xseq64.bdl.addrLow = putPaddrLow(bmp->phys);
1515 	icmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
1516 	icmd->un.xseq64.bdl.bdeSize = (num_entry * sizeof(struct ulp_bde64));
1517 	icmd->un.xseq64.w5.hcsw.Fctl = (LS | LA);
1518 	icmd->un.xseq64.w5.hcsw.Dfctl = 0;
1519 	icmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_SOL_CTL;
1520 	icmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT;
1521 
1522 	/* Fill in rest of iocb */
1523 	icmd->ulpCommand = CMD_XMIT_SEQUENCE64_CX;
1524 	icmd->ulpBdeCount = 1;
1525 	icmd->ulpLe = 1;
1526 	icmd->ulpClass = CLASS3;
1527 	if (phba->sli_rev == LPFC_SLI_REV4) {
1528 		/* Do not issue unsol response if oxid not marked as valid */
1529 		if (phba->ct_ctx[tag].valid != UNSOL_VALID) {
1530 			rc = IOCB_ERROR;
1531 			goto issue_ct_rsp_exit;
1532 		}
1533 		icmd->ulpContext = phba->ct_ctx[tag].rxid;
1534 		icmd->unsli3.rcvsli3.ox_id = phba->ct_ctx[tag].oxid;
1535 		ndlp = lpfc_findnode_did(phba->pport, phba->ct_ctx[tag].SID);
1536 		if (!ndlp) {
1537 			lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
1538 				 "2721 ndlp null for oxid %x SID %x\n",
1539 					icmd->ulpContext,
1540 					phba->ct_ctx[tag].SID);
1541 			rc = IOCB_ERROR;
1542 			goto issue_ct_rsp_exit;
1543 		}
1544 
1545 		/* Check if the ndlp is active */
1546 		if (!ndlp || !NLP_CHK_NODE_ACT(ndlp)) {
1547 			rc = IOCB_ERROR;
1548 			goto issue_ct_rsp_exit;
1549 		}
1550 
1551 		/* get a refernece count so the ndlp doesn't go away while
1552 		 * we respond
1553 		 */
1554 		if (!lpfc_nlp_get(ndlp)) {
1555 			rc = IOCB_ERROR;
1556 			goto issue_ct_rsp_exit;
1557 		}
1558 
1559 		icmd->un.ulpWord[3] =
1560 				phba->sli4_hba.rpi_ids[ndlp->nlp_rpi];
1561 
1562 		/* The exchange is done, mark the entry as invalid */
1563 		phba->ct_ctx[tag].valid = UNSOL_INVALID;
1564 	} else
1565 		icmd->ulpContext = (ushort) tag;
1566 
1567 	icmd->ulpTimeout = phba->fc_ratov * 2;
1568 
1569 	/* Xmit CT response on exchange <xid> */
1570 	lpfc_printf_log(phba, KERN_INFO, LOG_ELS,
1571 		"2722 Xmit CT response on exchange x%x Data: x%x x%x x%x\n",
1572 		icmd->ulpContext, icmd->ulpIoTag, tag, phba->link_state);
1573 
1574 	ctiocb->iocb_cmpl = NULL;
1575 	ctiocb->iocb_flag |= LPFC_IO_LIBDFC;
1576 	ctiocb->vport = phba->pport;
1577 	ctiocb->context1 = dd_data;
1578 	ctiocb->context2 = cmp;
1579 	ctiocb->context3 = bmp;
1580 	ctiocb->context_un.ndlp = ndlp;
1581 	ctiocb->iocb_cmpl = lpfc_issue_ct_rsp_cmp;
1582 
1583 	dd_data->type = TYPE_IOCB;
1584 	dd_data->set_job = job;
1585 	dd_data->context_un.iocb.cmdiocbq = ctiocb;
1586 	dd_data->context_un.iocb.ndlp = ndlp;
1587 	dd_data->context_un.iocb.rmp = NULL;
1588 	job->dd_data = dd_data;
1589 
1590 	if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
1591 		if (lpfc_readl(phba->HCregaddr, &creg_val)) {
1592 			rc = -IOCB_ERROR;
1593 			goto issue_ct_rsp_exit;
1594 		}
1595 		creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
1596 		writel(creg_val, phba->HCregaddr);
1597 		readl(phba->HCregaddr); /* flush */
1598 	}
1599 
1600 	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, ctiocb, 0);
1601 
1602 	if (rc == IOCB_SUCCESS) {
1603 		spin_lock_irqsave(&phba->hbalock, flags);
1604 		/* make sure the I/O had not been completed/released */
1605 		if (ctiocb->iocb_flag & LPFC_IO_LIBDFC) {
1606 			/* open up abort window to timeout handler */
1607 			ctiocb->iocb_flag |= LPFC_IO_CMD_OUTSTANDING;
1608 		}
1609 		spin_unlock_irqrestore(&phba->hbalock, flags);
1610 		return 0; /* done for now */
1611 	}
1612 
1613 	/* iocb failed so cleanup */
1614 	job->dd_data = NULL;
1615 
1616 issue_ct_rsp_exit:
1617 	lpfc_sli_release_iocbq(phba, ctiocb);
1618 no_ctiocb:
1619 	kfree(dd_data);
1620 no_dd_data:
1621 	return rc;
1622 }
1623 
1624 /**
1625  * lpfc_bsg_send_mgmt_rsp - process a SEND_MGMT_RESP bsg vendor command
1626  * @job: SEND_MGMT_RESP fc_bsg_job
1627  **/
1628 static int
1629 lpfc_bsg_send_mgmt_rsp(struct bsg_job *job)
1630 {
1631 	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
1632 	struct lpfc_hba *phba = vport->phba;
1633 	struct fc_bsg_request *bsg_request = job->request;
1634 	struct fc_bsg_reply *bsg_reply = job->reply;
1635 	struct send_mgmt_resp *mgmt_resp = (struct send_mgmt_resp *)
1636 		bsg_request->rqst_data.h_vendor.vendor_cmd;
1637 	struct ulp_bde64 *bpl;
1638 	struct lpfc_dmabuf *bmp = NULL, *cmp = NULL;
1639 	int bpl_entries;
1640 	uint32_t tag = mgmt_resp->tag;
1641 	unsigned long reqbfrcnt =
1642 			(unsigned long)job->request_payload.payload_len;
1643 	int rc = 0;
1644 
1645 	/* in case no data is transferred */
1646 	bsg_reply->reply_payload_rcv_len = 0;
1647 
1648 	if (!reqbfrcnt || (reqbfrcnt > (80 * BUF_SZ_4K))) {
1649 		rc = -ERANGE;
1650 		goto send_mgmt_rsp_exit;
1651 	}
1652 
1653 	bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
1654 	if (!bmp) {
1655 		rc = -ENOMEM;
1656 		goto send_mgmt_rsp_exit;
1657 	}
1658 
1659 	bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
1660 	if (!bmp->virt) {
1661 		rc = -ENOMEM;
1662 		goto send_mgmt_rsp_free_bmp;
1663 	}
1664 
1665 	INIT_LIST_HEAD(&bmp->list);
1666 	bpl = (struct ulp_bde64 *) bmp->virt;
1667 	bpl_entries = (LPFC_BPL_SIZE/sizeof(struct ulp_bde64));
1668 	cmp = lpfc_alloc_bsg_buffers(phba, job->request_payload.payload_len,
1669 				     1, bpl, &bpl_entries);
1670 	if (!cmp) {
1671 		rc = -ENOMEM;
1672 		goto send_mgmt_rsp_free_bmp;
1673 	}
1674 	lpfc_bsg_copy_data(cmp, &job->request_payload,
1675 			   job->request_payload.payload_len, 1);
1676 
1677 	rc = lpfc_issue_ct_rsp(phba, job, tag, cmp, bmp, bpl_entries);
1678 
1679 	if (rc == IOCB_SUCCESS)
1680 		return 0; /* done for now */
1681 
1682 	rc = -EACCES;
1683 
1684 	lpfc_free_bsg_buffers(phba, cmp);
1685 
1686 send_mgmt_rsp_free_bmp:
1687 	if (bmp->virt)
1688 		lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
1689 	kfree(bmp);
1690 send_mgmt_rsp_exit:
1691 	/* make error code available to userspace */
1692 	bsg_reply->result = rc;
1693 	job->dd_data = NULL;
1694 	return rc;
1695 }
1696 
1697 /**
1698  * lpfc_bsg_diag_mode_enter - process preparing into device diag loopback mode
1699  * @phba: Pointer to HBA context object.
1700  *
1701  * This function is responsible for preparing driver for diag loopback
1702  * on device.
1703  */
1704 static int
1705 lpfc_bsg_diag_mode_enter(struct lpfc_hba *phba)
1706 {
1707 	struct lpfc_vport **vports;
1708 	struct Scsi_Host *shost;
1709 	struct lpfc_sli *psli;
1710 	struct lpfc_queue *qp = NULL;
1711 	struct lpfc_sli_ring *pring;
1712 	int i = 0;
1713 
1714 	psli = &phba->sli;
1715 	if (!psli)
1716 		return -ENODEV;
1717 
1718 
1719 	if ((phba->link_state == LPFC_HBA_ERROR) ||
1720 	    (psli->sli_flag & LPFC_BLOCK_MGMT_IO) ||
1721 	    (!(psli->sli_flag & LPFC_SLI_ACTIVE)))
1722 		return -EACCES;
1723 
1724 	vports = lpfc_create_vport_work_array(phba);
1725 	if (vports) {
1726 		for (i = 0; i <= phba->max_vpi && vports[i] != NULL; i++) {
1727 			shost = lpfc_shost_from_vport(vports[i]);
1728 			scsi_block_requests(shost);
1729 		}
1730 		lpfc_destroy_vport_work_array(phba, vports);
1731 	} else {
1732 		shost = lpfc_shost_from_vport(phba->pport);
1733 		scsi_block_requests(shost);
1734 	}
1735 
1736 	if (phba->sli_rev != LPFC_SLI_REV4) {
1737 		pring = &psli->sli3_ring[LPFC_FCP_RING];
1738 		lpfc_emptyq_wait(phba, &pring->txcmplq, &phba->hbalock);
1739 		return 0;
1740 	}
1741 	list_for_each_entry(qp, &phba->sli4_hba.lpfc_wq_list, wq_list) {
1742 		pring = qp->pring;
1743 		if (!pring || (pring->ringno != LPFC_FCP_RING))
1744 			continue;
1745 		if (!lpfc_emptyq_wait(phba, &pring->txcmplq,
1746 				      &pring->ring_lock))
1747 			break;
1748 	}
1749 	return 0;
1750 }
1751 
1752 /**
1753  * lpfc_bsg_diag_mode_exit - exit process from device diag loopback mode
1754  * @phba: Pointer to HBA context object.
1755  *
1756  * This function is responsible for driver exit processing of setting up
1757  * diag loopback mode on device.
1758  */
1759 static void
1760 lpfc_bsg_diag_mode_exit(struct lpfc_hba *phba)
1761 {
1762 	struct Scsi_Host *shost;
1763 	struct lpfc_vport **vports;
1764 	int i;
1765 
1766 	vports = lpfc_create_vport_work_array(phba);
1767 	if (vports) {
1768 		for (i = 0; i <= phba->max_vpi && vports[i] != NULL; i++) {
1769 			shost = lpfc_shost_from_vport(vports[i]);
1770 			scsi_unblock_requests(shost);
1771 		}
1772 		lpfc_destroy_vport_work_array(phba, vports);
1773 	} else {
1774 		shost = lpfc_shost_from_vport(phba->pport);
1775 		scsi_unblock_requests(shost);
1776 	}
1777 	return;
1778 }
1779 
1780 /**
1781  * lpfc_sli3_bsg_diag_loopback_mode - process an sli3 bsg vendor command
1782  * @phba: Pointer to HBA context object.
1783  * @job: LPFC_BSG_VENDOR_DIAG_MODE
1784  *
1785  * This function is responsible for placing an sli3  port into diagnostic
1786  * loopback mode in order to perform a diagnostic loopback test.
1787  * All new scsi requests are blocked, a small delay is used to allow the
1788  * scsi requests to complete then the link is brought down. If the link is
1789  * is placed in loopback mode then scsi requests are again allowed
1790  * so the scsi mid-layer doesn't give up on the port.
1791  * All of this is done in-line.
1792  */
1793 static int
1794 lpfc_sli3_bsg_diag_loopback_mode(struct lpfc_hba *phba, struct bsg_job *job)
1795 {
1796 	struct fc_bsg_request *bsg_request = job->request;
1797 	struct fc_bsg_reply *bsg_reply = job->reply;
1798 	struct diag_mode_set *loopback_mode;
1799 	uint32_t link_flags;
1800 	uint32_t timeout;
1801 	LPFC_MBOXQ_t *pmboxq  = NULL;
1802 	int mbxstatus = MBX_SUCCESS;
1803 	int i = 0;
1804 	int rc = 0;
1805 
1806 	/* no data to return just the return code */
1807 	bsg_reply->reply_payload_rcv_len = 0;
1808 
1809 	if (job->request_len < sizeof(struct fc_bsg_request) +
1810 	    sizeof(struct diag_mode_set)) {
1811 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1812 				"2738 Received DIAG MODE request size:%d "
1813 				"below the minimum size:%d\n",
1814 				job->request_len,
1815 				(int)(sizeof(struct fc_bsg_request) +
1816 				sizeof(struct diag_mode_set)));
1817 		rc = -EINVAL;
1818 		goto job_error;
1819 	}
1820 
1821 	rc = lpfc_bsg_diag_mode_enter(phba);
1822 	if (rc)
1823 		goto job_error;
1824 
1825 	/* bring the link to diagnostic mode */
1826 	loopback_mode = (struct diag_mode_set *)
1827 		bsg_request->rqst_data.h_vendor.vendor_cmd;
1828 	link_flags = loopback_mode->type;
1829 	timeout = loopback_mode->timeout * 100;
1830 
1831 	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1832 	if (!pmboxq) {
1833 		rc = -ENOMEM;
1834 		goto loopback_mode_exit;
1835 	}
1836 	memset((void *)pmboxq, 0, sizeof(LPFC_MBOXQ_t));
1837 	pmboxq->u.mb.mbxCommand = MBX_DOWN_LINK;
1838 	pmboxq->u.mb.mbxOwner = OWN_HOST;
1839 
1840 	mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, LPFC_MBOX_TMO);
1841 
1842 	if ((mbxstatus == MBX_SUCCESS) && (pmboxq->u.mb.mbxStatus == 0)) {
1843 		/* wait for link down before proceeding */
1844 		i = 0;
1845 		while (phba->link_state != LPFC_LINK_DOWN) {
1846 			if (i++ > timeout) {
1847 				rc = -ETIMEDOUT;
1848 				goto loopback_mode_exit;
1849 			}
1850 			msleep(10);
1851 		}
1852 
1853 		memset((void *)pmboxq, 0, sizeof(LPFC_MBOXQ_t));
1854 		if (link_flags == INTERNAL_LOOP_BACK)
1855 			pmboxq->u.mb.un.varInitLnk.link_flags = FLAGS_LOCAL_LB;
1856 		else
1857 			pmboxq->u.mb.un.varInitLnk.link_flags =
1858 				FLAGS_TOPOLOGY_MODE_LOOP;
1859 
1860 		pmboxq->u.mb.mbxCommand = MBX_INIT_LINK;
1861 		pmboxq->u.mb.mbxOwner = OWN_HOST;
1862 
1863 		mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq,
1864 						     LPFC_MBOX_TMO);
1865 
1866 		if ((mbxstatus != MBX_SUCCESS) || (pmboxq->u.mb.mbxStatus))
1867 			rc = -ENODEV;
1868 		else {
1869 			spin_lock_irq(&phba->hbalock);
1870 			phba->link_flag |= LS_LOOPBACK_MODE;
1871 			spin_unlock_irq(&phba->hbalock);
1872 			/* wait for the link attention interrupt */
1873 			msleep(100);
1874 
1875 			i = 0;
1876 			while (phba->link_state != LPFC_HBA_READY) {
1877 				if (i++ > timeout) {
1878 					rc = -ETIMEDOUT;
1879 					break;
1880 				}
1881 
1882 				msleep(10);
1883 			}
1884 		}
1885 
1886 	} else
1887 		rc = -ENODEV;
1888 
1889 loopback_mode_exit:
1890 	lpfc_bsg_diag_mode_exit(phba);
1891 
1892 	/*
1893 	 * Let SLI layer release mboxq if mbox command completed after timeout.
1894 	 */
1895 	if (pmboxq && mbxstatus != MBX_TIMEOUT)
1896 		mempool_free(pmboxq, phba->mbox_mem_pool);
1897 
1898 job_error:
1899 	/* make error code available to userspace */
1900 	bsg_reply->result = rc;
1901 	/* complete the job back to userspace if no error */
1902 	if (rc == 0)
1903 		bsg_job_done(job, bsg_reply->result,
1904 			       bsg_reply->reply_payload_rcv_len);
1905 	return rc;
1906 }
1907 
1908 /**
1909  * lpfc_sli4_bsg_set_link_diag_state - set sli4 link diag state
1910  * @phba: Pointer to HBA context object.
1911  * @diag: Flag for set link to diag or nomral operation state.
1912  *
1913  * This function is responsible for issuing a sli4 mailbox command for setting
1914  * link to either diag state or normal operation state.
1915  */
1916 static int
1917 lpfc_sli4_bsg_set_link_diag_state(struct lpfc_hba *phba, uint32_t diag)
1918 {
1919 	LPFC_MBOXQ_t *pmboxq;
1920 	struct lpfc_mbx_set_link_diag_state *link_diag_state;
1921 	uint32_t req_len, alloc_len;
1922 	int mbxstatus = MBX_SUCCESS, rc;
1923 
1924 	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1925 	if (!pmboxq)
1926 		return -ENOMEM;
1927 
1928 	req_len = (sizeof(struct lpfc_mbx_set_link_diag_state) -
1929 		   sizeof(struct lpfc_sli4_cfg_mhdr));
1930 	alloc_len = lpfc_sli4_config(phba, pmboxq, LPFC_MBOX_SUBSYSTEM_FCOE,
1931 				LPFC_MBOX_OPCODE_FCOE_LINK_DIAG_STATE,
1932 				req_len, LPFC_SLI4_MBX_EMBED);
1933 	if (alloc_len != req_len) {
1934 		rc = -ENOMEM;
1935 		goto link_diag_state_set_out;
1936 	}
1937 	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
1938 			"3128 Set link to diagnostic state:x%x (x%x/x%x)\n",
1939 			diag, phba->sli4_hba.lnk_info.lnk_tp,
1940 			phba->sli4_hba.lnk_info.lnk_no);
1941 
1942 	link_diag_state = &pmboxq->u.mqe.un.link_diag_state;
1943 	bf_set(lpfc_mbx_set_diag_state_diag_bit_valid, &link_diag_state->u.req,
1944 	       LPFC_DIAG_STATE_DIAG_BIT_VALID_CHANGE);
1945 	bf_set(lpfc_mbx_set_diag_state_link_num, &link_diag_state->u.req,
1946 	       phba->sli4_hba.lnk_info.lnk_no);
1947 	bf_set(lpfc_mbx_set_diag_state_link_type, &link_diag_state->u.req,
1948 	       phba->sli4_hba.lnk_info.lnk_tp);
1949 	if (diag)
1950 		bf_set(lpfc_mbx_set_diag_state_diag,
1951 		       &link_diag_state->u.req, 1);
1952 	else
1953 		bf_set(lpfc_mbx_set_diag_state_diag,
1954 		       &link_diag_state->u.req, 0);
1955 
1956 	mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, LPFC_MBOX_TMO);
1957 
1958 	if ((mbxstatus == MBX_SUCCESS) && (pmboxq->u.mb.mbxStatus == 0))
1959 		rc = 0;
1960 	else
1961 		rc = -ENODEV;
1962 
1963 link_diag_state_set_out:
1964 	if (pmboxq && (mbxstatus != MBX_TIMEOUT))
1965 		mempool_free(pmboxq, phba->mbox_mem_pool);
1966 
1967 	return rc;
1968 }
1969 
1970 /**
1971  * lpfc_sli4_bsg_set_internal_loopback - set sli4 internal loopback diagnostic
1972  * @phba: Pointer to HBA context object.
1973  *
1974  * This function is responsible for issuing a sli4 mailbox command for setting
1975  * up internal loopback diagnostic.
1976  */
1977 static int
1978 lpfc_sli4_bsg_set_internal_loopback(struct lpfc_hba *phba)
1979 {
1980 	LPFC_MBOXQ_t *pmboxq;
1981 	uint32_t req_len, alloc_len;
1982 	struct lpfc_mbx_set_link_diag_loopback *link_diag_loopback;
1983 	int mbxstatus = MBX_SUCCESS, rc = 0;
1984 
1985 	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1986 	if (!pmboxq)
1987 		return -ENOMEM;
1988 	req_len = (sizeof(struct lpfc_mbx_set_link_diag_loopback) -
1989 		   sizeof(struct lpfc_sli4_cfg_mhdr));
1990 	alloc_len = lpfc_sli4_config(phba, pmboxq, LPFC_MBOX_SUBSYSTEM_FCOE,
1991 				LPFC_MBOX_OPCODE_FCOE_LINK_DIAG_LOOPBACK,
1992 				req_len, LPFC_SLI4_MBX_EMBED);
1993 	if (alloc_len != req_len) {
1994 		mempool_free(pmboxq, phba->mbox_mem_pool);
1995 		return -ENOMEM;
1996 	}
1997 	link_diag_loopback = &pmboxq->u.mqe.un.link_diag_loopback;
1998 	bf_set(lpfc_mbx_set_diag_state_link_num,
1999 	       &link_diag_loopback->u.req, phba->sli4_hba.lnk_info.lnk_no);
2000 	bf_set(lpfc_mbx_set_diag_state_link_type,
2001 	       &link_diag_loopback->u.req, phba->sli4_hba.lnk_info.lnk_tp);
2002 	bf_set(lpfc_mbx_set_diag_lpbk_type, &link_diag_loopback->u.req,
2003 	       LPFC_DIAG_LOOPBACK_TYPE_INTERNAL);
2004 
2005 	mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, LPFC_MBOX_TMO);
2006 	if ((mbxstatus != MBX_SUCCESS) || (pmboxq->u.mb.mbxStatus)) {
2007 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2008 				"3127 Failed setup loopback mode mailbox "
2009 				"command, rc:x%x, status:x%x\n", mbxstatus,
2010 				pmboxq->u.mb.mbxStatus);
2011 		rc = -ENODEV;
2012 	}
2013 	if (pmboxq && (mbxstatus != MBX_TIMEOUT))
2014 		mempool_free(pmboxq, phba->mbox_mem_pool);
2015 	return rc;
2016 }
2017 
2018 /**
2019  * lpfc_sli4_diag_fcport_reg_setup - setup port registrations for diagnostic
2020  * @phba: Pointer to HBA context object.
2021  *
2022  * This function set up SLI4 FC port registrations for diagnostic run, which
2023  * includes all the rpis, vfi, and also vpi.
2024  */
2025 static int
2026 lpfc_sli4_diag_fcport_reg_setup(struct lpfc_hba *phba)
2027 {
2028 	int rc;
2029 
2030 	if (phba->pport->fc_flag & FC_VFI_REGISTERED) {
2031 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2032 				"3136 Port still had vfi registered: "
2033 				"mydid:x%x, fcfi:%d, vfi:%d, vpi:%d\n",
2034 				phba->pport->fc_myDID, phba->fcf.fcfi,
2035 				phba->sli4_hba.vfi_ids[phba->pport->vfi],
2036 				phba->vpi_ids[phba->pport->vpi]);
2037 		return -EINVAL;
2038 	}
2039 	rc = lpfc_issue_reg_vfi(phba->pport);
2040 	return rc;
2041 }
2042 
2043 /**
2044  * lpfc_sli4_bsg_diag_loopback_mode - process an sli4 bsg vendor command
2045  * @phba: Pointer to HBA context object.
2046  * @job: LPFC_BSG_VENDOR_DIAG_MODE
2047  *
2048  * This function is responsible for placing an sli4 port into diagnostic
2049  * loopback mode in order to perform a diagnostic loopback test.
2050  */
2051 static int
2052 lpfc_sli4_bsg_diag_loopback_mode(struct lpfc_hba *phba, struct bsg_job *job)
2053 {
2054 	struct fc_bsg_request *bsg_request = job->request;
2055 	struct fc_bsg_reply *bsg_reply = job->reply;
2056 	struct diag_mode_set *loopback_mode;
2057 	uint32_t link_flags, timeout;
2058 	int i, rc = 0;
2059 
2060 	/* no data to return just the return code */
2061 	bsg_reply->reply_payload_rcv_len = 0;
2062 
2063 	if (job->request_len < sizeof(struct fc_bsg_request) +
2064 	    sizeof(struct diag_mode_set)) {
2065 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2066 				"3011 Received DIAG MODE request size:%d "
2067 				"below the minimum size:%d\n",
2068 				job->request_len,
2069 				(int)(sizeof(struct fc_bsg_request) +
2070 				sizeof(struct diag_mode_set)));
2071 		rc = -EINVAL;
2072 		goto job_error;
2073 	}
2074 
2075 	rc = lpfc_bsg_diag_mode_enter(phba);
2076 	if (rc)
2077 		goto job_error;
2078 
2079 	/* indicate we are in loobpack diagnostic mode */
2080 	spin_lock_irq(&phba->hbalock);
2081 	phba->link_flag |= LS_LOOPBACK_MODE;
2082 	spin_unlock_irq(&phba->hbalock);
2083 
2084 	/* reset port to start frome scratch */
2085 	rc = lpfc_selective_reset(phba);
2086 	if (rc)
2087 		goto job_error;
2088 
2089 	/* bring the link to diagnostic mode */
2090 	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2091 			"3129 Bring link to diagnostic state.\n");
2092 	loopback_mode = (struct diag_mode_set *)
2093 		bsg_request->rqst_data.h_vendor.vendor_cmd;
2094 	link_flags = loopback_mode->type;
2095 	timeout = loopback_mode->timeout * 100;
2096 
2097 	rc = lpfc_sli4_bsg_set_link_diag_state(phba, 1);
2098 	if (rc) {
2099 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2100 				"3130 Failed to bring link to diagnostic "
2101 				"state, rc:x%x\n", rc);
2102 		goto loopback_mode_exit;
2103 	}
2104 
2105 	/* wait for link down before proceeding */
2106 	i = 0;
2107 	while (phba->link_state != LPFC_LINK_DOWN) {
2108 		if (i++ > timeout) {
2109 			rc = -ETIMEDOUT;
2110 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2111 					"3131 Timeout waiting for link to "
2112 					"diagnostic mode, timeout:%d ms\n",
2113 					timeout * 10);
2114 			goto loopback_mode_exit;
2115 		}
2116 		msleep(10);
2117 	}
2118 
2119 	/* set up loopback mode */
2120 	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2121 			"3132 Set up loopback mode:x%x\n", link_flags);
2122 
2123 	if (link_flags == INTERNAL_LOOP_BACK)
2124 		rc = lpfc_sli4_bsg_set_internal_loopback(phba);
2125 	else if (link_flags == EXTERNAL_LOOP_BACK)
2126 		rc = lpfc_hba_init_link_fc_topology(phba,
2127 						    FLAGS_TOPOLOGY_MODE_PT_PT,
2128 						    MBX_NOWAIT);
2129 	else {
2130 		rc = -EINVAL;
2131 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
2132 				"3141 Loopback mode:x%x not supported\n",
2133 				link_flags);
2134 		goto loopback_mode_exit;
2135 	}
2136 
2137 	if (!rc) {
2138 		/* wait for the link attention interrupt */
2139 		msleep(100);
2140 		i = 0;
2141 		while (phba->link_state < LPFC_LINK_UP) {
2142 			if (i++ > timeout) {
2143 				rc = -ETIMEDOUT;
2144 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2145 					"3137 Timeout waiting for link up "
2146 					"in loopback mode, timeout:%d ms\n",
2147 					timeout * 10);
2148 				break;
2149 			}
2150 			msleep(10);
2151 		}
2152 	}
2153 
2154 	/* port resource registration setup for loopback diagnostic */
2155 	if (!rc) {
2156 		/* set up a none zero myDID for loopback test */
2157 		phba->pport->fc_myDID = 1;
2158 		rc = lpfc_sli4_diag_fcport_reg_setup(phba);
2159 	} else
2160 		goto loopback_mode_exit;
2161 
2162 	if (!rc) {
2163 		/* wait for the port ready */
2164 		msleep(100);
2165 		i = 0;
2166 		while (phba->link_state != LPFC_HBA_READY) {
2167 			if (i++ > timeout) {
2168 				rc = -ETIMEDOUT;
2169 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2170 					"3133 Timeout waiting for port "
2171 					"loopback mode ready, timeout:%d ms\n",
2172 					timeout * 10);
2173 				break;
2174 			}
2175 			msleep(10);
2176 		}
2177 	}
2178 
2179 loopback_mode_exit:
2180 	/* clear loopback diagnostic mode */
2181 	if (rc) {
2182 		spin_lock_irq(&phba->hbalock);
2183 		phba->link_flag &= ~LS_LOOPBACK_MODE;
2184 		spin_unlock_irq(&phba->hbalock);
2185 	}
2186 	lpfc_bsg_diag_mode_exit(phba);
2187 
2188 job_error:
2189 	/* make error code available to userspace */
2190 	bsg_reply->result = rc;
2191 	/* complete the job back to userspace if no error */
2192 	if (rc == 0)
2193 		bsg_job_done(job, bsg_reply->result,
2194 			       bsg_reply->reply_payload_rcv_len);
2195 	return rc;
2196 }
2197 
2198 /**
2199  * lpfc_bsg_diag_loopback_mode - bsg vendor command for diag loopback mode
2200  * @job: LPFC_BSG_VENDOR_DIAG_MODE
2201  *
2202  * This function is responsible for responding to check and dispatch bsg diag
2203  * command from the user to proper driver action routines.
2204  */
2205 static int
2206 lpfc_bsg_diag_loopback_mode(struct bsg_job *job)
2207 {
2208 	struct Scsi_Host *shost;
2209 	struct lpfc_vport *vport;
2210 	struct lpfc_hba *phba;
2211 	int rc;
2212 
2213 	shost = fc_bsg_to_shost(job);
2214 	if (!shost)
2215 		return -ENODEV;
2216 	vport = shost_priv(shost);
2217 	if (!vport)
2218 		return -ENODEV;
2219 	phba = vport->phba;
2220 	if (!phba)
2221 		return -ENODEV;
2222 
2223 	if (phba->sli_rev < LPFC_SLI_REV4)
2224 		rc = lpfc_sli3_bsg_diag_loopback_mode(phba, job);
2225 	else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) >=
2226 		 LPFC_SLI_INTF_IF_TYPE_2)
2227 		rc = lpfc_sli4_bsg_diag_loopback_mode(phba, job);
2228 	else
2229 		rc = -ENODEV;
2230 
2231 	return rc;
2232 }
2233 
2234 /**
2235  * lpfc_sli4_bsg_diag_mode_end - sli4 bsg vendor command for ending diag mode
2236  * @job: LPFC_BSG_VENDOR_DIAG_MODE_END
2237  *
2238  * This function is responsible for responding to check and dispatch bsg diag
2239  * command from the user to proper driver action routines.
2240  */
2241 static int
2242 lpfc_sli4_bsg_diag_mode_end(struct bsg_job *job)
2243 {
2244 	struct fc_bsg_request *bsg_request = job->request;
2245 	struct fc_bsg_reply *bsg_reply = job->reply;
2246 	struct Scsi_Host *shost;
2247 	struct lpfc_vport *vport;
2248 	struct lpfc_hba *phba;
2249 	struct diag_mode_set *loopback_mode_end_cmd;
2250 	uint32_t timeout;
2251 	int rc, i;
2252 
2253 	shost = fc_bsg_to_shost(job);
2254 	if (!shost)
2255 		return -ENODEV;
2256 	vport = shost_priv(shost);
2257 	if (!vport)
2258 		return -ENODEV;
2259 	phba = vport->phba;
2260 	if (!phba)
2261 		return -ENODEV;
2262 
2263 	if (phba->sli_rev < LPFC_SLI_REV4)
2264 		return -ENODEV;
2265 	if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
2266 	    LPFC_SLI_INTF_IF_TYPE_2)
2267 		return -ENODEV;
2268 
2269 	/* clear loopback diagnostic mode */
2270 	spin_lock_irq(&phba->hbalock);
2271 	phba->link_flag &= ~LS_LOOPBACK_MODE;
2272 	spin_unlock_irq(&phba->hbalock);
2273 	loopback_mode_end_cmd = (struct diag_mode_set *)
2274 			bsg_request->rqst_data.h_vendor.vendor_cmd;
2275 	timeout = loopback_mode_end_cmd->timeout * 100;
2276 
2277 	rc = lpfc_sli4_bsg_set_link_diag_state(phba, 0);
2278 	if (rc) {
2279 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2280 				"3139 Failed to bring link to diagnostic "
2281 				"state, rc:x%x\n", rc);
2282 		goto loopback_mode_end_exit;
2283 	}
2284 
2285 	/* wait for link down before proceeding */
2286 	i = 0;
2287 	while (phba->link_state != LPFC_LINK_DOWN) {
2288 		if (i++ > timeout) {
2289 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2290 					"3140 Timeout waiting for link to "
2291 					"diagnostic mode_end, timeout:%d ms\n",
2292 					timeout * 10);
2293 			/* there is nothing much we can do here */
2294 			break;
2295 		}
2296 		msleep(10);
2297 	}
2298 
2299 	/* reset port resource registrations */
2300 	rc = lpfc_selective_reset(phba);
2301 	phba->pport->fc_myDID = 0;
2302 
2303 loopback_mode_end_exit:
2304 	/* make return code available to userspace */
2305 	bsg_reply->result = rc;
2306 	/* complete the job back to userspace if no error */
2307 	if (rc == 0)
2308 		bsg_job_done(job, bsg_reply->result,
2309 			       bsg_reply->reply_payload_rcv_len);
2310 	return rc;
2311 }
2312 
2313 /**
2314  * lpfc_sli4_bsg_link_diag_test - sli4 bsg vendor command for diag link test
2315  * @job: LPFC_BSG_VENDOR_DIAG_LINK_TEST
2316  *
2317  * This function is to perform SLI4 diag link test request from the user
2318  * applicaiton.
2319  */
2320 static int
2321 lpfc_sli4_bsg_link_diag_test(struct bsg_job *job)
2322 {
2323 	struct fc_bsg_request *bsg_request = job->request;
2324 	struct fc_bsg_reply *bsg_reply = job->reply;
2325 	struct Scsi_Host *shost;
2326 	struct lpfc_vport *vport;
2327 	struct lpfc_hba *phba;
2328 	LPFC_MBOXQ_t *pmboxq;
2329 	struct sli4_link_diag *link_diag_test_cmd;
2330 	uint32_t req_len, alloc_len;
2331 	struct lpfc_mbx_run_link_diag_test *run_link_diag_test;
2332 	union lpfc_sli4_cfg_shdr *shdr;
2333 	uint32_t shdr_status, shdr_add_status;
2334 	struct diag_status *diag_status_reply;
2335 	int mbxstatus, rc = 0;
2336 
2337 	shost = fc_bsg_to_shost(job);
2338 	if (!shost) {
2339 		rc = -ENODEV;
2340 		goto job_error;
2341 	}
2342 	vport = shost_priv(shost);
2343 	if (!vport) {
2344 		rc = -ENODEV;
2345 		goto job_error;
2346 	}
2347 	phba = vport->phba;
2348 	if (!phba) {
2349 		rc = -ENODEV;
2350 		goto job_error;
2351 	}
2352 
2353 	if (phba->sli_rev < LPFC_SLI_REV4) {
2354 		rc = -ENODEV;
2355 		goto job_error;
2356 	}
2357 	if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
2358 	    LPFC_SLI_INTF_IF_TYPE_2) {
2359 		rc = -ENODEV;
2360 		goto job_error;
2361 	}
2362 
2363 	if (job->request_len < sizeof(struct fc_bsg_request) +
2364 	    sizeof(struct sli4_link_diag)) {
2365 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2366 				"3013 Received LINK DIAG TEST request "
2367 				" size:%d below the minimum size:%d\n",
2368 				job->request_len,
2369 				(int)(sizeof(struct fc_bsg_request) +
2370 				sizeof(struct sli4_link_diag)));
2371 		rc = -EINVAL;
2372 		goto job_error;
2373 	}
2374 
2375 	rc = lpfc_bsg_diag_mode_enter(phba);
2376 	if (rc)
2377 		goto job_error;
2378 
2379 	link_diag_test_cmd = (struct sli4_link_diag *)
2380 			 bsg_request->rqst_data.h_vendor.vendor_cmd;
2381 
2382 	rc = lpfc_sli4_bsg_set_link_diag_state(phba, 1);
2383 
2384 	if (rc)
2385 		goto job_error;
2386 
2387 	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
2388 	if (!pmboxq)
2389 		goto link_diag_test_exit;
2390 
2391 	req_len = (sizeof(struct lpfc_mbx_set_link_diag_state) -
2392 		   sizeof(struct lpfc_sli4_cfg_mhdr));
2393 	alloc_len = lpfc_sli4_config(phba, pmboxq, LPFC_MBOX_SUBSYSTEM_FCOE,
2394 				     LPFC_MBOX_OPCODE_FCOE_LINK_DIAG_STATE,
2395 				     req_len, LPFC_SLI4_MBX_EMBED);
2396 	if (alloc_len != req_len)
2397 		goto link_diag_test_exit;
2398 
2399 	run_link_diag_test = &pmboxq->u.mqe.un.link_diag_test;
2400 	bf_set(lpfc_mbx_run_diag_test_link_num, &run_link_diag_test->u.req,
2401 	       phba->sli4_hba.lnk_info.lnk_no);
2402 	bf_set(lpfc_mbx_run_diag_test_link_type, &run_link_diag_test->u.req,
2403 	       phba->sli4_hba.lnk_info.lnk_tp);
2404 	bf_set(lpfc_mbx_run_diag_test_test_id, &run_link_diag_test->u.req,
2405 	       link_diag_test_cmd->test_id);
2406 	bf_set(lpfc_mbx_run_diag_test_loops, &run_link_diag_test->u.req,
2407 	       link_diag_test_cmd->loops);
2408 	bf_set(lpfc_mbx_run_diag_test_test_ver, &run_link_diag_test->u.req,
2409 	       link_diag_test_cmd->test_version);
2410 	bf_set(lpfc_mbx_run_diag_test_err_act, &run_link_diag_test->u.req,
2411 	       link_diag_test_cmd->error_action);
2412 
2413 	mbxstatus = lpfc_sli_issue_mbox(phba, pmboxq, MBX_POLL);
2414 
2415 	shdr = (union lpfc_sli4_cfg_shdr *)
2416 		&pmboxq->u.mqe.un.sli4_config.header.cfg_shdr;
2417 	shdr_status = bf_get(lpfc_mbox_hdr_status, &shdr->response);
2418 	shdr_add_status = bf_get(lpfc_mbox_hdr_add_status, &shdr->response);
2419 	if (shdr_status || shdr_add_status || mbxstatus) {
2420 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
2421 				"3010 Run link diag test mailbox failed with "
2422 				"mbx_status x%x status x%x, add_status x%x\n",
2423 				mbxstatus, shdr_status, shdr_add_status);
2424 	}
2425 
2426 	diag_status_reply = (struct diag_status *)
2427 			    bsg_reply->reply_data.vendor_reply.vendor_rsp;
2428 
2429 	if (job->reply_len <
2430 	    sizeof(struct fc_bsg_request) + sizeof(struct diag_status)) {
2431 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2432 				"3012 Received Run link diag test reply "
2433 				"below minimum size (%d): reply_len:%d\n",
2434 				(int)(sizeof(struct fc_bsg_request) +
2435 				sizeof(struct diag_status)),
2436 				job->reply_len);
2437 		rc = -EINVAL;
2438 		goto job_error;
2439 	}
2440 
2441 	diag_status_reply->mbox_status = mbxstatus;
2442 	diag_status_reply->shdr_status = shdr_status;
2443 	diag_status_reply->shdr_add_status = shdr_add_status;
2444 
2445 link_diag_test_exit:
2446 	rc = lpfc_sli4_bsg_set_link_diag_state(phba, 0);
2447 
2448 	if (pmboxq)
2449 		mempool_free(pmboxq, phba->mbox_mem_pool);
2450 
2451 	lpfc_bsg_diag_mode_exit(phba);
2452 
2453 job_error:
2454 	/* make error code available to userspace */
2455 	bsg_reply->result = rc;
2456 	/* complete the job back to userspace if no error */
2457 	if (rc == 0)
2458 		bsg_job_done(job, bsg_reply->result,
2459 			       bsg_reply->reply_payload_rcv_len);
2460 	return rc;
2461 }
2462 
2463 /**
2464  * lpfcdiag_loop_self_reg - obtains a remote port login id
2465  * @phba: Pointer to HBA context object
2466  * @rpi: Pointer to a remote port login id
2467  *
2468  * This function obtains a remote port login id so the diag loopback test
2469  * can send and receive its own unsolicited CT command.
2470  **/
2471 static int lpfcdiag_loop_self_reg(struct lpfc_hba *phba, uint16_t *rpi)
2472 {
2473 	LPFC_MBOXQ_t *mbox;
2474 	struct lpfc_dmabuf *dmabuff;
2475 	int status;
2476 
2477 	mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
2478 	if (!mbox)
2479 		return -ENOMEM;
2480 
2481 	if (phba->sli_rev < LPFC_SLI_REV4)
2482 		status = lpfc_reg_rpi(phba, 0, phba->pport->fc_myDID,
2483 				(uint8_t *)&phba->pport->fc_sparam,
2484 				mbox, *rpi);
2485 	else {
2486 		*rpi = lpfc_sli4_alloc_rpi(phba);
2487 		if (*rpi == LPFC_RPI_ALLOC_ERROR) {
2488 			mempool_free(mbox, phba->mbox_mem_pool);
2489 			return -EBUSY;
2490 		}
2491 		status = lpfc_reg_rpi(phba, phba->pport->vpi,
2492 				phba->pport->fc_myDID,
2493 				(uint8_t *)&phba->pport->fc_sparam,
2494 				mbox, *rpi);
2495 	}
2496 
2497 	if (status) {
2498 		mempool_free(mbox, phba->mbox_mem_pool);
2499 		if (phba->sli_rev == LPFC_SLI_REV4)
2500 			lpfc_sli4_free_rpi(phba, *rpi);
2501 		return -ENOMEM;
2502 	}
2503 
2504 	dmabuff = (struct lpfc_dmabuf *)mbox->ctx_buf;
2505 	mbox->ctx_buf = NULL;
2506 	mbox->ctx_ndlp = NULL;
2507 	status = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_TMO);
2508 
2509 	if ((status != MBX_SUCCESS) || (mbox->u.mb.mbxStatus)) {
2510 		lpfc_mbuf_free(phba, dmabuff->virt, dmabuff->phys);
2511 		kfree(dmabuff);
2512 		if (status != MBX_TIMEOUT)
2513 			mempool_free(mbox, phba->mbox_mem_pool);
2514 		if (phba->sli_rev == LPFC_SLI_REV4)
2515 			lpfc_sli4_free_rpi(phba, *rpi);
2516 		return -ENODEV;
2517 	}
2518 
2519 	if (phba->sli_rev < LPFC_SLI_REV4)
2520 		*rpi = mbox->u.mb.un.varWords[0];
2521 
2522 	lpfc_mbuf_free(phba, dmabuff->virt, dmabuff->phys);
2523 	kfree(dmabuff);
2524 	mempool_free(mbox, phba->mbox_mem_pool);
2525 	return 0;
2526 }
2527 
2528 /**
2529  * lpfcdiag_loop_self_unreg - unregs from the rpi
2530  * @phba: Pointer to HBA context object
2531  * @rpi: Remote port login id
2532  *
2533  * This function unregisters the rpi obtained in lpfcdiag_loop_self_reg
2534  **/
2535 static int lpfcdiag_loop_self_unreg(struct lpfc_hba *phba, uint16_t rpi)
2536 {
2537 	LPFC_MBOXQ_t *mbox;
2538 	int status;
2539 
2540 	/* Allocate mboxq structure */
2541 	mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
2542 	if (mbox == NULL)
2543 		return -ENOMEM;
2544 
2545 	if (phba->sli_rev < LPFC_SLI_REV4)
2546 		lpfc_unreg_login(phba, 0, rpi, mbox);
2547 	else
2548 		lpfc_unreg_login(phba, phba->pport->vpi,
2549 				 phba->sli4_hba.rpi_ids[rpi], mbox);
2550 
2551 	status = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_TMO);
2552 
2553 	if ((status != MBX_SUCCESS) || (mbox->u.mb.mbxStatus)) {
2554 		if (status != MBX_TIMEOUT)
2555 			mempool_free(mbox, phba->mbox_mem_pool);
2556 		return -EIO;
2557 	}
2558 	mempool_free(mbox, phba->mbox_mem_pool);
2559 	if (phba->sli_rev == LPFC_SLI_REV4)
2560 		lpfc_sli4_free_rpi(phba, rpi);
2561 	return 0;
2562 }
2563 
2564 /**
2565  * lpfcdiag_loop_get_xri - obtains the transmit and receive ids
2566  * @phba: Pointer to HBA context object
2567  * @rpi: Remote port login id
2568  * @txxri: Pointer to transmit exchange id
2569  * @rxxri: Pointer to response exchabge id
2570  *
2571  * This function obtains the transmit and receive ids required to send
2572  * an unsolicited ct command with a payload. A special lpfc FsType and CmdRsp
2573  * flags are used to the unsolicted response handler is able to process
2574  * the ct command sent on the same port.
2575  **/
2576 static int lpfcdiag_loop_get_xri(struct lpfc_hba *phba, uint16_t rpi,
2577 			 uint16_t *txxri, uint16_t * rxxri)
2578 {
2579 	struct lpfc_bsg_event *evt;
2580 	struct lpfc_iocbq *cmdiocbq, *rspiocbq;
2581 	IOCB_t *cmd, *rsp;
2582 	struct lpfc_dmabuf *dmabuf;
2583 	struct ulp_bde64 *bpl = NULL;
2584 	struct lpfc_sli_ct_request *ctreq = NULL;
2585 	int ret_val = 0;
2586 	int time_left;
2587 	int iocb_stat = IOCB_SUCCESS;
2588 	unsigned long flags;
2589 
2590 	*txxri = 0;
2591 	*rxxri = 0;
2592 	evt = lpfc_bsg_event_new(FC_REG_CT_EVENT, current->pid,
2593 				SLI_CT_ELX_LOOPBACK);
2594 	if (!evt)
2595 		return -ENOMEM;
2596 
2597 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
2598 	list_add(&evt->node, &phba->ct_ev_waiters);
2599 	lpfc_bsg_event_ref(evt);
2600 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2601 
2602 	cmdiocbq = lpfc_sli_get_iocbq(phba);
2603 	rspiocbq = lpfc_sli_get_iocbq(phba);
2604 
2605 	dmabuf = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2606 	if (dmabuf) {
2607 		dmabuf->virt = lpfc_mbuf_alloc(phba, 0, &dmabuf->phys);
2608 		if (dmabuf->virt) {
2609 			INIT_LIST_HEAD(&dmabuf->list);
2610 			bpl = (struct ulp_bde64 *) dmabuf->virt;
2611 			memset(bpl, 0, sizeof(*bpl));
2612 			ctreq = (struct lpfc_sli_ct_request *)(bpl + 1);
2613 			bpl->addrHigh =
2614 				le32_to_cpu(putPaddrHigh(dmabuf->phys +
2615 					sizeof(*bpl)));
2616 			bpl->addrLow =
2617 				le32_to_cpu(putPaddrLow(dmabuf->phys +
2618 					sizeof(*bpl)));
2619 			bpl->tus.f.bdeFlags = 0;
2620 			bpl->tus.f.bdeSize = ELX_LOOPBACK_HEADER_SZ;
2621 			bpl->tus.w = le32_to_cpu(bpl->tus.w);
2622 		}
2623 	}
2624 
2625 	if (cmdiocbq == NULL || rspiocbq == NULL ||
2626 	    dmabuf == NULL || bpl == NULL || ctreq == NULL ||
2627 		dmabuf->virt == NULL) {
2628 		ret_val = -ENOMEM;
2629 		goto err_get_xri_exit;
2630 	}
2631 
2632 	cmd = &cmdiocbq->iocb;
2633 	rsp = &rspiocbq->iocb;
2634 
2635 	memset(ctreq, 0, ELX_LOOPBACK_HEADER_SZ);
2636 
2637 	ctreq->RevisionId.bits.Revision = SLI_CT_REVISION;
2638 	ctreq->RevisionId.bits.InId = 0;
2639 	ctreq->FsType = SLI_CT_ELX_LOOPBACK;
2640 	ctreq->FsSubType = 0;
2641 	ctreq->CommandResponse.bits.CmdRsp = ELX_LOOPBACK_XRI_SETUP;
2642 	ctreq->CommandResponse.bits.Size = 0;
2643 
2644 
2645 	cmd->un.xseq64.bdl.addrHigh = putPaddrHigh(dmabuf->phys);
2646 	cmd->un.xseq64.bdl.addrLow = putPaddrLow(dmabuf->phys);
2647 	cmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
2648 	cmd->un.xseq64.bdl.bdeSize = sizeof(*bpl);
2649 
2650 	cmd->un.xseq64.w5.hcsw.Fctl = LA;
2651 	cmd->un.xseq64.w5.hcsw.Dfctl = 0;
2652 	cmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL;
2653 	cmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT;
2654 
2655 	cmd->ulpCommand = CMD_XMIT_SEQUENCE64_CR;
2656 	cmd->ulpBdeCount = 1;
2657 	cmd->ulpLe = 1;
2658 	cmd->ulpClass = CLASS3;
2659 	cmd->ulpContext = rpi;
2660 
2661 	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
2662 	cmdiocbq->vport = phba->pport;
2663 	cmdiocbq->iocb_cmpl = NULL;
2664 
2665 	iocb_stat = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq,
2666 				rspiocbq,
2667 				(phba->fc_ratov * 2)
2668 				+ LPFC_DRVR_TIMEOUT);
2669 	if ((iocb_stat != IOCB_SUCCESS) || (rsp->ulpStatus != IOSTAT_SUCCESS)) {
2670 		ret_val = -EIO;
2671 		goto err_get_xri_exit;
2672 	}
2673 	*txxri =  rsp->ulpContext;
2674 
2675 	evt->waiting = 1;
2676 	evt->wait_time_stamp = jiffies;
2677 	time_left = wait_event_interruptible_timeout(
2678 		evt->wq, !list_empty(&evt->events_to_see),
2679 		msecs_to_jiffies(1000 *
2680 			((phba->fc_ratov * 2) + LPFC_DRVR_TIMEOUT)));
2681 	if (list_empty(&evt->events_to_see))
2682 		ret_val = (time_left) ? -EINTR : -ETIMEDOUT;
2683 	else {
2684 		spin_lock_irqsave(&phba->ct_ev_lock, flags);
2685 		list_move(evt->events_to_see.prev, &evt->events_to_get);
2686 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2687 		*rxxri = (list_entry(evt->events_to_get.prev,
2688 				     typeof(struct event_data),
2689 				     node))->immed_dat;
2690 	}
2691 	evt->waiting = 0;
2692 
2693 err_get_xri_exit:
2694 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
2695 	lpfc_bsg_event_unref(evt); /* release ref */
2696 	lpfc_bsg_event_unref(evt); /* delete */
2697 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2698 
2699 	if (dmabuf) {
2700 		if (dmabuf->virt)
2701 			lpfc_mbuf_free(phba, dmabuf->virt, dmabuf->phys);
2702 		kfree(dmabuf);
2703 	}
2704 
2705 	if (cmdiocbq && (iocb_stat != IOCB_TIMEDOUT))
2706 		lpfc_sli_release_iocbq(phba, cmdiocbq);
2707 	if (rspiocbq)
2708 		lpfc_sli_release_iocbq(phba, rspiocbq);
2709 	return ret_val;
2710 }
2711 
2712 /**
2713  * lpfc_bsg_dma_page_alloc - allocate a bsg mbox page sized dma buffers
2714  * @phba: Pointer to HBA context object
2715  *
2716  * This function allocates BSG_MBOX_SIZE (4KB) page size dma buffer and
2717  * returns the pointer to the buffer.
2718  **/
2719 static struct lpfc_dmabuf *
2720 lpfc_bsg_dma_page_alloc(struct lpfc_hba *phba)
2721 {
2722 	struct lpfc_dmabuf *dmabuf;
2723 	struct pci_dev *pcidev = phba->pcidev;
2724 
2725 	/* allocate dma buffer struct */
2726 	dmabuf = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2727 	if (!dmabuf)
2728 		return NULL;
2729 
2730 	INIT_LIST_HEAD(&dmabuf->list);
2731 
2732 	/* now, allocate dma buffer */
2733 	dmabuf->virt = dma_alloc_coherent(&pcidev->dev, BSG_MBOX_SIZE,
2734 					  &(dmabuf->phys), GFP_KERNEL);
2735 
2736 	if (!dmabuf->virt) {
2737 		kfree(dmabuf);
2738 		return NULL;
2739 	}
2740 
2741 	return dmabuf;
2742 }
2743 
2744 /**
2745  * lpfc_bsg_dma_page_free - free a bsg mbox page sized dma buffer
2746  * @phba: Pointer to HBA context object.
2747  * @dmabuf: Pointer to the bsg mbox page sized dma buffer descriptor.
2748  *
2749  * This routine just simply frees a dma buffer and its associated buffer
2750  * descriptor referred by @dmabuf.
2751  **/
2752 static void
2753 lpfc_bsg_dma_page_free(struct lpfc_hba *phba, struct lpfc_dmabuf *dmabuf)
2754 {
2755 	struct pci_dev *pcidev = phba->pcidev;
2756 
2757 	if (!dmabuf)
2758 		return;
2759 
2760 	if (dmabuf->virt)
2761 		dma_free_coherent(&pcidev->dev, BSG_MBOX_SIZE,
2762 				  dmabuf->virt, dmabuf->phys);
2763 	kfree(dmabuf);
2764 	return;
2765 }
2766 
2767 /**
2768  * lpfc_bsg_dma_page_list_free - free a list of bsg mbox page sized dma buffers
2769  * @phba: Pointer to HBA context object.
2770  * @dmabuf_list: Pointer to a list of bsg mbox page sized dma buffer descs.
2771  *
2772  * This routine just simply frees all dma buffers and their associated buffer
2773  * descriptors referred by @dmabuf_list.
2774  **/
2775 static void
2776 lpfc_bsg_dma_page_list_free(struct lpfc_hba *phba,
2777 			    struct list_head *dmabuf_list)
2778 {
2779 	struct lpfc_dmabuf *dmabuf, *next_dmabuf;
2780 
2781 	if (list_empty(dmabuf_list))
2782 		return;
2783 
2784 	list_for_each_entry_safe(dmabuf, next_dmabuf, dmabuf_list, list) {
2785 		list_del_init(&dmabuf->list);
2786 		lpfc_bsg_dma_page_free(phba, dmabuf);
2787 	}
2788 	return;
2789 }
2790 
2791 /**
2792  * diag_cmd_data_alloc - fills in a bde struct with dma buffers
2793  * @phba: Pointer to HBA context object
2794  * @bpl: Pointer to 64 bit bde structure
2795  * @size: Number of bytes to process
2796  * @nocopydata: Flag to copy user data into the allocated buffer
2797  *
2798  * This function allocates page size buffers and populates an lpfc_dmabufext.
2799  * If allowed the user data pointed to with indataptr is copied into the kernel
2800  * memory. The chained list of page size buffers is returned.
2801  **/
2802 static struct lpfc_dmabufext *
2803 diag_cmd_data_alloc(struct lpfc_hba *phba,
2804 		   struct ulp_bde64 *bpl, uint32_t size,
2805 		   int nocopydata)
2806 {
2807 	struct lpfc_dmabufext *mlist = NULL;
2808 	struct lpfc_dmabufext *dmp;
2809 	int cnt, offset = 0, i = 0;
2810 	struct pci_dev *pcidev;
2811 
2812 	pcidev = phba->pcidev;
2813 
2814 	while (size) {
2815 		/* We get chunks of 4K */
2816 		if (size > BUF_SZ_4K)
2817 			cnt = BUF_SZ_4K;
2818 		else
2819 			cnt = size;
2820 
2821 		/* allocate struct lpfc_dmabufext buffer header */
2822 		dmp = kmalloc(sizeof(struct lpfc_dmabufext), GFP_KERNEL);
2823 		if (!dmp)
2824 			goto out;
2825 
2826 		INIT_LIST_HEAD(&dmp->dma.list);
2827 
2828 		/* Queue it to a linked list */
2829 		if (mlist)
2830 			list_add_tail(&dmp->dma.list, &mlist->dma.list);
2831 		else
2832 			mlist = dmp;
2833 
2834 		/* allocate buffer */
2835 		dmp->dma.virt = dma_alloc_coherent(&pcidev->dev,
2836 						   cnt,
2837 						   &(dmp->dma.phys),
2838 						   GFP_KERNEL);
2839 
2840 		if (!dmp->dma.virt)
2841 			goto out;
2842 
2843 		dmp->size = cnt;
2844 
2845 		if (nocopydata) {
2846 			bpl->tus.f.bdeFlags = 0;
2847 		} else {
2848 			memset((uint8_t *)dmp->dma.virt, 0, cnt);
2849 			bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
2850 		}
2851 
2852 		/* build buffer ptr list for IOCB */
2853 		bpl->addrLow = le32_to_cpu(putPaddrLow(dmp->dma.phys));
2854 		bpl->addrHigh = le32_to_cpu(putPaddrHigh(dmp->dma.phys));
2855 		bpl->tus.f.bdeSize = (ushort) cnt;
2856 		bpl->tus.w = le32_to_cpu(bpl->tus.w);
2857 		bpl++;
2858 
2859 		i++;
2860 		offset += cnt;
2861 		size -= cnt;
2862 	}
2863 
2864 	if (mlist) {
2865 		mlist->flag = i;
2866 		return mlist;
2867 	}
2868 out:
2869 	diag_cmd_data_free(phba, mlist);
2870 	return NULL;
2871 }
2872 
2873 /**
2874  * lpfcdiag_loop_post_rxbufs - post the receive buffers for an unsol CT cmd
2875  * @phba: Pointer to HBA context object
2876  * @rxxri: Receive exchange id
2877  * @len: Number of data bytes
2878  *
2879  * This function allocates and posts a data buffer of sufficient size to receive
2880  * an unsolicted CT command.
2881  **/
2882 static int lpfcdiag_loop_post_rxbufs(struct lpfc_hba *phba, uint16_t rxxri,
2883 			     size_t len)
2884 {
2885 	struct lpfc_sli_ring *pring;
2886 	struct lpfc_iocbq *cmdiocbq;
2887 	IOCB_t *cmd = NULL;
2888 	struct list_head head, *curr, *next;
2889 	struct lpfc_dmabuf *rxbmp;
2890 	struct lpfc_dmabuf *dmp;
2891 	struct lpfc_dmabuf *mp[2] = {NULL, NULL};
2892 	struct ulp_bde64 *rxbpl = NULL;
2893 	uint32_t num_bde;
2894 	struct lpfc_dmabufext *rxbuffer = NULL;
2895 	int ret_val = 0;
2896 	int iocb_stat;
2897 	int i = 0;
2898 
2899 	pring = lpfc_phba_elsring(phba);
2900 
2901 	cmdiocbq = lpfc_sli_get_iocbq(phba);
2902 	rxbmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2903 	if (rxbmp != NULL) {
2904 		rxbmp->virt = lpfc_mbuf_alloc(phba, 0, &rxbmp->phys);
2905 		if (rxbmp->virt) {
2906 			INIT_LIST_HEAD(&rxbmp->list);
2907 			rxbpl = (struct ulp_bde64 *) rxbmp->virt;
2908 			rxbuffer = diag_cmd_data_alloc(phba, rxbpl, len, 0);
2909 		}
2910 	}
2911 
2912 	if (!cmdiocbq || !rxbmp || !rxbpl || !rxbuffer || !pring) {
2913 		ret_val = -ENOMEM;
2914 		goto err_post_rxbufs_exit;
2915 	}
2916 
2917 	/* Queue buffers for the receive exchange */
2918 	num_bde = (uint32_t)rxbuffer->flag;
2919 	dmp = &rxbuffer->dma;
2920 
2921 	cmd = &cmdiocbq->iocb;
2922 	i = 0;
2923 
2924 	INIT_LIST_HEAD(&head);
2925 	list_add_tail(&head, &dmp->list);
2926 	list_for_each_safe(curr, next, &head) {
2927 		mp[i] = list_entry(curr, struct lpfc_dmabuf, list);
2928 		list_del(curr);
2929 
2930 		if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
2931 			mp[i]->buffer_tag = lpfc_sli_get_buffer_tag(phba);
2932 			cmd->un.quexri64cx.buff.bde.addrHigh =
2933 				putPaddrHigh(mp[i]->phys);
2934 			cmd->un.quexri64cx.buff.bde.addrLow =
2935 				putPaddrLow(mp[i]->phys);
2936 			cmd->un.quexri64cx.buff.bde.tus.f.bdeSize =
2937 				((struct lpfc_dmabufext *)mp[i])->size;
2938 			cmd->un.quexri64cx.buff.buffer_tag = mp[i]->buffer_tag;
2939 			cmd->ulpCommand = CMD_QUE_XRI64_CX;
2940 			cmd->ulpPU = 0;
2941 			cmd->ulpLe = 1;
2942 			cmd->ulpBdeCount = 1;
2943 			cmd->unsli3.que_xri64cx_ext_words.ebde_count = 0;
2944 
2945 		} else {
2946 			cmd->un.cont64[i].addrHigh = putPaddrHigh(mp[i]->phys);
2947 			cmd->un.cont64[i].addrLow = putPaddrLow(mp[i]->phys);
2948 			cmd->un.cont64[i].tus.f.bdeSize =
2949 				((struct lpfc_dmabufext *)mp[i])->size;
2950 					cmd->ulpBdeCount = ++i;
2951 
2952 			if ((--num_bde > 0) && (i < 2))
2953 				continue;
2954 
2955 			cmd->ulpCommand = CMD_QUE_XRI_BUF64_CX;
2956 			cmd->ulpLe = 1;
2957 		}
2958 
2959 		cmd->ulpClass = CLASS3;
2960 		cmd->ulpContext = rxxri;
2961 
2962 		iocb_stat = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq,
2963 						0);
2964 		if (iocb_stat == IOCB_ERROR) {
2965 			diag_cmd_data_free(phba,
2966 				(struct lpfc_dmabufext *)mp[0]);
2967 			if (mp[1])
2968 				diag_cmd_data_free(phba,
2969 					  (struct lpfc_dmabufext *)mp[1]);
2970 			dmp = list_entry(next, struct lpfc_dmabuf, list);
2971 			ret_val = -EIO;
2972 			goto err_post_rxbufs_exit;
2973 		}
2974 
2975 		lpfc_sli_ringpostbuf_put(phba, pring, mp[0]);
2976 		if (mp[1]) {
2977 			lpfc_sli_ringpostbuf_put(phba, pring, mp[1]);
2978 			mp[1] = NULL;
2979 		}
2980 
2981 		/* The iocb was freed by lpfc_sli_issue_iocb */
2982 		cmdiocbq = lpfc_sli_get_iocbq(phba);
2983 		if (!cmdiocbq) {
2984 			dmp = list_entry(next, struct lpfc_dmabuf, list);
2985 			ret_val = -EIO;
2986 			goto err_post_rxbufs_exit;
2987 		}
2988 
2989 		cmd = &cmdiocbq->iocb;
2990 		i = 0;
2991 	}
2992 	list_del(&head);
2993 
2994 err_post_rxbufs_exit:
2995 
2996 	if (rxbmp) {
2997 		if (rxbmp->virt)
2998 			lpfc_mbuf_free(phba, rxbmp->virt, rxbmp->phys);
2999 		kfree(rxbmp);
3000 	}
3001 
3002 	if (cmdiocbq)
3003 		lpfc_sli_release_iocbq(phba, cmdiocbq);
3004 	return ret_val;
3005 }
3006 
3007 /**
3008  * lpfc_bsg_diag_loopback_run - run loopback on a port by issue ct cmd to itself
3009  * @job: LPFC_BSG_VENDOR_DIAG_TEST fc_bsg_job
3010  *
3011  * This function receives a user data buffer to be transmitted and received on
3012  * the same port, the link must be up and in loopback mode prior
3013  * to being called.
3014  * 1. A kernel buffer is allocated to copy the user data into.
3015  * 2. The port registers with "itself".
3016  * 3. The transmit and receive exchange ids are obtained.
3017  * 4. The receive exchange id is posted.
3018  * 5. A new els loopback event is created.
3019  * 6. The command and response iocbs are allocated.
3020  * 7. The cmd iocb FsType is set to elx loopback and the CmdRsp to looppback.
3021  *
3022  * This function is meant to be called n times while the port is in loopback
3023  * so it is the apps responsibility to issue a reset to take the port out
3024  * of loopback mode.
3025  **/
3026 static int
3027 lpfc_bsg_diag_loopback_run(struct bsg_job *job)
3028 {
3029 	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
3030 	struct fc_bsg_reply *bsg_reply = job->reply;
3031 	struct lpfc_hba *phba = vport->phba;
3032 	struct lpfc_bsg_event *evt;
3033 	struct event_data *evdat;
3034 	struct lpfc_sli *psli = &phba->sli;
3035 	uint32_t size;
3036 	uint32_t full_size;
3037 	size_t segment_len = 0, segment_offset = 0, current_offset = 0;
3038 	uint16_t rpi = 0;
3039 	struct lpfc_iocbq *cmdiocbq, *rspiocbq = NULL;
3040 	IOCB_t *cmd, *rsp = NULL;
3041 	struct lpfc_sli_ct_request *ctreq;
3042 	struct lpfc_dmabuf *txbmp;
3043 	struct ulp_bde64 *txbpl = NULL;
3044 	struct lpfc_dmabufext *txbuffer = NULL;
3045 	struct list_head head;
3046 	struct lpfc_dmabuf  *curr;
3047 	uint16_t txxri = 0, rxxri;
3048 	uint32_t num_bde;
3049 	uint8_t *ptr = NULL, *rx_databuf = NULL;
3050 	int rc = 0;
3051 	int time_left;
3052 	int iocb_stat = IOCB_SUCCESS;
3053 	unsigned long flags;
3054 	void *dataout = NULL;
3055 	uint32_t total_mem;
3056 
3057 	/* in case no data is returned return just the return code */
3058 	bsg_reply->reply_payload_rcv_len = 0;
3059 
3060 	if (job->request_len <
3061 	    sizeof(struct fc_bsg_request) + sizeof(struct diag_mode_test)) {
3062 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3063 				"2739 Received DIAG TEST request below minimum "
3064 				"size\n");
3065 		rc = -EINVAL;
3066 		goto loopback_test_exit;
3067 	}
3068 
3069 	if (job->request_payload.payload_len !=
3070 		job->reply_payload.payload_len) {
3071 		rc = -EINVAL;
3072 		goto loopback_test_exit;
3073 	}
3074 
3075 	if ((phba->link_state == LPFC_HBA_ERROR) ||
3076 	    (psli->sli_flag & LPFC_BLOCK_MGMT_IO) ||
3077 	    (!(psli->sli_flag & LPFC_SLI_ACTIVE))) {
3078 		rc = -EACCES;
3079 		goto loopback_test_exit;
3080 	}
3081 
3082 	if (!lpfc_is_link_up(phba) || !(phba->link_flag & LS_LOOPBACK_MODE)) {
3083 		rc = -EACCES;
3084 		goto loopback_test_exit;
3085 	}
3086 
3087 	size = job->request_payload.payload_len;
3088 	full_size = size + ELX_LOOPBACK_HEADER_SZ; /* plus the header */
3089 
3090 	if ((size == 0) || (size > 80 * BUF_SZ_4K)) {
3091 		rc = -ERANGE;
3092 		goto loopback_test_exit;
3093 	}
3094 
3095 	if (full_size >= BUF_SZ_4K) {
3096 		/*
3097 		 * Allocate memory for ioctl data. If buffer is bigger than 64k,
3098 		 * then we allocate 64k and re-use that buffer over and over to
3099 		 * xfer the whole block. This is because Linux kernel has a
3100 		 * problem allocating more than 120k of kernel space memory. Saw
3101 		 * problem with GET_FCPTARGETMAPPING...
3102 		 */
3103 		if (size <= (64 * 1024))
3104 			total_mem = full_size;
3105 		else
3106 			total_mem = 64 * 1024;
3107 	} else
3108 		/* Allocate memory for ioctl data */
3109 		total_mem = BUF_SZ_4K;
3110 
3111 	dataout = kmalloc(total_mem, GFP_KERNEL);
3112 	if (dataout == NULL) {
3113 		rc = -ENOMEM;
3114 		goto loopback_test_exit;
3115 	}
3116 
3117 	ptr = dataout;
3118 	ptr += ELX_LOOPBACK_HEADER_SZ;
3119 	sg_copy_to_buffer(job->request_payload.sg_list,
3120 				job->request_payload.sg_cnt,
3121 				ptr, size);
3122 	rc = lpfcdiag_loop_self_reg(phba, &rpi);
3123 	if (rc)
3124 		goto loopback_test_exit;
3125 
3126 	if (phba->sli_rev < LPFC_SLI_REV4) {
3127 		rc = lpfcdiag_loop_get_xri(phba, rpi, &txxri, &rxxri);
3128 		if (rc) {
3129 			lpfcdiag_loop_self_unreg(phba, rpi);
3130 			goto loopback_test_exit;
3131 		}
3132 
3133 		rc = lpfcdiag_loop_post_rxbufs(phba, rxxri, full_size);
3134 		if (rc) {
3135 			lpfcdiag_loop_self_unreg(phba, rpi);
3136 			goto loopback_test_exit;
3137 		}
3138 	}
3139 	evt = lpfc_bsg_event_new(FC_REG_CT_EVENT, current->pid,
3140 				SLI_CT_ELX_LOOPBACK);
3141 	if (!evt) {
3142 		lpfcdiag_loop_self_unreg(phba, rpi);
3143 		rc = -ENOMEM;
3144 		goto loopback_test_exit;
3145 	}
3146 
3147 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
3148 	list_add(&evt->node, &phba->ct_ev_waiters);
3149 	lpfc_bsg_event_ref(evt);
3150 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3151 
3152 	cmdiocbq = lpfc_sli_get_iocbq(phba);
3153 	if (phba->sli_rev < LPFC_SLI_REV4)
3154 		rspiocbq = lpfc_sli_get_iocbq(phba);
3155 	txbmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
3156 
3157 	if (txbmp) {
3158 		txbmp->virt = lpfc_mbuf_alloc(phba, 0, &txbmp->phys);
3159 		if (txbmp->virt) {
3160 			INIT_LIST_HEAD(&txbmp->list);
3161 			txbpl = (struct ulp_bde64 *) txbmp->virt;
3162 			txbuffer = diag_cmd_data_alloc(phba,
3163 							txbpl, full_size, 0);
3164 		}
3165 	}
3166 
3167 	if (!cmdiocbq || !txbmp || !txbpl || !txbuffer || !txbmp->virt) {
3168 		rc = -ENOMEM;
3169 		goto err_loopback_test_exit;
3170 	}
3171 	if ((phba->sli_rev < LPFC_SLI_REV4) && !rspiocbq) {
3172 		rc = -ENOMEM;
3173 		goto err_loopback_test_exit;
3174 	}
3175 
3176 	cmd = &cmdiocbq->iocb;
3177 	if (phba->sli_rev < LPFC_SLI_REV4)
3178 		rsp = &rspiocbq->iocb;
3179 
3180 	INIT_LIST_HEAD(&head);
3181 	list_add_tail(&head, &txbuffer->dma.list);
3182 	list_for_each_entry(curr, &head, list) {
3183 		segment_len = ((struct lpfc_dmabufext *)curr)->size;
3184 		if (current_offset == 0) {
3185 			ctreq = curr->virt;
3186 			memset(ctreq, 0, ELX_LOOPBACK_HEADER_SZ);
3187 			ctreq->RevisionId.bits.Revision = SLI_CT_REVISION;
3188 			ctreq->RevisionId.bits.InId = 0;
3189 			ctreq->FsType = SLI_CT_ELX_LOOPBACK;
3190 			ctreq->FsSubType = 0;
3191 			ctreq->CommandResponse.bits.CmdRsp = ELX_LOOPBACK_DATA;
3192 			ctreq->CommandResponse.bits.Size   = size;
3193 			segment_offset = ELX_LOOPBACK_HEADER_SZ;
3194 		} else
3195 			segment_offset = 0;
3196 
3197 		BUG_ON(segment_offset >= segment_len);
3198 		memcpy(curr->virt + segment_offset,
3199 			ptr + current_offset,
3200 			segment_len - segment_offset);
3201 
3202 		current_offset += segment_len - segment_offset;
3203 		BUG_ON(current_offset > size);
3204 	}
3205 	list_del(&head);
3206 
3207 	/* Build the XMIT_SEQUENCE iocb */
3208 	num_bde = (uint32_t)txbuffer->flag;
3209 
3210 	cmd->un.xseq64.bdl.addrHigh = putPaddrHigh(txbmp->phys);
3211 	cmd->un.xseq64.bdl.addrLow = putPaddrLow(txbmp->phys);
3212 	cmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
3213 	cmd->un.xseq64.bdl.bdeSize = (num_bde * sizeof(struct ulp_bde64));
3214 
3215 	cmd->un.xseq64.w5.hcsw.Fctl = (LS | LA);
3216 	cmd->un.xseq64.w5.hcsw.Dfctl = 0;
3217 	cmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL;
3218 	cmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT;
3219 
3220 	cmd->ulpCommand = CMD_XMIT_SEQUENCE64_CX;
3221 	cmd->ulpBdeCount = 1;
3222 	cmd->ulpLe = 1;
3223 	cmd->ulpClass = CLASS3;
3224 
3225 	if (phba->sli_rev < LPFC_SLI_REV4) {
3226 		cmd->ulpContext = txxri;
3227 	} else {
3228 		cmd->un.xseq64.bdl.ulpIoTag32 = 0;
3229 		cmd->un.ulpWord[3] = phba->sli4_hba.rpi_ids[rpi];
3230 		cmdiocbq->context3 = txbmp;
3231 		cmdiocbq->sli4_xritag = NO_XRI;
3232 		cmd->unsli3.rcvsli3.ox_id = 0xffff;
3233 	}
3234 	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
3235 	cmdiocbq->iocb_flag |= LPFC_IO_LOOPBACK;
3236 	cmdiocbq->vport = phba->pport;
3237 	cmdiocbq->iocb_cmpl = NULL;
3238 	iocb_stat = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq,
3239 					     rspiocbq, (phba->fc_ratov * 2) +
3240 					     LPFC_DRVR_TIMEOUT);
3241 
3242 	if ((iocb_stat != IOCB_SUCCESS) ||
3243 	    ((phba->sli_rev < LPFC_SLI_REV4) &&
3244 	     (rsp->ulpStatus != IOSTAT_SUCCESS))) {
3245 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3246 				"3126 Failed loopback test issue iocb: "
3247 				"iocb_stat:x%x\n", iocb_stat);
3248 		rc = -EIO;
3249 		goto err_loopback_test_exit;
3250 	}
3251 
3252 	evt->waiting = 1;
3253 	time_left = wait_event_interruptible_timeout(
3254 		evt->wq, !list_empty(&evt->events_to_see),
3255 		msecs_to_jiffies(1000 *
3256 			((phba->fc_ratov * 2) + LPFC_DRVR_TIMEOUT)));
3257 	evt->waiting = 0;
3258 	if (list_empty(&evt->events_to_see)) {
3259 		rc = (time_left) ? -EINTR : -ETIMEDOUT;
3260 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3261 				"3125 Not receiving unsolicited event, "
3262 				"rc:x%x\n", rc);
3263 	} else {
3264 		spin_lock_irqsave(&phba->ct_ev_lock, flags);
3265 		list_move(evt->events_to_see.prev, &evt->events_to_get);
3266 		evdat = list_entry(evt->events_to_get.prev,
3267 				   typeof(*evdat), node);
3268 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3269 		rx_databuf = evdat->data;
3270 		if (evdat->len != full_size) {
3271 			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3272 				"1603 Loopback test did not receive expected "
3273 				"data length. actual length 0x%x expected "
3274 				"length 0x%x\n",
3275 				evdat->len, full_size);
3276 			rc = -EIO;
3277 		} else if (rx_databuf == NULL)
3278 			rc = -EIO;
3279 		else {
3280 			rc = IOCB_SUCCESS;
3281 			/* skip over elx loopback header */
3282 			rx_databuf += ELX_LOOPBACK_HEADER_SZ;
3283 			bsg_reply->reply_payload_rcv_len =
3284 				sg_copy_from_buffer(job->reply_payload.sg_list,
3285 						    job->reply_payload.sg_cnt,
3286 						    rx_databuf, size);
3287 			bsg_reply->reply_payload_rcv_len = size;
3288 		}
3289 	}
3290 
3291 err_loopback_test_exit:
3292 	lpfcdiag_loop_self_unreg(phba, rpi);
3293 
3294 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
3295 	lpfc_bsg_event_unref(evt); /* release ref */
3296 	lpfc_bsg_event_unref(evt); /* delete */
3297 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3298 
3299 	if ((cmdiocbq != NULL) && (iocb_stat != IOCB_TIMEDOUT))
3300 		lpfc_sli_release_iocbq(phba, cmdiocbq);
3301 
3302 	if (rspiocbq != NULL)
3303 		lpfc_sli_release_iocbq(phba, rspiocbq);
3304 
3305 	if (txbmp != NULL) {
3306 		if (txbpl != NULL) {
3307 			if (txbuffer != NULL)
3308 				diag_cmd_data_free(phba, txbuffer);
3309 			lpfc_mbuf_free(phba, txbmp->virt, txbmp->phys);
3310 		}
3311 		kfree(txbmp);
3312 	}
3313 
3314 loopback_test_exit:
3315 	kfree(dataout);
3316 	/* make error code available to userspace */
3317 	bsg_reply->result = rc;
3318 	job->dd_data = NULL;
3319 	/* complete the job back to userspace if no error */
3320 	if (rc == IOCB_SUCCESS)
3321 		bsg_job_done(job, bsg_reply->result,
3322 			       bsg_reply->reply_payload_rcv_len);
3323 	return rc;
3324 }
3325 
3326 /**
3327  * lpfc_bsg_get_dfc_rev - process a GET_DFC_REV bsg vendor command
3328  * @job: GET_DFC_REV fc_bsg_job
3329  **/
3330 static int
3331 lpfc_bsg_get_dfc_rev(struct bsg_job *job)
3332 {
3333 	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
3334 	struct fc_bsg_reply *bsg_reply = job->reply;
3335 	struct lpfc_hba *phba = vport->phba;
3336 	struct get_mgmt_rev_reply *event_reply;
3337 	int rc = 0;
3338 
3339 	if (job->request_len <
3340 	    sizeof(struct fc_bsg_request) + sizeof(struct get_mgmt_rev)) {
3341 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3342 				"2740 Received GET_DFC_REV request below "
3343 				"minimum size\n");
3344 		rc = -EINVAL;
3345 		goto job_error;
3346 	}
3347 
3348 	event_reply = (struct get_mgmt_rev_reply *)
3349 		bsg_reply->reply_data.vendor_reply.vendor_rsp;
3350 
3351 	if (job->reply_len <
3352 	    sizeof(struct fc_bsg_request) + sizeof(struct get_mgmt_rev_reply)) {
3353 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3354 				"2741 Received GET_DFC_REV reply below "
3355 				"minimum size\n");
3356 		rc = -EINVAL;
3357 		goto job_error;
3358 	}
3359 
3360 	event_reply->info.a_Major = MANAGEMENT_MAJOR_REV;
3361 	event_reply->info.a_Minor = MANAGEMENT_MINOR_REV;
3362 job_error:
3363 	bsg_reply->result = rc;
3364 	if (rc == 0)
3365 		bsg_job_done(job, bsg_reply->result,
3366 			       bsg_reply->reply_payload_rcv_len);
3367 	return rc;
3368 }
3369 
3370 /**
3371  * lpfc_bsg_issue_mbox_cmpl - lpfc_bsg_issue_mbox mbox completion handler
3372  * @phba: Pointer to HBA context object.
3373  * @pmboxq: Pointer to mailbox command.
3374  *
3375  * This is completion handler function for mailbox commands issued from
3376  * lpfc_bsg_issue_mbox function. This function is called by the
3377  * mailbox event handler function with no lock held. This function
3378  * will wake up thread waiting on the wait queue pointed by context1
3379  * of the mailbox.
3380  **/
3381 static void
3382 lpfc_bsg_issue_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
3383 {
3384 	struct bsg_job_data *dd_data;
3385 	struct fc_bsg_reply *bsg_reply;
3386 	struct bsg_job *job;
3387 	uint32_t size;
3388 	unsigned long flags;
3389 	uint8_t *pmb, *pmb_buf;
3390 
3391 	dd_data = pmboxq->ctx_ndlp;
3392 
3393 	/*
3394 	 * The outgoing buffer is readily referred from the dma buffer,
3395 	 * just need to get header part from mailboxq structure.
3396 	 */
3397 	pmb = (uint8_t *)&pmboxq->u.mb;
3398 	pmb_buf = (uint8_t *)dd_data->context_un.mbox.mb;
3399 	memcpy(pmb_buf, pmb, sizeof(MAILBOX_t));
3400 
3401 	/* Determine if job has been aborted */
3402 
3403 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
3404 	job = dd_data->set_job;
3405 	if (job) {
3406 		/* Prevent timeout handling from trying to abort job  */
3407 		job->dd_data = NULL;
3408 	}
3409 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3410 
3411 	/* Copy the mailbox data to the job if it is still active */
3412 
3413 	if (job) {
3414 		bsg_reply = job->reply;
3415 		size = job->reply_payload.payload_len;
3416 		bsg_reply->reply_payload_rcv_len =
3417 			sg_copy_from_buffer(job->reply_payload.sg_list,
3418 					    job->reply_payload.sg_cnt,
3419 					    pmb_buf, size);
3420 	}
3421 
3422 	dd_data->set_job = NULL;
3423 	mempool_free(dd_data->context_un.mbox.pmboxq, phba->mbox_mem_pool);
3424 	lpfc_bsg_dma_page_free(phba, dd_data->context_un.mbox.dmabuffers);
3425 	kfree(dd_data);
3426 
3427 	/* Complete the job if the job is still active */
3428 
3429 	if (job) {
3430 		bsg_reply->result = 0;
3431 		bsg_job_done(job, bsg_reply->result,
3432 			       bsg_reply->reply_payload_rcv_len);
3433 	}
3434 	return;
3435 }
3436 
3437 /**
3438  * lpfc_bsg_check_cmd_access - test for a supported mailbox command
3439  * @phba: Pointer to HBA context object.
3440  * @mb: Pointer to a mailbox object.
3441  * @vport: Pointer to a vport object.
3442  *
3443  * Some commands require the port to be offline, some may not be called from
3444  * the application.
3445  **/
3446 static int lpfc_bsg_check_cmd_access(struct lpfc_hba *phba,
3447 	MAILBOX_t *mb, struct lpfc_vport *vport)
3448 {
3449 	/* return negative error values for bsg job */
3450 	switch (mb->mbxCommand) {
3451 	/* Offline only */
3452 	case MBX_INIT_LINK:
3453 	case MBX_DOWN_LINK:
3454 	case MBX_CONFIG_LINK:
3455 	case MBX_CONFIG_RING:
3456 	case MBX_RESET_RING:
3457 	case MBX_UNREG_LOGIN:
3458 	case MBX_CLEAR_LA:
3459 	case MBX_DUMP_CONTEXT:
3460 	case MBX_RUN_DIAGS:
3461 	case MBX_RESTART:
3462 	case MBX_SET_MASK:
3463 		if (!(vport->fc_flag & FC_OFFLINE_MODE)) {
3464 			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3465 				"2743 Command 0x%x is illegal in on-line "
3466 				"state\n",
3467 				mb->mbxCommand);
3468 			return -EPERM;
3469 		}
3470 	case MBX_WRITE_NV:
3471 	case MBX_WRITE_VPARMS:
3472 	case MBX_LOAD_SM:
3473 	case MBX_READ_NV:
3474 	case MBX_READ_CONFIG:
3475 	case MBX_READ_RCONFIG:
3476 	case MBX_READ_STATUS:
3477 	case MBX_READ_XRI:
3478 	case MBX_READ_REV:
3479 	case MBX_READ_LNK_STAT:
3480 	case MBX_DUMP_MEMORY:
3481 	case MBX_DOWN_LOAD:
3482 	case MBX_UPDATE_CFG:
3483 	case MBX_KILL_BOARD:
3484 	case MBX_READ_TOPOLOGY:
3485 	case MBX_LOAD_AREA:
3486 	case MBX_LOAD_EXP_ROM:
3487 	case MBX_BEACON:
3488 	case MBX_DEL_LD_ENTRY:
3489 	case MBX_SET_DEBUG:
3490 	case MBX_WRITE_WWN:
3491 	case MBX_SLI4_CONFIG:
3492 	case MBX_READ_EVENT_LOG:
3493 	case MBX_READ_EVENT_LOG_STATUS:
3494 	case MBX_WRITE_EVENT_LOG:
3495 	case MBX_PORT_CAPABILITIES:
3496 	case MBX_PORT_IOV_CONTROL:
3497 	case MBX_RUN_BIU_DIAG64:
3498 		break;
3499 	case MBX_SET_VARIABLE:
3500 		lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
3501 			"1226 mbox: set_variable 0x%x, 0x%x\n",
3502 			mb->un.varWords[0],
3503 			mb->un.varWords[1]);
3504 		if ((mb->un.varWords[0] == SETVAR_MLOMNT)
3505 			&& (mb->un.varWords[1] == 1)) {
3506 			phba->wait_4_mlo_maint_flg = 1;
3507 		} else if (mb->un.varWords[0] == SETVAR_MLORST) {
3508 			spin_lock_irq(&phba->hbalock);
3509 			phba->link_flag &= ~LS_LOOPBACK_MODE;
3510 			spin_unlock_irq(&phba->hbalock);
3511 			phba->fc_topology = LPFC_TOPOLOGY_PT_PT;
3512 		}
3513 		break;
3514 	case MBX_READ_SPARM64:
3515 	case MBX_REG_LOGIN:
3516 	case MBX_REG_LOGIN64:
3517 	case MBX_CONFIG_PORT:
3518 	case MBX_RUN_BIU_DIAG:
3519 	default:
3520 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3521 			"2742 Unknown Command 0x%x\n",
3522 			mb->mbxCommand);
3523 		return -EPERM;
3524 	}
3525 
3526 	return 0; /* ok */
3527 }
3528 
3529 /**
3530  * lpfc_bsg_mbox_ext_cleanup - clean up context of multi-buffer mbox session
3531  * @phba: Pointer to HBA context object.
3532  *
3533  * This is routine clean up and reset BSG handling of multi-buffer mbox
3534  * command session.
3535  **/
3536 static void
3537 lpfc_bsg_mbox_ext_session_reset(struct lpfc_hba *phba)
3538 {
3539 	if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_IDLE)
3540 		return;
3541 
3542 	/* free all memory, including dma buffers */
3543 	lpfc_bsg_dma_page_list_free(phba,
3544 				    &phba->mbox_ext_buf_ctx.ext_dmabuf_list);
3545 	lpfc_bsg_dma_page_free(phba, phba->mbox_ext_buf_ctx.mbx_dmabuf);
3546 	/* multi-buffer write mailbox command pass-through complete */
3547 	memset((char *)&phba->mbox_ext_buf_ctx, 0,
3548 	       sizeof(struct lpfc_mbox_ext_buf_ctx));
3549 	INIT_LIST_HEAD(&phba->mbox_ext_buf_ctx.ext_dmabuf_list);
3550 
3551 	return;
3552 }
3553 
3554 /**
3555  * lpfc_bsg_issue_mbox_ext_handle_job - job handler for multi-buffer mbox cmpl
3556  * @phba: Pointer to HBA context object.
3557  * @pmboxq: Pointer to mailbox command.
3558  *
3559  * This is routine handles BSG job for mailbox commands completions with
3560  * multiple external buffers.
3561  **/
3562 static struct bsg_job *
3563 lpfc_bsg_issue_mbox_ext_handle_job(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
3564 {
3565 	struct bsg_job_data *dd_data;
3566 	struct bsg_job *job;
3567 	struct fc_bsg_reply *bsg_reply;
3568 	uint8_t *pmb, *pmb_buf;
3569 	unsigned long flags;
3570 	uint32_t size;
3571 	int rc = 0;
3572 	struct lpfc_dmabuf *dmabuf;
3573 	struct lpfc_sli_config_mbox *sli_cfg_mbx;
3574 	uint8_t *pmbx;
3575 
3576 	dd_data = pmboxq->ctx_buf;
3577 
3578 	/* Determine if job has been aborted */
3579 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
3580 	job = dd_data->set_job;
3581 	if (job) {
3582 		bsg_reply = job->reply;
3583 		/* Prevent timeout handling from trying to abort job  */
3584 		job->dd_data = NULL;
3585 	}
3586 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3587 
3588 	/*
3589 	 * The outgoing buffer is readily referred from the dma buffer,
3590 	 * just need to get header part from mailboxq structure.
3591 	 */
3592 
3593 	pmb = (uint8_t *)&pmboxq->u.mb;
3594 	pmb_buf = (uint8_t *)dd_data->context_un.mbox.mb;
3595 	/* Copy the byte swapped response mailbox back to the user */
3596 	memcpy(pmb_buf, pmb, sizeof(MAILBOX_t));
3597 	/* if there is any non-embedded extended data copy that too */
3598 	dmabuf = phba->mbox_ext_buf_ctx.mbx_dmabuf;
3599 	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)dmabuf->virt;
3600 	if (!bsg_bf_get(lpfc_mbox_hdr_emb,
3601 	    &sli_cfg_mbx->un.sli_config_emb0_subsys.sli_config_hdr)) {
3602 		pmbx = (uint8_t *)dmabuf->virt;
3603 		/* byte swap the extended data following the mailbox command */
3604 		lpfc_sli_pcimem_bcopy(&pmbx[sizeof(MAILBOX_t)],
3605 			&pmbx[sizeof(MAILBOX_t)],
3606 			sli_cfg_mbx->un.sli_config_emb0_subsys.mse[0].buf_len);
3607 	}
3608 
3609 	/* Complete the job if the job is still active */
3610 
3611 	if (job) {
3612 		size = job->reply_payload.payload_len;
3613 		bsg_reply->reply_payload_rcv_len =
3614 			sg_copy_from_buffer(job->reply_payload.sg_list,
3615 					    job->reply_payload.sg_cnt,
3616 					    pmb_buf, size);
3617 
3618 		/* result for successful */
3619 		bsg_reply->result = 0;
3620 
3621 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3622 				"2937 SLI_CONFIG ext-buffer mailbox command "
3623 				"(x%x/x%x) complete bsg job done, bsize:%d\n",
3624 				phba->mbox_ext_buf_ctx.nembType,
3625 				phba->mbox_ext_buf_ctx.mboxType, size);
3626 		lpfc_idiag_mbxacc_dump_bsg_mbox(phba,
3627 					phba->mbox_ext_buf_ctx.nembType,
3628 					phba->mbox_ext_buf_ctx.mboxType,
3629 					dma_ebuf, sta_pos_addr,
3630 					phba->mbox_ext_buf_ctx.mbx_dmabuf, 0);
3631 	} else {
3632 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3633 				"2938 SLI_CONFIG ext-buffer mailbox "
3634 				"command (x%x/x%x) failure, rc:x%x\n",
3635 				phba->mbox_ext_buf_ctx.nembType,
3636 				phba->mbox_ext_buf_ctx.mboxType, rc);
3637 	}
3638 
3639 
3640 	/* state change */
3641 	phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_DONE;
3642 	kfree(dd_data);
3643 	return job;
3644 }
3645 
3646 /**
3647  * lpfc_bsg_issue_read_mbox_ext_cmpl - compl handler for multi-buffer read mbox
3648  * @phba: Pointer to HBA context object.
3649  * @pmboxq: Pointer to mailbox command.
3650  *
3651  * This is completion handler function for mailbox read commands with multiple
3652  * external buffers.
3653  **/
3654 static void
3655 lpfc_bsg_issue_read_mbox_ext_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
3656 {
3657 	struct bsg_job *job;
3658 	struct fc_bsg_reply *bsg_reply;
3659 
3660 	job = lpfc_bsg_issue_mbox_ext_handle_job(phba, pmboxq);
3661 
3662 	/* handle the BSG job with mailbox command */
3663 	if (!job)
3664 		pmboxq->u.mb.mbxStatus = MBXERR_ERROR;
3665 
3666 	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3667 			"2939 SLI_CONFIG ext-buffer rd mailbox command "
3668 			"complete, ctxState:x%x, mbxStatus:x%x\n",
3669 			phba->mbox_ext_buf_ctx.state, pmboxq->u.mb.mbxStatus);
3670 
3671 	if (pmboxq->u.mb.mbxStatus || phba->mbox_ext_buf_ctx.numBuf == 1)
3672 		lpfc_bsg_mbox_ext_session_reset(phba);
3673 
3674 	/* free base driver mailbox structure memory */
3675 	mempool_free(pmboxq, phba->mbox_mem_pool);
3676 
3677 	/* if the job is still active, call job done */
3678 	if (job) {
3679 		bsg_reply = job->reply;
3680 		bsg_job_done(job, bsg_reply->result,
3681 			       bsg_reply->reply_payload_rcv_len);
3682 	}
3683 	return;
3684 }
3685 
3686 /**
3687  * lpfc_bsg_issue_write_mbox_ext_cmpl - cmpl handler for multi-buffer write mbox
3688  * @phba: Pointer to HBA context object.
3689  * @pmboxq: Pointer to mailbox command.
3690  *
3691  * This is completion handler function for mailbox write commands with multiple
3692  * external buffers.
3693  **/
3694 static void
3695 lpfc_bsg_issue_write_mbox_ext_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
3696 {
3697 	struct bsg_job *job;
3698 	struct fc_bsg_reply *bsg_reply;
3699 
3700 	job = lpfc_bsg_issue_mbox_ext_handle_job(phba, pmboxq);
3701 
3702 	/* handle the BSG job with the mailbox command */
3703 	if (!job)
3704 		pmboxq->u.mb.mbxStatus = MBXERR_ERROR;
3705 
3706 	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3707 			"2940 SLI_CONFIG ext-buffer wr mailbox command "
3708 			"complete, ctxState:x%x, mbxStatus:x%x\n",
3709 			phba->mbox_ext_buf_ctx.state, pmboxq->u.mb.mbxStatus);
3710 
3711 	/* free all memory, including dma buffers */
3712 	mempool_free(pmboxq, phba->mbox_mem_pool);
3713 	lpfc_bsg_mbox_ext_session_reset(phba);
3714 
3715 	/* if the job is still active, call job done */
3716 	if (job) {
3717 		bsg_reply = job->reply;
3718 		bsg_job_done(job, bsg_reply->result,
3719 			       bsg_reply->reply_payload_rcv_len);
3720 	}
3721 
3722 	return;
3723 }
3724 
3725 static void
3726 lpfc_bsg_sli_cfg_dma_desc_setup(struct lpfc_hba *phba, enum nemb_type nemb_tp,
3727 				uint32_t index, struct lpfc_dmabuf *mbx_dmabuf,
3728 				struct lpfc_dmabuf *ext_dmabuf)
3729 {
3730 	struct lpfc_sli_config_mbox *sli_cfg_mbx;
3731 
3732 	/* pointer to the start of mailbox command */
3733 	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)mbx_dmabuf->virt;
3734 
3735 	if (nemb_tp == nemb_mse) {
3736 		if (index == 0) {
3737 			sli_cfg_mbx->un.sli_config_emb0_subsys.
3738 				mse[index].pa_hi =
3739 				putPaddrHigh(mbx_dmabuf->phys +
3740 					     sizeof(MAILBOX_t));
3741 			sli_cfg_mbx->un.sli_config_emb0_subsys.
3742 				mse[index].pa_lo =
3743 				putPaddrLow(mbx_dmabuf->phys +
3744 					    sizeof(MAILBOX_t));
3745 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3746 					"2943 SLI_CONFIG(mse)[%d], "
3747 					"bufLen:%d, addrHi:x%x, addrLo:x%x\n",
3748 					index,
3749 					sli_cfg_mbx->un.sli_config_emb0_subsys.
3750 					mse[index].buf_len,
3751 					sli_cfg_mbx->un.sli_config_emb0_subsys.
3752 					mse[index].pa_hi,
3753 					sli_cfg_mbx->un.sli_config_emb0_subsys.
3754 					mse[index].pa_lo);
3755 		} else {
3756 			sli_cfg_mbx->un.sli_config_emb0_subsys.
3757 				mse[index].pa_hi =
3758 				putPaddrHigh(ext_dmabuf->phys);
3759 			sli_cfg_mbx->un.sli_config_emb0_subsys.
3760 				mse[index].pa_lo =
3761 				putPaddrLow(ext_dmabuf->phys);
3762 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3763 					"2944 SLI_CONFIG(mse)[%d], "
3764 					"bufLen:%d, addrHi:x%x, addrLo:x%x\n",
3765 					index,
3766 					sli_cfg_mbx->un.sli_config_emb0_subsys.
3767 					mse[index].buf_len,
3768 					sli_cfg_mbx->un.sli_config_emb0_subsys.
3769 					mse[index].pa_hi,
3770 					sli_cfg_mbx->un.sli_config_emb0_subsys.
3771 					mse[index].pa_lo);
3772 		}
3773 	} else {
3774 		if (index == 0) {
3775 			sli_cfg_mbx->un.sli_config_emb1_subsys.
3776 				hbd[index].pa_hi =
3777 				putPaddrHigh(mbx_dmabuf->phys +
3778 					     sizeof(MAILBOX_t));
3779 			sli_cfg_mbx->un.sli_config_emb1_subsys.
3780 				hbd[index].pa_lo =
3781 				putPaddrLow(mbx_dmabuf->phys +
3782 					    sizeof(MAILBOX_t));
3783 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3784 					"3007 SLI_CONFIG(hbd)[%d], "
3785 					"bufLen:%d, addrHi:x%x, addrLo:x%x\n",
3786 				index,
3787 				bsg_bf_get(lpfc_mbox_sli_config_ecmn_hbd_len,
3788 				&sli_cfg_mbx->un.
3789 				sli_config_emb1_subsys.hbd[index]),
3790 				sli_cfg_mbx->un.sli_config_emb1_subsys.
3791 				hbd[index].pa_hi,
3792 				sli_cfg_mbx->un.sli_config_emb1_subsys.
3793 				hbd[index].pa_lo);
3794 
3795 		} else {
3796 			sli_cfg_mbx->un.sli_config_emb1_subsys.
3797 				hbd[index].pa_hi =
3798 				putPaddrHigh(ext_dmabuf->phys);
3799 			sli_cfg_mbx->un.sli_config_emb1_subsys.
3800 				hbd[index].pa_lo =
3801 				putPaddrLow(ext_dmabuf->phys);
3802 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3803 					"3008 SLI_CONFIG(hbd)[%d], "
3804 					"bufLen:%d, addrHi:x%x, addrLo:x%x\n",
3805 				index,
3806 				bsg_bf_get(lpfc_mbox_sli_config_ecmn_hbd_len,
3807 				&sli_cfg_mbx->un.
3808 				sli_config_emb1_subsys.hbd[index]),
3809 				sli_cfg_mbx->un.sli_config_emb1_subsys.
3810 				hbd[index].pa_hi,
3811 				sli_cfg_mbx->un.sli_config_emb1_subsys.
3812 				hbd[index].pa_lo);
3813 		}
3814 	}
3815 	return;
3816 }
3817 
3818 /**
3819  * lpfc_bsg_sli_cfg_mse_read_cmd_ext - sli_config non-embedded mailbox cmd read
3820  * @phba: Pointer to HBA context object.
3821  * @mb: Pointer to a BSG mailbox object.
3822  * @nemb_tp: Enumerate of non-embedded mailbox command type.
3823  * @dmabuff: Pointer to a DMA buffer descriptor.
3824  *
3825  * This routine performs SLI_CONFIG (0x9B) read mailbox command operation with
3826  * non-embedded external bufffers.
3827  **/
3828 static int
3829 lpfc_bsg_sli_cfg_read_cmd_ext(struct lpfc_hba *phba, struct bsg_job *job,
3830 			      enum nemb_type nemb_tp,
3831 			      struct lpfc_dmabuf *dmabuf)
3832 {
3833 	struct fc_bsg_request *bsg_request = job->request;
3834 	struct lpfc_sli_config_mbox *sli_cfg_mbx;
3835 	struct dfc_mbox_req *mbox_req;
3836 	struct lpfc_dmabuf *curr_dmabuf, *next_dmabuf;
3837 	uint32_t ext_buf_cnt, ext_buf_index;
3838 	struct lpfc_dmabuf *ext_dmabuf = NULL;
3839 	struct bsg_job_data *dd_data = NULL;
3840 	LPFC_MBOXQ_t *pmboxq = NULL;
3841 	MAILBOX_t *pmb;
3842 	uint8_t *pmbx;
3843 	int rc, i;
3844 
3845 	mbox_req =
3846 	   (struct dfc_mbox_req *)bsg_request->rqst_data.h_vendor.vendor_cmd;
3847 
3848 	/* pointer to the start of mailbox command */
3849 	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)dmabuf->virt;
3850 
3851 	if (nemb_tp == nemb_mse) {
3852 		ext_buf_cnt = bsg_bf_get(lpfc_mbox_hdr_mse_cnt,
3853 			&sli_cfg_mbx->un.sli_config_emb0_subsys.sli_config_hdr);
3854 		if (ext_buf_cnt > LPFC_MBX_SLI_CONFIG_MAX_MSE) {
3855 			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3856 					"2945 Handled SLI_CONFIG(mse) rd, "
3857 					"ext_buf_cnt(%d) out of range(%d)\n",
3858 					ext_buf_cnt,
3859 					LPFC_MBX_SLI_CONFIG_MAX_MSE);
3860 			rc = -ERANGE;
3861 			goto job_error;
3862 		}
3863 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3864 				"2941 Handled SLI_CONFIG(mse) rd, "
3865 				"ext_buf_cnt:%d\n", ext_buf_cnt);
3866 	} else {
3867 		/* sanity check on interface type for support */
3868 		if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
3869 		    LPFC_SLI_INTF_IF_TYPE_2) {
3870 			rc = -ENODEV;
3871 			goto job_error;
3872 		}
3873 		/* nemb_tp == nemb_hbd */
3874 		ext_buf_cnt = sli_cfg_mbx->un.sli_config_emb1_subsys.hbd_count;
3875 		if (ext_buf_cnt > LPFC_MBX_SLI_CONFIG_MAX_HBD) {
3876 			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3877 					"2946 Handled SLI_CONFIG(hbd) rd, "
3878 					"ext_buf_cnt(%d) out of range(%d)\n",
3879 					ext_buf_cnt,
3880 					LPFC_MBX_SLI_CONFIG_MAX_HBD);
3881 			rc = -ERANGE;
3882 			goto job_error;
3883 		}
3884 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3885 				"2942 Handled SLI_CONFIG(hbd) rd, "
3886 				"ext_buf_cnt:%d\n", ext_buf_cnt);
3887 	}
3888 
3889 	/* before dma descriptor setup */
3890 	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, nemb_tp, mbox_rd, dma_mbox,
3891 					sta_pre_addr, dmabuf, ext_buf_cnt);
3892 
3893 	/* reject non-embedded mailbox command with none external buffer */
3894 	if (ext_buf_cnt == 0) {
3895 		rc = -EPERM;
3896 		goto job_error;
3897 	} else if (ext_buf_cnt > 1) {
3898 		/* additional external read buffers */
3899 		for (i = 1; i < ext_buf_cnt; i++) {
3900 			ext_dmabuf = lpfc_bsg_dma_page_alloc(phba);
3901 			if (!ext_dmabuf) {
3902 				rc = -ENOMEM;
3903 				goto job_error;
3904 			}
3905 			list_add_tail(&ext_dmabuf->list,
3906 				      &phba->mbox_ext_buf_ctx.ext_dmabuf_list);
3907 		}
3908 	}
3909 
3910 	/* bsg tracking structure */
3911 	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
3912 	if (!dd_data) {
3913 		rc = -ENOMEM;
3914 		goto job_error;
3915 	}
3916 
3917 	/* mailbox command structure for base driver */
3918 	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
3919 	if (!pmboxq) {
3920 		rc = -ENOMEM;
3921 		goto job_error;
3922 	}
3923 	memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
3924 
3925 	/* for the first external buffer */
3926 	lpfc_bsg_sli_cfg_dma_desc_setup(phba, nemb_tp, 0, dmabuf, dmabuf);
3927 
3928 	/* for the rest of external buffer descriptors if any */
3929 	if (ext_buf_cnt > 1) {
3930 		ext_buf_index = 1;
3931 		list_for_each_entry_safe(curr_dmabuf, next_dmabuf,
3932 				&phba->mbox_ext_buf_ctx.ext_dmabuf_list, list) {
3933 			lpfc_bsg_sli_cfg_dma_desc_setup(phba, nemb_tp,
3934 						ext_buf_index, dmabuf,
3935 						curr_dmabuf);
3936 			ext_buf_index++;
3937 		}
3938 	}
3939 
3940 	/* after dma descriptor setup */
3941 	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, nemb_tp, mbox_rd, dma_mbox,
3942 					sta_pos_addr, dmabuf, ext_buf_cnt);
3943 
3944 	/* construct base driver mbox command */
3945 	pmb = &pmboxq->u.mb;
3946 	pmbx = (uint8_t *)dmabuf->virt;
3947 	memcpy(pmb, pmbx, sizeof(*pmb));
3948 	pmb->mbxOwner = OWN_HOST;
3949 	pmboxq->vport = phba->pport;
3950 
3951 	/* multi-buffer handling context */
3952 	phba->mbox_ext_buf_ctx.nembType = nemb_tp;
3953 	phba->mbox_ext_buf_ctx.mboxType = mbox_rd;
3954 	phba->mbox_ext_buf_ctx.numBuf = ext_buf_cnt;
3955 	phba->mbox_ext_buf_ctx.mbxTag = mbox_req->extMboxTag;
3956 	phba->mbox_ext_buf_ctx.seqNum = mbox_req->extSeqNum;
3957 	phba->mbox_ext_buf_ctx.mbx_dmabuf = dmabuf;
3958 
3959 	/* callback for multi-buffer read mailbox command */
3960 	pmboxq->mbox_cmpl = lpfc_bsg_issue_read_mbox_ext_cmpl;
3961 
3962 	/* context fields to callback function */
3963 	pmboxq->ctx_buf = dd_data;
3964 	dd_data->type = TYPE_MBOX;
3965 	dd_data->set_job = job;
3966 	dd_data->context_un.mbox.pmboxq = pmboxq;
3967 	dd_data->context_un.mbox.mb = (MAILBOX_t *)pmbx;
3968 	job->dd_data = dd_data;
3969 
3970 	/* state change */
3971 	phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_PORT;
3972 
3973 	/*
3974 	 * Non-embedded mailbox subcommand data gets byte swapped here because
3975 	 * the lower level driver code only does the first 64 mailbox words.
3976 	 */
3977 	if ((!bsg_bf_get(lpfc_mbox_hdr_emb,
3978 	    &sli_cfg_mbx->un.sli_config_emb0_subsys.sli_config_hdr)) &&
3979 		(nemb_tp == nemb_mse))
3980 		lpfc_sli_pcimem_bcopy(&pmbx[sizeof(MAILBOX_t)],
3981 			&pmbx[sizeof(MAILBOX_t)],
3982 				sli_cfg_mbx->un.sli_config_emb0_subsys.
3983 					mse[0].buf_len);
3984 
3985 	rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
3986 	if ((rc == MBX_SUCCESS) || (rc == MBX_BUSY)) {
3987 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3988 				"2947 Issued SLI_CONFIG ext-buffer "
3989 				"mailbox command, rc:x%x\n", rc);
3990 		return SLI_CONFIG_HANDLED;
3991 	}
3992 	lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3993 			"2948 Failed to issue SLI_CONFIG ext-buffer "
3994 			"mailbox command, rc:x%x\n", rc);
3995 	rc = -EPIPE;
3996 
3997 job_error:
3998 	if (pmboxq)
3999 		mempool_free(pmboxq, phba->mbox_mem_pool);
4000 	lpfc_bsg_dma_page_list_free(phba,
4001 				    &phba->mbox_ext_buf_ctx.ext_dmabuf_list);
4002 	kfree(dd_data);
4003 	phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_IDLE;
4004 	return rc;
4005 }
4006 
4007 /**
4008  * lpfc_bsg_sli_cfg_write_cmd_ext - sli_config non-embedded mailbox cmd write
4009  * @phba: Pointer to HBA context object.
4010  * @mb: Pointer to a BSG mailbox object.
4011  * @dmabuff: Pointer to a DMA buffer descriptor.
4012  *
4013  * This routine performs SLI_CONFIG (0x9B) write mailbox command operation with
4014  * non-embedded external bufffers.
4015  **/
4016 static int
4017 lpfc_bsg_sli_cfg_write_cmd_ext(struct lpfc_hba *phba, struct bsg_job *job,
4018 			       enum nemb_type nemb_tp,
4019 			       struct lpfc_dmabuf *dmabuf)
4020 {
4021 	struct fc_bsg_request *bsg_request = job->request;
4022 	struct fc_bsg_reply *bsg_reply = job->reply;
4023 	struct dfc_mbox_req *mbox_req;
4024 	struct lpfc_sli_config_mbox *sli_cfg_mbx;
4025 	uint32_t ext_buf_cnt;
4026 	struct bsg_job_data *dd_data = NULL;
4027 	LPFC_MBOXQ_t *pmboxq = NULL;
4028 	MAILBOX_t *pmb;
4029 	uint8_t *mbx;
4030 	int rc = SLI_CONFIG_NOT_HANDLED, i;
4031 
4032 	mbox_req =
4033 	   (struct dfc_mbox_req *)bsg_request->rqst_data.h_vendor.vendor_cmd;
4034 
4035 	/* pointer to the start of mailbox command */
4036 	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)dmabuf->virt;
4037 
4038 	if (nemb_tp == nemb_mse) {
4039 		ext_buf_cnt = bsg_bf_get(lpfc_mbox_hdr_mse_cnt,
4040 			&sli_cfg_mbx->un.sli_config_emb0_subsys.sli_config_hdr);
4041 		if (ext_buf_cnt > LPFC_MBX_SLI_CONFIG_MAX_MSE) {
4042 			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4043 					"2953 Failed SLI_CONFIG(mse) wr, "
4044 					"ext_buf_cnt(%d) out of range(%d)\n",
4045 					ext_buf_cnt,
4046 					LPFC_MBX_SLI_CONFIG_MAX_MSE);
4047 			return -ERANGE;
4048 		}
4049 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4050 				"2949 Handled SLI_CONFIG(mse) wr, "
4051 				"ext_buf_cnt:%d\n", ext_buf_cnt);
4052 	} else {
4053 		/* sanity check on interface type for support */
4054 		if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
4055 		    LPFC_SLI_INTF_IF_TYPE_2)
4056 			return -ENODEV;
4057 		/* nemb_tp == nemb_hbd */
4058 		ext_buf_cnt = sli_cfg_mbx->un.sli_config_emb1_subsys.hbd_count;
4059 		if (ext_buf_cnt > LPFC_MBX_SLI_CONFIG_MAX_HBD) {
4060 			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4061 					"2954 Failed SLI_CONFIG(hbd) wr, "
4062 					"ext_buf_cnt(%d) out of range(%d)\n",
4063 					ext_buf_cnt,
4064 					LPFC_MBX_SLI_CONFIG_MAX_HBD);
4065 			return -ERANGE;
4066 		}
4067 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4068 				"2950 Handled SLI_CONFIG(hbd) wr, "
4069 				"ext_buf_cnt:%d\n", ext_buf_cnt);
4070 	}
4071 
4072 	/* before dma buffer descriptor setup */
4073 	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, nemb_tp, mbox_wr, dma_mbox,
4074 					sta_pre_addr, dmabuf, ext_buf_cnt);
4075 
4076 	if (ext_buf_cnt == 0)
4077 		return -EPERM;
4078 
4079 	/* for the first external buffer */
4080 	lpfc_bsg_sli_cfg_dma_desc_setup(phba, nemb_tp, 0, dmabuf, dmabuf);
4081 
4082 	/* after dma descriptor setup */
4083 	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, nemb_tp, mbox_wr, dma_mbox,
4084 					sta_pos_addr, dmabuf, ext_buf_cnt);
4085 
4086 	/* log for looking forward */
4087 	for (i = 1; i < ext_buf_cnt; i++) {
4088 		if (nemb_tp == nemb_mse)
4089 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4090 				"2951 SLI_CONFIG(mse), buf[%d]-length:%d\n",
4091 				i, sli_cfg_mbx->un.sli_config_emb0_subsys.
4092 				mse[i].buf_len);
4093 		else
4094 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4095 				"2952 SLI_CONFIG(hbd), buf[%d]-length:%d\n",
4096 				i, bsg_bf_get(lpfc_mbox_sli_config_ecmn_hbd_len,
4097 				&sli_cfg_mbx->un.sli_config_emb1_subsys.
4098 				hbd[i]));
4099 	}
4100 
4101 	/* multi-buffer handling context */
4102 	phba->mbox_ext_buf_ctx.nembType = nemb_tp;
4103 	phba->mbox_ext_buf_ctx.mboxType = mbox_wr;
4104 	phba->mbox_ext_buf_ctx.numBuf = ext_buf_cnt;
4105 	phba->mbox_ext_buf_ctx.mbxTag = mbox_req->extMboxTag;
4106 	phba->mbox_ext_buf_ctx.seqNum = mbox_req->extSeqNum;
4107 	phba->mbox_ext_buf_ctx.mbx_dmabuf = dmabuf;
4108 
4109 	if (ext_buf_cnt == 1) {
4110 		/* bsg tracking structure */
4111 		dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
4112 		if (!dd_data) {
4113 			rc = -ENOMEM;
4114 			goto job_error;
4115 		}
4116 
4117 		/* mailbox command structure for base driver */
4118 		pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
4119 		if (!pmboxq) {
4120 			rc = -ENOMEM;
4121 			goto job_error;
4122 		}
4123 		memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
4124 		pmb = &pmboxq->u.mb;
4125 		mbx = (uint8_t *)dmabuf->virt;
4126 		memcpy(pmb, mbx, sizeof(*pmb));
4127 		pmb->mbxOwner = OWN_HOST;
4128 		pmboxq->vport = phba->pport;
4129 
4130 		/* callback for multi-buffer read mailbox command */
4131 		pmboxq->mbox_cmpl = lpfc_bsg_issue_write_mbox_ext_cmpl;
4132 
4133 		/* context fields to callback function */
4134 		pmboxq->ctx_buf = dd_data;
4135 		dd_data->type = TYPE_MBOX;
4136 		dd_data->set_job = job;
4137 		dd_data->context_un.mbox.pmboxq = pmboxq;
4138 		dd_data->context_un.mbox.mb = (MAILBOX_t *)mbx;
4139 		job->dd_data = dd_data;
4140 
4141 		/* state change */
4142 
4143 		phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_PORT;
4144 		rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
4145 		if ((rc == MBX_SUCCESS) || (rc == MBX_BUSY)) {
4146 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4147 					"2955 Issued SLI_CONFIG ext-buffer "
4148 					"mailbox command, rc:x%x\n", rc);
4149 			return SLI_CONFIG_HANDLED;
4150 		}
4151 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4152 				"2956 Failed to issue SLI_CONFIG ext-buffer "
4153 				"mailbox command, rc:x%x\n", rc);
4154 		rc = -EPIPE;
4155 		goto job_error;
4156 	}
4157 
4158 	/* wait for additoinal external buffers */
4159 
4160 	bsg_reply->result = 0;
4161 	bsg_job_done(job, bsg_reply->result,
4162 		       bsg_reply->reply_payload_rcv_len);
4163 	return SLI_CONFIG_HANDLED;
4164 
4165 job_error:
4166 	if (pmboxq)
4167 		mempool_free(pmboxq, phba->mbox_mem_pool);
4168 	kfree(dd_data);
4169 
4170 	return rc;
4171 }
4172 
4173 /**
4174  * lpfc_bsg_handle_sli_cfg_mbox - handle sli-cfg mailbox cmd with ext buffer
4175  * @phba: Pointer to HBA context object.
4176  * @mb: Pointer to a BSG mailbox object.
4177  * @dmabuff: Pointer to a DMA buffer descriptor.
4178  *
4179  * This routine handles SLI_CONFIG (0x9B) mailbox command with non-embedded
4180  * external bufffers, including both 0x9B with non-embedded MSEs and 0x9B
4181  * with embedded sussystem 0x1 and opcodes with external HBDs.
4182  **/
4183 static int
4184 lpfc_bsg_handle_sli_cfg_mbox(struct lpfc_hba *phba, struct bsg_job *job,
4185 			     struct lpfc_dmabuf *dmabuf)
4186 {
4187 	struct lpfc_sli_config_mbox *sli_cfg_mbx;
4188 	uint32_t subsys;
4189 	uint32_t opcode;
4190 	int rc = SLI_CONFIG_NOT_HANDLED;
4191 
4192 	/* state change on new multi-buffer pass-through mailbox command */
4193 	phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_HOST;
4194 
4195 	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)dmabuf->virt;
4196 
4197 	if (!bsg_bf_get(lpfc_mbox_hdr_emb,
4198 	    &sli_cfg_mbx->un.sli_config_emb0_subsys.sli_config_hdr)) {
4199 		subsys = bsg_bf_get(lpfc_emb0_subcmnd_subsys,
4200 				    &sli_cfg_mbx->un.sli_config_emb0_subsys);
4201 		opcode = bsg_bf_get(lpfc_emb0_subcmnd_opcode,
4202 				    &sli_cfg_mbx->un.sli_config_emb0_subsys);
4203 		if (subsys == SLI_CONFIG_SUBSYS_FCOE) {
4204 			switch (opcode) {
4205 			case FCOE_OPCODE_READ_FCF:
4206 			case FCOE_OPCODE_GET_DPORT_RESULTS:
4207 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4208 						"2957 Handled SLI_CONFIG "
4209 						"subsys_fcoe, opcode:x%x\n",
4210 						opcode);
4211 				rc = lpfc_bsg_sli_cfg_read_cmd_ext(phba, job,
4212 							nemb_mse, dmabuf);
4213 				break;
4214 			case FCOE_OPCODE_ADD_FCF:
4215 			case FCOE_OPCODE_SET_DPORT_MODE:
4216 			case LPFC_MBOX_OPCODE_FCOE_LINK_DIAG_STATE:
4217 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4218 						"2958 Handled SLI_CONFIG "
4219 						"subsys_fcoe, opcode:x%x\n",
4220 						opcode);
4221 				rc = lpfc_bsg_sli_cfg_write_cmd_ext(phba, job,
4222 							nemb_mse, dmabuf);
4223 				break;
4224 			default:
4225 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4226 						"2959 Reject SLI_CONFIG "
4227 						"subsys_fcoe, opcode:x%x\n",
4228 						opcode);
4229 				rc = -EPERM;
4230 				break;
4231 			}
4232 		} else if (subsys == SLI_CONFIG_SUBSYS_COMN) {
4233 			switch (opcode) {
4234 			case COMN_OPCODE_GET_CNTL_ADDL_ATTRIBUTES:
4235 			case COMN_OPCODE_GET_CNTL_ATTRIBUTES:
4236 			case COMN_OPCODE_GET_PROFILE_CONFIG:
4237 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4238 						"3106 Handled SLI_CONFIG "
4239 						"subsys_comn, opcode:x%x\n",
4240 						opcode);
4241 				rc = lpfc_bsg_sli_cfg_read_cmd_ext(phba, job,
4242 							nemb_mse, dmabuf);
4243 				break;
4244 			default:
4245 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4246 						"3107 Reject SLI_CONFIG "
4247 						"subsys_comn, opcode:x%x\n",
4248 						opcode);
4249 				rc = -EPERM;
4250 				break;
4251 			}
4252 		} else {
4253 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4254 					"2977 Reject SLI_CONFIG "
4255 					"subsys:x%d, opcode:x%x\n",
4256 					subsys, opcode);
4257 			rc = -EPERM;
4258 		}
4259 	} else {
4260 		subsys = bsg_bf_get(lpfc_emb1_subcmnd_subsys,
4261 				    &sli_cfg_mbx->un.sli_config_emb1_subsys);
4262 		opcode = bsg_bf_get(lpfc_emb1_subcmnd_opcode,
4263 				    &sli_cfg_mbx->un.sli_config_emb1_subsys);
4264 		if (subsys == SLI_CONFIG_SUBSYS_COMN) {
4265 			switch (opcode) {
4266 			case COMN_OPCODE_READ_OBJECT:
4267 			case COMN_OPCODE_READ_OBJECT_LIST:
4268 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4269 						"2960 Handled SLI_CONFIG "
4270 						"subsys_comn, opcode:x%x\n",
4271 						opcode);
4272 				rc = lpfc_bsg_sli_cfg_read_cmd_ext(phba, job,
4273 							nemb_hbd, dmabuf);
4274 				break;
4275 			case COMN_OPCODE_WRITE_OBJECT:
4276 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4277 						"2961 Handled SLI_CONFIG "
4278 						"subsys_comn, opcode:x%x\n",
4279 						opcode);
4280 				rc = lpfc_bsg_sli_cfg_write_cmd_ext(phba, job,
4281 							nemb_hbd, dmabuf);
4282 				break;
4283 			default:
4284 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4285 						"2962 Not handled SLI_CONFIG "
4286 						"subsys_comn, opcode:x%x\n",
4287 						opcode);
4288 				rc = SLI_CONFIG_NOT_HANDLED;
4289 				break;
4290 			}
4291 		} else {
4292 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4293 					"2978 Not handled SLI_CONFIG "
4294 					"subsys:x%d, opcode:x%x\n",
4295 					subsys, opcode);
4296 			rc = SLI_CONFIG_NOT_HANDLED;
4297 		}
4298 	}
4299 
4300 	/* state reset on not handled new multi-buffer mailbox command */
4301 	if (rc != SLI_CONFIG_HANDLED)
4302 		phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_IDLE;
4303 
4304 	return rc;
4305 }
4306 
4307 /**
4308  * lpfc_bsg_mbox_ext_abort_req - request to abort mbox command with ext buffers
4309  * @phba: Pointer to HBA context object.
4310  *
4311  * This routine is for requesting to abort a pass-through mailbox command with
4312  * multiple external buffers due to error condition.
4313  **/
4314 static void
4315 lpfc_bsg_mbox_ext_abort(struct lpfc_hba *phba)
4316 {
4317 	if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_PORT)
4318 		phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_ABTS;
4319 	else
4320 		lpfc_bsg_mbox_ext_session_reset(phba);
4321 	return;
4322 }
4323 
4324 /**
4325  * lpfc_bsg_read_ebuf_get - get the next mailbox read external buffer
4326  * @phba: Pointer to HBA context object.
4327  * @dmabuf: Pointer to a DMA buffer descriptor.
4328  *
4329  * This routine extracts the next mailbox read external buffer back to
4330  * user space through BSG.
4331  **/
4332 static int
4333 lpfc_bsg_read_ebuf_get(struct lpfc_hba *phba, struct bsg_job *job)
4334 {
4335 	struct fc_bsg_reply *bsg_reply = job->reply;
4336 	struct lpfc_sli_config_mbox *sli_cfg_mbx;
4337 	struct lpfc_dmabuf *dmabuf;
4338 	uint8_t *pbuf;
4339 	uint32_t size;
4340 	uint32_t index;
4341 
4342 	index = phba->mbox_ext_buf_ctx.seqNum;
4343 	phba->mbox_ext_buf_ctx.seqNum++;
4344 
4345 	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)
4346 			phba->mbox_ext_buf_ctx.mbx_dmabuf->virt;
4347 
4348 	if (phba->mbox_ext_buf_ctx.nembType == nemb_mse) {
4349 		size = bsg_bf_get(lpfc_mbox_sli_config_mse_len,
4350 			&sli_cfg_mbx->un.sli_config_emb0_subsys.mse[index]);
4351 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4352 				"2963 SLI_CONFIG (mse) ext-buffer rd get "
4353 				"buffer[%d], size:%d\n", index, size);
4354 	} else {
4355 		size = bsg_bf_get(lpfc_mbox_sli_config_ecmn_hbd_len,
4356 			&sli_cfg_mbx->un.sli_config_emb1_subsys.hbd[index]);
4357 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4358 				"2964 SLI_CONFIG (hbd) ext-buffer rd get "
4359 				"buffer[%d], size:%d\n", index, size);
4360 	}
4361 	if (list_empty(&phba->mbox_ext_buf_ctx.ext_dmabuf_list))
4362 		return -EPIPE;
4363 	dmabuf = list_first_entry(&phba->mbox_ext_buf_ctx.ext_dmabuf_list,
4364 				  struct lpfc_dmabuf, list);
4365 	list_del_init(&dmabuf->list);
4366 
4367 	/* after dma buffer descriptor setup */
4368 	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, phba->mbox_ext_buf_ctx.nembType,
4369 					mbox_rd, dma_ebuf, sta_pos_addr,
4370 					dmabuf, index);
4371 
4372 	pbuf = (uint8_t *)dmabuf->virt;
4373 	bsg_reply->reply_payload_rcv_len =
4374 		sg_copy_from_buffer(job->reply_payload.sg_list,
4375 				    job->reply_payload.sg_cnt,
4376 				    pbuf, size);
4377 
4378 	lpfc_bsg_dma_page_free(phba, dmabuf);
4379 
4380 	if (phba->mbox_ext_buf_ctx.seqNum == phba->mbox_ext_buf_ctx.numBuf) {
4381 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4382 				"2965 SLI_CONFIG (hbd) ext-buffer rd mbox "
4383 				"command session done\n");
4384 		lpfc_bsg_mbox_ext_session_reset(phba);
4385 	}
4386 
4387 	bsg_reply->result = 0;
4388 	bsg_job_done(job, bsg_reply->result,
4389 		       bsg_reply->reply_payload_rcv_len);
4390 
4391 	return SLI_CONFIG_HANDLED;
4392 }
4393 
4394 /**
4395  * lpfc_bsg_write_ebuf_set - set the next mailbox write external buffer
4396  * @phba: Pointer to HBA context object.
4397  * @dmabuf: Pointer to a DMA buffer descriptor.
4398  *
4399  * This routine sets up the next mailbox read external buffer obtained
4400  * from user space through BSG.
4401  **/
4402 static int
4403 lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job,
4404 			struct lpfc_dmabuf *dmabuf)
4405 {
4406 	struct fc_bsg_reply *bsg_reply = job->reply;
4407 	struct bsg_job_data *dd_data = NULL;
4408 	LPFC_MBOXQ_t *pmboxq = NULL;
4409 	MAILBOX_t *pmb;
4410 	enum nemb_type nemb_tp;
4411 	uint8_t *pbuf;
4412 	uint32_t size;
4413 	uint32_t index;
4414 	int rc;
4415 
4416 	index = phba->mbox_ext_buf_ctx.seqNum;
4417 	phba->mbox_ext_buf_ctx.seqNum++;
4418 	nemb_tp = phba->mbox_ext_buf_ctx.nembType;
4419 
4420 	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
4421 	if (!dd_data) {
4422 		rc = -ENOMEM;
4423 		goto job_error;
4424 	}
4425 
4426 	pbuf = (uint8_t *)dmabuf->virt;
4427 	size = job->request_payload.payload_len;
4428 	sg_copy_to_buffer(job->request_payload.sg_list,
4429 			  job->request_payload.sg_cnt,
4430 			  pbuf, size);
4431 
4432 	if (phba->mbox_ext_buf_ctx.nembType == nemb_mse) {
4433 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4434 				"2966 SLI_CONFIG (mse) ext-buffer wr set "
4435 				"buffer[%d], size:%d\n",
4436 				phba->mbox_ext_buf_ctx.seqNum, size);
4437 
4438 	} else {
4439 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4440 				"2967 SLI_CONFIG (hbd) ext-buffer wr set "
4441 				"buffer[%d], size:%d\n",
4442 				phba->mbox_ext_buf_ctx.seqNum, size);
4443 
4444 	}
4445 
4446 	/* set up external buffer descriptor and add to external buffer list */
4447 	lpfc_bsg_sli_cfg_dma_desc_setup(phba, nemb_tp, index,
4448 					phba->mbox_ext_buf_ctx.mbx_dmabuf,
4449 					dmabuf);
4450 	list_add_tail(&dmabuf->list, &phba->mbox_ext_buf_ctx.ext_dmabuf_list);
4451 
4452 	/* after write dma buffer */
4453 	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, phba->mbox_ext_buf_ctx.nembType,
4454 					mbox_wr, dma_ebuf, sta_pos_addr,
4455 					dmabuf, index);
4456 
4457 	if (phba->mbox_ext_buf_ctx.seqNum == phba->mbox_ext_buf_ctx.numBuf) {
4458 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4459 				"2968 SLI_CONFIG ext-buffer wr all %d "
4460 				"ebuffers received\n",
4461 				phba->mbox_ext_buf_ctx.numBuf);
4462 		/* mailbox command structure for base driver */
4463 		pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
4464 		if (!pmboxq) {
4465 			rc = -ENOMEM;
4466 			goto job_error;
4467 		}
4468 		memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
4469 		pbuf = (uint8_t *)phba->mbox_ext_buf_ctx.mbx_dmabuf->virt;
4470 		pmb = &pmboxq->u.mb;
4471 		memcpy(pmb, pbuf, sizeof(*pmb));
4472 		pmb->mbxOwner = OWN_HOST;
4473 		pmboxq->vport = phba->pport;
4474 
4475 		/* callback for multi-buffer write mailbox command */
4476 		pmboxq->mbox_cmpl = lpfc_bsg_issue_write_mbox_ext_cmpl;
4477 
4478 		/* context fields to callback function */
4479 		pmboxq->ctx_buf = dd_data;
4480 		dd_data->type = TYPE_MBOX;
4481 		dd_data->set_job = job;
4482 		dd_data->context_un.mbox.pmboxq = pmboxq;
4483 		dd_data->context_un.mbox.mb = (MAILBOX_t *)pbuf;
4484 		job->dd_data = dd_data;
4485 
4486 		/* state change */
4487 		phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_PORT;
4488 
4489 		rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
4490 		if ((rc == MBX_SUCCESS) || (rc == MBX_BUSY)) {
4491 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4492 					"2969 Issued SLI_CONFIG ext-buffer "
4493 					"mailbox command, rc:x%x\n", rc);
4494 			return SLI_CONFIG_HANDLED;
4495 		}
4496 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4497 				"2970 Failed to issue SLI_CONFIG ext-buffer "
4498 				"mailbox command, rc:x%x\n", rc);
4499 		rc = -EPIPE;
4500 		goto job_error;
4501 	}
4502 
4503 	/* wait for additoinal external buffers */
4504 	bsg_reply->result = 0;
4505 	bsg_job_done(job, bsg_reply->result,
4506 		       bsg_reply->reply_payload_rcv_len);
4507 	return SLI_CONFIG_HANDLED;
4508 
4509 job_error:
4510 	lpfc_bsg_dma_page_free(phba, dmabuf);
4511 	kfree(dd_data);
4512 
4513 	return rc;
4514 }
4515 
4516 /**
4517  * lpfc_bsg_handle_sli_cfg_ebuf - handle ext buffer with sli-cfg mailbox cmd
4518  * @phba: Pointer to HBA context object.
4519  * @mb: Pointer to a BSG mailbox object.
4520  * @dmabuff: Pointer to a DMA buffer descriptor.
4521  *
4522  * This routine handles the external buffer with SLI_CONFIG (0x9B) mailbox
4523  * command with multiple non-embedded external buffers.
4524  **/
4525 static int
4526 lpfc_bsg_handle_sli_cfg_ebuf(struct lpfc_hba *phba, struct bsg_job *job,
4527 			     struct lpfc_dmabuf *dmabuf)
4528 {
4529 	int rc;
4530 
4531 	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4532 			"2971 SLI_CONFIG buffer (type:x%x)\n",
4533 			phba->mbox_ext_buf_ctx.mboxType);
4534 
4535 	if (phba->mbox_ext_buf_ctx.mboxType == mbox_rd) {
4536 		if (phba->mbox_ext_buf_ctx.state != LPFC_BSG_MBOX_DONE) {
4537 			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4538 					"2972 SLI_CONFIG rd buffer state "
4539 					"mismatch:x%x\n",
4540 					phba->mbox_ext_buf_ctx.state);
4541 			lpfc_bsg_mbox_ext_abort(phba);
4542 			return -EPIPE;
4543 		}
4544 		rc = lpfc_bsg_read_ebuf_get(phba, job);
4545 		if (rc == SLI_CONFIG_HANDLED)
4546 			lpfc_bsg_dma_page_free(phba, dmabuf);
4547 	} else { /* phba->mbox_ext_buf_ctx.mboxType == mbox_wr */
4548 		if (phba->mbox_ext_buf_ctx.state != LPFC_BSG_MBOX_HOST) {
4549 			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4550 					"2973 SLI_CONFIG wr buffer state "
4551 					"mismatch:x%x\n",
4552 					phba->mbox_ext_buf_ctx.state);
4553 			lpfc_bsg_mbox_ext_abort(phba);
4554 			return -EPIPE;
4555 		}
4556 		rc = lpfc_bsg_write_ebuf_set(phba, job, dmabuf);
4557 	}
4558 	return rc;
4559 }
4560 
4561 /**
4562  * lpfc_bsg_handle_sli_cfg_ext - handle sli-cfg mailbox with external buffer
4563  * @phba: Pointer to HBA context object.
4564  * @mb: Pointer to a BSG mailbox object.
4565  * @dmabuff: Pointer to a DMA buffer descriptor.
4566  *
4567  * This routine checkes and handles non-embedded multi-buffer SLI_CONFIG
4568  * (0x9B) mailbox commands and external buffers.
4569  **/
4570 static int
4571 lpfc_bsg_handle_sli_cfg_ext(struct lpfc_hba *phba, struct bsg_job *job,
4572 			    struct lpfc_dmabuf *dmabuf)
4573 {
4574 	struct fc_bsg_request *bsg_request = job->request;
4575 	struct dfc_mbox_req *mbox_req;
4576 	int rc = SLI_CONFIG_NOT_HANDLED;
4577 
4578 	mbox_req =
4579 	   (struct dfc_mbox_req *)bsg_request->rqst_data.h_vendor.vendor_cmd;
4580 
4581 	/* mbox command with/without single external buffer */
4582 	if (mbox_req->extMboxTag == 0 && mbox_req->extSeqNum == 0)
4583 		return rc;
4584 
4585 	/* mbox command and first external buffer */
4586 	if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_IDLE) {
4587 		if (mbox_req->extSeqNum == 1) {
4588 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4589 					"2974 SLI_CONFIG mailbox: tag:%d, "
4590 					"seq:%d\n", mbox_req->extMboxTag,
4591 					mbox_req->extSeqNum);
4592 			rc = lpfc_bsg_handle_sli_cfg_mbox(phba, job, dmabuf);
4593 			return rc;
4594 		} else
4595 			goto sli_cfg_ext_error;
4596 	}
4597 
4598 	/*
4599 	 * handle additional external buffers
4600 	 */
4601 
4602 	/* check broken pipe conditions */
4603 	if (mbox_req->extMboxTag != phba->mbox_ext_buf_ctx.mbxTag)
4604 		goto sli_cfg_ext_error;
4605 	if (mbox_req->extSeqNum > phba->mbox_ext_buf_ctx.numBuf)
4606 		goto sli_cfg_ext_error;
4607 	if (mbox_req->extSeqNum != phba->mbox_ext_buf_ctx.seqNum + 1)
4608 		goto sli_cfg_ext_error;
4609 
4610 	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4611 			"2975 SLI_CONFIG mailbox external buffer: "
4612 			"extSta:x%x, tag:%d, seq:%d\n",
4613 			phba->mbox_ext_buf_ctx.state, mbox_req->extMboxTag,
4614 			mbox_req->extSeqNum);
4615 	rc = lpfc_bsg_handle_sli_cfg_ebuf(phba, job, dmabuf);
4616 	return rc;
4617 
4618 sli_cfg_ext_error:
4619 	/* all other cases, broken pipe */
4620 	lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4621 			"2976 SLI_CONFIG mailbox broken pipe: "
4622 			"ctxSta:x%x, ctxNumBuf:%d "
4623 			"ctxTag:%d, ctxSeq:%d, tag:%d, seq:%d\n",
4624 			phba->mbox_ext_buf_ctx.state,
4625 			phba->mbox_ext_buf_ctx.numBuf,
4626 			phba->mbox_ext_buf_ctx.mbxTag,
4627 			phba->mbox_ext_buf_ctx.seqNum,
4628 			mbox_req->extMboxTag, mbox_req->extSeqNum);
4629 
4630 	lpfc_bsg_mbox_ext_session_reset(phba);
4631 
4632 	return -EPIPE;
4633 }
4634 
4635 /**
4636  * lpfc_bsg_issue_mbox - issues a mailbox command on behalf of an app
4637  * @phba: Pointer to HBA context object.
4638  * @mb: Pointer to a mailbox object.
4639  * @vport: Pointer to a vport object.
4640  *
4641  * Allocate a tracking object, mailbox command memory, get a mailbox
4642  * from the mailbox pool, copy the caller mailbox command.
4643  *
4644  * If offline and the sli is active we need to poll for the command (port is
4645  * being reset) and com-plete the job, otherwise issue the mailbox command and
4646  * let our completion handler finish the command.
4647  **/
4648 static int
4649 lpfc_bsg_issue_mbox(struct lpfc_hba *phba, struct bsg_job *job,
4650 	struct lpfc_vport *vport)
4651 {
4652 	struct fc_bsg_request *bsg_request = job->request;
4653 	struct fc_bsg_reply *bsg_reply = job->reply;
4654 	LPFC_MBOXQ_t *pmboxq = NULL; /* internal mailbox queue */
4655 	MAILBOX_t *pmb; /* shortcut to the pmboxq mailbox */
4656 	/* a 4k buffer to hold the mb and extended data from/to the bsg */
4657 	uint8_t *pmbx = NULL;
4658 	struct bsg_job_data *dd_data = NULL; /* bsg data tracking structure */
4659 	struct lpfc_dmabuf *dmabuf = NULL;
4660 	struct dfc_mbox_req *mbox_req;
4661 	struct READ_EVENT_LOG_VAR *rdEventLog;
4662 	uint32_t transmit_length, receive_length, mode;
4663 	struct lpfc_mbx_sli4_config *sli4_config;
4664 	struct lpfc_mbx_nembed_cmd *nembed_sge;
4665 	struct ulp_bde64 *bde;
4666 	uint8_t *ext = NULL;
4667 	int rc = 0;
4668 	uint8_t *from;
4669 	uint32_t size;
4670 
4671 	/* in case no data is transferred */
4672 	bsg_reply->reply_payload_rcv_len = 0;
4673 
4674 	/* sanity check to protect driver */
4675 	if (job->reply_payload.payload_len > BSG_MBOX_SIZE ||
4676 	    job->request_payload.payload_len > BSG_MBOX_SIZE) {
4677 		rc = -ERANGE;
4678 		goto job_done;
4679 	}
4680 
4681 	/*
4682 	 * Don't allow mailbox commands to be sent when blocked or when in
4683 	 * the middle of discovery
4684 	 */
4685 	 if (phba->sli.sli_flag & LPFC_BLOCK_MGMT_IO) {
4686 		rc = -EAGAIN;
4687 		goto job_done;
4688 	}
4689 
4690 	mbox_req =
4691 	    (struct dfc_mbox_req *)bsg_request->rqst_data.h_vendor.vendor_cmd;
4692 
4693 	/* check if requested extended data lengths are valid */
4694 	if ((mbox_req->inExtWLen > BSG_MBOX_SIZE/sizeof(uint32_t)) ||
4695 	    (mbox_req->outExtWLen > BSG_MBOX_SIZE/sizeof(uint32_t))) {
4696 		rc = -ERANGE;
4697 		goto job_done;
4698 	}
4699 
4700 	dmabuf = lpfc_bsg_dma_page_alloc(phba);
4701 	if (!dmabuf || !dmabuf->virt) {
4702 		rc = -ENOMEM;
4703 		goto job_done;
4704 	}
4705 
4706 	/* Get the mailbox command or external buffer from BSG */
4707 	pmbx = (uint8_t *)dmabuf->virt;
4708 	size = job->request_payload.payload_len;
4709 	sg_copy_to_buffer(job->request_payload.sg_list,
4710 			  job->request_payload.sg_cnt, pmbx, size);
4711 
4712 	/* Handle possible SLI_CONFIG with non-embedded payloads */
4713 	if (phba->sli_rev == LPFC_SLI_REV4) {
4714 		rc = lpfc_bsg_handle_sli_cfg_ext(phba, job, dmabuf);
4715 		if (rc == SLI_CONFIG_HANDLED)
4716 			goto job_cont;
4717 		if (rc)
4718 			goto job_done;
4719 		/* SLI_CONFIG_NOT_HANDLED for other mailbox commands */
4720 	}
4721 
4722 	rc = lpfc_bsg_check_cmd_access(phba, (MAILBOX_t *)pmbx, vport);
4723 	if (rc != 0)
4724 		goto job_done; /* must be negative */
4725 
4726 	/* allocate our bsg tracking structure */
4727 	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
4728 	if (!dd_data) {
4729 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
4730 				"2727 Failed allocation of dd_data\n");
4731 		rc = -ENOMEM;
4732 		goto job_done;
4733 	}
4734 
4735 	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
4736 	if (!pmboxq) {
4737 		rc = -ENOMEM;
4738 		goto job_done;
4739 	}
4740 	memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
4741 
4742 	pmb = &pmboxq->u.mb;
4743 	memcpy(pmb, pmbx, sizeof(*pmb));
4744 	pmb->mbxOwner = OWN_HOST;
4745 	pmboxq->vport = vport;
4746 
4747 	/* If HBA encountered an error attention, allow only DUMP
4748 	 * or RESTART mailbox commands until the HBA is restarted.
4749 	 */
4750 	if (phba->pport->stopped &&
4751 	    pmb->mbxCommand != MBX_DUMP_MEMORY &&
4752 	    pmb->mbxCommand != MBX_RESTART &&
4753 	    pmb->mbxCommand != MBX_WRITE_VPARMS &&
4754 	    pmb->mbxCommand != MBX_WRITE_WWN)
4755 		lpfc_printf_log(phba, KERN_WARNING, LOG_MBOX,
4756 				"2797 mbox: Issued mailbox cmd "
4757 				"0x%x while in stopped state.\n",
4758 				pmb->mbxCommand);
4759 
4760 	/* extended mailbox commands will need an extended buffer */
4761 	if (mbox_req->inExtWLen || mbox_req->outExtWLen) {
4762 		from = pmbx;
4763 		ext = from + sizeof(MAILBOX_t);
4764 		pmboxq->ctx_buf = ext;
4765 		pmboxq->in_ext_byte_len =
4766 			mbox_req->inExtWLen * sizeof(uint32_t);
4767 		pmboxq->out_ext_byte_len =
4768 			mbox_req->outExtWLen * sizeof(uint32_t);
4769 		pmboxq->mbox_offset_word = mbox_req->mbOffset;
4770 	}
4771 
4772 	/* biu diag will need a kernel buffer to transfer the data
4773 	 * allocate our own buffer and setup the mailbox command to
4774 	 * use ours
4775 	 */
4776 	if (pmb->mbxCommand == MBX_RUN_BIU_DIAG64) {
4777 		transmit_length = pmb->un.varWords[1];
4778 		receive_length = pmb->un.varWords[4];
4779 		/* transmit length cannot be greater than receive length or
4780 		 * mailbox extension size
4781 		 */
4782 		if ((transmit_length > receive_length) ||
4783 			(transmit_length > BSG_MBOX_SIZE - sizeof(MAILBOX_t))) {
4784 			rc = -ERANGE;
4785 			goto job_done;
4786 		}
4787 		pmb->un.varBIUdiag.un.s2.xmit_bde64.addrHigh =
4788 			putPaddrHigh(dmabuf->phys + sizeof(MAILBOX_t));
4789 		pmb->un.varBIUdiag.un.s2.xmit_bde64.addrLow =
4790 			putPaddrLow(dmabuf->phys + sizeof(MAILBOX_t));
4791 
4792 		pmb->un.varBIUdiag.un.s2.rcv_bde64.addrHigh =
4793 			putPaddrHigh(dmabuf->phys + sizeof(MAILBOX_t)
4794 			  + pmb->un.varBIUdiag.un.s2.xmit_bde64.tus.f.bdeSize);
4795 		pmb->un.varBIUdiag.un.s2.rcv_bde64.addrLow =
4796 			putPaddrLow(dmabuf->phys + sizeof(MAILBOX_t)
4797 			  + pmb->un.varBIUdiag.un.s2.xmit_bde64.tus.f.bdeSize);
4798 	} else if (pmb->mbxCommand == MBX_READ_EVENT_LOG) {
4799 		rdEventLog = &pmb->un.varRdEventLog;
4800 		receive_length = rdEventLog->rcv_bde64.tus.f.bdeSize;
4801 		mode = bf_get(lpfc_event_log, rdEventLog);
4802 
4803 		/* receive length cannot be greater than mailbox
4804 		 * extension size
4805 		 */
4806 		if (receive_length > BSG_MBOX_SIZE - sizeof(MAILBOX_t)) {
4807 			rc = -ERANGE;
4808 			goto job_done;
4809 		}
4810 
4811 		/* mode zero uses a bde like biu diags command */
4812 		if (mode == 0) {
4813 			pmb->un.varWords[3] = putPaddrLow(dmabuf->phys
4814 							+ sizeof(MAILBOX_t));
4815 			pmb->un.varWords[4] = putPaddrHigh(dmabuf->phys
4816 							+ sizeof(MAILBOX_t));
4817 		}
4818 	} else if (phba->sli_rev == LPFC_SLI_REV4) {
4819 		/* Let type 4 (well known data) through because the data is
4820 		 * returned in varwords[4-8]
4821 		 * otherwise check the recieve length and fetch the buffer addr
4822 		 */
4823 		if ((pmb->mbxCommand == MBX_DUMP_MEMORY) &&
4824 			(pmb->un.varDmp.type != DMP_WELL_KNOWN)) {
4825 			/* rebuild the command for sli4 using our own buffers
4826 			* like we do for biu diags
4827 			*/
4828 			receive_length = pmb->un.varWords[2];
4829 			/* receive length cannot be greater than mailbox
4830 			 * extension size
4831 			 */
4832 			if (receive_length == 0) {
4833 				rc = -ERANGE;
4834 				goto job_done;
4835 			}
4836 			pmb->un.varWords[3] = putPaddrLow(dmabuf->phys
4837 						+ sizeof(MAILBOX_t));
4838 			pmb->un.varWords[4] = putPaddrHigh(dmabuf->phys
4839 						+ sizeof(MAILBOX_t));
4840 		} else if ((pmb->mbxCommand == MBX_UPDATE_CFG) &&
4841 			pmb->un.varUpdateCfg.co) {
4842 			bde = (struct ulp_bde64 *)&pmb->un.varWords[4];
4843 
4844 			/* bde size cannot be greater than mailbox ext size */
4845 			if (bde->tus.f.bdeSize >
4846 			    BSG_MBOX_SIZE - sizeof(MAILBOX_t)) {
4847 				rc = -ERANGE;
4848 				goto job_done;
4849 			}
4850 			bde->addrHigh = putPaddrHigh(dmabuf->phys
4851 						+ sizeof(MAILBOX_t));
4852 			bde->addrLow = putPaddrLow(dmabuf->phys
4853 						+ sizeof(MAILBOX_t));
4854 		} else if (pmb->mbxCommand == MBX_SLI4_CONFIG) {
4855 			/* Handling non-embedded SLI_CONFIG mailbox command */
4856 			sli4_config = &pmboxq->u.mqe.un.sli4_config;
4857 			if (!bf_get(lpfc_mbox_hdr_emb,
4858 			    &sli4_config->header.cfg_mhdr)) {
4859 				/* rebuild the command for sli4 using our
4860 				 * own buffers like we do for biu diags
4861 				 */
4862 				nembed_sge = (struct lpfc_mbx_nembed_cmd *)
4863 						&pmb->un.varWords[0];
4864 				receive_length = nembed_sge->sge[0].length;
4865 
4866 				/* receive length cannot be greater than
4867 				 * mailbox extension size
4868 				 */
4869 				if ((receive_length == 0) ||
4870 				    (receive_length >
4871 				     BSG_MBOX_SIZE - sizeof(MAILBOX_t))) {
4872 					rc = -ERANGE;
4873 					goto job_done;
4874 				}
4875 
4876 				nembed_sge->sge[0].pa_hi =
4877 						putPaddrHigh(dmabuf->phys
4878 						   + sizeof(MAILBOX_t));
4879 				nembed_sge->sge[0].pa_lo =
4880 						putPaddrLow(dmabuf->phys
4881 						   + sizeof(MAILBOX_t));
4882 			}
4883 		}
4884 	}
4885 
4886 	dd_data->context_un.mbox.dmabuffers = dmabuf;
4887 
4888 	/* setup wake call as IOCB callback */
4889 	pmboxq->mbox_cmpl = lpfc_bsg_issue_mbox_cmpl;
4890 
4891 	/* setup context field to pass wait_queue pointer to wake function */
4892 	pmboxq->ctx_ndlp = dd_data;
4893 	dd_data->type = TYPE_MBOX;
4894 	dd_data->set_job = job;
4895 	dd_data->context_un.mbox.pmboxq = pmboxq;
4896 	dd_data->context_un.mbox.mb = (MAILBOX_t *)pmbx;
4897 	dd_data->context_un.mbox.ext = ext;
4898 	dd_data->context_un.mbox.mbOffset = mbox_req->mbOffset;
4899 	dd_data->context_un.mbox.inExtWLen = mbox_req->inExtWLen;
4900 	dd_data->context_un.mbox.outExtWLen = mbox_req->outExtWLen;
4901 	job->dd_data = dd_data;
4902 
4903 	if ((vport->fc_flag & FC_OFFLINE_MODE) ||
4904 	    (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))) {
4905 		rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_POLL);
4906 		if (rc != MBX_SUCCESS) {
4907 			rc = (rc == MBX_TIMEOUT) ? -ETIME : -ENODEV;
4908 			goto job_done;
4909 		}
4910 
4911 		/* job finished, copy the data */
4912 		memcpy(pmbx, pmb, sizeof(*pmb));
4913 		bsg_reply->reply_payload_rcv_len =
4914 			sg_copy_from_buffer(job->reply_payload.sg_list,
4915 					    job->reply_payload.sg_cnt,
4916 					    pmbx, size);
4917 		/* not waiting mbox already done */
4918 		rc = 0;
4919 		goto job_done;
4920 	}
4921 
4922 	rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
4923 	if ((rc == MBX_SUCCESS) || (rc == MBX_BUSY))
4924 		return 1; /* job started */
4925 
4926 job_done:
4927 	/* common exit for error or job completed inline */
4928 	if (pmboxq)
4929 		mempool_free(pmboxq, phba->mbox_mem_pool);
4930 	lpfc_bsg_dma_page_free(phba, dmabuf);
4931 	kfree(dd_data);
4932 
4933 job_cont:
4934 	return rc;
4935 }
4936 
4937 /**
4938  * lpfc_bsg_mbox_cmd - process an fc bsg LPFC_BSG_VENDOR_MBOX command
4939  * @job: MBOX fc_bsg_job for LPFC_BSG_VENDOR_MBOX.
4940  **/
4941 static int
4942 lpfc_bsg_mbox_cmd(struct bsg_job *job)
4943 {
4944 	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
4945 	struct fc_bsg_request *bsg_request = job->request;
4946 	struct fc_bsg_reply *bsg_reply = job->reply;
4947 	struct lpfc_hba *phba = vport->phba;
4948 	struct dfc_mbox_req *mbox_req;
4949 	int rc = 0;
4950 
4951 	/* mix-and-match backward compatibility */
4952 	bsg_reply->reply_payload_rcv_len = 0;
4953 	if (job->request_len <
4954 	    sizeof(struct fc_bsg_request) + sizeof(struct dfc_mbox_req)) {
4955 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4956 				"2737 Mix-and-match backward compatibility "
4957 				"between MBOX_REQ old size:%d and "
4958 				"new request size:%d\n",
4959 				(int)(job->request_len -
4960 				      sizeof(struct fc_bsg_request)),
4961 				(int)sizeof(struct dfc_mbox_req));
4962 		mbox_req = (struct dfc_mbox_req *)
4963 				bsg_request->rqst_data.h_vendor.vendor_cmd;
4964 		mbox_req->extMboxTag = 0;
4965 		mbox_req->extSeqNum = 0;
4966 	}
4967 
4968 	rc = lpfc_bsg_issue_mbox(phba, job, vport);
4969 
4970 	if (rc == 0) {
4971 		/* job done */
4972 		bsg_reply->result = 0;
4973 		job->dd_data = NULL;
4974 		bsg_job_done(job, bsg_reply->result,
4975 			       bsg_reply->reply_payload_rcv_len);
4976 	} else if (rc == 1)
4977 		/* job submitted, will complete later*/
4978 		rc = 0; /* return zero, no error */
4979 	else {
4980 		/* some error occurred */
4981 		bsg_reply->result = rc;
4982 		job->dd_data = NULL;
4983 	}
4984 
4985 	return rc;
4986 }
4987 
4988 /**
4989  * lpfc_bsg_menlo_cmd_cmp - lpfc_menlo_cmd completion handler
4990  * @phba: Pointer to HBA context object.
4991  * @cmdiocbq: Pointer to command iocb.
4992  * @rspiocbq: Pointer to response iocb.
4993  *
4994  * This function is the completion handler for iocbs issued using
4995  * lpfc_menlo_cmd function. This function is called by the
4996  * ring event handler function without any lock held. This function
4997  * can be called from both worker thread context and interrupt
4998  * context. This function also can be called from another thread which
4999  * cleans up the SLI layer objects.
5000  * This function copies the contents of the response iocb to the
5001  * response iocb memory object provided by the caller of
5002  * lpfc_sli_issue_iocb_wait and then wakes up the thread which
5003  * sleeps for the iocb completion.
5004  **/
5005 static void
5006 lpfc_bsg_menlo_cmd_cmp(struct lpfc_hba *phba,
5007 			struct lpfc_iocbq *cmdiocbq,
5008 			struct lpfc_iocbq *rspiocbq)
5009 {
5010 	struct bsg_job_data *dd_data;
5011 	struct bsg_job *job;
5012 	struct fc_bsg_reply *bsg_reply;
5013 	IOCB_t *rsp;
5014 	struct lpfc_dmabuf *bmp, *cmp, *rmp;
5015 	struct lpfc_bsg_menlo *menlo;
5016 	unsigned long flags;
5017 	struct menlo_response *menlo_resp;
5018 	unsigned int rsp_size;
5019 	int rc = 0;
5020 
5021 	dd_data = cmdiocbq->context1;
5022 	cmp = cmdiocbq->context2;
5023 	bmp = cmdiocbq->context3;
5024 	menlo = &dd_data->context_un.menlo;
5025 	rmp = menlo->rmp;
5026 	rsp = &rspiocbq->iocb;
5027 
5028 	/* Determine if job has been aborted */
5029 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
5030 	job = dd_data->set_job;
5031 	if (job) {
5032 		bsg_reply = job->reply;
5033 		/* Prevent timeout handling from trying to abort job  */
5034 		job->dd_data = NULL;
5035 	}
5036 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5037 
5038 	/* Copy the job data or set the failing status for the job */
5039 
5040 	if (job) {
5041 		/* always return the xri, this would be used in the case
5042 		 * of a menlo download to allow the data to be sent as a
5043 		 * continuation of the exchange.
5044 		 */
5045 
5046 		menlo_resp = (struct menlo_response *)
5047 			bsg_reply->reply_data.vendor_reply.vendor_rsp;
5048 		menlo_resp->xri = rsp->ulpContext;
5049 		if (rsp->ulpStatus) {
5050 			if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
5051 				switch (rsp->un.ulpWord[4] & IOERR_PARAM_MASK) {
5052 				case IOERR_SEQUENCE_TIMEOUT:
5053 					rc = -ETIMEDOUT;
5054 					break;
5055 				case IOERR_INVALID_RPI:
5056 					rc = -EFAULT;
5057 					break;
5058 				default:
5059 					rc = -EACCES;
5060 					break;
5061 				}
5062 			} else {
5063 				rc = -EACCES;
5064 			}
5065 		} else {
5066 			rsp_size = rsp->un.genreq64.bdl.bdeSize;
5067 			bsg_reply->reply_payload_rcv_len =
5068 				lpfc_bsg_copy_data(rmp, &job->reply_payload,
5069 						   rsp_size, 0);
5070 		}
5071 
5072 	}
5073 
5074 	lpfc_sli_release_iocbq(phba, cmdiocbq);
5075 	lpfc_free_bsg_buffers(phba, cmp);
5076 	lpfc_free_bsg_buffers(phba, rmp);
5077 	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
5078 	kfree(bmp);
5079 	kfree(dd_data);
5080 
5081 	/* Complete the job if active */
5082 
5083 	if (job) {
5084 		bsg_reply->result = rc;
5085 		bsg_job_done(job, bsg_reply->result,
5086 			       bsg_reply->reply_payload_rcv_len);
5087 	}
5088 
5089 	return;
5090 }
5091 
5092 /**
5093  * lpfc_menlo_cmd - send an ioctl for menlo hardware
5094  * @job: fc_bsg_job to handle
5095  *
5096  * This function issues a gen request 64 CR ioctl for all menlo cmd requests,
5097  * all the command completions will return the xri for the command.
5098  * For menlo data requests a gen request 64 CX is used to continue the exchange
5099  * supplied in the menlo request header xri field.
5100  **/
5101 static int
5102 lpfc_menlo_cmd(struct bsg_job *job)
5103 {
5104 	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
5105 	struct fc_bsg_request *bsg_request = job->request;
5106 	struct fc_bsg_reply *bsg_reply = job->reply;
5107 	struct lpfc_hba *phba = vport->phba;
5108 	struct lpfc_iocbq *cmdiocbq;
5109 	IOCB_t *cmd;
5110 	int rc = 0;
5111 	struct menlo_command *menlo_cmd;
5112 	struct lpfc_dmabuf *bmp = NULL, *cmp = NULL, *rmp = NULL;
5113 	int request_nseg;
5114 	int reply_nseg;
5115 	struct bsg_job_data *dd_data;
5116 	struct ulp_bde64 *bpl = NULL;
5117 
5118 	/* in case no data is returned return just the return code */
5119 	bsg_reply->reply_payload_rcv_len = 0;
5120 
5121 	if (job->request_len <
5122 	    sizeof(struct fc_bsg_request) +
5123 		sizeof(struct menlo_command)) {
5124 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
5125 				"2784 Received MENLO_CMD request below "
5126 				"minimum size\n");
5127 		rc = -ERANGE;
5128 		goto no_dd_data;
5129 	}
5130 
5131 	if (job->reply_len <
5132 	    sizeof(struct fc_bsg_request) + sizeof(struct menlo_response)) {
5133 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
5134 				"2785 Received MENLO_CMD reply below "
5135 				"minimum size\n");
5136 		rc = -ERANGE;
5137 		goto no_dd_data;
5138 	}
5139 
5140 	if (!(phba->menlo_flag & HBA_MENLO_SUPPORT)) {
5141 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
5142 				"2786 Adapter does not support menlo "
5143 				"commands\n");
5144 		rc = -EPERM;
5145 		goto no_dd_data;
5146 	}
5147 
5148 	menlo_cmd = (struct menlo_command *)
5149 		bsg_request->rqst_data.h_vendor.vendor_cmd;
5150 
5151 	/* allocate our bsg tracking structure */
5152 	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
5153 	if (!dd_data) {
5154 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
5155 				"2787 Failed allocation of dd_data\n");
5156 		rc = -ENOMEM;
5157 		goto no_dd_data;
5158 	}
5159 
5160 	bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
5161 	if (!bmp) {
5162 		rc = -ENOMEM;
5163 		goto free_dd;
5164 	}
5165 
5166 	bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
5167 	if (!bmp->virt) {
5168 		rc = -ENOMEM;
5169 		goto free_bmp;
5170 	}
5171 
5172 	INIT_LIST_HEAD(&bmp->list);
5173 
5174 	bpl = (struct ulp_bde64 *)bmp->virt;
5175 	request_nseg = LPFC_BPL_SIZE/sizeof(struct ulp_bde64);
5176 	cmp = lpfc_alloc_bsg_buffers(phba, job->request_payload.payload_len,
5177 				     1, bpl, &request_nseg);
5178 	if (!cmp) {
5179 		rc = -ENOMEM;
5180 		goto free_bmp;
5181 	}
5182 	lpfc_bsg_copy_data(cmp, &job->request_payload,
5183 			   job->request_payload.payload_len, 1);
5184 
5185 	bpl += request_nseg;
5186 	reply_nseg = LPFC_BPL_SIZE/sizeof(struct ulp_bde64) - request_nseg;
5187 	rmp = lpfc_alloc_bsg_buffers(phba, job->reply_payload.payload_len, 0,
5188 				     bpl, &reply_nseg);
5189 	if (!rmp) {
5190 		rc = -ENOMEM;
5191 		goto free_cmp;
5192 	}
5193 
5194 	cmdiocbq = lpfc_sli_get_iocbq(phba);
5195 	if (!cmdiocbq) {
5196 		rc = -ENOMEM;
5197 		goto free_rmp;
5198 	}
5199 
5200 	cmd = &cmdiocbq->iocb;
5201 	cmd->un.genreq64.bdl.ulpIoTag32 = 0;
5202 	cmd->un.genreq64.bdl.addrHigh = putPaddrHigh(bmp->phys);
5203 	cmd->un.genreq64.bdl.addrLow = putPaddrLow(bmp->phys);
5204 	cmd->un.genreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
5205 	cmd->un.genreq64.bdl.bdeSize =
5206 	    (request_nseg + reply_nseg) * sizeof(struct ulp_bde64);
5207 	cmd->un.genreq64.w5.hcsw.Fctl = (SI | LA);
5208 	cmd->un.genreq64.w5.hcsw.Dfctl = 0;
5209 	cmd->un.genreq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CMD;
5210 	cmd->un.genreq64.w5.hcsw.Type = MENLO_TRANSPORT_TYPE; /* 0xfe */
5211 	cmd->ulpBdeCount = 1;
5212 	cmd->ulpClass = CLASS3;
5213 	cmd->ulpOwner = OWN_CHIP;
5214 	cmd->ulpLe = 1; /* Limited Edition */
5215 	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
5216 	cmdiocbq->vport = phba->pport;
5217 	/* We want the firmware to timeout before we do */
5218 	cmd->ulpTimeout = MENLO_TIMEOUT - 5;
5219 	cmdiocbq->iocb_cmpl = lpfc_bsg_menlo_cmd_cmp;
5220 	cmdiocbq->context1 = dd_data;
5221 	cmdiocbq->context2 = cmp;
5222 	cmdiocbq->context3 = bmp;
5223 	if (menlo_cmd->cmd == LPFC_BSG_VENDOR_MENLO_CMD) {
5224 		cmd->ulpCommand = CMD_GEN_REQUEST64_CR;
5225 		cmd->ulpPU = MENLO_PU; /* 3 */
5226 		cmd->un.ulpWord[4] = MENLO_DID; /* 0x0000FC0E */
5227 		cmd->ulpContext = MENLO_CONTEXT; /* 0 */
5228 	} else {
5229 		cmd->ulpCommand = CMD_GEN_REQUEST64_CX;
5230 		cmd->ulpPU = 1;
5231 		cmd->un.ulpWord[4] = 0;
5232 		cmd->ulpContext = menlo_cmd->xri;
5233 	}
5234 
5235 	dd_data->type = TYPE_MENLO;
5236 	dd_data->set_job = job;
5237 	dd_data->context_un.menlo.cmdiocbq = cmdiocbq;
5238 	dd_data->context_un.menlo.rmp = rmp;
5239 	job->dd_data = dd_data;
5240 
5241 	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq,
5242 		MENLO_TIMEOUT - 5);
5243 	if (rc == IOCB_SUCCESS)
5244 		return 0; /* done for now */
5245 
5246 	lpfc_sli_release_iocbq(phba, cmdiocbq);
5247 
5248 free_rmp:
5249 	lpfc_free_bsg_buffers(phba, rmp);
5250 free_cmp:
5251 	lpfc_free_bsg_buffers(phba, cmp);
5252 free_bmp:
5253 	if (bmp->virt)
5254 		lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
5255 	kfree(bmp);
5256 free_dd:
5257 	kfree(dd_data);
5258 no_dd_data:
5259 	/* make error code available to userspace */
5260 	bsg_reply->result = rc;
5261 	job->dd_data = NULL;
5262 	return rc;
5263 }
5264 
5265 static int
5266 lpfc_forced_link_speed(struct bsg_job *job)
5267 {
5268 	struct Scsi_Host *shost = fc_bsg_to_shost(job);
5269 	struct lpfc_vport *vport = shost_priv(shost);
5270 	struct lpfc_hba *phba = vport->phba;
5271 	struct fc_bsg_reply *bsg_reply = job->reply;
5272 	struct forced_link_speed_support_reply *forced_reply;
5273 	int rc = 0;
5274 
5275 	if (job->request_len <
5276 	    sizeof(struct fc_bsg_request) +
5277 	    sizeof(struct get_forced_link_speed_support)) {
5278 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
5279 				"0048 Received FORCED_LINK_SPEED request "
5280 				"below minimum size\n");
5281 		rc = -EINVAL;
5282 		goto job_error;
5283 	}
5284 
5285 	forced_reply = (struct forced_link_speed_support_reply *)
5286 		bsg_reply->reply_data.vendor_reply.vendor_rsp;
5287 
5288 	if (job->reply_len <
5289 	    sizeof(struct fc_bsg_request) +
5290 	    sizeof(struct forced_link_speed_support_reply)) {
5291 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
5292 				"0049 Received FORCED_LINK_SPEED reply below "
5293 				"minimum size\n");
5294 		rc = -EINVAL;
5295 		goto job_error;
5296 	}
5297 
5298 	forced_reply->supported = (phba->hba_flag & HBA_FORCED_LINK_SPEED)
5299 				   ? LPFC_FORCED_LINK_SPEED_SUPPORTED
5300 				   : LPFC_FORCED_LINK_SPEED_NOT_SUPPORTED;
5301 job_error:
5302 	bsg_reply->result = rc;
5303 	if (rc == 0)
5304 		bsg_job_done(job, bsg_reply->result,
5305 			       bsg_reply->reply_payload_rcv_len);
5306 	return rc;
5307 }
5308 
5309 /**
5310  * lpfc_check_fwlog_support: Check FW log support on the adapter
5311  * @phba: Pointer to HBA context object.
5312  *
5313  * Check if FW Logging support by the adapter
5314  **/
5315 int
5316 lpfc_check_fwlog_support(struct lpfc_hba *phba)
5317 {
5318 	struct lpfc_ras_fwlog *ras_fwlog = NULL;
5319 
5320 	ras_fwlog = &phba->ras_fwlog;
5321 
5322 	if (ras_fwlog->ras_hwsupport == false)
5323 		return -EACCES;
5324 	else if (ras_fwlog->ras_enabled == false)
5325 		return -EPERM;
5326 	else
5327 		return 0;
5328 }
5329 
5330 /**
5331  * lpfc_bsg_get_ras_config: Get RAS configuration settings
5332  * @job: fc_bsg_job to handle
5333  *
5334  * Get RAS configuration values set.
5335  **/
5336 static int
5337 lpfc_bsg_get_ras_config(struct bsg_job *job)
5338 {
5339 	struct Scsi_Host *shost = fc_bsg_to_shost(job);
5340 	struct lpfc_vport *vport = shost_priv(shost);
5341 	struct fc_bsg_reply *bsg_reply = job->reply;
5342 	struct lpfc_hba *phba = vport->phba;
5343 	struct lpfc_bsg_get_ras_config_reply *ras_reply;
5344 	struct lpfc_ras_fwlog *ras_fwlog = &phba->ras_fwlog;
5345 	int rc = 0;
5346 
5347 	if (job->request_len <
5348 	    sizeof(struct fc_bsg_request) +
5349 	    sizeof(struct lpfc_bsg_ras_req)) {
5350 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
5351 				"6192 FW_LOG request received "
5352 				"below minimum size\n");
5353 		rc = -EINVAL;
5354 		goto ras_job_error;
5355 	}
5356 
5357 	/* Check FW log status */
5358 	rc = lpfc_check_fwlog_support(phba);
5359 	if (rc)
5360 		goto ras_job_error;
5361 
5362 	ras_reply = (struct lpfc_bsg_get_ras_config_reply *)
5363 		bsg_reply->reply_data.vendor_reply.vendor_rsp;
5364 
5365 	/* Current logging state */
5366 	if (ras_fwlog->ras_active == true)
5367 		ras_reply->state = LPFC_RASLOG_STATE_RUNNING;
5368 	else
5369 		ras_reply->state = LPFC_RASLOG_STATE_STOPPED;
5370 
5371 	ras_reply->log_level = phba->ras_fwlog.fw_loglevel;
5372 	ras_reply->log_buff_sz = phba->cfg_ras_fwlog_buffsize;
5373 
5374 ras_job_error:
5375 	/* make error code available to userspace */
5376 	bsg_reply->result = rc;
5377 
5378 	/* complete the job back to userspace */
5379 	bsg_job_done(job, bsg_reply->result, bsg_reply->reply_payload_rcv_len);
5380 	return rc;
5381 }
5382 
5383 /**
5384  * lpfc_bsg_set_ras_config: Set FW logging parameters
5385  * @job: fc_bsg_job to handle
5386  *
5387  * Set log-level parameters for FW-logging in host memory
5388  **/
5389 static int
5390 lpfc_bsg_set_ras_config(struct bsg_job *job)
5391 {
5392 	struct Scsi_Host *shost = fc_bsg_to_shost(job);
5393 	struct lpfc_vport *vport = shost_priv(shost);
5394 	struct lpfc_hba *phba = vport->phba;
5395 	struct lpfc_bsg_set_ras_config_req *ras_req;
5396 	struct fc_bsg_request *bsg_request = job->request;
5397 	struct lpfc_ras_fwlog *ras_fwlog = &phba->ras_fwlog;
5398 	struct fc_bsg_reply *bsg_reply = job->reply;
5399 	uint8_t action = 0, log_level = 0;
5400 	int rc = 0, action_status = 0;
5401 
5402 	if (job->request_len <
5403 	    sizeof(struct fc_bsg_request) +
5404 	    sizeof(struct lpfc_bsg_set_ras_config_req)) {
5405 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
5406 				"6182 Received RAS_LOG request "
5407 				"below minimum size\n");
5408 		rc = -EINVAL;
5409 		goto ras_job_error;
5410 	}
5411 
5412 	/* Check FW log status */
5413 	rc = lpfc_check_fwlog_support(phba);
5414 	if (rc)
5415 		goto ras_job_error;
5416 
5417 	ras_req = (struct lpfc_bsg_set_ras_config_req *)
5418 		bsg_request->rqst_data.h_vendor.vendor_cmd;
5419 	action = ras_req->action;
5420 	log_level = ras_req->log_level;
5421 
5422 	if (action == LPFC_RASACTION_STOP_LOGGING) {
5423 		/* Check if already disabled */
5424 		if (ras_fwlog->ras_active == false) {
5425 			rc = -ESRCH;
5426 			goto ras_job_error;
5427 		}
5428 
5429 		/* Disable logging */
5430 		lpfc_ras_stop_fwlog(phba);
5431 	} else {
5432 		/*action = LPFC_RASACTION_START_LOGGING*/
5433 
5434 		/* Even though FW-logging is active re-initialize
5435 		 * FW-logging with new log-level. Return status
5436 		 * "Logging already Running" to caller.
5437 		 **/
5438 		if (ras_fwlog->ras_active)
5439 			action_status = -EINPROGRESS;
5440 
5441 		/* Enable logging */
5442 		rc = lpfc_sli4_ras_fwlog_init(phba, log_level,
5443 					      LPFC_RAS_ENABLE_LOGGING);
5444 		if (rc) {
5445 			rc = -EINVAL;
5446 			goto ras_job_error;
5447 		}
5448 
5449 		/* Check if FW-logging is re-initialized */
5450 		if (action_status == -EINPROGRESS)
5451 			rc = action_status;
5452 	}
5453 ras_job_error:
5454 	/* make error code available to userspace */
5455 	bsg_reply->result = rc;
5456 
5457 	/* complete the job back to userspace */
5458 	bsg_job_done(job, bsg_reply->result,
5459 		       bsg_reply->reply_payload_rcv_len);
5460 
5461 	return rc;
5462 }
5463 
5464 /**
5465  * lpfc_bsg_get_ras_lwpd: Get log write position data
5466  * @job: fc_bsg_job to handle
5467  *
5468  * Get Offset/Wrap count of the log message written
5469  * in host memory
5470  **/
5471 static int
5472 lpfc_bsg_get_ras_lwpd(struct bsg_job *job)
5473 {
5474 	struct Scsi_Host *shost = fc_bsg_to_shost(job);
5475 	struct lpfc_vport *vport = shost_priv(shost);
5476 	struct lpfc_bsg_get_ras_lwpd *ras_reply;
5477 	struct lpfc_hba *phba = vport->phba;
5478 	struct lpfc_ras_fwlog *ras_fwlog = &phba->ras_fwlog;
5479 	struct fc_bsg_reply *bsg_reply = job->reply;
5480 	u32 *lwpd_ptr = NULL;
5481 	int rc = 0;
5482 
5483 	rc = lpfc_check_fwlog_support(phba);
5484 	if (rc)
5485 		goto ras_job_error;
5486 
5487 	if (job->request_len <
5488 	    sizeof(struct fc_bsg_request) +
5489 	    sizeof(struct lpfc_bsg_ras_req)) {
5490 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
5491 				"6183 Received RAS_LOG request "
5492 				"below minimum size\n");
5493 		rc = -EINVAL;
5494 		goto ras_job_error;
5495 	}
5496 
5497 	ras_reply = (struct lpfc_bsg_get_ras_lwpd *)
5498 		bsg_reply->reply_data.vendor_reply.vendor_rsp;
5499 
5500 	if (!ras_fwlog->lwpd.virt) {
5501 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
5502 				"6193 Restart FW Logging\n");
5503 		rc = -EINVAL;
5504 		goto ras_job_error;
5505 	}
5506 
5507 	/* Get lwpd offset */
5508 	lwpd_ptr = (uint32_t *)(ras_fwlog->lwpd.virt);
5509 	ras_reply->offset = be32_to_cpu(*lwpd_ptr & 0xffffffff);
5510 
5511 	/* Get wrap count */
5512 	ras_reply->wrap_count = be32_to_cpu(*(++lwpd_ptr) & 0xffffffff);
5513 
5514 ras_job_error:
5515 	/* make error code available to userspace */
5516 	bsg_reply->result = rc;
5517 
5518 	/* complete the job back to userspace */
5519 	bsg_job_done(job, bsg_reply->result, bsg_reply->reply_payload_rcv_len);
5520 
5521 	return rc;
5522 }
5523 
5524 /**
5525  * lpfc_bsg_get_ras_fwlog: Read FW log
5526  * @job: fc_bsg_job to handle
5527  *
5528  * Copy the FW log into the passed buffer.
5529  **/
5530 static int
5531 lpfc_bsg_get_ras_fwlog(struct bsg_job *job)
5532 {
5533 	struct Scsi_Host *shost = fc_bsg_to_shost(job);
5534 	struct lpfc_vport *vport = shost_priv(shost);
5535 	struct lpfc_hba *phba = vport->phba;
5536 	struct fc_bsg_request *bsg_request = job->request;
5537 	struct fc_bsg_reply *bsg_reply = job->reply;
5538 	struct lpfc_bsg_get_fwlog_req *ras_req;
5539 	u32 rd_offset, rd_index, offset;
5540 	void *src, *fwlog_buff;
5541 	struct lpfc_ras_fwlog *ras_fwlog = NULL;
5542 	struct lpfc_dmabuf *dmabuf, *next;
5543 	int rc = 0;
5544 
5545 	ras_fwlog = &phba->ras_fwlog;
5546 
5547 	rc = lpfc_check_fwlog_support(phba);
5548 	if (rc)
5549 		goto ras_job_error;
5550 
5551 	/* Logging to be stopped before reading */
5552 	if (ras_fwlog->ras_active == true) {
5553 		rc = -EINPROGRESS;
5554 		goto ras_job_error;
5555 	}
5556 
5557 	if (job->request_len <
5558 	    sizeof(struct fc_bsg_request) +
5559 	    sizeof(struct lpfc_bsg_get_fwlog_req)) {
5560 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
5561 				"6184 Received RAS_LOG request "
5562 				"below minimum size\n");
5563 		rc = -EINVAL;
5564 		goto ras_job_error;
5565 	}
5566 
5567 	ras_req = (struct lpfc_bsg_get_fwlog_req *)
5568 		bsg_request->rqst_data.h_vendor.vendor_cmd;
5569 	rd_offset = ras_req->read_offset;
5570 
5571 	/* Allocate memory to read fw log*/
5572 	fwlog_buff = vmalloc(ras_req->read_size);
5573 	if (!fwlog_buff) {
5574 		rc = -ENOMEM;
5575 		goto ras_job_error;
5576 	}
5577 
5578 	rd_index = (rd_offset / LPFC_RAS_MAX_ENTRY_SIZE);
5579 	offset = (rd_offset % LPFC_RAS_MAX_ENTRY_SIZE);
5580 
5581 	list_for_each_entry_safe(dmabuf, next,
5582 			      &ras_fwlog->fwlog_buff_list, list) {
5583 
5584 		if (dmabuf->buffer_tag < rd_index)
5585 			continue;
5586 
5587 		src = dmabuf->virt + offset;
5588 		memcpy(fwlog_buff, src, ras_req->read_size);
5589 		break;
5590 	}
5591 
5592 	bsg_reply->reply_payload_rcv_len =
5593 		sg_copy_from_buffer(job->reply_payload.sg_list,
5594 				    job->reply_payload.sg_cnt,
5595 				    fwlog_buff, ras_req->read_size);
5596 
5597 	vfree(fwlog_buff);
5598 
5599 ras_job_error:
5600 	bsg_reply->result = rc;
5601 	bsg_job_done(job, bsg_reply->result, bsg_reply->reply_payload_rcv_len);
5602 
5603 	return rc;
5604 }
5605 
5606 static int
5607 lpfc_get_trunk_info(struct bsg_job *job)
5608 {
5609 	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
5610 	struct lpfc_hba *phba = vport->phba;
5611 	struct fc_bsg_reply *bsg_reply = job->reply;
5612 	struct lpfc_trunk_info *event_reply;
5613 	int rc = 0;
5614 
5615 	if (job->request_len <
5616 	    sizeof(struct fc_bsg_request) + sizeof(struct get_trunk_info_req)) {
5617 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
5618 				"2744 Received GET TRUNK _INFO request below "
5619 				"minimum size\n");
5620 		rc = -EINVAL;
5621 		goto job_error;
5622 	}
5623 
5624 	event_reply = (struct lpfc_trunk_info *)
5625 		bsg_reply->reply_data.vendor_reply.vendor_rsp;
5626 
5627 	if (job->reply_len <
5628 	    sizeof(struct fc_bsg_request) + sizeof(struct lpfc_trunk_info)) {
5629 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
5630 				"2728 Received GET TRUNK _INFO reply below "
5631 				"minimum size\n");
5632 		rc = -EINVAL;
5633 		goto job_error;
5634 	}
5635 	if (event_reply == NULL) {
5636 		rc = -EINVAL;
5637 		goto job_error;
5638 	}
5639 
5640 	bsg_bf_set(lpfc_trunk_info_link_status, event_reply,
5641 		   (phba->link_state >= LPFC_LINK_UP) ? 1 : 0);
5642 
5643 	bsg_bf_set(lpfc_trunk_info_trunk_active0, event_reply,
5644 		   (phba->trunk_link.link0.state == LPFC_LINK_UP) ? 1 : 0);
5645 
5646 	bsg_bf_set(lpfc_trunk_info_trunk_active1, event_reply,
5647 		   (phba->trunk_link.link1.state == LPFC_LINK_UP) ? 1 : 0);
5648 
5649 	bsg_bf_set(lpfc_trunk_info_trunk_active2, event_reply,
5650 		   (phba->trunk_link.link2.state == LPFC_LINK_UP) ? 1 : 0);
5651 
5652 	bsg_bf_set(lpfc_trunk_info_trunk_active3, event_reply,
5653 		   (phba->trunk_link.link3.state == LPFC_LINK_UP) ? 1 : 0);
5654 
5655 	bsg_bf_set(lpfc_trunk_info_trunk_config0, event_reply,
5656 		   bf_get(lpfc_conf_trunk_port0, &phba->sli4_hba));
5657 
5658 	bsg_bf_set(lpfc_trunk_info_trunk_config1, event_reply,
5659 		   bf_get(lpfc_conf_trunk_port1, &phba->sli4_hba));
5660 
5661 	bsg_bf_set(lpfc_trunk_info_trunk_config2, event_reply,
5662 		   bf_get(lpfc_conf_trunk_port2, &phba->sli4_hba));
5663 
5664 	bsg_bf_set(lpfc_trunk_info_trunk_config3, event_reply,
5665 		   bf_get(lpfc_conf_trunk_port3, &phba->sli4_hba));
5666 
5667 	event_reply->port_speed = phba->sli4_hba.link_state.speed / 1000;
5668 	event_reply->logical_speed =
5669 				phba->sli4_hba.link_state.logical_speed / 100;
5670 job_error:
5671 	bsg_reply->result = rc;
5672 	bsg_job_done(job, bsg_reply->result,
5673 		       bsg_reply->reply_payload_rcv_len);
5674 	return rc;
5675 
5676 }
5677 
5678 /**
5679  * lpfc_bsg_hst_vendor - process a vendor-specific fc_bsg_job
5680  * @job: fc_bsg_job to handle
5681  **/
5682 static int
5683 lpfc_bsg_hst_vendor(struct bsg_job *job)
5684 {
5685 	struct fc_bsg_request *bsg_request = job->request;
5686 	struct fc_bsg_reply *bsg_reply = job->reply;
5687 	int command = bsg_request->rqst_data.h_vendor.vendor_cmd[0];
5688 	int rc;
5689 
5690 	switch (command) {
5691 	case LPFC_BSG_VENDOR_SET_CT_EVENT:
5692 		rc = lpfc_bsg_hba_set_event(job);
5693 		break;
5694 	case LPFC_BSG_VENDOR_GET_CT_EVENT:
5695 		rc = lpfc_bsg_hba_get_event(job);
5696 		break;
5697 	case LPFC_BSG_VENDOR_SEND_MGMT_RESP:
5698 		rc = lpfc_bsg_send_mgmt_rsp(job);
5699 		break;
5700 	case LPFC_BSG_VENDOR_DIAG_MODE:
5701 		rc = lpfc_bsg_diag_loopback_mode(job);
5702 		break;
5703 	case LPFC_BSG_VENDOR_DIAG_MODE_END:
5704 		rc = lpfc_sli4_bsg_diag_mode_end(job);
5705 		break;
5706 	case LPFC_BSG_VENDOR_DIAG_RUN_LOOPBACK:
5707 		rc = lpfc_bsg_diag_loopback_run(job);
5708 		break;
5709 	case LPFC_BSG_VENDOR_LINK_DIAG_TEST:
5710 		rc = lpfc_sli4_bsg_link_diag_test(job);
5711 		break;
5712 	case LPFC_BSG_VENDOR_GET_MGMT_REV:
5713 		rc = lpfc_bsg_get_dfc_rev(job);
5714 		break;
5715 	case LPFC_BSG_VENDOR_MBOX:
5716 		rc = lpfc_bsg_mbox_cmd(job);
5717 		break;
5718 	case LPFC_BSG_VENDOR_MENLO_CMD:
5719 	case LPFC_BSG_VENDOR_MENLO_DATA:
5720 		rc = lpfc_menlo_cmd(job);
5721 		break;
5722 	case LPFC_BSG_VENDOR_FORCED_LINK_SPEED:
5723 		rc = lpfc_forced_link_speed(job);
5724 		break;
5725 	case LPFC_BSG_VENDOR_RAS_GET_LWPD:
5726 		rc = lpfc_bsg_get_ras_lwpd(job);
5727 		break;
5728 	case LPFC_BSG_VENDOR_RAS_GET_FWLOG:
5729 		rc = lpfc_bsg_get_ras_fwlog(job);
5730 		break;
5731 	case LPFC_BSG_VENDOR_RAS_GET_CONFIG:
5732 		rc = lpfc_bsg_get_ras_config(job);
5733 		break;
5734 	case LPFC_BSG_VENDOR_RAS_SET_CONFIG:
5735 		rc = lpfc_bsg_set_ras_config(job);
5736 		break;
5737 	case LPFC_BSG_VENDOR_GET_TRUNK_INFO:
5738 		rc = lpfc_get_trunk_info(job);
5739 		break;
5740 	default:
5741 		rc = -EINVAL;
5742 		bsg_reply->reply_payload_rcv_len = 0;
5743 		/* make error code available to userspace */
5744 		bsg_reply->result = rc;
5745 		break;
5746 	}
5747 
5748 	return rc;
5749 }
5750 
5751 /**
5752  * lpfc_bsg_request - handle a bsg request from the FC transport
5753  * @job: bsg_job to handle
5754  **/
5755 int
5756 lpfc_bsg_request(struct bsg_job *job)
5757 {
5758 	struct fc_bsg_request *bsg_request = job->request;
5759 	struct fc_bsg_reply *bsg_reply = job->reply;
5760 	uint32_t msgcode;
5761 	int rc;
5762 
5763 	msgcode = bsg_request->msgcode;
5764 	switch (msgcode) {
5765 	case FC_BSG_HST_VENDOR:
5766 		rc = lpfc_bsg_hst_vendor(job);
5767 		break;
5768 	case FC_BSG_RPT_ELS:
5769 		rc = lpfc_bsg_rport_els(job);
5770 		break;
5771 	case FC_BSG_RPT_CT:
5772 		rc = lpfc_bsg_send_mgmt_cmd(job);
5773 		break;
5774 	default:
5775 		rc = -EINVAL;
5776 		bsg_reply->reply_payload_rcv_len = 0;
5777 		/* make error code available to userspace */
5778 		bsg_reply->result = rc;
5779 		break;
5780 	}
5781 
5782 	return rc;
5783 }
5784 
5785 /**
5786  * lpfc_bsg_timeout - handle timeout of a bsg request from the FC transport
5787  * @job: bsg_job that has timed out
5788  *
5789  * This function just aborts the job's IOCB.  The aborted IOCB will return to
5790  * the waiting function which will handle passing the error back to userspace
5791  **/
5792 int
5793 lpfc_bsg_timeout(struct bsg_job *job)
5794 {
5795 	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
5796 	struct lpfc_hba *phba = vport->phba;
5797 	struct lpfc_iocbq *cmdiocb;
5798 	struct lpfc_sli_ring *pring;
5799 	struct bsg_job_data *dd_data;
5800 	unsigned long flags;
5801 	int rc = 0;
5802 	LIST_HEAD(completions);
5803 	struct lpfc_iocbq *check_iocb, *next_iocb;
5804 
5805 	pring = lpfc_phba_elsring(phba);
5806 	if (unlikely(!pring))
5807 		return -EIO;
5808 
5809 	/* if job's driver data is NULL, the command completed or is in the
5810 	 * the process of completing.  In this case, return status to request
5811 	 * so the timeout is retried.  This avoids double completion issues
5812 	 * and the request will be pulled off the timer queue when the
5813 	 * command's completion handler executes.  Otherwise, prevent the
5814 	 * command's completion handler from executing the job done callback
5815 	 * and continue processing to abort the outstanding the command.
5816 	 */
5817 
5818 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
5819 	dd_data = (struct bsg_job_data *)job->dd_data;
5820 	if (dd_data) {
5821 		dd_data->set_job = NULL;
5822 		job->dd_data = NULL;
5823 	} else {
5824 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5825 		return -EAGAIN;
5826 	}
5827 
5828 	switch (dd_data->type) {
5829 	case TYPE_IOCB:
5830 		/* Check to see if IOCB was issued to the port or not. If not,
5831 		 * remove it from the txq queue and call cancel iocbs.
5832 		 * Otherwise, call abort iotag
5833 		 */
5834 		cmdiocb = dd_data->context_un.iocb.cmdiocbq;
5835 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5836 
5837 		spin_lock_irqsave(&phba->hbalock, flags);
5838 		/* make sure the I/O abort window is still open */
5839 		if (!(cmdiocb->iocb_flag & LPFC_IO_CMD_OUTSTANDING)) {
5840 			spin_unlock_irqrestore(&phba->hbalock, flags);
5841 			return -EAGAIN;
5842 		}
5843 		list_for_each_entry_safe(check_iocb, next_iocb, &pring->txq,
5844 					 list) {
5845 			if (check_iocb == cmdiocb) {
5846 				list_move_tail(&check_iocb->list, &completions);
5847 				break;
5848 			}
5849 		}
5850 		if (list_empty(&completions))
5851 			lpfc_sli_issue_abort_iotag(phba, pring, cmdiocb);
5852 		spin_unlock_irqrestore(&phba->hbalock, flags);
5853 		if (!list_empty(&completions)) {
5854 			lpfc_sli_cancel_iocbs(phba, &completions,
5855 					      IOSTAT_LOCAL_REJECT,
5856 					      IOERR_SLI_ABORTED);
5857 		}
5858 		break;
5859 
5860 	case TYPE_EVT:
5861 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5862 		break;
5863 
5864 	case TYPE_MBOX:
5865 		/* Update the ext buf ctx state if needed */
5866 
5867 		if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_PORT)
5868 			phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_ABTS;
5869 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5870 		break;
5871 	case TYPE_MENLO:
5872 		/* Check to see if IOCB was issued to the port or not. If not,
5873 		 * remove it from the txq queue and call cancel iocbs.
5874 		 * Otherwise, call abort iotag.
5875 		 */
5876 		cmdiocb = dd_data->context_un.menlo.cmdiocbq;
5877 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5878 
5879 		spin_lock_irqsave(&phba->hbalock, flags);
5880 		list_for_each_entry_safe(check_iocb, next_iocb, &pring->txq,
5881 					 list) {
5882 			if (check_iocb == cmdiocb) {
5883 				list_move_tail(&check_iocb->list, &completions);
5884 				break;
5885 			}
5886 		}
5887 		if (list_empty(&completions))
5888 			lpfc_sli_issue_abort_iotag(phba, pring, cmdiocb);
5889 		spin_unlock_irqrestore(&phba->hbalock, flags);
5890 		if (!list_empty(&completions)) {
5891 			lpfc_sli_cancel_iocbs(phba, &completions,
5892 					      IOSTAT_LOCAL_REJECT,
5893 					      IOERR_SLI_ABORTED);
5894 		}
5895 		break;
5896 	default:
5897 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5898 		break;
5899 	}
5900 
5901 	/* scsi transport fc fc_bsg_job_timeout expects a zero return code,
5902 	 * otherwise an error message will be displayed on the console
5903 	 * so always return success (zero)
5904 	 */
5905 	return rc;
5906 }
5907