xref: /openbmc/linux/drivers/scsi/lpfc/lpfc_bsg.c (revision d2999e1b)
1 /*******************************************************************
2  * This file is part of the Emulex Linux Device Driver for         *
3  * Fibre Channel Host Bus Adapters.                                *
4  * Copyright (C) 2009-2014 Emulex.  All rights reserved.           *
5  * EMULEX and SLI are trademarks of Emulex.                        *
6  * www.emulex.com                                                  *
7  *                                                                 *
8  * This program is free software; you can redistribute it and/or   *
9  * modify it under the terms of version 2 of the GNU General       *
10  * Public License as published by the Free Software Foundation.    *
11  * This program is distributed in the hope that it will be useful. *
12  * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
13  * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
14  * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
15  * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
16  * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
17  * more details, a copy of which can be found in the file COPYING  *
18  * included with this package.                                     *
19  *******************************************************************/
20 
21 #include <linux/interrupt.h>
22 #include <linux/mempool.h>
23 #include <linux/pci.h>
24 #include <linux/slab.h>
25 #include <linux/delay.h>
26 #include <linux/list.h>
27 
28 #include <scsi/scsi.h>
29 #include <scsi/scsi_host.h>
30 #include <scsi/scsi_transport_fc.h>
31 #include <scsi/scsi_bsg_fc.h>
32 #include <scsi/fc/fc_fs.h>
33 
34 #include "lpfc_hw4.h"
35 #include "lpfc_hw.h"
36 #include "lpfc_sli.h"
37 #include "lpfc_sli4.h"
38 #include "lpfc_nl.h"
39 #include "lpfc_bsg.h"
40 #include "lpfc_disc.h"
41 #include "lpfc_scsi.h"
42 #include "lpfc.h"
43 #include "lpfc_logmsg.h"
44 #include "lpfc_crtn.h"
45 #include "lpfc_debugfs.h"
46 #include "lpfc_vport.h"
47 #include "lpfc_version.h"
48 
49 struct lpfc_bsg_event {
50 	struct list_head node;
51 	struct kref kref;
52 	wait_queue_head_t wq;
53 
54 	/* Event type and waiter identifiers */
55 	uint32_t type_mask;
56 	uint32_t req_id;
57 	uint32_t reg_id;
58 
59 	/* next two flags are here for the auto-delete logic */
60 	unsigned long wait_time_stamp;
61 	int waiting;
62 
63 	/* seen and not seen events */
64 	struct list_head events_to_get;
65 	struct list_head events_to_see;
66 
67 	/* driver data associated with the job */
68 	void *dd_data;
69 };
70 
71 struct lpfc_bsg_iocb {
72 	struct lpfc_iocbq *cmdiocbq;
73 	struct lpfc_dmabuf *rmp;
74 	struct lpfc_nodelist *ndlp;
75 };
76 
77 struct lpfc_bsg_mbox {
78 	LPFC_MBOXQ_t *pmboxq;
79 	MAILBOX_t *mb;
80 	struct lpfc_dmabuf *dmabuffers; /* for BIU diags */
81 	uint8_t *ext; /* extended mailbox data */
82 	uint32_t mbOffset; /* from app */
83 	uint32_t inExtWLen; /* from app */
84 	uint32_t outExtWLen; /* from app */
85 };
86 
87 #define MENLO_DID 0x0000FC0E
88 
89 struct lpfc_bsg_menlo {
90 	struct lpfc_iocbq *cmdiocbq;
91 	struct lpfc_dmabuf *rmp;
92 };
93 
94 #define TYPE_EVT 	1
95 #define TYPE_IOCB	2
96 #define TYPE_MBOX	3
97 #define TYPE_MENLO	4
98 struct bsg_job_data {
99 	uint32_t type;
100 	struct fc_bsg_job *set_job; /* job waiting for this iocb to finish */
101 	union {
102 		struct lpfc_bsg_event *evt;
103 		struct lpfc_bsg_iocb iocb;
104 		struct lpfc_bsg_mbox mbox;
105 		struct lpfc_bsg_menlo menlo;
106 	} context_un;
107 };
108 
109 struct event_data {
110 	struct list_head node;
111 	uint32_t type;
112 	uint32_t immed_dat;
113 	void *data;
114 	uint32_t len;
115 };
116 
117 #define BUF_SZ_4K 4096
118 #define SLI_CT_ELX_LOOPBACK 0x10
119 
120 enum ELX_LOOPBACK_CMD {
121 	ELX_LOOPBACK_XRI_SETUP,
122 	ELX_LOOPBACK_DATA,
123 };
124 
125 #define ELX_LOOPBACK_HEADER_SZ \
126 	(size_t)(&((struct lpfc_sli_ct_request *)NULL)->un)
127 
128 struct lpfc_dmabufext {
129 	struct lpfc_dmabuf dma;
130 	uint32_t size;
131 	uint32_t flag;
132 };
133 
134 static void
135 lpfc_free_bsg_buffers(struct lpfc_hba *phba, struct lpfc_dmabuf *mlist)
136 {
137 	struct lpfc_dmabuf *mlast, *next_mlast;
138 
139 	if (mlist) {
140 		list_for_each_entry_safe(mlast, next_mlast, &mlist->list,
141 					 list) {
142 			lpfc_mbuf_free(phba, mlast->virt, mlast->phys);
143 			list_del(&mlast->list);
144 			kfree(mlast);
145 		}
146 		lpfc_mbuf_free(phba, mlist->virt, mlist->phys);
147 		kfree(mlist);
148 	}
149 	return;
150 }
151 
152 static struct lpfc_dmabuf *
153 lpfc_alloc_bsg_buffers(struct lpfc_hba *phba, unsigned int size,
154 		       int outbound_buffers, struct ulp_bde64 *bpl,
155 		       int *bpl_entries)
156 {
157 	struct lpfc_dmabuf *mlist = NULL;
158 	struct lpfc_dmabuf *mp;
159 	unsigned int bytes_left = size;
160 
161 	/* Verify we can support the size specified */
162 	if (!size || (size > (*bpl_entries * LPFC_BPL_SIZE)))
163 		return NULL;
164 
165 	/* Determine the number of dma buffers to allocate */
166 	*bpl_entries = (size % LPFC_BPL_SIZE ? size/LPFC_BPL_SIZE + 1 :
167 			size/LPFC_BPL_SIZE);
168 
169 	/* Allocate dma buffer and place in BPL passed */
170 	while (bytes_left) {
171 		/* Allocate dma buffer  */
172 		mp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
173 		if (!mp) {
174 			if (mlist)
175 				lpfc_free_bsg_buffers(phba, mlist);
176 			return NULL;
177 		}
178 
179 		INIT_LIST_HEAD(&mp->list);
180 		mp->virt = lpfc_mbuf_alloc(phba, MEM_PRI, &(mp->phys));
181 
182 		if (!mp->virt) {
183 			kfree(mp);
184 			if (mlist)
185 				lpfc_free_bsg_buffers(phba, mlist);
186 			return NULL;
187 		}
188 
189 		/* Queue it to a linked list */
190 		if (!mlist)
191 			mlist = mp;
192 		else
193 			list_add_tail(&mp->list, &mlist->list);
194 
195 		/* Add buffer to buffer pointer list */
196 		if (outbound_buffers)
197 			bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
198 		else
199 			bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
200 		bpl->addrLow = le32_to_cpu(putPaddrLow(mp->phys));
201 		bpl->addrHigh = le32_to_cpu(putPaddrHigh(mp->phys));
202 		bpl->tus.f.bdeSize = (uint16_t)
203 			(bytes_left >= LPFC_BPL_SIZE ? LPFC_BPL_SIZE :
204 			 bytes_left);
205 		bytes_left -= bpl->tus.f.bdeSize;
206 		bpl->tus.w = le32_to_cpu(bpl->tus.w);
207 		bpl++;
208 	}
209 	return mlist;
210 }
211 
212 static unsigned int
213 lpfc_bsg_copy_data(struct lpfc_dmabuf *dma_buffers,
214 		   struct fc_bsg_buffer *bsg_buffers,
215 		   unsigned int bytes_to_transfer, int to_buffers)
216 {
217 
218 	struct lpfc_dmabuf *mp;
219 	unsigned int transfer_bytes, bytes_copied = 0;
220 	unsigned int sg_offset, dma_offset;
221 	unsigned char *dma_address, *sg_address;
222 	LIST_HEAD(temp_list);
223 	struct sg_mapping_iter miter;
224 	unsigned long flags;
225 	unsigned int sg_flags = SG_MITER_ATOMIC;
226 	bool sg_valid;
227 
228 	list_splice_init(&dma_buffers->list, &temp_list);
229 	list_add(&dma_buffers->list, &temp_list);
230 	sg_offset = 0;
231 	if (to_buffers)
232 		sg_flags |= SG_MITER_FROM_SG;
233 	else
234 		sg_flags |= SG_MITER_TO_SG;
235 	sg_miter_start(&miter, bsg_buffers->sg_list, bsg_buffers->sg_cnt,
236 		       sg_flags);
237 	local_irq_save(flags);
238 	sg_valid = sg_miter_next(&miter);
239 	list_for_each_entry(mp, &temp_list, list) {
240 		dma_offset = 0;
241 		while (bytes_to_transfer && sg_valid &&
242 		       (dma_offset < LPFC_BPL_SIZE)) {
243 			dma_address = mp->virt + dma_offset;
244 			if (sg_offset) {
245 				/* Continue previous partial transfer of sg */
246 				sg_address = miter.addr + sg_offset;
247 				transfer_bytes = miter.length - sg_offset;
248 			} else {
249 				sg_address = miter.addr;
250 				transfer_bytes = miter.length;
251 			}
252 			if (bytes_to_transfer < transfer_bytes)
253 				transfer_bytes = bytes_to_transfer;
254 			if (transfer_bytes > (LPFC_BPL_SIZE - dma_offset))
255 				transfer_bytes = LPFC_BPL_SIZE - dma_offset;
256 			if (to_buffers)
257 				memcpy(dma_address, sg_address, transfer_bytes);
258 			else
259 				memcpy(sg_address, dma_address, transfer_bytes);
260 			dma_offset += transfer_bytes;
261 			sg_offset += transfer_bytes;
262 			bytes_to_transfer -= transfer_bytes;
263 			bytes_copied += transfer_bytes;
264 			if (sg_offset >= miter.length) {
265 				sg_offset = 0;
266 				sg_valid = sg_miter_next(&miter);
267 			}
268 		}
269 	}
270 	sg_miter_stop(&miter);
271 	local_irq_restore(flags);
272 	list_del_init(&dma_buffers->list);
273 	list_splice(&temp_list, &dma_buffers->list);
274 	return bytes_copied;
275 }
276 
277 /**
278  * lpfc_bsg_send_mgmt_cmd_cmp - lpfc_bsg_send_mgmt_cmd's completion handler
279  * @phba: Pointer to HBA context object.
280  * @cmdiocbq: Pointer to command iocb.
281  * @rspiocbq: Pointer to response iocb.
282  *
283  * This function is the completion handler for iocbs issued using
284  * lpfc_bsg_send_mgmt_cmd function. This function is called by the
285  * ring event handler function without any lock held. This function
286  * can be called from both worker thread context and interrupt
287  * context. This function also can be called from another thread which
288  * cleans up the SLI layer objects.
289  * This function copies the contents of the response iocb to the
290  * response iocb memory object provided by the caller of
291  * lpfc_sli_issue_iocb_wait and then wakes up the thread which
292  * sleeps for the iocb completion.
293  **/
294 static void
295 lpfc_bsg_send_mgmt_cmd_cmp(struct lpfc_hba *phba,
296 			struct lpfc_iocbq *cmdiocbq,
297 			struct lpfc_iocbq *rspiocbq)
298 {
299 	struct bsg_job_data *dd_data;
300 	struct fc_bsg_job *job;
301 	IOCB_t *rsp;
302 	struct lpfc_dmabuf *bmp, *cmp, *rmp;
303 	struct lpfc_nodelist *ndlp;
304 	struct lpfc_bsg_iocb *iocb;
305 	unsigned long flags;
306 	unsigned int rsp_size;
307 	int rc = 0;
308 
309 	dd_data = cmdiocbq->context1;
310 
311 	/* Determine if job has been aborted */
312 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
313 	job = dd_data->set_job;
314 	if (job) {
315 		/* Prevent timeout handling from trying to abort job */
316 		job->dd_data = NULL;
317 	}
318 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
319 
320 	/* Close the timeout handler abort window */
321 	spin_lock_irqsave(&phba->hbalock, flags);
322 	cmdiocbq->iocb_flag &= ~LPFC_IO_CMD_OUTSTANDING;
323 	spin_unlock_irqrestore(&phba->hbalock, flags);
324 
325 	iocb = &dd_data->context_un.iocb;
326 	ndlp = iocb->ndlp;
327 	rmp = iocb->rmp;
328 	cmp = cmdiocbq->context2;
329 	bmp = cmdiocbq->context3;
330 	rsp = &rspiocbq->iocb;
331 
332 	/* Copy the completed data or set the error status */
333 
334 	if (job) {
335 		if (rsp->ulpStatus) {
336 			if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
337 				switch (rsp->un.ulpWord[4] & IOERR_PARAM_MASK) {
338 				case IOERR_SEQUENCE_TIMEOUT:
339 					rc = -ETIMEDOUT;
340 					break;
341 				case IOERR_INVALID_RPI:
342 					rc = -EFAULT;
343 					break;
344 				default:
345 					rc = -EACCES;
346 					break;
347 				}
348 			} else {
349 				rc = -EACCES;
350 			}
351 		} else {
352 			rsp_size = rsp->un.genreq64.bdl.bdeSize;
353 			job->reply->reply_payload_rcv_len =
354 				lpfc_bsg_copy_data(rmp, &job->reply_payload,
355 						   rsp_size, 0);
356 		}
357 	}
358 
359 	lpfc_free_bsg_buffers(phba, cmp);
360 	lpfc_free_bsg_buffers(phba, rmp);
361 	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
362 	kfree(bmp);
363 	lpfc_sli_release_iocbq(phba, cmdiocbq);
364 	lpfc_nlp_put(ndlp);
365 	kfree(dd_data);
366 
367 	/* Complete the job if the job is still active */
368 
369 	if (job) {
370 		job->reply->result = rc;
371 		job->job_done(job);
372 	}
373 	return;
374 }
375 
376 /**
377  * lpfc_bsg_send_mgmt_cmd - send a CT command from a bsg request
378  * @job: fc_bsg_job to handle
379  **/
380 static int
381 lpfc_bsg_send_mgmt_cmd(struct fc_bsg_job *job)
382 {
383 	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
384 	struct lpfc_hba *phba = vport->phba;
385 	struct lpfc_rport_data *rdata = job->rport->dd_data;
386 	struct lpfc_nodelist *ndlp = rdata->pnode;
387 	struct ulp_bde64 *bpl = NULL;
388 	uint32_t timeout;
389 	struct lpfc_iocbq *cmdiocbq = NULL;
390 	IOCB_t *cmd;
391 	struct lpfc_dmabuf *bmp = NULL, *cmp = NULL, *rmp = NULL;
392 	int request_nseg;
393 	int reply_nseg;
394 	struct bsg_job_data *dd_data;
395 	unsigned long flags;
396 	uint32_t creg_val;
397 	int rc = 0;
398 	int iocb_stat;
399 
400 	/* in case no data is transferred */
401 	job->reply->reply_payload_rcv_len = 0;
402 
403 	/* allocate our bsg tracking structure */
404 	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
405 	if (!dd_data) {
406 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
407 				"2733 Failed allocation of dd_data\n");
408 		rc = -ENOMEM;
409 		goto no_dd_data;
410 	}
411 
412 	if (!lpfc_nlp_get(ndlp)) {
413 		rc = -ENODEV;
414 		goto no_ndlp;
415 	}
416 
417 	if (ndlp->nlp_flag & NLP_ELS_SND_MASK) {
418 		rc = -ENODEV;
419 		goto free_ndlp;
420 	}
421 
422 	cmdiocbq = lpfc_sli_get_iocbq(phba);
423 	if (!cmdiocbq) {
424 		rc = -ENOMEM;
425 		goto free_ndlp;
426 	}
427 
428 	cmd = &cmdiocbq->iocb;
429 
430 	bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
431 	if (!bmp) {
432 		rc = -ENOMEM;
433 		goto free_cmdiocbq;
434 	}
435 	bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
436 	if (!bmp->virt) {
437 		rc = -ENOMEM;
438 		goto free_bmp;
439 	}
440 
441 	INIT_LIST_HEAD(&bmp->list);
442 
443 	bpl = (struct ulp_bde64 *) bmp->virt;
444 	request_nseg = LPFC_BPL_SIZE/sizeof(struct ulp_bde64);
445 	cmp = lpfc_alloc_bsg_buffers(phba, job->request_payload.payload_len,
446 				     1, bpl, &request_nseg);
447 	if (!cmp) {
448 		rc = -ENOMEM;
449 		goto free_bmp;
450 	}
451 	lpfc_bsg_copy_data(cmp, &job->request_payload,
452 			   job->request_payload.payload_len, 1);
453 
454 	bpl += request_nseg;
455 	reply_nseg = LPFC_BPL_SIZE/sizeof(struct ulp_bde64) - request_nseg;
456 	rmp = lpfc_alloc_bsg_buffers(phba, job->reply_payload.payload_len, 0,
457 				     bpl, &reply_nseg);
458 	if (!rmp) {
459 		rc = -ENOMEM;
460 		goto free_cmp;
461 	}
462 
463 	cmd->un.genreq64.bdl.ulpIoTag32 = 0;
464 	cmd->un.genreq64.bdl.addrHigh = putPaddrHigh(bmp->phys);
465 	cmd->un.genreq64.bdl.addrLow = putPaddrLow(bmp->phys);
466 	cmd->un.genreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
467 	cmd->un.genreq64.bdl.bdeSize =
468 		(request_nseg + reply_nseg) * sizeof(struct ulp_bde64);
469 	cmd->ulpCommand = CMD_GEN_REQUEST64_CR;
470 	cmd->un.genreq64.w5.hcsw.Fctl = (SI | LA);
471 	cmd->un.genreq64.w5.hcsw.Dfctl = 0;
472 	cmd->un.genreq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL;
473 	cmd->un.genreq64.w5.hcsw.Type = FC_TYPE_CT;
474 	cmd->ulpBdeCount = 1;
475 	cmd->ulpLe = 1;
476 	cmd->ulpClass = CLASS3;
477 	cmd->ulpContext = ndlp->nlp_rpi;
478 	if (phba->sli_rev == LPFC_SLI_REV4)
479 		cmd->ulpContext = phba->sli4_hba.rpi_ids[ndlp->nlp_rpi];
480 	cmd->ulpOwner = OWN_CHIP;
481 	cmdiocbq->vport = phba->pport;
482 	cmdiocbq->context3 = bmp;
483 	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
484 	timeout = phba->fc_ratov * 2;
485 	cmd->ulpTimeout = timeout;
486 
487 	cmdiocbq->iocb_cmpl = lpfc_bsg_send_mgmt_cmd_cmp;
488 	cmdiocbq->context1 = dd_data;
489 	cmdiocbq->context2 = cmp;
490 	cmdiocbq->context3 = bmp;
491 	cmdiocbq->context_un.ndlp = ndlp;
492 	dd_data->type = TYPE_IOCB;
493 	dd_data->set_job = job;
494 	dd_data->context_un.iocb.cmdiocbq = cmdiocbq;
495 	dd_data->context_un.iocb.ndlp = ndlp;
496 	dd_data->context_un.iocb.rmp = rmp;
497 	job->dd_data = dd_data;
498 
499 	if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
500 		if (lpfc_readl(phba->HCregaddr, &creg_val)) {
501 			rc = -EIO ;
502 			goto free_rmp;
503 		}
504 		creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
505 		writel(creg_val, phba->HCregaddr);
506 		readl(phba->HCregaddr); /* flush */
507 	}
508 
509 	iocb_stat = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0);
510 
511 	if (iocb_stat == IOCB_SUCCESS) {
512 		spin_lock_irqsave(&phba->hbalock, flags);
513 		/* make sure the I/O had not been completed yet */
514 		if (cmdiocbq->iocb_flag & LPFC_IO_LIBDFC) {
515 			/* open up abort window to timeout handler */
516 			cmdiocbq->iocb_flag |= LPFC_IO_CMD_OUTSTANDING;
517 		}
518 		spin_unlock_irqrestore(&phba->hbalock, flags);
519 		return 0; /* done for now */
520 	} else if (iocb_stat == IOCB_BUSY) {
521 		rc = -EAGAIN;
522 	} else {
523 		rc = -EIO;
524 	}
525 
526 	/* iocb failed so cleanup */
527 	job->dd_data = NULL;
528 
529 free_rmp:
530 	lpfc_free_bsg_buffers(phba, rmp);
531 free_cmp:
532 	lpfc_free_bsg_buffers(phba, cmp);
533 free_bmp:
534 	if (bmp->virt)
535 		lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
536 	kfree(bmp);
537 free_cmdiocbq:
538 	lpfc_sli_release_iocbq(phba, cmdiocbq);
539 free_ndlp:
540 	lpfc_nlp_put(ndlp);
541 no_ndlp:
542 	kfree(dd_data);
543 no_dd_data:
544 	/* make error code available to userspace */
545 	job->reply->result = rc;
546 	job->dd_data = NULL;
547 	return rc;
548 }
549 
550 /**
551  * lpfc_bsg_rport_els_cmp - lpfc_bsg_rport_els's completion handler
552  * @phba: Pointer to HBA context object.
553  * @cmdiocbq: Pointer to command iocb.
554  * @rspiocbq: Pointer to response iocb.
555  *
556  * This function is the completion handler for iocbs issued using
557  * lpfc_bsg_rport_els_cmp function. This function is called by the
558  * ring event handler function without any lock held. This function
559  * can be called from both worker thread context and interrupt
560  * context. This function also can be called from other thread which
561  * cleans up the SLI layer objects.
562  * This function copies the contents of the response iocb to the
563  * response iocb memory object provided by the caller of
564  * lpfc_sli_issue_iocb_wait and then wakes up the thread which
565  * sleeps for the iocb completion.
566  **/
567 static void
568 lpfc_bsg_rport_els_cmp(struct lpfc_hba *phba,
569 			struct lpfc_iocbq *cmdiocbq,
570 			struct lpfc_iocbq *rspiocbq)
571 {
572 	struct bsg_job_data *dd_data;
573 	struct fc_bsg_job *job;
574 	IOCB_t *rsp;
575 	struct lpfc_nodelist *ndlp;
576 	struct lpfc_dmabuf *pcmd = NULL, *prsp = NULL;
577 	struct fc_bsg_ctels_reply *els_reply;
578 	uint8_t *rjt_data;
579 	unsigned long flags;
580 	unsigned int rsp_size;
581 	int rc = 0;
582 
583 	dd_data = cmdiocbq->context1;
584 	ndlp = dd_data->context_un.iocb.ndlp;
585 	cmdiocbq->context1 = ndlp;
586 
587 	/* Determine if job has been aborted */
588 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
589 	job = dd_data->set_job;
590 	if (job) {
591 		/* Prevent timeout handling from trying to abort job  */
592 		job->dd_data = NULL;
593 	}
594 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
595 
596 	/* Close the timeout handler abort window */
597 	spin_lock_irqsave(&phba->hbalock, flags);
598 	cmdiocbq->iocb_flag &= ~LPFC_IO_CMD_OUTSTANDING;
599 	spin_unlock_irqrestore(&phba->hbalock, flags);
600 
601 	rsp = &rspiocbq->iocb;
602 	pcmd = (struct lpfc_dmabuf *)cmdiocbq->context2;
603 	prsp = (struct lpfc_dmabuf *)pcmd->list.next;
604 
605 	/* Copy the completed job data or determine the job status if job is
606 	 * still active
607 	 */
608 
609 	if (job) {
610 		if (rsp->ulpStatus == IOSTAT_SUCCESS) {
611 			rsp_size = rsp->un.elsreq64.bdl.bdeSize;
612 			job->reply->reply_payload_rcv_len =
613 				sg_copy_from_buffer(job->reply_payload.sg_list,
614 						    job->reply_payload.sg_cnt,
615 						    prsp->virt,
616 						    rsp_size);
617 		} else if (rsp->ulpStatus == IOSTAT_LS_RJT) {
618 			job->reply->reply_payload_rcv_len =
619 				sizeof(struct fc_bsg_ctels_reply);
620 			/* LS_RJT data returned in word 4 */
621 			rjt_data = (uint8_t *)&rsp->un.ulpWord[4];
622 			els_reply = &job->reply->reply_data.ctels_reply;
623 			els_reply->status = FC_CTELS_STATUS_REJECT;
624 			els_reply->rjt_data.action = rjt_data[3];
625 			els_reply->rjt_data.reason_code = rjt_data[2];
626 			els_reply->rjt_data.reason_explanation = rjt_data[1];
627 			els_reply->rjt_data.vendor_unique = rjt_data[0];
628 		} else {
629 			rc = -EIO;
630 		}
631 	}
632 
633 	lpfc_nlp_put(ndlp);
634 	lpfc_els_free_iocb(phba, cmdiocbq);
635 	kfree(dd_data);
636 
637 	/* Complete the job if the job is still active */
638 
639 	if (job) {
640 		job->reply->result = rc;
641 		job->job_done(job);
642 	}
643 	return;
644 }
645 
646 /**
647  * lpfc_bsg_rport_els - send an ELS command from a bsg request
648  * @job: fc_bsg_job to handle
649  **/
650 static int
651 lpfc_bsg_rport_els(struct fc_bsg_job *job)
652 {
653 	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
654 	struct lpfc_hba *phba = vport->phba;
655 	struct lpfc_rport_data *rdata = job->rport->dd_data;
656 	struct lpfc_nodelist *ndlp = rdata->pnode;
657 	uint32_t elscmd;
658 	uint32_t cmdsize;
659 	uint32_t rspsize;
660 	struct lpfc_iocbq *cmdiocbq;
661 	uint16_t rpi = 0;
662 	struct bsg_job_data *dd_data;
663 	unsigned long flags;
664 	uint32_t creg_val;
665 	int rc = 0;
666 
667 	/* in case no data is transferred */
668 	job->reply->reply_payload_rcv_len = 0;
669 
670 	/* verify the els command is not greater than the
671 	 * maximum ELS transfer size.
672 	 */
673 
674 	if (job->request_payload.payload_len > FCELSSIZE) {
675 		rc = -EINVAL;
676 		goto no_dd_data;
677 	}
678 
679 	/* allocate our bsg tracking structure */
680 	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
681 	if (!dd_data) {
682 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
683 				"2735 Failed allocation of dd_data\n");
684 		rc = -ENOMEM;
685 		goto no_dd_data;
686 	}
687 
688 	elscmd = job->request->rqst_data.r_els.els_code;
689 	cmdsize = job->request_payload.payload_len;
690 	rspsize = job->reply_payload.payload_len;
691 
692 	if (!lpfc_nlp_get(ndlp)) {
693 		rc = -ENODEV;
694 		goto free_dd_data;
695 	}
696 
697 	/* We will use the allocated dma buffers by prep els iocb for command
698 	 * and response to ensure if the job times out and the request is freed,
699 	 * we won't be dma into memory that is no longer allocated to for the
700 	 * request.
701 	 */
702 
703 	cmdiocbq = lpfc_prep_els_iocb(vport, 1, cmdsize, 0, ndlp,
704 				      ndlp->nlp_DID, elscmd);
705 	if (!cmdiocbq) {
706 		rc = -EIO;
707 		goto release_ndlp;
708 	}
709 
710 	rpi = ndlp->nlp_rpi;
711 
712 	/* Transfer the request payload to allocated command dma buffer */
713 
714 	sg_copy_to_buffer(job->request_payload.sg_list,
715 			  job->request_payload.sg_cnt,
716 			  ((struct lpfc_dmabuf *)cmdiocbq->context2)->virt,
717 			  cmdsize);
718 
719 	if (phba->sli_rev == LPFC_SLI_REV4)
720 		cmdiocbq->iocb.ulpContext = phba->sli4_hba.rpi_ids[rpi];
721 	else
722 		cmdiocbq->iocb.ulpContext = rpi;
723 	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
724 	cmdiocbq->context1 = dd_data;
725 	cmdiocbq->context_un.ndlp = ndlp;
726 	cmdiocbq->iocb_cmpl = lpfc_bsg_rport_els_cmp;
727 	dd_data->type = TYPE_IOCB;
728 	dd_data->set_job = job;
729 	dd_data->context_un.iocb.cmdiocbq = cmdiocbq;
730 	dd_data->context_un.iocb.ndlp = ndlp;
731 	dd_data->context_un.iocb.rmp = NULL;
732 	job->dd_data = dd_data;
733 
734 	if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
735 		if (lpfc_readl(phba->HCregaddr, &creg_val)) {
736 			rc = -EIO;
737 			goto linkdown_err;
738 		}
739 		creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
740 		writel(creg_val, phba->HCregaddr);
741 		readl(phba->HCregaddr); /* flush */
742 	}
743 
744 	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0);
745 
746 	if (rc == IOCB_SUCCESS) {
747 		spin_lock_irqsave(&phba->hbalock, flags);
748 		/* make sure the I/O had not been completed/released */
749 		if (cmdiocbq->iocb_flag & LPFC_IO_LIBDFC) {
750 			/* open up abort window to timeout handler */
751 			cmdiocbq->iocb_flag |= LPFC_IO_CMD_OUTSTANDING;
752 		}
753 		spin_unlock_irqrestore(&phba->hbalock, flags);
754 		return 0; /* done for now */
755 	} else if (rc == IOCB_BUSY) {
756 		rc = -EAGAIN;
757 	} else {
758 		rc = -EIO;
759 	}
760 
761 	/* iocb failed so cleanup */
762 	job->dd_data = NULL;
763 
764 linkdown_err:
765 	cmdiocbq->context1 = ndlp;
766 	lpfc_els_free_iocb(phba, cmdiocbq);
767 
768 release_ndlp:
769 	lpfc_nlp_put(ndlp);
770 
771 free_dd_data:
772 	kfree(dd_data);
773 
774 no_dd_data:
775 	/* make error code available to userspace */
776 	job->reply->result = rc;
777 	job->dd_data = NULL;
778 	return rc;
779 }
780 
781 /**
782  * lpfc_bsg_event_free - frees an allocated event structure
783  * @kref: Pointer to a kref.
784  *
785  * Called from kref_put. Back cast the kref into an event structure address.
786  * Free any events to get, delete associated nodes, free any events to see,
787  * free any data then free the event itself.
788  **/
789 static void
790 lpfc_bsg_event_free(struct kref *kref)
791 {
792 	struct lpfc_bsg_event *evt = container_of(kref, struct lpfc_bsg_event,
793 						  kref);
794 	struct event_data *ed;
795 
796 	list_del(&evt->node);
797 
798 	while (!list_empty(&evt->events_to_get)) {
799 		ed = list_entry(evt->events_to_get.next, typeof(*ed), node);
800 		list_del(&ed->node);
801 		kfree(ed->data);
802 		kfree(ed);
803 	}
804 
805 	while (!list_empty(&evt->events_to_see)) {
806 		ed = list_entry(evt->events_to_see.next, typeof(*ed), node);
807 		list_del(&ed->node);
808 		kfree(ed->data);
809 		kfree(ed);
810 	}
811 
812 	kfree(evt->dd_data);
813 	kfree(evt);
814 }
815 
816 /**
817  * lpfc_bsg_event_ref - increments the kref for an event
818  * @evt: Pointer to an event structure.
819  **/
820 static inline void
821 lpfc_bsg_event_ref(struct lpfc_bsg_event *evt)
822 {
823 	kref_get(&evt->kref);
824 }
825 
826 /**
827  * lpfc_bsg_event_unref - Uses kref_put to free an event structure
828  * @evt: Pointer to an event structure.
829  **/
830 static inline void
831 lpfc_bsg_event_unref(struct lpfc_bsg_event *evt)
832 {
833 	kref_put(&evt->kref, lpfc_bsg_event_free);
834 }
835 
836 /**
837  * lpfc_bsg_event_new - allocate and initialize a event structure
838  * @ev_mask: Mask of events.
839  * @ev_reg_id: Event reg id.
840  * @ev_req_id: Event request id.
841  **/
842 static struct lpfc_bsg_event *
843 lpfc_bsg_event_new(uint32_t ev_mask, int ev_reg_id, uint32_t ev_req_id)
844 {
845 	struct lpfc_bsg_event *evt = kzalloc(sizeof(*evt), GFP_KERNEL);
846 
847 	if (!evt)
848 		return NULL;
849 
850 	INIT_LIST_HEAD(&evt->events_to_get);
851 	INIT_LIST_HEAD(&evt->events_to_see);
852 	evt->type_mask = ev_mask;
853 	evt->req_id = ev_req_id;
854 	evt->reg_id = ev_reg_id;
855 	evt->wait_time_stamp = jiffies;
856 	evt->dd_data = NULL;
857 	init_waitqueue_head(&evt->wq);
858 	kref_init(&evt->kref);
859 	return evt;
860 }
861 
862 /**
863  * diag_cmd_data_free - Frees an lpfc dma buffer extension
864  * @phba: Pointer to HBA context object.
865  * @mlist: Pointer to an lpfc dma buffer extension.
866  **/
867 static int
868 diag_cmd_data_free(struct lpfc_hba *phba, struct lpfc_dmabufext *mlist)
869 {
870 	struct lpfc_dmabufext *mlast;
871 	struct pci_dev *pcidev;
872 	struct list_head head, *curr, *next;
873 
874 	if ((!mlist) || (!lpfc_is_link_up(phba) &&
875 		(phba->link_flag & LS_LOOPBACK_MODE))) {
876 		return 0;
877 	}
878 
879 	pcidev = phba->pcidev;
880 	list_add_tail(&head, &mlist->dma.list);
881 
882 	list_for_each_safe(curr, next, &head) {
883 		mlast = list_entry(curr, struct lpfc_dmabufext , dma.list);
884 		if (mlast->dma.virt)
885 			dma_free_coherent(&pcidev->dev,
886 					  mlast->size,
887 					  mlast->dma.virt,
888 					  mlast->dma.phys);
889 		kfree(mlast);
890 	}
891 	return 0;
892 }
893 
894 /**
895  * lpfc_bsg_ct_unsol_event - process an unsolicited CT command
896  * @phba:
897  * @pring:
898  * @piocbq:
899  *
900  * This function is called when an unsolicited CT command is received.  It
901  * forwards the event to any processes registered to receive CT events.
902  **/
903 int
904 lpfc_bsg_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
905 			struct lpfc_iocbq *piocbq)
906 {
907 	uint32_t evt_req_id = 0;
908 	uint32_t cmd;
909 	uint32_t len;
910 	struct lpfc_dmabuf *dmabuf = NULL;
911 	struct lpfc_bsg_event *evt;
912 	struct event_data *evt_dat = NULL;
913 	struct lpfc_iocbq *iocbq;
914 	size_t offset = 0;
915 	struct list_head head;
916 	struct ulp_bde64 *bde;
917 	dma_addr_t dma_addr;
918 	int i;
919 	struct lpfc_dmabuf *bdeBuf1 = piocbq->context2;
920 	struct lpfc_dmabuf *bdeBuf2 = piocbq->context3;
921 	struct lpfc_hbq_entry *hbqe;
922 	struct lpfc_sli_ct_request *ct_req;
923 	struct fc_bsg_job *job = NULL;
924 	struct bsg_job_data *dd_data = NULL;
925 	unsigned long flags;
926 	int size = 0;
927 
928 	INIT_LIST_HEAD(&head);
929 	list_add_tail(&head, &piocbq->list);
930 
931 	if (piocbq->iocb.ulpBdeCount == 0 ||
932 	    piocbq->iocb.un.cont64[0].tus.f.bdeSize == 0)
933 		goto error_ct_unsol_exit;
934 
935 	if (phba->link_state == LPFC_HBA_ERROR ||
936 		(!(phba->sli.sli_flag & LPFC_SLI_ACTIVE)))
937 		goto error_ct_unsol_exit;
938 
939 	if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED)
940 		dmabuf = bdeBuf1;
941 	else {
942 		dma_addr = getPaddr(piocbq->iocb.un.cont64[0].addrHigh,
943 				    piocbq->iocb.un.cont64[0].addrLow);
944 		dmabuf = lpfc_sli_ringpostbuf_get(phba, pring, dma_addr);
945 	}
946 	if (dmabuf == NULL)
947 		goto error_ct_unsol_exit;
948 	ct_req = (struct lpfc_sli_ct_request *)dmabuf->virt;
949 	evt_req_id = ct_req->FsType;
950 	cmd = ct_req->CommandResponse.bits.CmdRsp;
951 	len = ct_req->CommandResponse.bits.Size;
952 	if (!(phba->sli3_options & LPFC_SLI3_HBQ_ENABLED))
953 		lpfc_sli_ringpostbuf_put(phba, pring, dmabuf);
954 
955 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
956 	list_for_each_entry(evt, &phba->ct_ev_waiters, node) {
957 		if (!(evt->type_mask & FC_REG_CT_EVENT) ||
958 			evt->req_id != evt_req_id)
959 			continue;
960 
961 		lpfc_bsg_event_ref(evt);
962 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
963 		evt_dat = kzalloc(sizeof(*evt_dat), GFP_KERNEL);
964 		if (evt_dat == NULL) {
965 			spin_lock_irqsave(&phba->ct_ev_lock, flags);
966 			lpfc_bsg_event_unref(evt);
967 			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
968 					"2614 Memory allocation failed for "
969 					"CT event\n");
970 			break;
971 		}
972 
973 		if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
974 			/* take accumulated byte count from the last iocbq */
975 			iocbq = list_entry(head.prev, typeof(*iocbq), list);
976 			evt_dat->len = iocbq->iocb.unsli3.rcvsli3.acc_len;
977 		} else {
978 			list_for_each_entry(iocbq, &head, list) {
979 				for (i = 0; i < iocbq->iocb.ulpBdeCount; i++)
980 					evt_dat->len +=
981 					iocbq->iocb.un.cont64[i].tus.f.bdeSize;
982 			}
983 		}
984 
985 		evt_dat->data = kzalloc(evt_dat->len, GFP_KERNEL);
986 		if (evt_dat->data == NULL) {
987 			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
988 					"2615 Memory allocation failed for "
989 					"CT event data, size %d\n",
990 					evt_dat->len);
991 			kfree(evt_dat);
992 			spin_lock_irqsave(&phba->ct_ev_lock, flags);
993 			lpfc_bsg_event_unref(evt);
994 			spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
995 			goto error_ct_unsol_exit;
996 		}
997 
998 		list_for_each_entry(iocbq, &head, list) {
999 			size = 0;
1000 			if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
1001 				bdeBuf1 = iocbq->context2;
1002 				bdeBuf2 = iocbq->context3;
1003 			}
1004 			for (i = 0; i < iocbq->iocb.ulpBdeCount; i++) {
1005 				if (phba->sli3_options &
1006 				    LPFC_SLI3_HBQ_ENABLED) {
1007 					if (i == 0) {
1008 						hbqe = (struct lpfc_hbq_entry *)
1009 						  &iocbq->iocb.un.ulpWord[0];
1010 						size = hbqe->bde.tus.f.bdeSize;
1011 						dmabuf = bdeBuf1;
1012 					} else if (i == 1) {
1013 						hbqe = (struct lpfc_hbq_entry *)
1014 							&iocbq->iocb.unsli3.
1015 							sli3Words[4];
1016 						size = hbqe->bde.tus.f.bdeSize;
1017 						dmabuf = bdeBuf2;
1018 					}
1019 					if ((offset + size) > evt_dat->len)
1020 						size = evt_dat->len - offset;
1021 				} else {
1022 					size = iocbq->iocb.un.cont64[i].
1023 						tus.f.bdeSize;
1024 					bde = &iocbq->iocb.un.cont64[i];
1025 					dma_addr = getPaddr(bde->addrHigh,
1026 							    bde->addrLow);
1027 					dmabuf = lpfc_sli_ringpostbuf_get(phba,
1028 							pring, dma_addr);
1029 				}
1030 				if (!dmabuf) {
1031 					lpfc_printf_log(phba, KERN_ERR,
1032 						LOG_LIBDFC, "2616 No dmabuf "
1033 						"found for iocbq 0x%p\n",
1034 						iocbq);
1035 					kfree(evt_dat->data);
1036 					kfree(evt_dat);
1037 					spin_lock_irqsave(&phba->ct_ev_lock,
1038 						flags);
1039 					lpfc_bsg_event_unref(evt);
1040 					spin_unlock_irqrestore(
1041 						&phba->ct_ev_lock, flags);
1042 					goto error_ct_unsol_exit;
1043 				}
1044 				memcpy((char *)(evt_dat->data) + offset,
1045 				       dmabuf->virt, size);
1046 				offset += size;
1047 				if (evt_req_id != SLI_CT_ELX_LOOPBACK &&
1048 				    !(phba->sli3_options &
1049 				      LPFC_SLI3_HBQ_ENABLED)) {
1050 					lpfc_sli_ringpostbuf_put(phba, pring,
1051 								 dmabuf);
1052 				} else {
1053 					switch (cmd) {
1054 					case ELX_LOOPBACK_DATA:
1055 						if (phba->sli_rev <
1056 						    LPFC_SLI_REV4)
1057 							diag_cmd_data_free(phba,
1058 							(struct lpfc_dmabufext
1059 							 *)dmabuf);
1060 						break;
1061 					case ELX_LOOPBACK_XRI_SETUP:
1062 						if ((phba->sli_rev ==
1063 							LPFC_SLI_REV2) ||
1064 							(phba->sli3_options &
1065 							LPFC_SLI3_HBQ_ENABLED
1066 							)) {
1067 							lpfc_in_buf_free(phba,
1068 									dmabuf);
1069 						} else {
1070 							lpfc_post_buffer(phba,
1071 									 pring,
1072 									 1);
1073 						}
1074 						break;
1075 					default:
1076 						if (!(phba->sli3_options &
1077 						      LPFC_SLI3_HBQ_ENABLED))
1078 							lpfc_post_buffer(phba,
1079 									 pring,
1080 									 1);
1081 						break;
1082 					}
1083 				}
1084 			}
1085 		}
1086 
1087 		spin_lock_irqsave(&phba->ct_ev_lock, flags);
1088 		if (phba->sli_rev == LPFC_SLI_REV4) {
1089 			evt_dat->immed_dat = phba->ctx_idx;
1090 			phba->ctx_idx = (phba->ctx_idx + 1) % LPFC_CT_CTX_MAX;
1091 			/* Provide warning for over-run of the ct_ctx array */
1092 			if (phba->ct_ctx[evt_dat->immed_dat].valid ==
1093 			    UNSOL_VALID)
1094 				lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
1095 						"2717 CT context array entry "
1096 						"[%d] over-run: oxid:x%x, "
1097 						"sid:x%x\n", phba->ctx_idx,
1098 						phba->ct_ctx[
1099 						    evt_dat->immed_dat].oxid,
1100 						phba->ct_ctx[
1101 						    evt_dat->immed_dat].SID);
1102 			phba->ct_ctx[evt_dat->immed_dat].rxid =
1103 				piocbq->iocb.ulpContext;
1104 			phba->ct_ctx[evt_dat->immed_dat].oxid =
1105 				piocbq->iocb.unsli3.rcvsli3.ox_id;
1106 			phba->ct_ctx[evt_dat->immed_dat].SID =
1107 				piocbq->iocb.un.rcvels.remoteID;
1108 			phba->ct_ctx[evt_dat->immed_dat].valid = UNSOL_VALID;
1109 		} else
1110 			evt_dat->immed_dat = piocbq->iocb.ulpContext;
1111 
1112 		evt_dat->type = FC_REG_CT_EVENT;
1113 		list_add(&evt_dat->node, &evt->events_to_see);
1114 		if (evt_req_id == SLI_CT_ELX_LOOPBACK) {
1115 			wake_up_interruptible(&evt->wq);
1116 			lpfc_bsg_event_unref(evt);
1117 			break;
1118 		}
1119 
1120 		list_move(evt->events_to_see.prev, &evt->events_to_get);
1121 
1122 		dd_data = (struct bsg_job_data *)evt->dd_data;
1123 		job = dd_data->set_job;
1124 		dd_data->set_job = NULL;
1125 		lpfc_bsg_event_unref(evt);
1126 		if (job) {
1127 			job->reply->reply_payload_rcv_len = size;
1128 			/* make error code available to userspace */
1129 			job->reply->result = 0;
1130 			job->dd_data = NULL;
1131 			/* complete the job back to userspace */
1132 			spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1133 			job->job_done(job);
1134 			spin_lock_irqsave(&phba->ct_ev_lock, flags);
1135 		}
1136 	}
1137 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1138 
1139 error_ct_unsol_exit:
1140 	if (!list_empty(&head))
1141 		list_del(&head);
1142 	if ((phba->sli_rev < LPFC_SLI_REV4) &&
1143 	    (evt_req_id == SLI_CT_ELX_LOOPBACK))
1144 		return 0;
1145 	return 1;
1146 }
1147 
1148 /**
1149  * lpfc_bsg_ct_unsol_abort - handler ct abort to management plane
1150  * @phba: Pointer to HBA context object.
1151  * @dmabuf: pointer to a dmabuf that describes the FC sequence
1152  *
1153  * This function handles abort to the CT command toward management plane
1154  * for SLI4 port.
1155  *
1156  * If the pending context of a CT command to management plane present, clears
1157  * such context and returns 1 for handled; otherwise, it returns 0 indicating
1158  * no context exists.
1159  **/
1160 int
1161 lpfc_bsg_ct_unsol_abort(struct lpfc_hba *phba, struct hbq_dmabuf *dmabuf)
1162 {
1163 	struct fc_frame_header fc_hdr;
1164 	struct fc_frame_header *fc_hdr_ptr = &fc_hdr;
1165 	int ctx_idx, handled = 0;
1166 	uint16_t oxid, rxid;
1167 	uint32_t sid;
1168 
1169 	memcpy(fc_hdr_ptr, dmabuf->hbuf.virt, sizeof(struct fc_frame_header));
1170 	sid = sli4_sid_from_fc_hdr(fc_hdr_ptr);
1171 	oxid = be16_to_cpu(fc_hdr_ptr->fh_ox_id);
1172 	rxid = be16_to_cpu(fc_hdr_ptr->fh_rx_id);
1173 
1174 	for (ctx_idx = 0; ctx_idx < LPFC_CT_CTX_MAX; ctx_idx++) {
1175 		if (phba->ct_ctx[ctx_idx].valid != UNSOL_VALID)
1176 			continue;
1177 		if (phba->ct_ctx[ctx_idx].rxid != rxid)
1178 			continue;
1179 		if (phba->ct_ctx[ctx_idx].oxid != oxid)
1180 			continue;
1181 		if (phba->ct_ctx[ctx_idx].SID != sid)
1182 			continue;
1183 		phba->ct_ctx[ctx_idx].valid = UNSOL_INVALID;
1184 		handled = 1;
1185 	}
1186 	return handled;
1187 }
1188 
1189 /**
1190  * lpfc_bsg_hba_set_event - process a SET_EVENT bsg vendor command
1191  * @job: SET_EVENT fc_bsg_job
1192  **/
1193 static int
1194 lpfc_bsg_hba_set_event(struct fc_bsg_job *job)
1195 {
1196 	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
1197 	struct lpfc_hba *phba = vport->phba;
1198 	struct set_ct_event *event_req;
1199 	struct lpfc_bsg_event *evt;
1200 	int rc = 0;
1201 	struct bsg_job_data *dd_data = NULL;
1202 	uint32_t ev_mask;
1203 	unsigned long flags;
1204 
1205 	if (job->request_len <
1206 	    sizeof(struct fc_bsg_request) + sizeof(struct set_ct_event)) {
1207 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1208 				"2612 Received SET_CT_EVENT below minimum "
1209 				"size\n");
1210 		rc = -EINVAL;
1211 		goto job_error;
1212 	}
1213 
1214 	event_req = (struct set_ct_event *)
1215 		job->request->rqst_data.h_vendor.vendor_cmd;
1216 	ev_mask = ((uint32_t)(unsigned long)event_req->type_mask &
1217 				FC_REG_EVENT_MASK);
1218 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1219 	list_for_each_entry(evt, &phba->ct_ev_waiters, node) {
1220 		if (evt->reg_id == event_req->ev_reg_id) {
1221 			lpfc_bsg_event_ref(evt);
1222 			evt->wait_time_stamp = jiffies;
1223 			dd_data = (struct bsg_job_data *)evt->dd_data;
1224 			break;
1225 		}
1226 	}
1227 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1228 
1229 	if (&evt->node == &phba->ct_ev_waiters) {
1230 		/* no event waiting struct yet - first call */
1231 		dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
1232 		if (dd_data == NULL) {
1233 			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1234 					"2734 Failed allocation of dd_data\n");
1235 			rc = -ENOMEM;
1236 			goto job_error;
1237 		}
1238 		evt = lpfc_bsg_event_new(ev_mask, event_req->ev_reg_id,
1239 					event_req->ev_req_id);
1240 		if (!evt) {
1241 			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1242 					"2617 Failed allocation of event "
1243 					"waiter\n");
1244 			rc = -ENOMEM;
1245 			goto job_error;
1246 		}
1247 		dd_data->type = TYPE_EVT;
1248 		dd_data->set_job = NULL;
1249 		dd_data->context_un.evt = evt;
1250 		evt->dd_data = (void *)dd_data;
1251 		spin_lock_irqsave(&phba->ct_ev_lock, flags);
1252 		list_add(&evt->node, &phba->ct_ev_waiters);
1253 		lpfc_bsg_event_ref(evt);
1254 		evt->wait_time_stamp = jiffies;
1255 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1256 	}
1257 
1258 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1259 	evt->waiting = 1;
1260 	dd_data->set_job = job; /* for unsolicited command */
1261 	job->dd_data = dd_data; /* for fc transport timeout callback*/
1262 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1263 	return 0; /* call job done later */
1264 
1265 job_error:
1266 	if (dd_data != NULL)
1267 		kfree(dd_data);
1268 
1269 	job->dd_data = NULL;
1270 	return rc;
1271 }
1272 
1273 /**
1274  * lpfc_bsg_hba_get_event - process a GET_EVENT bsg vendor command
1275  * @job: GET_EVENT fc_bsg_job
1276  **/
1277 static int
1278 lpfc_bsg_hba_get_event(struct fc_bsg_job *job)
1279 {
1280 	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
1281 	struct lpfc_hba *phba = vport->phba;
1282 	struct get_ct_event *event_req;
1283 	struct get_ct_event_reply *event_reply;
1284 	struct lpfc_bsg_event *evt, *evt_next;
1285 	struct event_data *evt_dat = NULL;
1286 	unsigned long flags;
1287 	uint32_t rc = 0;
1288 
1289 	if (job->request_len <
1290 	    sizeof(struct fc_bsg_request) + sizeof(struct get_ct_event)) {
1291 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1292 				"2613 Received GET_CT_EVENT request below "
1293 				"minimum size\n");
1294 		rc = -EINVAL;
1295 		goto job_error;
1296 	}
1297 
1298 	event_req = (struct get_ct_event *)
1299 		job->request->rqst_data.h_vendor.vendor_cmd;
1300 
1301 	event_reply = (struct get_ct_event_reply *)
1302 		job->reply->reply_data.vendor_reply.vendor_rsp;
1303 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1304 	list_for_each_entry_safe(evt, evt_next, &phba->ct_ev_waiters, node) {
1305 		if (evt->reg_id == event_req->ev_reg_id) {
1306 			if (list_empty(&evt->events_to_get))
1307 				break;
1308 			lpfc_bsg_event_ref(evt);
1309 			evt->wait_time_stamp = jiffies;
1310 			evt_dat = list_entry(evt->events_to_get.prev,
1311 					     struct event_data, node);
1312 			list_del(&evt_dat->node);
1313 			break;
1314 		}
1315 	}
1316 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1317 
1318 	/* The app may continue to ask for event data until it gets
1319 	 * an error indicating that there isn't anymore
1320 	 */
1321 	if (evt_dat == NULL) {
1322 		job->reply->reply_payload_rcv_len = 0;
1323 		rc = -ENOENT;
1324 		goto job_error;
1325 	}
1326 
1327 	if (evt_dat->len > job->request_payload.payload_len) {
1328 		evt_dat->len = job->request_payload.payload_len;
1329 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1330 				"2618 Truncated event data at %d "
1331 				"bytes\n",
1332 				job->request_payload.payload_len);
1333 	}
1334 
1335 	event_reply->type = evt_dat->type;
1336 	event_reply->immed_data = evt_dat->immed_dat;
1337 	if (evt_dat->len > 0)
1338 		job->reply->reply_payload_rcv_len =
1339 			sg_copy_from_buffer(job->request_payload.sg_list,
1340 					    job->request_payload.sg_cnt,
1341 					    evt_dat->data, evt_dat->len);
1342 	else
1343 		job->reply->reply_payload_rcv_len = 0;
1344 
1345 	if (evt_dat) {
1346 		kfree(evt_dat->data);
1347 		kfree(evt_dat);
1348 	}
1349 
1350 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1351 	lpfc_bsg_event_unref(evt);
1352 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1353 	job->dd_data = NULL;
1354 	job->reply->result = 0;
1355 	job->job_done(job);
1356 	return 0;
1357 
1358 job_error:
1359 	job->dd_data = NULL;
1360 	job->reply->result = rc;
1361 	return rc;
1362 }
1363 
1364 /**
1365  * lpfc_issue_ct_rsp_cmp - lpfc_issue_ct_rsp's completion handler
1366  * @phba: Pointer to HBA context object.
1367  * @cmdiocbq: Pointer to command iocb.
1368  * @rspiocbq: Pointer to response iocb.
1369  *
1370  * This function is the completion handler for iocbs issued using
1371  * lpfc_issue_ct_rsp_cmp function. This function is called by the
1372  * ring event handler function without any lock held. This function
1373  * can be called from both worker thread context and interrupt
1374  * context. This function also can be called from other thread which
1375  * cleans up the SLI layer objects.
1376  * This function copy the contents of the response iocb to the
1377  * response iocb memory object provided by the caller of
1378  * lpfc_sli_issue_iocb_wait and then wakes up the thread which
1379  * sleeps for the iocb completion.
1380  **/
1381 static void
1382 lpfc_issue_ct_rsp_cmp(struct lpfc_hba *phba,
1383 			struct lpfc_iocbq *cmdiocbq,
1384 			struct lpfc_iocbq *rspiocbq)
1385 {
1386 	struct bsg_job_data *dd_data;
1387 	struct fc_bsg_job *job;
1388 	IOCB_t *rsp;
1389 	struct lpfc_dmabuf *bmp, *cmp;
1390 	struct lpfc_nodelist *ndlp;
1391 	unsigned long flags;
1392 	int rc = 0;
1393 
1394 	dd_data = cmdiocbq->context1;
1395 
1396 	/* Determine if job has been aborted */
1397 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1398 	job = dd_data->set_job;
1399 	if (job) {
1400 		/* Prevent timeout handling from trying to abort job  */
1401 		job->dd_data = NULL;
1402 	}
1403 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1404 
1405 	/* Close the timeout handler abort window */
1406 	spin_lock_irqsave(&phba->hbalock, flags);
1407 	cmdiocbq->iocb_flag &= ~LPFC_IO_CMD_OUTSTANDING;
1408 	spin_unlock_irqrestore(&phba->hbalock, flags);
1409 
1410 	ndlp = dd_data->context_un.iocb.ndlp;
1411 	cmp = cmdiocbq->context2;
1412 	bmp = cmdiocbq->context3;
1413 	rsp = &rspiocbq->iocb;
1414 
1415 	/* Copy the completed job data or set the error status */
1416 
1417 	if (job) {
1418 		if (rsp->ulpStatus) {
1419 			if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
1420 				switch (rsp->un.ulpWord[4] & IOERR_PARAM_MASK) {
1421 				case IOERR_SEQUENCE_TIMEOUT:
1422 					rc = -ETIMEDOUT;
1423 					break;
1424 				case IOERR_INVALID_RPI:
1425 					rc = -EFAULT;
1426 					break;
1427 				default:
1428 					rc = -EACCES;
1429 					break;
1430 				}
1431 			} else {
1432 				rc = -EACCES;
1433 			}
1434 		} else {
1435 			job->reply->reply_payload_rcv_len = 0;
1436 		}
1437 	}
1438 
1439 	lpfc_free_bsg_buffers(phba, cmp);
1440 	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
1441 	kfree(bmp);
1442 	lpfc_sli_release_iocbq(phba, cmdiocbq);
1443 	lpfc_nlp_put(ndlp);
1444 	kfree(dd_data);
1445 
1446 	/* Complete the job if the job is still active */
1447 
1448 	if (job) {
1449 		job->reply->result = rc;
1450 		job->job_done(job);
1451 	}
1452 	return;
1453 }
1454 
1455 /**
1456  * lpfc_issue_ct_rsp - issue a ct response
1457  * @phba: Pointer to HBA context object.
1458  * @job: Pointer to the job object.
1459  * @tag: tag index value into the ports context exchange array.
1460  * @bmp: Pointer to a dma buffer descriptor.
1461  * @num_entry: Number of enties in the bde.
1462  **/
1463 static int
1464 lpfc_issue_ct_rsp(struct lpfc_hba *phba, struct fc_bsg_job *job, uint32_t tag,
1465 		  struct lpfc_dmabuf *cmp, struct lpfc_dmabuf *bmp,
1466 		  int num_entry)
1467 {
1468 	IOCB_t *icmd;
1469 	struct lpfc_iocbq *ctiocb = NULL;
1470 	int rc = 0;
1471 	struct lpfc_nodelist *ndlp = NULL;
1472 	struct bsg_job_data *dd_data;
1473 	unsigned long flags;
1474 	uint32_t creg_val;
1475 
1476 	/* allocate our bsg tracking structure */
1477 	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
1478 	if (!dd_data) {
1479 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1480 				"2736 Failed allocation of dd_data\n");
1481 		rc = -ENOMEM;
1482 		goto no_dd_data;
1483 	}
1484 
1485 	/* Allocate buffer for  command iocb */
1486 	ctiocb = lpfc_sli_get_iocbq(phba);
1487 	if (!ctiocb) {
1488 		rc = -ENOMEM;
1489 		goto no_ctiocb;
1490 	}
1491 
1492 	icmd = &ctiocb->iocb;
1493 	icmd->un.xseq64.bdl.ulpIoTag32 = 0;
1494 	icmd->un.xseq64.bdl.addrHigh = putPaddrHigh(bmp->phys);
1495 	icmd->un.xseq64.bdl.addrLow = putPaddrLow(bmp->phys);
1496 	icmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
1497 	icmd->un.xseq64.bdl.bdeSize = (num_entry * sizeof(struct ulp_bde64));
1498 	icmd->un.xseq64.w5.hcsw.Fctl = (LS | LA);
1499 	icmd->un.xseq64.w5.hcsw.Dfctl = 0;
1500 	icmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_SOL_CTL;
1501 	icmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT;
1502 
1503 	/* Fill in rest of iocb */
1504 	icmd->ulpCommand = CMD_XMIT_SEQUENCE64_CX;
1505 	icmd->ulpBdeCount = 1;
1506 	icmd->ulpLe = 1;
1507 	icmd->ulpClass = CLASS3;
1508 	if (phba->sli_rev == LPFC_SLI_REV4) {
1509 		/* Do not issue unsol response if oxid not marked as valid */
1510 		if (phba->ct_ctx[tag].valid != UNSOL_VALID) {
1511 			rc = IOCB_ERROR;
1512 			goto issue_ct_rsp_exit;
1513 		}
1514 		icmd->ulpContext = phba->ct_ctx[tag].rxid;
1515 		icmd->unsli3.rcvsli3.ox_id = phba->ct_ctx[tag].oxid;
1516 		ndlp = lpfc_findnode_did(phba->pport, phba->ct_ctx[tag].SID);
1517 		if (!ndlp) {
1518 			lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
1519 				 "2721 ndlp null for oxid %x SID %x\n",
1520 					icmd->ulpContext,
1521 					phba->ct_ctx[tag].SID);
1522 			rc = IOCB_ERROR;
1523 			goto issue_ct_rsp_exit;
1524 		}
1525 
1526 		/* Check if the ndlp is active */
1527 		if (!ndlp || !NLP_CHK_NODE_ACT(ndlp)) {
1528 			rc = IOCB_ERROR;
1529 			goto issue_ct_rsp_exit;
1530 		}
1531 
1532 		/* get a refernece count so the ndlp doesn't go away while
1533 		 * we respond
1534 		 */
1535 		if (!lpfc_nlp_get(ndlp)) {
1536 			rc = IOCB_ERROR;
1537 			goto issue_ct_rsp_exit;
1538 		}
1539 
1540 		icmd->un.ulpWord[3] =
1541 				phba->sli4_hba.rpi_ids[ndlp->nlp_rpi];
1542 
1543 		/* The exchange is done, mark the entry as invalid */
1544 		phba->ct_ctx[tag].valid = UNSOL_INVALID;
1545 	} else
1546 		icmd->ulpContext = (ushort) tag;
1547 
1548 	icmd->ulpTimeout = phba->fc_ratov * 2;
1549 
1550 	/* Xmit CT response on exchange <xid> */
1551 	lpfc_printf_log(phba, KERN_INFO, LOG_ELS,
1552 		"2722 Xmit CT response on exchange x%x Data: x%x x%x x%x\n",
1553 		icmd->ulpContext, icmd->ulpIoTag, tag, phba->link_state);
1554 
1555 	ctiocb->iocb_cmpl = NULL;
1556 	ctiocb->iocb_flag |= LPFC_IO_LIBDFC;
1557 	ctiocb->vport = phba->pport;
1558 	ctiocb->context1 = dd_data;
1559 	ctiocb->context2 = cmp;
1560 	ctiocb->context3 = bmp;
1561 	ctiocb->context_un.ndlp = ndlp;
1562 	ctiocb->iocb_cmpl = lpfc_issue_ct_rsp_cmp;
1563 
1564 	dd_data->type = TYPE_IOCB;
1565 	dd_data->set_job = job;
1566 	dd_data->context_un.iocb.cmdiocbq = ctiocb;
1567 	dd_data->context_un.iocb.ndlp = ndlp;
1568 	dd_data->context_un.iocb.rmp = NULL;
1569 	job->dd_data = dd_data;
1570 
1571 	if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
1572 		if (lpfc_readl(phba->HCregaddr, &creg_val)) {
1573 			rc = -IOCB_ERROR;
1574 			goto issue_ct_rsp_exit;
1575 		}
1576 		creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
1577 		writel(creg_val, phba->HCregaddr);
1578 		readl(phba->HCregaddr); /* flush */
1579 	}
1580 
1581 	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, ctiocb, 0);
1582 
1583 	if (rc == IOCB_SUCCESS) {
1584 		spin_lock_irqsave(&phba->hbalock, flags);
1585 		/* make sure the I/O had not been completed/released */
1586 		if (ctiocb->iocb_flag & LPFC_IO_LIBDFC) {
1587 			/* open up abort window to timeout handler */
1588 			ctiocb->iocb_flag |= LPFC_IO_CMD_OUTSTANDING;
1589 		}
1590 		spin_unlock_irqrestore(&phba->hbalock, flags);
1591 		return 0; /* done for now */
1592 	}
1593 
1594 	/* iocb failed so cleanup */
1595 	job->dd_data = NULL;
1596 
1597 issue_ct_rsp_exit:
1598 	lpfc_sli_release_iocbq(phba, ctiocb);
1599 no_ctiocb:
1600 	kfree(dd_data);
1601 no_dd_data:
1602 	return rc;
1603 }
1604 
1605 /**
1606  * lpfc_bsg_send_mgmt_rsp - process a SEND_MGMT_RESP bsg vendor command
1607  * @job: SEND_MGMT_RESP fc_bsg_job
1608  **/
1609 static int
1610 lpfc_bsg_send_mgmt_rsp(struct fc_bsg_job *job)
1611 {
1612 	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
1613 	struct lpfc_hba *phba = vport->phba;
1614 	struct send_mgmt_resp *mgmt_resp = (struct send_mgmt_resp *)
1615 		job->request->rqst_data.h_vendor.vendor_cmd;
1616 	struct ulp_bde64 *bpl;
1617 	struct lpfc_dmabuf *bmp = NULL, *cmp = NULL;
1618 	int bpl_entries;
1619 	uint32_t tag = mgmt_resp->tag;
1620 	unsigned long reqbfrcnt =
1621 			(unsigned long)job->request_payload.payload_len;
1622 	int rc = 0;
1623 
1624 	/* in case no data is transferred */
1625 	job->reply->reply_payload_rcv_len = 0;
1626 
1627 	if (!reqbfrcnt || (reqbfrcnt > (80 * BUF_SZ_4K))) {
1628 		rc = -ERANGE;
1629 		goto send_mgmt_rsp_exit;
1630 	}
1631 
1632 	bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
1633 	if (!bmp) {
1634 		rc = -ENOMEM;
1635 		goto send_mgmt_rsp_exit;
1636 	}
1637 
1638 	bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
1639 	if (!bmp->virt) {
1640 		rc = -ENOMEM;
1641 		goto send_mgmt_rsp_free_bmp;
1642 	}
1643 
1644 	INIT_LIST_HEAD(&bmp->list);
1645 	bpl = (struct ulp_bde64 *) bmp->virt;
1646 	bpl_entries = (LPFC_BPL_SIZE/sizeof(struct ulp_bde64));
1647 	cmp = lpfc_alloc_bsg_buffers(phba, job->request_payload.payload_len,
1648 				     1, bpl, &bpl_entries);
1649 	if (!cmp) {
1650 		rc = -ENOMEM;
1651 		goto send_mgmt_rsp_free_bmp;
1652 	}
1653 	lpfc_bsg_copy_data(cmp, &job->request_payload,
1654 			   job->request_payload.payload_len, 1);
1655 
1656 	rc = lpfc_issue_ct_rsp(phba, job, tag, cmp, bmp, bpl_entries);
1657 
1658 	if (rc == IOCB_SUCCESS)
1659 		return 0; /* done for now */
1660 
1661 	rc = -EACCES;
1662 
1663 	lpfc_free_bsg_buffers(phba, cmp);
1664 
1665 send_mgmt_rsp_free_bmp:
1666 	if (bmp->virt)
1667 		lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
1668 	kfree(bmp);
1669 send_mgmt_rsp_exit:
1670 	/* make error code available to userspace */
1671 	job->reply->result = rc;
1672 	job->dd_data = NULL;
1673 	return rc;
1674 }
1675 
1676 /**
1677  * lpfc_bsg_diag_mode_enter - process preparing into device diag loopback mode
1678  * @phba: Pointer to HBA context object.
1679  *
1680  * This function is responsible for preparing driver for diag loopback
1681  * on device.
1682  */
1683 static int
1684 lpfc_bsg_diag_mode_enter(struct lpfc_hba *phba)
1685 {
1686 	struct lpfc_vport **vports;
1687 	struct Scsi_Host *shost;
1688 	struct lpfc_sli *psli;
1689 	struct lpfc_sli_ring *pring;
1690 	int i = 0;
1691 
1692 	psli = &phba->sli;
1693 	if (!psli)
1694 		return -ENODEV;
1695 
1696 	pring = &psli->ring[LPFC_FCP_RING];
1697 	if (!pring)
1698 		return -ENODEV;
1699 
1700 	if ((phba->link_state == LPFC_HBA_ERROR) ||
1701 	    (psli->sli_flag & LPFC_BLOCK_MGMT_IO) ||
1702 	    (!(psli->sli_flag & LPFC_SLI_ACTIVE)))
1703 		return -EACCES;
1704 
1705 	vports = lpfc_create_vport_work_array(phba);
1706 	if (vports) {
1707 		for (i = 0; i <= phba->max_vpi && vports[i] != NULL; i++) {
1708 			shost = lpfc_shost_from_vport(vports[i]);
1709 			scsi_block_requests(shost);
1710 		}
1711 		lpfc_destroy_vport_work_array(phba, vports);
1712 	} else {
1713 		shost = lpfc_shost_from_vport(phba->pport);
1714 		scsi_block_requests(shost);
1715 	}
1716 
1717 	while (!list_empty(&pring->txcmplq)) {
1718 		if (i++ > 500)  /* wait up to 5 seconds */
1719 			break;
1720 		msleep(10);
1721 	}
1722 	return 0;
1723 }
1724 
1725 /**
1726  * lpfc_bsg_diag_mode_exit - exit process from device diag loopback mode
1727  * @phba: Pointer to HBA context object.
1728  *
1729  * This function is responsible for driver exit processing of setting up
1730  * diag loopback mode on device.
1731  */
1732 static void
1733 lpfc_bsg_diag_mode_exit(struct lpfc_hba *phba)
1734 {
1735 	struct Scsi_Host *shost;
1736 	struct lpfc_vport **vports;
1737 	int i;
1738 
1739 	vports = lpfc_create_vport_work_array(phba);
1740 	if (vports) {
1741 		for (i = 0; i <= phba->max_vpi && vports[i] != NULL; i++) {
1742 			shost = lpfc_shost_from_vport(vports[i]);
1743 			scsi_unblock_requests(shost);
1744 		}
1745 		lpfc_destroy_vport_work_array(phba, vports);
1746 	} else {
1747 		shost = lpfc_shost_from_vport(phba->pport);
1748 		scsi_unblock_requests(shost);
1749 	}
1750 	return;
1751 }
1752 
1753 /**
1754  * lpfc_sli3_bsg_diag_loopback_mode - process an sli3 bsg vendor command
1755  * @phba: Pointer to HBA context object.
1756  * @job: LPFC_BSG_VENDOR_DIAG_MODE
1757  *
1758  * This function is responsible for placing an sli3  port into diagnostic
1759  * loopback mode in order to perform a diagnostic loopback test.
1760  * All new scsi requests are blocked, a small delay is used to allow the
1761  * scsi requests to complete then the link is brought down. If the link is
1762  * is placed in loopback mode then scsi requests are again allowed
1763  * so the scsi mid-layer doesn't give up on the port.
1764  * All of this is done in-line.
1765  */
1766 static int
1767 lpfc_sli3_bsg_diag_loopback_mode(struct lpfc_hba *phba, struct fc_bsg_job *job)
1768 {
1769 	struct diag_mode_set *loopback_mode;
1770 	uint32_t link_flags;
1771 	uint32_t timeout;
1772 	LPFC_MBOXQ_t *pmboxq  = NULL;
1773 	int mbxstatus = MBX_SUCCESS;
1774 	int i = 0;
1775 	int rc = 0;
1776 
1777 	/* no data to return just the return code */
1778 	job->reply->reply_payload_rcv_len = 0;
1779 
1780 	if (job->request_len < sizeof(struct fc_bsg_request) +
1781 	    sizeof(struct diag_mode_set)) {
1782 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1783 				"2738 Received DIAG MODE request size:%d "
1784 				"below the minimum size:%d\n",
1785 				job->request_len,
1786 				(int)(sizeof(struct fc_bsg_request) +
1787 				sizeof(struct diag_mode_set)));
1788 		rc = -EINVAL;
1789 		goto job_error;
1790 	}
1791 
1792 	rc = lpfc_bsg_diag_mode_enter(phba);
1793 	if (rc)
1794 		goto job_error;
1795 
1796 	/* bring the link to diagnostic mode */
1797 	loopback_mode = (struct diag_mode_set *)
1798 		job->request->rqst_data.h_vendor.vendor_cmd;
1799 	link_flags = loopback_mode->type;
1800 	timeout = loopback_mode->timeout * 100;
1801 
1802 	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1803 	if (!pmboxq) {
1804 		rc = -ENOMEM;
1805 		goto loopback_mode_exit;
1806 	}
1807 	memset((void *)pmboxq, 0, sizeof(LPFC_MBOXQ_t));
1808 	pmboxq->u.mb.mbxCommand = MBX_DOWN_LINK;
1809 	pmboxq->u.mb.mbxOwner = OWN_HOST;
1810 
1811 	mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, LPFC_MBOX_TMO);
1812 
1813 	if ((mbxstatus == MBX_SUCCESS) && (pmboxq->u.mb.mbxStatus == 0)) {
1814 		/* wait for link down before proceeding */
1815 		i = 0;
1816 		while (phba->link_state != LPFC_LINK_DOWN) {
1817 			if (i++ > timeout) {
1818 				rc = -ETIMEDOUT;
1819 				goto loopback_mode_exit;
1820 			}
1821 			msleep(10);
1822 		}
1823 
1824 		memset((void *)pmboxq, 0, sizeof(LPFC_MBOXQ_t));
1825 		if (link_flags == INTERNAL_LOOP_BACK)
1826 			pmboxq->u.mb.un.varInitLnk.link_flags = FLAGS_LOCAL_LB;
1827 		else
1828 			pmboxq->u.mb.un.varInitLnk.link_flags =
1829 				FLAGS_TOPOLOGY_MODE_LOOP;
1830 
1831 		pmboxq->u.mb.mbxCommand = MBX_INIT_LINK;
1832 		pmboxq->u.mb.mbxOwner = OWN_HOST;
1833 
1834 		mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq,
1835 						     LPFC_MBOX_TMO);
1836 
1837 		if ((mbxstatus != MBX_SUCCESS) || (pmboxq->u.mb.mbxStatus))
1838 			rc = -ENODEV;
1839 		else {
1840 			spin_lock_irq(&phba->hbalock);
1841 			phba->link_flag |= LS_LOOPBACK_MODE;
1842 			spin_unlock_irq(&phba->hbalock);
1843 			/* wait for the link attention interrupt */
1844 			msleep(100);
1845 
1846 			i = 0;
1847 			while (phba->link_state != LPFC_HBA_READY) {
1848 				if (i++ > timeout) {
1849 					rc = -ETIMEDOUT;
1850 					break;
1851 				}
1852 
1853 				msleep(10);
1854 			}
1855 		}
1856 
1857 	} else
1858 		rc = -ENODEV;
1859 
1860 loopback_mode_exit:
1861 	lpfc_bsg_diag_mode_exit(phba);
1862 
1863 	/*
1864 	 * Let SLI layer release mboxq if mbox command completed after timeout.
1865 	 */
1866 	if (pmboxq && mbxstatus != MBX_TIMEOUT)
1867 		mempool_free(pmboxq, phba->mbox_mem_pool);
1868 
1869 job_error:
1870 	/* make error code available to userspace */
1871 	job->reply->result = rc;
1872 	/* complete the job back to userspace if no error */
1873 	if (rc == 0)
1874 		job->job_done(job);
1875 	return rc;
1876 }
1877 
1878 /**
1879  * lpfc_sli4_bsg_set_link_diag_state - set sli4 link diag state
1880  * @phba: Pointer to HBA context object.
1881  * @diag: Flag for set link to diag or nomral operation state.
1882  *
1883  * This function is responsible for issuing a sli4 mailbox command for setting
1884  * link to either diag state or normal operation state.
1885  */
1886 static int
1887 lpfc_sli4_bsg_set_link_diag_state(struct lpfc_hba *phba, uint32_t diag)
1888 {
1889 	LPFC_MBOXQ_t *pmboxq;
1890 	struct lpfc_mbx_set_link_diag_state *link_diag_state;
1891 	uint32_t req_len, alloc_len;
1892 	int mbxstatus = MBX_SUCCESS, rc;
1893 
1894 	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1895 	if (!pmboxq)
1896 		return -ENOMEM;
1897 
1898 	req_len = (sizeof(struct lpfc_mbx_set_link_diag_state) -
1899 		   sizeof(struct lpfc_sli4_cfg_mhdr));
1900 	alloc_len = lpfc_sli4_config(phba, pmboxq, LPFC_MBOX_SUBSYSTEM_FCOE,
1901 				LPFC_MBOX_OPCODE_FCOE_LINK_DIAG_STATE,
1902 				req_len, LPFC_SLI4_MBX_EMBED);
1903 	if (alloc_len != req_len) {
1904 		rc = -ENOMEM;
1905 		goto link_diag_state_set_out;
1906 	}
1907 	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
1908 			"3128 Set link to diagnostic state:x%x (x%x/x%x)\n",
1909 			diag, phba->sli4_hba.lnk_info.lnk_tp,
1910 			phba->sli4_hba.lnk_info.lnk_no);
1911 
1912 	link_diag_state = &pmboxq->u.mqe.un.link_diag_state;
1913 	bf_set(lpfc_mbx_set_diag_state_diag_bit_valid, &link_diag_state->u.req,
1914 	       LPFC_DIAG_STATE_DIAG_BIT_VALID_CHANGE);
1915 	bf_set(lpfc_mbx_set_diag_state_link_num, &link_diag_state->u.req,
1916 	       phba->sli4_hba.lnk_info.lnk_no);
1917 	bf_set(lpfc_mbx_set_diag_state_link_type, &link_diag_state->u.req,
1918 	       phba->sli4_hba.lnk_info.lnk_tp);
1919 	if (diag)
1920 		bf_set(lpfc_mbx_set_diag_state_diag,
1921 		       &link_diag_state->u.req, 1);
1922 	else
1923 		bf_set(lpfc_mbx_set_diag_state_diag,
1924 		       &link_diag_state->u.req, 0);
1925 
1926 	mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, LPFC_MBOX_TMO);
1927 
1928 	if ((mbxstatus == MBX_SUCCESS) && (pmboxq->u.mb.mbxStatus == 0))
1929 		rc = 0;
1930 	else
1931 		rc = -ENODEV;
1932 
1933 link_diag_state_set_out:
1934 	if (pmboxq && (mbxstatus != MBX_TIMEOUT))
1935 		mempool_free(pmboxq, phba->mbox_mem_pool);
1936 
1937 	return rc;
1938 }
1939 
1940 /**
1941  * lpfc_sli4_bsg_set_internal_loopback - set sli4 internal loopback diagnostic
1942  * @phba: Pointer to HBA context object.
1943  *
1944  * This function is responsible for issuing a sli4 mailbox command for setting
1945  * up internal loopback diagnostic.
1946  */
1947 static int
1948 lpfc_sli4_bsg_set_internal_loopback(struct lpfc_hba *phba)
1949 {
1950 	LPFC_MBOXQ_t *pmboxq;
1951 	uint32_t req_len, alloc_len;
1952 	struct lpfc_mbx_set_link_diag_loopback *link_diag_loopback;
1953 	int mbxstatus = MBX_SUCCESS, rc = 0;
1954 
1955 	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1956 	if (!pmboxq)
1957 		return -ENOMEM;
1958 	req_len = (sizeof(struct lpfc_mbx_set_link_diag_loopback) -
1959 		   sizeof(struct lpfc_sli4_cfg_mhdr));
1960 	alloc_len = lpfc_sli4_config(phba, pmboxq, LPFC_MBOX_SUBSYSTEM_FCOE,
1961 				LPFC_MBOX_OPCODE_FCOE_LINK_DIAG_LOOPBACK,
1962 				req_len, LPFC_SLI4_MBX_EMBED);
1963 	if (alloc_len != req_len) {
1964 		mempool_free(pmboxq, phba->mbox_mem_pool);
1965 		return -ENOMEM;
1966 	}
1967 	link_diag_loopback = &pmboxq->u.mqe.un.link_diag_loopback;
1968 	bf_set(lpfc_mbx_set_diag_state_link_num,
1969 	       &link_diag_loopback->u.req, phba->sli4_hba.lnk_info.lnk_no);
1970 	bf_set(lpfc_mbx_set_diag_state_link_type,
1971 	       &link_diag_loopback->u.req, phba->sli4_hba.lnk_info.lnk_tp);
1972 	bf_set(lpfc_mbx_set_diag_lpbk_type, &link_diag_loopback->u.req,
1973 	       LPFC_DIAG_LOOPBACK_TYPE_INTERNAL);
1974 
1975 	mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, LPFC_MBOX_TMO);
1976 	if ((mbxstatus != MBX_SUCCESS) || (pmboxq->u.mb.mbxStatus)) {
1977 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1978 				"3127 Failed setup loopback mode mailbox "
1979 				"command, rc:x%x, status:x%x\n", mbxstatus,
1980 				pmboxq->u.mb.mbxStatus);
1981 		rc = -ENODEV;
1982 	}
1983 	if (pmboxq && (mbxstatus != MBX_TIMEOUT))
1984 		mempool_free(pmboxq, phba->mbox_mem_pool);
1985 	return rc;
1986 }
1987 
1988 /**
1989  * lpfc_sli4_diag_fcport_reg_setup - setup port registrations for diagnostic
1990  * @phba: Pointer to HBA context object.
1991  *
1992  * This function set up SLI4 FC port registrations for diagnostic run, which
1993  * includes all the rpis, vfi, and also vpi.
1994  */
1995 static int
1996 lpfc_sli4_diag_fcport_reg_setup(struct lpfc_hba *phba)
1997 {
1998 	int rc;
1999 
2000 	if (phba->pport->fc_flag & FC_VFI_REGISTERED) {
2001 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2002 				"3136 Port still had vfi registered: "
2003 				"mydid:x%x, fcfi:%d, vfi:%d, vpi:%d\n",
2004 				phba->pport->fc_myDID, phba->fcf.fcfi,
2005 				phba->sli4_hba.vfi_ids[phba->pport->vfi],
2006 				phba->vpi_ids[phba->pport->vpi]);
2007 		return -EINVAL;
2008 	}
2009 	rc = lpfc_issue_reg_vfi(phba->pport);
2010 	return rc;
2011 }
2012 
2013 /**
2014  * lpfc_sli4_bsg_diag_loopback_mode - process an sli4 bsg vendor command
2015  * @phba: Pointer to HBA context object.
2016  * @job: LPFC_BSG_VENDOR_DIAG_MODE
2017  *
2018  * This function is responsible for placing an sli4 port into diagnostic
2019  * loopback mode in order to perform a diagnostic loopback test.
2020  */
2021 static int
2022 lpfc_sli4_bsg_diag_loopback_mode(struct lpfc_hba *phba, struct fc_bsg_job *job)
2023 {
2024 	struct diag_mode_set *loopback_mode;
2025 	uint32_t link_flags, timeout;
2026 	int i, rc = 0;
2027 
2028 	/* no data to return just the return code */
2029 	job->reply->reply_payload_rcv_len = 0;
2030 
2031 	if (job->request_len < sizeof(struct fc_bsg_request) +
2032 	    sizeof(struct diag_mode_set)) {
2033 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2034 				"3011 Received DIAG MODE request size:%d "
2035 				"below the minimum size:%d\n",
2036 				job->request_len,
2037 				(int)(sizeof(struct fc_bsg_request) +
2038 				sizeof(struct diag_mode_set)));
2039 		rc = -EINVAL;
2040 		goto job_error;
2041 	}
2042 
2043 	rc = lpfc_bsg_diag_mode_enter(phba);
2044 	if (rc)
2045 		goto job_error;
2046 
2047 	/* indicate we are in loobpack diagnostic mode */
2048 	spin_lock_irq(&phba->hbalock);
2049 	phba->link_flag |= LS_LOOPBACK_MODE;
2050 	spin_unlock_irq(&phba->hbalock);
2051 
2052 	/* reset port to start frome scratch */
2053 	rc = lpfc_selective_reset(phba);
2054 	if (rc)
2055 		goto job_error;
2056 
2057 	/* bring the link to diagnostic mode */
2058 	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2059 			"3129 Bring link to diagnostic state.\n");
2060 	loopback_mode = (struct diag_mode_set *)
2061 		job->request->rqst_data.h_vendor.vendor_cmd;
2062 	link_flags = loopback_mode->type;
2063 	timeout = loopback_mode->timeout * 100;
2064 
2065 	rc = lpfc_sli4_bsg_set_link_diag_state(phba, 1);
2066 	if (rc) {
2067 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2068 				"3130 Failed to bring link to diagnostic "
2069 				"state, rc:x%x\n", rc);
2070 		goto loopback_mode_exit;
2071 	}
2072 
2073 	/* wait for link down before proceeding */
2074 	i = 0;
2075 	while (phba->link_state != LPFC_LINK_DOWN) {
2076 		if (i++ > timeout) {
2077 			rc = -ETIMEDOUT;
2078 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2079 					"3131 Timeout waiting for link to "
2080 					"diagnostic mode, timeout:%d ms\n",
2081 					timeout * 10);
2082 			goto loopback_mode_exit;
2083 		}
2084 		msleep(10);
2085 	}
2086 
2087 	/* set up loopback mode */
2088 	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2089 			"3132 Set up loopback mode:x%x\n", link_flags);
2090 
2091 	if (link_flags == INTERNAL_LOOP_BACK)
2092 		rc = lpfc_sli4_bsg_set_internal_loopback(phba);
2093 	else if (link_flags == EXTERNAL_LOOP_BACK)
2094 		rc = lpfc_hba_init_link_fc_topology(phba,
2095 						    FLAGS_TOPOLOGY_MODE_PT_PT,
2096 						    MBX_NOWAIT);
2097 	else {
2098 		rc = -EINVAL;
2099 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
2100 				"3141 Loopback mode:x%x not supported\n",
2101 				link_flags);
2102 		goto loopback_mode_exit;
2103 	}
2104 
2105 	if (!rc) {
2106 		/* wait for the link attention interrupt */
2107 		msleep(100);
2108 		i = 0;
2109 		while (phba->link_state < LPFC_LINK_UP) {
2110 			if (i++ > timeout) {
2111 				rc = -ETIMEDOUT;
2112 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2113 					"3137 Timeout waiting for link up "
2114 					"in loopback mode, timeout:%d ms\n",
2115 					timeout * 10);
2116 				break;
2117 			}
2118 			msleep(10);
2119 		}
2120 	}
2121 
2122 	/* port resource registration setup for loopback diagnostic */
2123 	if (!rc) {
2124 		/* set up a none zero myDID for loopback test */
2125 		phba->pport->fc_myDID = 1;
2126 		rc = lpfc_sli4_diag_fcport_reg_setup(phba);
2127 	} else
2128 		goto loopback_mode_exit;
2129 
2130 	if (!rc) {
2131 		/* wait for the port ready */
2132 		msleep(100);
2133 		i = 0;
2134 		while (phba->link_state != LPFC_HBA_READY) {
2135 			if (i++ > timeout) {
2136 				rc = -ETIMEDOUT;
2137 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2138 					"3133 Timeout waiting for port "
2139 					"loopback mode ready, timeout:%d ms\n",
2140 					timeout * 10);
2141 				break;
2142 			}
2143 			msleep(10);
2144 		}
2145 	}
2146 
2147 loopback_mode_exit:
2148 	/* clear loopback diagnostic mode */
2149 	if (rc) {
2150 		spin_lock_irq(&phba->hbalock);
2151 		phba->link_flag &= ~LS_LOOPBACK_MODE;
2152 		spin_unlock_irq(&phba->hbalock);
2153 	}
2154 	lpfc_bsg_diag_mode_exit(phba);
2155 
2156 job_error:
2157 	/* make error code available to userspace */
2158 	job->reply->result = rc;
2159 	/* complete the job back to userspace if no error */
2160 	if (rc == 0)
2161 		job->job_done(job);
2162 	return rc;
2163 }
2164 
2165 /**
2166  * lpfc_bsg_diag_loopback_mode - bsg vendor command for diag loopback mode
2167  * @job: LPFC_BSG_VENDOR_DIAG_MODE
2168  *
2169  * This function is responsible for responding to check and dispatch bsg diag
2170  * command from the user to proper driver action routines.
2171  */
2172 static int
2173 lpfc_bsg_diag_loopback_mode(struct fc_bsg_job *job)
2174 {
2175 	struct Scsi_Host *shost;
2176 	struct lpfc_vport *vport;
2177 	struct lpfc_hba *phba;
2178 	int rc;
2179 
2180 	shost = job->shost;
2181 	if (!shost)
2182 		return -ENODEV;
2183 	vport = (struct lpfc_vport *)job->shost->hostdata;
2184 	if (!vport)
2185 		return -ENODEV;
2186 	phba = vport->phba;
2187 	if (!phba)
2188 		return -ENODEV;
2189 
2190 	if (phba->sli_rev < LPFC_SLI_REV4)
2191 		rc = lpfc_sli3_bsg_diag_loopback_mode(phba, job);
2192 	else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) ==
2193 		 LPFC_SLI_INTF_IF_TYPE_2)
2194 		rc = lpfc_sli4_bsg_diag_loopback_mode(phba, job);
2195 	else
2196 		rc = -ENODEV;
2197 
2198 	return rc;
2199 }
2200 
2201 /**
2202  * lpfc_sli4_bsg_diag_mode_end - sli4 bsg vendor command for ending diag mode
2203  * @job: LPFC_BSG_VENDOR_DIAG_MODE_END
2204  *
2205  * This function is responsible for responding to check and dispatch bsg diag
2206  * command from the user to proper driver action routines.
2207  */
2208 static int
2209 lpfc_sli4_bsg_diag_mode_end(struct fc_bsg_job *job)
2210 {
2211 	struct Scsi_Host *shost;
2212 	struct lpfc_vport *vport;
2213 	struct lpfc_hba *phba;
2214 	struct diag_mode_set *loopback_mode_end_cmd;
2215 	uint32_t timeout;
2216 	int rc, i;
2217 
2218 	shost = job->shost;
2219 	if (!shost)
2220 		return -ENODEV;
2221 	vport = (struct lpfc_vport *)job->shost->hostdata;
2222 	if (!vport)
2223 		return -ENODEV;
2224 	phba = vport->phba;
2225 	if (!phba)
2226 		return -ENODEV;
2227 
2228 	if (phba->sli_rev < LPFC_SLI_REV4)
2229 		return -ENODEV;
2230 	if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
2231 	    LPFC_SLI_INTF_IF_TYPE_2)
2232 		return -ENODEV;
2233 
2234 	/* clear loopback diagnostic mode */
2235 	spin_lock_irq(&phba->hbalock);
2236 	phba->link_flag &= ~LS_LOOPBACK_MODE;
2237 	spin_unlock_irq(&phba->hbalock);
2238 	loopback_mode_end_cmd = (struct diag_mode_set *)
2239 			job->request->rqst_data.h_vendor.vendor_cmd;
2240 	timeout = loopback_mode_end_cmd->timeout * 100;
2241 
2242 	rc = lpfc_sli4_bsg_set_link_diag_state(phba, 0);
2243 	if (rc) {
2244 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2245 				"3139 Failed to bring link to diagnostic "
2246 				"state, rc:x%x\n", rc);
2247 		goto loopback_mode_end_exit;
2248 	}
2249 
2250 	/* wait for link down before proceeding */
2251 	i = 0;
2252 	while (phba->link_state != LPFC_LINK_DOWN) {
2253 		if (i++ > timeout) {
2254 			rc = -ETIMEDOUT;
2255 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2256 					"3140 Timeout waiting for link to "
2257 					"diagnostic mode_end, timeout:%d ms\n",
2258 					timeout * 10);
2259 			/* there is nothing much we can do here */
2260 			break;
2261 		}
2262 		msleep(10);
2263 	}
2264 
2265 	/* reset port resource registrations */
2266 	rc = lpfc_selective_reset(phba);
2267 	phba->pport->fc_myDID = 0;
2268 
2269 loopback_mode_end_exit:
2270 	/* make return code available to userspace */
2271 	job->reply->result = rc;
2272 	/* complete the job back to userspace if no error */
2273 	if (rc == 0)
2274 		job->job_done(job);
2275 	return rc;
2276 }
2277 
2278 /**
2279  * lpfc_sli4_bsg_link_diag_test - sli4 bsg vendor command for diag link test
2280  * @job: LPFC_BSG_VENDOR_DIAG_LINK_TEST
2281  *
2282  * This function is to perform SLI4 diag link test request from the user
2283  * applicaiton.
2284  */
2285 static int
2286 lpfc_sli4_bsg_link_diag_test(struct fc_bsg_job *job)
2287 {
2288 	struct Scsi_Host *shost;
2289 	struct lpfc_vport *vport;
2290 	struct lpfc_hba *phba;
2291 	LPFC_MBOXQ_t *pmboxq;
2292 	struct sli4_link_diag *link_diag_test_cmd;
2293 	uint32_t req_len, alloc_len;
2294 	uint32_t timeout;
2295 	struct lpfc_mbx_run_link_diag_test *run_link_diag_test;
2296 	union lpfc_sli4_cfg_shdr *shdr;
2297 	uint32_t shdr_status, shdr_add_status;
2298 	struct diag_status *diag_status_reply;
2299 	int mbxstatus, rc = 0;
2300 
2301 	shost = job->shost;
2302 	if (!shost) {
2303 		rc = -ENODEV;
2304 		goto job_error;
2305 	}
2306 	vport = (struct lpfc_vport *)job->shost->hostdata;
2307 	if (!vport) {
2308 		rc = -ENODEV;
2309 		goto job_error;
2310 	}
2311 	phba = vport->phba;
2312 	if (!phba) {
2313 		rc = -ENODEV;
2314 		goto job_error;
2315 	}
2316 
2317 	if (phba->sli_rev < LPFC_SLI_REV4) {
2318 		rc = -ENODEV;
2319 		goto job_error;
2320 	}
2321 	if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
2322 	    LPFC_SLI_INTF_IF_TYPE_2) {
2323 		rc = -ENODEV;
2324 		goto job_error;
2325 	}
2326 
2327 	if (job->request_len < sizeof(struct fc_bsg_request) +
2328 	    sizeof(struct sli4_link_diag)) {
2329 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2330 				"3013 Received LINK DIAG TEST request "
2331 				" size:%d below the minimum size:%d\n",
2332 				job->request_len,
2333 				(int)(sizeof(struct fc_bsg_request) +
2334 				sizeof(struct sli4_link_diag)));
2335 		rc = -EINVAL;
2336 		goto job_error;
2337 	}
2338 
2339 	rc = lpfc_bsg_diag_mode_enter(phba);
2340 	if (rc)
2341 		goto job_error;
2342 
2343 	link_diag_test_cmd = (struct sli4_link_diag *)
2344 			 job->request->rqst_data.h_vendor.vendor_cmd;
2345 	timeout = link_diag_test_cmd->timeout * 100;
2346 
2347 	rc = lpfc_sli4_bsg_set_link_diag_state(phba, 1);
2348 
2349 	if (rc)
2350 		goto job_error;
2351 
2352 	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
2353 	if (!pmboxq) {
2354 		rc = -ENOMEM;
2355 		goto link_diag_test_exit;
2356 	}
2357 
2358 	req_len = (sizeof(struct lpfc_mbx_set_link_diag_state) -
2359 		   sizeof(struct lpfc_sli4_cfg_mhdr));
2360 	alloc_len = lpfc_sli4_config(phba, pmboxq, LPFC_MBOX_SUBSYSTEM_FCOE,
2361 				     LPFC_MBOX_OPCODE_FCOE_LINK_DIAG_STATE,
2362 				     req_len, LPFC_SLI4_MBX_EMBED);
2363 	if (alloc_len != req_len) {
2364 		rc = -ENOMEM;
2365 		goto link_diag_test_exit;
2366 	}
2367 	run_link_diag_test = &pmboxq->u.mqe.un.link_diag_test;
2368 	bf_set(lpfc_mbx_run_diag_test_link_num, &run_link_diag_test->u.req,
2369 	       phba->sli4_hba.lnk_info.lnk_no);
2370 	bf_set(lpfc_mbx_run_diag_test_link_type, &run_link_diag_test->u.req,
2371 	       phba->sli4_hba.lnk_info.lnk_tp);
2372 	bf_set(lpfc_mbx_run_diag_test_test_id, &run_link_diag_test->u.req,
2373 	       link_diag_test_cmd->test_id);
2374 	bf_set(lpfc_mbx_run_diag_test_loops, &run_link_diag_test->u.req,
2375 	       link_diag_test_cmd->loops);
2376 	bf_set(lpfc_mbx_run_diag_test_test_ver, &run_link_diag_test->u.req,
2377 	       link_diag_test_cmd->test_version);
2378 	bf_set(lpfc_mbx_run_diag_test_err_act, &run_link_diag_test->u.req,
2379 	       link_diag_test_cmd->error_action);
2380 
2381 	mbxstatus = lpfc_sli_issue_mbox(phba, pmboxq, MBX_POLL);
2382 
2383 	shdr = (union lpfc_sli4_cfg_shdr *)
2384 		&pmboxq->u.mqe.un.sli4_config.header.cfg_shdr;
2385 	shdr_status = bf_get(lpfc_mbox_hdr_status, &shdr->response);
2386 	shdr_add_status = bf_get(lpfc_mbox_hdr_add_status, &shdr->response);
2387 	if (shdr_status || shdr_add_status || mbxstatus) {
2388 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
2389 				"3010 Run link diag test mailbox failed with "
2390 				"mbx_status x%x status x%x, add_status x%x\n",
2391 				mbxstatus, shdr_status, shdr_add_status);
2392 	}
2393 
2394 	diag_status_reply = (struct diag_status *)
2395 			    job->reply->reply_data.vendor_reply.vendor_rsp;
2396 
2397 	if (job->reply_len <
2398 	    sizeof(struct fc_bsg_request) + sizeof(struct diag_status)) {
2399 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2400 				"3012 Received Run link diag test reply "
2401 				"below minimum size (%d): reply_len:%d\n",
2402 				(int)(sizeof(struct fc_bsg_request) +
2403 				sizeof(struct diag_status)),
2404 				job->reply_len);
2405 		rc = -EINVAL;
2406 		goto job_error;
2407 	}
2408 
2409 	diag_status_reply->mbox_status = mbxstatus;
2410 	diag_status_reply->shdr_status = shdr_status;
2411 	diag_status_reply->shdr_add_status = shdr_add_status;
2412 
2413 link_diag_test_exit:
2414 	rc = lpfc_sli4_bsg_set_link_diag_state(phba, 0);
2415 
2416 	if (pmboxq)
2417 		mempool_free(pmboxq, phba->mbox_mem_pool);
2418 
2419 	lpfc_bsg_diag_mode_exit(phba);
2420 
2421 job_error:
2422 	/* make error code available to userspace */
2423 	job->reply->result = rc;
2424 	/* complete the job back to userspace if no error */
2425 	if (rc == 0)
2426 		job->job_done(job);
2427 	return rc;
2428 }
2429 
2430 /**
2431  * lpfcdiag_loop_self_reg - obtains a remote port login id
2432  * @phba: Pointer to HBA context object
2433  * @rpi: Pointer to a remote port login id
2434  *
2435  * This function obtains a remote port login id so the diag loopback test
2436  * can send and receive its own unsolicited CT command.
2437  **/
2438 static int lpfcdiag_loop_self_reg(struct lpfc_hba *phba, uint16_t *rpi)
2439 {
2440 	LPFC_MBOXQ_t *mbox;
2441 	struct lpfc_dmabuf *dmabuff;
2442 	int status;
2443 
2444 	mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
2445 	if (!mbox)
2446 		return -ENOMEM;
2447 
2448 	if (phba->sli_rev < LPFC_SLI_REV4)
2449 		status = lpfc_reg_rpi(phba, 0, phba->pport->fc_myDID,
2450 				(uint8_t *)&phba->pport->fc_sparam,
2451 				mbox, *rpi);
2452 	else {
2453 		*rpi = lpfc_sli4_alloc_rpi(phba);
2454 		status = lpfc_reg_rpi(phba, phba->pport->vpi,
2455 				phba->pport->fc_myDID,
2456 				(uint8_t *)&phba->pport->fc_sparam,
2457 				mbox, *rpi);
2458 	}
2459 
2460 	if (status) {
2461 		mempool_free(mbox, phba->mbox_mem_pool);
2462 		if (phba->sli_rev == LPFC_SLI_REV4)
2463 			lpfc_sli4_free_rpi(phba, *rpi);
2464 		return -ENOMEM;
2465 	}
2466 
2467 	dmabuff = (struct lpfc_dmabuf *) mbox->context1;
2468 	mbox->context1 = NULL;
2469 	mbox->context2 = NULL;
2470 	status = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_TMO);
2471 
2472 	if ((status != MBX_SUCCESS) || (mbox->u.mb.mbxStatus)) {
2473 		lpfc_mbuf_free(phba, dmabuff->virt, dmabuff->phys);
2474 		kfree(dmabuff);
2475 		if (status != MBX_TIMEOUT)
2476 			mempool_free(mbox, phba->mbox_mem_pool);
2477 		if (phba->sli_rev == LPFC_SLI_REV4)
2478 			lpfc_sli4_free_rpi(phba, *rpi);
2479 		return -ENODEV;
2480 	}
2481 
2482 	if (phba->sli_rev < LPFC_SLI_REV4)
2483 		*rpi = mbox->u.mb.un.varWords[0];
2484 
2485 	lpfc_mbuf_free(phba, dmabuff->virt, dmabuff->phys);
2486 	kfree(dmabuff);
2487 	mempool_free(mbox, phba->mbox_mem_pool);
2488 	return 0;
2489 }
2490 
2491 /**
2492  * lpfcdiag_loop_self_unreg - unregs from the rpi
2493  * @phba: Pointer to HBA context object
2494  * @rpi: Remote port login id
2495  *
2496  * This function unregisters the rpi obtained in lpfcdiag_loop_self_reg
2497  **/
2498 static int lpfcdiag_loop_self_unreg(struct lpfc_hba *phba, uint16_t rpi)
2499 {
2500 	LPFC_MBOXQ_t *mbox;
2501 	int status;
2502 
2503 	/* Allocate mboxq structure */
2504 	mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
2505 	if (mbox == NULL)
2506 		return -ENOMEM;
2507 
2508 	if (phba->sli_rev < LPFC_SLI_REV4)
2509 		lpfc_unreg_login(phba, 0, rpi, mbox);
2510 	else
2511 		lpfc_unreg_login(phba, phba->pport->vpi,
2512 				 phba->sli4_hba.rpi_ids[rpi], mbox);
2513 
2514 	status = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_TMO);
2515 
2516 	if ((status != MBX_SUCCESS) || (mbox->u.mb.mbxStatus)) {
2517 		if (status != MBX_TIMEOUT)
2518 			mempool_free(mbox, phba->mbox_mem_pool);
2519 		return -EIO;
2520 	}
2521 	mempool_free(mbox, phba->mbox_mem_pool);
2522 	if (phba->sli_rev == LPFC_SLI_REV4)
2523 		lpfc_sli4_free_rpi(phba, rpi);
2524 	return 0;
2525 }
2526 
2527 /**
2528  * lpfcdiag_loop_get_xri - obtains the transmit and receive ids
2529  * @phba: Pointer to HBA context object
2530  * @rpi: Remote port login id
2531  * @txxri: Pointer to transmit exchange id
2532  * @rxxri: Pointer to response exchabge id
2533  *
2534  * This function obtains the transmit and receive ids required to send
2535  * an unsolicited ct command with a payload. A special lpfc FsType and CmdRsp
2536  * flags are used to the unsolicted response handler is able to process
2537  * the ct command sent on the same port.
2538  **/
2539 static int lpfcdiag_loop_get_xri(struct lpfc_hba *phba, uint16_t rpi,
2540 			 uint16_t *txxri, uint16_t * rxxri)
2541 {
2542 	struct lpfc_bsg_event *evt;
2543 	struct lpfc_iocbq *cmdiocbq, *rspiocbq;
2544 	IOCB_t *cmd, *rsp;
2545 	struct lpfc_dmabuf *dmabuf;
2546 	struct ulp_bde64 *bpl = NULL;
2547 	struct lpfc_sli_ct_request *ctreq = NULL;
2548 	int ret_val = 0;
2549 	int time_left;
2550 	int iocb_stat = IOCB_SUCCESS;
2551 	unsigned long flags;
2552 
2553 	*txxri = 0;
2554 	*rxxri = 0;
2555 	evt = lpfc_bsg_event_new(FC_REG_CT_EVENT, current->pid,
2556 				SLI_CT_ELX_LOOPBACK);
2557 	if (!evt)
2558 		return -ENOMEM;
2559 
2560 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
2561 	list_add(&evt->node, &phba->ct_ev_waiters);
2562 	lpfc_bsg_event_ref(evt);
2563 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2564 
2565 	cmdiocbq = lpfc_sli_get_iocbq(phba);
2566 	rspiocbq = lpfc_sli_get_iocbq(phba);
2567 
2568 	dmabuf = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2569 	if (dmabuf) {
2570 		dmabuf->virt = lpfc_mbuf_alloc(phba, 0, &dmabuf->phys);
2571 		if (dmabuf->virt) {
2572 			INIT_LIST_HEAD(&dmabuf->list);
2573 			bpl = (struct ulp_bde64 *) dmabuf->virt;
2574 			memset(bpl, 0, sizeof(*bpl));
2575 			ctreq = (struct lpfc_sli_ct_request *)(bpl + 1);
2576 			bpl->addrHigh =
2577 				le32_to_cpu(putPaddrHigh(dmabuf->phys +
2578 					sizeof(*bpl)));
2579 			bpl->addrLow =
2580 				le32_to_cpu(putPaddrLow(dmabuf->phys +
2581 					sizeof(*bpl)));
2582 			bpl->tus.f.bdeFlags = 0;
2583 			bpl->tus.f.bdeSize = ELX_LOOPBACK_HEADER_SZ;
2584 			bpl->tus.w = le32_to_cpu(bpl->tus.w);
2585 		}
2586 	}
2587 
2588 	if (cmdiocbq == NULL || rspiocbq == NULL ||
2589 	    dmabuf == NULL || bpl == NULL || ctreq == NULL ||
2590 		dmabuf->virt == NULL) {
2591 		ret_val = -ENOMEM;
2592 		goto err_get_xri_exit;
2593 	}
2594 
2595 	cmd = &cmdiocbq->iocb;
2596 	rsp = &rspiocbq->iocb;
2597 
2598 	memset(ctreq, 0, ELX_LOOPBACK_HEADER_SZ);
2599 
2600 	ctreq->RevisionId.bits.Revision = SLI_CT_REVISION;
2601 	ctreq->RevisionId.bits.InId = 0;
2602 	ctreq->FsType = SLI_CT_ELX_LOOPBACK;
2603 	ctreq->FsSubType = 0;
2604 	ctreq->CommandResponse.bits.CmdRsp = ELX_LOOPBACK_XRI_SETUP;
2605 	ctreq->CommandResponse.bits.Size = 0;
2606 
2607 
2608 	cmd->un.xseq64.bdl.addrHigh = putPaddrHigh(dmabuf->phys);
2609 	cmd->un.xseq64.bdl.addrLow = putPaddrLow(dmabuf->phys);
2610 	cmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
2611 	cmd->un.xseq64.bdl.bdeSize = sizeof(*bpl);
2612 
2613 	cmd->un.xseq64.w5.hcsw.Fctl = LA;
2614 	cmd->un.xseq64.w5.hcsw.Dfctl = 0;
2615 	cmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL;
2616 	cmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT;
2617 
2618 	cmd->ulpCommand = CMD_XMIT_SEQUENCE64_CR;
2619 	cmd->ulpBdeCount = 1;
2620 	cmd->ulpLe = 1;
2621 	cmd->ulpClass = CLASS3;
2622 	cmd->ulpContext = rpi;
2623 
2624 	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
2625 	cmdiocbq->vport = phba->pport;
2626 	cmdiocbq->iocb_cmpl = NULL;
2627 
2628 	iocb_stat = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq,
2629 				rspiocbq,
2630 				(phba->fc_ratov * 2)
2631 				+ LPFC_DRVR_TIMEOUT);
2632 	if ((iocb_stat != IOCB_SUCCESS) || (rsp->ulpStatus != IOSTAT_SUCCESS)) {
2633 		ret_val = -EIO;
2634 		goto err_get_xri_exit;
2635 	}
2636 	*txxri =  rsp->ulpContext;
2637 
2638 	evt->waiting = 1;
2639 	evt->wait_time_stamp = jiffies;
2640 	time_left = wait_event_interruptible_timeout(
2641 		evt->wq, !list_empty(&evt->events_to_see),
2642 		msecs_to_jiffies(1000 *
2643 			((phba->fc_ratov * 2) + LPFC_DRVR_TIMEOUT)));
2644 	if (list_empty(&evt->events_to_see))
2645 		ret_val = (time_left) ? -EINTR : -ETIMEDOUT;
2646 	else {
2647 		spin_lock_irqsave(&phba->ct_ev_lock, flags);
2648 		list_move(evt->events_to_see.prev, &evt->events_to_get);
2649 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2650 		*rxxri = (list_entry(evt->events_to_get.prev,
2651 				     typeof(struct event_data),
2652 				     node))->immed_dat;
2653 	}
2654 	evt->waiting = 0;
2655 
2656 err_get_xri_exit:
2657 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
2658 	lpfc_bsg_event_unref(evt); /* release ref */
2659 	lpfc_bsg_event_unref(evt); /* delete */
2660 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2661 
2662 	if (dmabuf) {
2663 		if (dmabuf->virt)
2664 			lpfc_mbuf_free(phba, dmabuf->virt, dmabuf->phys);
2665 		kfree(dmabuf);
2666 	}
2667 
2668 	if (cmdiocbq && (iocb_stat != IOCB_TIMEDOUT))
2669 		lpfc_sli_release_iocbq(phba, cmdiocbq);
2670 	if (rspiocbq)
2671 		lpfc_sli_release_iocbq(phba, rspiocbq);
2672 	return ret_val;
2673 }
2674 
2675 /**
2676  * lpfc_bsg_dma_page_alloc - allocate a bsg mbox page sized dma buffers
2677  * @phba: Pointer to HBA context object
2678  *
2679  * This function allocates BSG_MBOX_SIZE (4KB) page size dma buffer and.
2680  * returns the pointer to the buffer.
2681  **/
2682 static struct lpfc_dmabuf *
2683 lpfc_bsg_dma_page_alloc(struct lpfc_hba *phba)
2684 {
2685 	struct lpfc_dmabuf *dmabuf;
2686 	struct pci_dev *pcidev = phba->pcidev;
2687 
2688 	/* allocate dma buffer struct */
2689 	dmabuf = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2690 	if (!dmabuf)
2691 		return NULL;
2692 
2693 	INIT_LIST_HEAD(&dmabuf->list);
2694 
2695 	/* now, allocate dma buffer */
2696 	dmabuf->virt = dma_alloc_coherent(&pcidev->dev, BSG_MBOX_SIZE,
2697 					  &(dmabuf->phys), GFP_KERNEL);
2698 
2699 	if (!dmabuf->virt) {
2700 		kfree(dmabuf);
2701 		return NULL;
2702 	}
2703 	memset((uint8_t *)dmabuf->virt, 0, BSG_MBOX_SIZE);
2704 
2705 	return dmabuf;
2706 }
2707 
2708 /**
2709  * lpfc_bsg_dma_page_free - free a bsg mbox page sized dma buffer
2710  * @phba: Pointer to HBA context object.
2711  * @dmabuf: Pointer to the bsg mbox page sized dma buffer descriptor.
2712  *
2713  * This routine just simply frees a dma buffer and its associated buffer
2714  * descriptor referred by @dmabuf.
2715  **/
2716 static void
2717 lpfc_bsg_dma_page_free(struct lpfc_hba *phba, struct lpfc_dmabuf *dmabuf)
2718 {
2719 	struct pci_dev *pcidev = phba->pcidev;
2720 
2721 	if (!dmabuf)
2722 		return;
2723 
2724 	if (dmabuf->virt)
2725 		dma_free_coherent(&pcidev->dev, BSG_MBOX_SIZE,
2726 				  dmabuf->virt, dmabuf->phys);
2727 	kfree(dmabuf);
2728 	return;
2729 }
2730 
2731 /**
2732  * lpfc_bsg_dma_page_list_free - free a list of bsg mbox page sized dma buffers
2733  * @phba: Pointer to HBA context object.
2734  * @dmabuf_list: Pointer to a list of bsg mbox page sized dma buffer descs.
2735  *
2736  * This routine just simply frees all dma buffers and their associated buffer
2737  * descriptors referred by @dmabuf_list.
2738  **/
2739 static void
2740 lpfc_bsg_dma_page_list_free(struct lpfc_hba *phba,
2741 			    struct list_head *dmabuf_list)
2742 {
2743 	struct lpfc_dmabuf *dmabuf, *next_dmabuf;
2744 
2745 	if (list_empty(dmabuf_list))
2746 		return;
2747 
2748 	list_for_each_entry_safe(dmabuf, next_dmabuf, dmabuf_list, list) {
2749 		list_del_init(&dmabuf->list);
2750 		lpfc_bsg_dma_page_free(phba, dmabuf);
2751 	}
2752 	return;
2753 }
2754 
2755 /**
2756  * diag_cmd_data_alloc - fills in a bde struct with dma buffers
2757  * @phba: Pointer to HBA context object
2758  * @bpl: Pointer to 64 bit bde structure
2759  * @size: Number of bytes to process
2760  * @nocopydata: Flag to copy user data into the allocated buffer
2761  *
2762  * This function allocates page size buffers and populates an lpfc_dmabufext.
2763  * If allowed the user data pointed to with indataptr is copied into the kernel
2764  * memory. The chained list of page size buffers is returned.
2765  **/
2766 static struct lpfc_dmabufext *
2767 diag_cmd_data_alloc(struct lpfc_hba *phba,
2768 		   struct ulp_bde64 *bpl, uint32_t size,
2769 		   int nocopydata)
2770 {
2771 	struct lpfc_dmabufext *mlist = NULL;
2772 	struct lpfc_dmabufext *dmp;
2773 	int cnt, offset = 0, i = 0;
2774 	struct pci_dev *pcidev;
2775 
2776 	pcidev = phba->pcidev;
2777 
2778 	while (size) {
2779 		/* We get chunks of 4K */
2780 		if (size > BUF_SZ_4K)
2781 			cnt = BUF_SZ_4K;
2782 		else
2783 			cnt = size;
2784 
2785 		/* allocate struct lpfc_dmabufext buffer header */
2786 		dmp = kmalloc(sizeof(struct lpfc_dmabufext), GFP_KERNEL);
2787 		if (!dmp)
2788 			goto out;
2789 
2790 		INIT_LIST_HEAD(&dmp->dma.list);
2791 
2792 		/* Queue it to a linked list */
2793 		if (mlist)
2794 			list_add_tail(&dmp->dma.list, &mlist->dma.list);
2795 		else
2796 			mlist = dmp;
2797 
2798 		/* allocate buffer */
2799 		dmp->dma.virt = dma_alloc_coherent(&pcidev->dev,
2800 						   cnt,
2801 						   &(dmp->dma.phys),
2802 						   GFP_KERNEL);
2803 
2804 		if (!dmp->dma.virt)
2805 			goto out;
2806 
2807 		dmp->size = cnt;
2808 
2809 		if (nocopydata) {
2810 			bpl->tus.f.bdeFlags = 0;
2811 			pci_dma_sync_single_for_device(phba->pcidev,
2812 				dmp->dma.phys, LPFC_BPL_SIZE, PCI_DMA_TODEVICE);
2813 
2814 		} else {
2815 			memset((uint8_t *)dmp->dma.virt, 0, cnt);
2816 			bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
2817 		}
2818 
2819 		/* build buffer ptr list for IOCB */
2820 		bpl->addrLow = le32_to_cpu(putPaddrLow(dmp->dma.phys));
2821 		bpl->addrHigh = le32_to_cpu(putPaddrHigh(dmp->dma.phys));
2822 		bpl->tus.f.bdeSize = (ushort) cnt;
2823 		bpl->tus.w = le32_to_cpu(bpl->tus.w);
2824 		bpl++;
2825 
2826 		i++;
2827 		offset += cnt;
2828 		size -= cnt;
2829 	}
2830 
2831 	mlist->flag = i;
2832 	return mlist;
2833 out:
2834 	diag_cmd_data_free(phba, mlist);
2835 	return NULL;
2836 }
2837 
2838 /**
2839  * lpfcdiag_loop_post_rxbufs - post the receive buffers for an unsol CT cmd
2840  * @phba: Pointer to HBA context object
2841  * @rxxri: Receive exchange id
2842  * @len: Number of data bytes
2843  *
2844  * This function allocates and posts a data buffer of sufficient size to receive
2845  * an unsolicted CT command.
2846  **/
2847 static int lpfcdiag_loop_post_rxbufs(struct lpfc_hba *phba, uint16_t rxxri,
2848 			     size_t len)
2849 {
2850 	struct lpfc_sli *psli = &phba->sli;
2851 	struct lpfc_sli_ring *pring = &psli->ring[LPFC_ELS_RING];
2852 	struct lpfc_iocbq *cmdiocbq;
2853 	IOCB_t *cmd = NULL;
2854 	struct list_head head, *curr, *next;
2855 	struct lpfc_dmabuf *rxbmp;
2856 	struct lpfc_dmabuf *dmp;
2857 	struct lpfc_dmabuf *mp[2] = {NULL, NULL};
2858 	struct ulp_bde64 *rxbpl = NULL;
2859 	uint32_t num_bde;
2860 	struct lpfc_dmabufext *rxbuffer = NULL;
2861 	int ret_val = 0;
2862 	int iocb_stat;
2863 	int i = 0;
2864 
2865 	cmdiocbq = lpfc_sli_get_iocbq(phba);
2866 	rxbmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2867 	if (rxbmp != NULL) {
2868 		rxbmp->virt = lpfc_mbuf_alloc(phba, 0, &rxbmp->phys);
2869 		if (rxbmp->virt) {
2870 			INIT_LIST_HEAD(&rxbmp->list);
2871 			rxbpl = (struct ulp_bde64 *) rxbmp->virt;
2872 			rxbuffer = diag_cmd_data_alloc(phba, rxbpl, len, 0);
2873 		}
2874 	}
2875 
2876 	if (!cmdiocbq || !rxbmp || !rxbpl || !rxbuffer) {
2877 		ret_val = -ENOMEM;
2878 		goto err_post_rxbufs_exit;
2879 	}
2880 
2881 	/* Queue buffers for the receive exchange */
2882 	num_bde = (uint32_t)rxbuffer->flag;
2883 	dmp = &rxbuffer->dma;
2884 
2885 	cmd = &cmdiocbq->iocb;
2886 	i = 0;
2887 
2888 	INIT_LIST_HEAD(&head);
2889 	list_add_tail(&head, &dmp->list);
2890 	list_for_each_safe(curr, next, &head) {
2891 		mp[i] = list_entry(curr, struct lpfc_dmabuf, list);
2892 		list_del(curr);
2893 
2894 		if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
2895 			mp[i]->buffer_tag = lpfc_sli_get_buffer_tag(phba);
2896 			cmd->un.quexri64cx.buff.bde.addrHigh =
2897 				putPaddrHigh(mp[i]->phys);
2898 			cmd->un.quexri64cx.buff.bde.addrLow =
2899 				putPaddrLow(mp[i]->phys);
2900 			cmd->un.quexri64cx.buff.bde.tus.f.bdeSize =
2901 				((struct lpfc_dmabufext *)mp[i])->size;
2902 			cmd->un.quexri64cx.buff.buffer_tag = mp[i]->buffer_tag;
2903 			cmd->ulpCommand = CMD_QUE_XRI64_CX;
2904 			cmd->ulpPU = 0;
2905 			cmd->ulpLe = 1;
2906 			cmd->ulpBdeCount = 1;
2907 			cmd->unsli3.que_xri64cx_ext_words.ebde_count = 0;
2908 
2909 		} else {
2910 			cmd->un.cont64[i].addrHigh = putPaddrHigh(mp[i]->phys);
2911 			cmd->un.cont64[i].addrLow = putPaddrLow(mp[i]->phys);
2912 			cmd->un.cont64[i].tus.f.bdeSize =
2913 				((struct lpfc_dmabufext *)mp[i])->size;
2914 					cmd->ulpBdeCount = ++i;
2915 
2916 			if ((--num_bde > 0) && (i < 2))
2917 				continue;
2918 
2919 			cmd->ulpCommand = CMD_QUE_XRI_BUF64_CX;
2920 			cmd->ulpLe = 1;
2921 		}
2922 
2923 		cmd->ulpClass = CLASS3;
2924 		cmd->ulpContext = rxxri;
2925 
2926 		iocb_stat = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq,
2927 						0);
2928 		if (iocb_stat == IOCB_ERROR) {
2929 			diag_cmd_data_free(phba,
2930 				(struct lpfc_dmabufext *)mp[0]);
2931 			if (mp[1])
2932 				diag_cmd_data_free(phba,
2933 					  (struct lpfc_dmabufext *)mp[1]);
2934 			dmp = list_entry(next, struct lpfc_dmabuf, list);
2935 			ret_val = -EIO;
2936 			goto err_post_rxbufs_exit;
2937 		}
2938 
2939 		lpfc_sli_ringpostbuf_put(phba, pring, mp[0]);
2940 		if (mp[1]) {
2941 			lpfc_sli_ringpostbuf_put(phba, pring, mp[1]);
2942 			mp[1] = NULL;
2943 		}
2944 
2945 		/* The iocb was freed by lpfc_sli_issue_iocb */
2946 		cmdiocbq = lpfc_sli_get_iocbq(phba);
2947 		if (!cmdiocbq) {
2948 			dmp = list_entry(next, struct lpfc_dmabuf, list);
2949 			ret_val = -EIO;
2950 			goto err_post_rxbufs_exit;
2951 		}
2952 
2953 		cmd = &cmdiocbq->iocb;
2954 		i = 0;
2955 	}
2956 	list_del(&head);
2957 
2958 err_post_rxbufs_exit:
2959 
2960 	if (rxbmp) {
2961 		if (rxbmp->virt)
2962 			lpfc_mbuf_free(phba, rxbmp->virt, rxbmp->phys);
2963 		kfree(rxbmp);
2964 	}
2965 
2966 	if (cmdiocbq)
2967 		lpfc_sli_release_iocbq(phba, cmdiocbq);
2968 	return ret_val;
2969 }
2970 
2971 /**
2972  * lpfc_bsg_diag_loopback_run - run loopback on a port by issue ct cmd to itself
2973  * @job: LPFC_BSG_VENDOR_DIAG_TEST fc_bsg_job
2974  *
2975  * This function receives a user data buffer to be transmitted and received on
2976  * the same port, the link must be up and in loopback mode prior
2977  * to being called.
2978  * 1. A kernel buffer is allocated to copy the user data into.
2979  * 2. The port registers with "itself".
2980  * 3. The transmit and receive exchange ids are obtained.
2981  * 4. The receive exchange id is posted.
2982  * 5. A new els loopback event is created.
2983  * 6. The command and response iocbs are allocated.
2984  * 7. The cmd iocb FsType is set to elx loopback and the CmdRsp to looppback.
2985  *
2986  * This function is meant to be called n times while the port is in loopback
2987  * so it is the apps responsibility to issue a reset to take the port out
2988  * of loopback mode.
2989  **/
2990 static int
2991 lpfc_bsg_diag_loopback_run(struct fc_bsg_job *job)
2992 {
2993 	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
2994 	struct lpfc_hba *phba = vport->phba;
2995 	struct diag_mode_test *diag_mode;
2996 	struct lpfc_bsg_event *evt;
2997 	struct event_data *evdat;
2998 	struct lpfc_sli *psli = &phba->sli;
2999 	uint32_t size;
3000 	uint32_t full_size;
3001 	size_t segment_len = 0, segment_offset = 0, current_offset = 0;
3002 	uint16_t rpi = 0;
3003 	struct lpfc_iocbq *cmdiocbq, *rspiocbq = NULL;
3004 	IOCB_t *cmd, *rsp = NULL;
3005 	struct lpfc_sli_ct_request *ctreq;
3006 	struct lpfc_dmabuf *txbmp;
3007 	struct ulp_bde64 *txbpl = NULL;
3008 	struct lpfc_dmabufext *txbuffer = NULL;
3009 	struct list_head head;
3010 	struct lpfc_dmabuf  *curr;
3011 	uint16_t txxri = 0, rxxri;
3012 	uint32_t num_bde;
3013 	uint8_t *ptr = NULL, *rx_databuf = NULL;
3014 	int rc = 0;
3015 	int time_left;
3016 	int iocb_stat = IOCB_SUCCESS;
3017 	unsigned long flags;
3018 	void *dataout = NULL;
3019 	uint32_t total_mem;
3020 
3021 	/* in case no data is returned return just the return code */
3022 	job->reply->reply_payload_rcv_len = 0;
3023 
3024 	if (job->request_len <
3025 	    sizeof(struct fc_bsg_request) + sizeof(struct diag_mode_test)) {
3026 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3027 				"2739 Received DIAG TEST request below minimum "
3028 				"size\n");
3029 		rc = -EINVAL;
3030 		goto loopback_test_exit;
3031 	}
3032 
3033 	if (job->request_payload.payload_len !=
3034 		job->reply_payload.payload_len) {
3035 		rc = -EINVAL;
3036 		goto loopback_test_exit;
3037 	}
3038 	diag_mode = (struct diag_mode_test *)
3039 		job->request->rqst_data.h_vendor.vendor_cmd;
3040 
3041 	if ((phba->link_state == LPFC_HBA_ERROR) ||
3042 	    (psli->sli_flag & LPFC_BLOCK_MGMT_IO) ||
3043 	    (!(psli->sli_flag & LPFC_SLI_ACTIVE))) {
3044 		rc = -EACCES;
3045 		goto loopback_test_exit;
3046 	}
3047 
3048 	if (!lpfc_is_link_up(phba) || !(phba->link_flag & LS_LOOPBACK_MODE)) {
3049 		rc = -EACCES;
3050 		goto loopback_test_exit;
3051 	}
3052 
3053 	size = job->request_payload.payload_len;
3054 	full_size = size + ELX_LOOPBACK_HEADER_SZ; /* plus the header */
3055 
3056 	if ((size == 0) || (size > 80 * BUF_SZ_4K)) {
3057 		rc = -ERANGE;
3058 		goto loopback_test_exit;
3059 	}
3060 
3061 	if (full_size >= BUF_SZ_4K) {
3062 		/*
3063 		 * Allocate memory for ioctl data. If buffer is bigger than 64k,
3064 		 * then we allocate 64k and re-use that buffer over and over to
3065 		 * xfer the whole block. This is because Linux kernel has a
3066 		 * problem allocating more than 120k of kernel space memory. Saw
3067 		 * problem with GET_FCPTARGETMAPPING...
3068 		 */
3069 		if (size <= (64 * 1024))
3070 			total_mem = full_size;
3071 		else
3072 			total_mem = 64 * 1024;
3073 	} else
3074 		/* Allocate memory for ioctl data */
3075 		total_mem = BUF_SZ_4K;
3076 
3077 	dataout = kmalloc(total_mem, GFP_KERNEL);
3078 	if (dataout == NULL) {
3079 		rc = -ENOMEM;
3080 		goto loopback_test_exit;
3081 	}
3082 
3083 	ptr = dataout;
3084 	ptr += ELX_LOOPBACK_HEADER_SZ;
3085 	sg_copy_to_buffer(job->request_payload.sg_list,
3086 				job->request_payload.sg_cnt,
3087 				ptr, size);
3088 	rc = lpfcdiag_loop_self_reg(phba, &rpi);
3089 	if (rc)
3090 		goto loopback_test_exit;
3091 
3092 	if (phba->sli_rev < LPFC_SLI_REV4) {
3093 		rc = lpfcdiag_loop_get_xri(phba, rpi, &txxri, &rxxri);
3094 		if (rc) {
3095 			lpfcdiag_loop_self_unreg(phba, rpi);
3096 			goto loopback_test_exit;
3097 		}
3098 
3099 		rc = lpfcdiag_loop_post_rxbufs(phba, rxxri, full_size);
3100 		if (rc) {
3101 			lpfcdiag_loop_self_unreg(phba, rpi);
3102 			goto loopback_test_exit;
3103 		}
3104 	}
3105 	evt = lpfc_bsg_event_new(FC_REG_CT_EVENT, current->pid,
3106 				SLI_CT_ELX_LOOPBACK);
3107 	if (!evt) {
3108 		lpfcdiag_loop_self_unreg(phba, rpi);
3109 		rc = -ENOMEM;
3110 		goto loopback_test_exit;
3111 	}
3112 
3113 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
3114 	list_add(&evt->node, &phba->ct_ev_waiters);
3115 	lpfc_bsg_event_ref(evt);
3116 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3117 
3118 	cmdiocbq = lpfc_sli_get_iocbq(phba);
3119 	if (phba->sli_rev < LPFC_SLI_REV4)
3120 		rspiocbq = lpfc_sli_get_iocbq(phba);
3121 	txbmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
3122 
3123 	if (txbmp) {
3124 		txbmp->virt = lpfc_mbuf_alloc(phba, 0, &txbmp->phys);
3125 		if (txbmp->virt) {
3126 			INIT_LIST_HEAD(&txbmp->list);
3127 			txbpl = (struct ulp_bde64 *) txbmp->virt;
3128 			txbuffer = diag_cmd_data_alloc(phba,
3129 							txbpl, full_size, 0);
3130 		}
3131 	}
3132 
3133 	if (!cmdiocbq || !txbmp || !txbpl || !txbuffer || !txbmp->virt) {
3134 		rc = -ENOMEM;
3135 		goto err_loopback_test_exit;
3136 	}
3137 	if ((phba->sli_rev < LPFC_SLI_REV4) && !rspiocbq) {
3138 		rc = -ENOMEM;
3139 		goto err_loopback_test_exit;
3140 	}
3141 
3142 	cmd = &cmdiocbq->iocb;
3143 	if (phba->sli_rev < LPFC_SLI_REV4)
3144 		rsp = &rspiocbq->iocb;
3145 
3146 	INIT_LIST_HEAD(&head);
3147 	list_add_tail(&head, &txbuffer->dma.list);
3148 	list_for_each_entry(curr, &head, list) {
3149 		segment_len = ((struct lpfc_dmabufext *)curr)->size;
3150 		if (current_offset == 0) {
3151 			ctreq = curr->virt;
3152 			memset(ctreq, 0, ELX_LOOPBACK_HEADER_SZ);
3153 			ctreq->RevisionId.bits.Revision = SLI_CT_REVISION;
3154 			ctreq->RevisionId.bits.InId = 0;
3155 			ctreq->FsType = SLI_CT_ELX_LOOPBACK;
3156 			ctreq->FsSubType = 0;
3157 			ctreq->CommandResponse.bits.CmdRsp = ELX_LOOPBACK_DATA;
3158 			ctreq->CommandResponse.bits.Size   = size;
3159 			segment_offset = ELX_LOOPBACK_HEADER_SZ;
3160 		} else
3161 			segment_offset = 0;
3162 
3163 		BUG_ON(segment_offset >= segment_len);
3164 		memcpy(curr->virt + segment_offset,
3165 			ptr + current_offset,
3166 			segment_len - segment_offset);
3167 
3168 		current_offset += segment_len - segment_offset;
3169 		BUG_ON(current_offset > size);
3170 	}
3171 	list_del(&head);
3172 
3173 	/* Build the XMIT_SEQUENCE iocb */
3174 	num_bde = (uint32_t)txbuffer->flag;
3175 
3176 	cmd->un.xseq64.bdl.addrHigh = putPaddrHigh(txbmp->phys);
3177 	cmd->un.xseq64.bdl.addrLow = putPaddrLow(txbmp->phys);
3178 	cmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
3179 	cmd->un.xseq64.bdl.bdeSize = (num_bde * sizeof(struct ulp_bde64));
3180 
3181 	cmd->un.xseq64.w5.hcsw.Fctl = (LS | LA);
3182 	cmd->un.xseq64.w5.hcsw.Dfctl = 0;
3183 	cmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL;
3184 	cmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT;
3185 
3186 	cmd->ulpCommand = CMD_XMIT_SEQUENCE64_CX;
3187 	cmd->ulpBdeCount = 1;
3188 	cmd->ulpLe = 1;
3189 	cmd->ulpClass = CLASS3;
3190 
3191 	if (phba->sli_rev < LPFC_SLI_REV4) {
3192 		cmd->ulpContext = txxri;
3193 	} else {
3194 		cmd->un.xseq64.bdl.ulpIoTag32 = 0;
3195 		cmd->un.ulpWord[3] = phba->sli4_hba.rpi_ids[rpi];
3196 		cmdiocbq->context3 = txbmp;
3197 		cmdiocbq->sli4_xritag = NO_XRI;
3198 		cmd->unsli3.rcvsli3.ox_id = 0xffff;
3199 	}
3200 	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
3201 	cmdiocbq->vport = phba->pport;
3202 	cmdiocbq->iocb_cmpl = NULL;
3203 	iocb_stat = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq,
3204 					     rspiocbq, (phba->fc_ratov * 2) +
3205 					     LPFC_DRVR_TIMEOUT);
3206 
3207 	if ((iocb_stat != IOCB_SUCCESS) ||
3208 	    ((phba->sli_rev < LPFC_SLI_REV4) &&
3209 	     (rsp->ulpStatus != IOSTAT_SUCCESS))) {
3210 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3211 				"3126 Failed loopback test issue iocb: "
3212 				"iocb_stat:x%x\n", iocb_stat);
3213 		rc = -EIO;
3214 		goto err_loopback_test_exit;
3215 	}
3216 
3217 	evt->waiting = 1;
3218 	time_left = wait_event_interruptible_timeout(
3219 		evt->wq, !list_empty(&evt->events_to_see),
3220 		msecs_to_jiffies(1000 *
3221 			((phba->fc_ratov * 2) + LPFC_DRVR_TIMEOUT)));
3222 	evt->waiting = 0;
3223 	if (list_empty(&evt->events_to_see)) {
3224 		rc = (time_left) ? -EINTR : -ETIMEDOUT;
3225 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3226 				"3125 Not receiving unsolicited event, "
3227 				"rc:x%x\n", rc);
3228 	} else {
3229 		spin_lock_irqsave(&phba->ct_ev_lock, flags);
3230 		list_move(evt->events_to_see.prev, &evt->events_to_get);
3231 		evdat = list_entry(evt->events_to_get.prev,
3232 				   typeof(*evdat), node);
3233 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3234 		rx_databuf = evdat->data;
3235 		if (evdat->len != full_size) {
3236 			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3237 				"1603 Loopback test did not receive expected "
3238 				"data length. actual length 0x%x expected "
3239 				"length 0x%x\n",
3240 				evdat->len, full_size);
3241 			rc = -EIO;
3242 		} else if (rx_databuf == NULL)
3243 			rc = -EIO;
3244 		else {
3245 			rc = IOCB_SUCCESS;
3246 			/* skip over elx loopback header */
3247 			rx_databuf += ELX_LOOPBACK_HEADER_SZ;
3248 			job->reply->reply_payload_rcv_len =
3249 				sg_copy_from_buffer(job->reply_payload.sg_list,
3250 						    job->reply_payload.sg_cnt,
3251 						    rx_databuf, size);
3252 			job->reply->reply_payload_rcv_len = size;
3253 		}
3254 	}
3255 
3256 err_loopback_test_exit:
3257 	lpfcdiag_loop_self_unreg(phba, rpi);
3258 
3259 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
3260 	lpfc_bsg_event_unref(evt); /* release ref */
3261 	lpfc_bsg_event_unref(evt); /* delete */
3262 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3263 
3264 	if ((cmdiocbq != NULL) && (iocb_stat != IOCB_TIMEDOUT))
3265 		lpfc_sli_release_iocbq(phba, cmdiocbq);
3266 
3267 	if (rspiocbq != NULL)
3268 		lpfc_sli_release_iocbq(phba, rspiocbq);
3269 
3270 	if (txbmp != NULL) {
3271 		if (txbpl != NULL) {
3272 			if (txbuffer != NULL)
3273 				diag_cmd_data_free(phba, txbuffer);
3274 			lpfc_mbuf_free(phba, txbmp->virt, txbmp->phys);
3275 		}
3276 		kfree(txbmp);
3277 	}
3278 
3279 loopback_test_exit:
3280 	kfree(dataout);
3281 	/* make error code available to userspace */
3282 	job->reply->result = rc;
3283 	job->dd_data = NULL;
3284 	/* complete the job back to userspace if no error */
3285 	if (rc == IOCB_SUCCESS)
3286 		job->job_done(job);
3287 	return rc;
3288 }
3289 
3290 /**
3291  * lpfc_bsg_get_dfc_rev - process a GET_DFC_REV bsg vendor command
3292  * @job: GET_DFC_REV fc_bsg_job
3293  **/
3294 static int
3295 lpfc_bsg_get_dfc_rev(struct fc_bsg_job *job)
3296 {
3297 	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
3298 	struct lpfc_hba *phba = vport->phba;
3299 	struct get_mgmt_rev *event_req;
3300 	struct get_mgmt_rev_reply *event_reply;
3301 	int rc = 0;
3302 
3303 	if (job->request_len <
3304 	    sizeof(struct fc_bsg_request) + sizeof(struct get_mgmt_rev)) {
3305 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3306 				"2740 Received GET_DFC_REV request below "
3307 				"minimum size\n");
3308 		rc = -EINVAL;
3309 		goto job_error;
3310 	}
3311 
3312 	event_req = (struct get_mgmt_rev *)
3313 		job->request->rqst_data.h_vendor.vendor_cmd;
3314 
3315 	event_reply = (struct get_mgmt_rev_reply *)
3316 		job->reply->reply_data.vendor_reply.vendor_rsp;
3317 
3318 	if (job->reply_len <
3319 	    sizeof(struct fc_bsg_request) + sizeof(struct get_mgmt_rev_reply)) {
3320 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3321 				"2741 Received GET_DFC_REV reply below "
3322 				"minimum size\n");
3323 		rc = -EINVAL;
3324 		goto job_error;
3325 	}
3326 
3327 	event_reply->info.a_Major = MANAGEMENT_MAJOR_REV;
3328 	event_reply->info.a_Minor = MANAGEMENT_MINOR_REV;
3329 job_error:
3330 	job->reply->result = rc;
3331 	if (rc == 0)
3332 		job->job_done(job);
3333 	return rc;
3334 }
3335 
3336 /**
3337  * lpfc_bsg_issue_mbox_cmpl - lpfc_bsg_issue_mbox mbox completion handler
3338  * @phba: Pointer to HBA context object.
3339  * @pmboxq: Pointer to mailbox command.
3340  *
3341  * This is completion handler function for mailbox commands issued from
3342  * lpfc_bsg_issue_mbox function. This function is called by the
3343  * mailbox event handler function with no lock held. This function
3344  * will wake up thread waiting on the wait queue pointed by context1
3345  * of the mailbox.
3346  **/
3347 void
3348 lpfc_bsg_issue_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
3349 {
3350 	struct bsg_job_data *dd_data;
3351 	struct fc_bsg_job *job;
3352 	uint32_t size;
3353 	unsigned long flags;
3354 	uint8_t *pmb, *pmb_buf;
3355 
3356 	dd_data = pmboxq->context1;
3357 
3358 	/*
3359 	 * The outgoing buffer is readily referred from the dma buffer,
3360 	 * just need to get header part from mailboxq structure.
3361 	 */
3362 	pmb = (uint8_t *)&pmboxq->u.mb;
3363 	pmb_buf = (uint8_t *)dd_data->context_un.mbox.mb;
3364 	memcpy(pmb_buf, pmb, sizeof(MAILBOX_t));
3365 
3366 	/* Determine if job has been aborted */
3367 
3368 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
3369 	job = dd_data->set_job;
3370 	if (job) {
3371 		/* Prevent timeout handling from trying to abort job  */
3372 		job->dd_data = NULL;
3373 	}
3374 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3375 
3376 	/* Copy the mailbox data to the job if it is still active */
3377 
3378 	if (job) {
3379 		size = job->reply_payload.payload_len;
3380 		job->reply->reply_payload_rcv_len =
3381 			sg_copy_from_buffer(job->reply_payload.sg_list,
3382 					    job->reply_payload.sg_cnt,
3383 					    pmb_buf, size);
3384 	}
3385 
3386 	dd_data->set_job = NULL;
3387 	mempool_free(dd_data->context_un.mbox.pmboxq, phba->mbox_mem_pool);
3388 	lpfc_bsg_dma_page_free(phba, dd_data->context_un.mbox.dmabuffers);
3389 	kfree(dd_data);
3390 
3391 	/* Complete the job if the job is still active */
3392 
3393 	if (job) {
3394 		job->reply->result = 0;
3395 		job->job_done(job);
3396 	}
3397 	return;
3398 }
3399 
3400 /**
3401  * lpfc_bsg_check_cmd_access - test for a supported mailbox command
3402  * @phba: Pointer to HBA context object.
3403  * @mb: Pointer to a mailbox object.
3404  * @vport: Pointer to a vport object.
3405  *
3406  * Some commands require the port to be offline, some may not be called from
3407  * the application.
3408  **/
3409 static int lpfc_bsg_check_cmd_access(struct lpfc_hba *phba,
3410 	MAILBOX_t *mb, struct lpfc_vport *vport)
3411 {
3412 	/* return negative error values for bsg job */
3413 	switch (mb->mbxCommand) {
3414 	/* Offline only */
3415 	case MBX_INIT_LINK:
3416 	case MBX_DOWN_LINK:
3417 	case MBX_CONFIG_LINK:
3418 	case MBX_CONFIG_RING:
3419 	case MBX_RESET_RING:
3420 	case MBX_UNREG_LOGIN:
3421 	case MBX_CLEAR_LA:
3422 	case MBX_DUMP_CONTEXT:
3423 	case MBX_RUN_DIAGS:
3424 	case MBX_RESTART:
3425 	case MBX_SET_MASK:
3426 		if (!(vport->fc_flag & FC_OFFLINE_MODE)) {
3427 			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3428 				"2743 Command 0x%x is illegal in on-line "
3429 				"state\n",
3430 				mb->mbxCommand);
3431 			return -EPERM;
3432 		}
3433 	case MBX_WRITE_NV:
3434 	case MBX_WRITE_VPARMS:
3435 	case MBX_LOAD_SM:
3436 	case MBX_READ_NV:
3437 	case MBX_READ_CONFIG:
3438 	case MBX_READ_RCONFIG:
3439 	case MBX_READ_STATUS:
3440 	case MBX_READ_XRI:
3441 	case MBX_READ_REV:
3442 	case MBX_READ_LNK_STAT:
3443 	case MBX_DUMP_MEMORY:
3444 	case MBX_DOWN_LOAD:
3445 	case MBX_UPDATE_CFG:
3446 	case MBX_KILL_BOARD:
3447 	case MBX_READ_TOPOLOGY:
3448 	case MBX_LOAD_AREA:
3449 	case MBX_LOAD_EXP_ROM:
3450 	case MBX_BEACON:
3451 	case MBX_DEL_LD_ENTRY:
3452 	case MBX_SET_DEBUG:
3453 	case MBX_WRITE_WWN:
3454 	case MBX_SLI4_CONFIG:
3455 	case MBX_READ_EVENT_LOG:
3456 	case MBX_READ_EVENT_LOG_STATUS:
3457 	case MBX_WRITE_EVENT_LOG:
3458 	case MBX_PORT_CAPABILITIES:
3459 	case MBX_PORT_IOV_CONTROL:
3460 	case MBX_RUN_BIU_DIAG64:
3461 		break;
3462 	case MBX_SET_VARIABLE:
3463 		lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
3464 			"1226 mbox: set_variable 0x%x, 0x%x\n",
3465 			mb->un.varWords[0],
3466 			mb->un.varWords[1]);
3467 		if ((mb->un.varWords[0] == SETVAR_MLOMNT)
3468 			&& (mb->un.varWords[1] == 1)) {
3469 			phba->wait_4_mlo_maint_flg = 1;
3470 		} else if (mb->un.varWords[0] == SETVAR_MLORST) {
3471 			spin_lock_irq(&phba->hbalock);
3472 			phba->link_flag &= ~LS_LOOPBACK_MODE;
3473 			spin_unlock_irq(&phba->hbalock);
3474 			phba->fc_topology = LPFC_TOPOLOGY_PT_PT;
3475 		}
3476 		break;
3477 	case MBX_READ_SPARM64:
3478 	case MBX_REG_LOGIN:
3479 	case MBX_REG_LOGIN64:
3480 	case MBX_CONFIG_PORT:
3481 	case MBX_RUN_BIU_DIAG:
3482 	default:
3483 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3484 			"2742 Unknown Command 0x%x\n",
3485 			mb->mbxCommand);
3486 		return -EPERM;
3487 	}
3488 
3489 	return 0; /* ok */
3490 }
3491 
3492 /**
3493  * lpfc_bsg_mbox_ext_cleanup - clean up context of multi-buffer mbox session
3494  * @phba: Pointer to HBA context object.
3495  *
3496  * This is routine clean up and reset BSG handling of multi-buffer mbox
3497  * command session.
3498  **/
3499 static void
3500 lpfc_bsg_mbox_ext_session_reset(struct lpfc_hba *phba)
3501 {
3502 	if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_IDLE)
3503 		return;
3504 
3505 	/* free all memory, including dma buffers */
3506 	lpfc_bsg_dma_page_list_free(phba,
3507 				    &phba->mbox_ext_buf_ctx.ext_dmabuf_list);
3508 	lpfc_bsg_dma_page_free(phba, phba->mbox_ext_buf_ctx.mbx_dmabuf);
3509 	/* multi-buffer write mailbox command pass-through complete */
3510 	memset((char *)&phba->mbox_ext_buf_ctx, 0,
3511 	       sizeof(struct lpfc_mbox_ext_buf_ctx));
3512 	INIT_LIST_HEAD(&phba->mbox_ext_buf_ctx.ext_dmabuf_list);
3513 
3514 	return;
3515 }
3516 
3517 /**
3518  * lpfc_bsg_issue_mbox_ext_handle_job - job handler for multi-buffer mbox cmpl
3519  * @phba: Pointer to HBA context object.
3520  * @pmboxq: Pointer to mailbox command.
3521  *
3522  * This is routine handles BSG job for mailbox commands completions with
3523  * multiple external buffers.
3524  **/
3525 static struct fc_bsg_job *
3526 lpfc_bsg_issue_mbox_ext_handle_job(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
3527 {
3528 	struct bsg_job_data *dd_data;
3529 	struct fc_bsg_job *job;
3530 	uint8_t *pmb, *pmb_buf;
3531 	unsigned long flags;
3532 	uint32_t size;
3533 	int rc = 0;
3534 	struct lpfc_dmabuf *dmabuf;
3535 	struct lpfc_sli_config_mbox *sli_cfg_mbx;
3536 	uint8_t *pmbx;
3537 
3538 	dd_data = pmboxq->context1;
3539 
3540 	/* Determine if job has been aborted */
3541 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
3542 	job = dd_data->set_job;
3543 	if (job) {
3544 		/* Prevent timeout handling from trying to abort job  */
3545 		job->dd_data = NULL;
3546 	}
3547 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3548 
3549 	/*
3550 	 * The outgoing buffer is readily referred from the dma buffer,
3551 	 * just need to get header part from mailboxq structure.
3552 	 */
3553 
3554 	pmb = (uint8_t *)&pmboxq->u.mb;
3555 	pmb_buf = (uint8_t *)dd_data->context_un.mbox.mb;
3556 	/* Copy the byte swapped response mailbox back to the user */
3557 	memcpy(pmb_buf, pmb, sizeof(MAILBOX_t));
3558 	/* if there is any non-embedded extended data copy that too */
3559 	dmabuf = phba->mbox_ext_buf_ctx.mbx_dmabuf;
3560 	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)dmabuf->virt;
3561 	if (!bsg_bf_get(lpfc_mbox_hdr_emb,
3562 	    &sli_cfg_mbx->un.sli_config_emb0_subsys.sli_config_hdr)) {
3563 		pmbx = (uint8_t *)dmabuf->virt;
3564 		/* byte swap the extended data following the mailbox command */
3565 		lpfc_sli_pcimem_bcopy(&pmbx[sizeof(MAILBOX_t)],
3566 			&pmbx[sizeof(MAILBOX_t)],
3567 			sli_cfg_mbx->un.sli_config_emb0_subsys.mse[0].buf_len);
3568 	}
3569 
3570 	/* Complete the job if the job is still active */
3571 
3572 	if (job) {
3573 		size = job->reply_payload.payload_len;
3574 		job->reply->reply_payload_rcv_len =
3575 			sg_copy_from_buffer(job->reply_payload.sg_list,
3576 					    job->reply_payload.sg_cnt,
3577 					    pmb_buf, size);
3578 
3579 		/* result for successful */
3580 		job->reply->result = 0;
3581 
3582 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3583 				"2937 SLI_CONFIG ext-buffer maibox command "
3584 				"(x%x/x%x) complete bsg job done, bsize:%d\n",
3585 				phba->mbox_ext_buf_ctx.nembType,
3586 				phba->mbox_ext_buf_ctx.mboxType, size);
3587 		lpfc_idiag_mbxacc_dump_bsg_mbox(phba,
3588 					phba->mbox_ext_buf_ctx.nembType,
3589 					phba->mbox_ext_buf_ctx.mboxType,
3590 					dma_ebuf, sta_pos_addr,
3591 					phba->mbox_ext_buf_ctx.mbx_dmabuf, 0);
3592 	} else {
3593 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3594 				"2938 SLI_CONFIG ext-buffer maibox "
3595 				"command (x%x/x%x) failure, rc:x%x\n",
3596 				phba->mbox_ext_buf_ctx.nembType,
3597 				phba->mbox_ext_buf_ctx.mboxType, rc);
3598 	}
3599 
3600 
3601 	/* state change */
3602 	phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_DONE;
3603 	kfree(dd_data);
3604 	return job;
3605 }
3606 
3607 /**
3608  * lpfc_bsg_issue_read_mbox_ext_cmpl - compl handler for multi-buffer read mbox
3609  * @phba: Pointer to HBA context object.
3610  * @pmboxq: Pointer to mailbox command.
3611  *
3612  * This is completion handler function for mailbox read commands with multiple
3613  * external buffers.
3614  **/
3615 static void
3616 lpfc_bsg_issue_read_mbox_ext_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
3617 {
3618 	struct fc_bsg_job *job;
3619 
3620 	job = lpfc_bsg_issue_mbox_ext_handle_job(phba, pmboxq);
3621 
3622 	/* handle the BSG job with mailbox command */
3623 	if (!job)
3624 		pmboxq->u.mb.mbxStatus = MBXERR_ERROR;
3625 
3626 	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3627 			"2939 SLI_CONFIG ext-buffer rd maibox command "
3628 			"complete, ctxState:x%x, mbxStatus:x%x\n",
3629 			phba->mbox_ext_buf_ctx.state, pmboxq->u.mb.mbxStatus);
3630 
3631 	if (pmboxq->u.mb.mbxStatus || phba->mbox_ext_buf_ctx.numBuf == 1)
3632 		lpfc_bsg_mbox_ext_session_reset(phba);
3633 
3634 	/* free base driver mailbox structure memory */
3635 	mempool_free(pmboxq, phba->mbox_mem_pool);
3636 
3637 	/* if the job is still active, call job done */
3638 	if (job)
3639 		job->job_done(job);
3640 
3641 	return;
3642 }
3643 
3644 /**
3645  * lpfc_bsg_issue_write_mbox_ext_cmpl - cmpl handler for multi-buffer write mbox
3646  * @phba: Pointer to HBA context object.
3647  * @pmboxq: Pointer to mailbox command.
3648  *
3649  * This is completion handler function for mailbox write commands with multiple
3650  * external buffers.
3651  **/
3652 static void
3653 lpfc_bsg_issue_write_mbox_ext_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
3654 {
3655 	struct fc_bsg_job *job;
3656 
3657 	job = lpfc_bsg_issue_mbox_ext_handle_job(phba, pmboxq);
3658 
3659 	/* handle the BSG job with the mailbox command */
3660 	if (!job)
3661 		pmboxq->u.mb.mbxStatus = MBXERR_ERROR;
3662 
3663 	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3664 			"2940 SLI_CONFIG ext-buffer wr maibox command "
3665 			"complete, ctxState:x%x, mbxStatus:x%x\n",
3666 			phba->mbox_ext_buf_ctx.state, pmboxq->u.mb.mbxStatus);
3667 
3668 	/* free all memory, including dma buffers */
3669 	mempool_free(pmboxq, phba->mbox_mem_pool);
3670 	lpfc_bsg_mbox_ext_session_reset(phba);
3671 
3672 	/* if the job is still active, call job done */
3673 	if (job)
3674 		job->job_done(job);
3675 
3676 	return;
3677 }
3678 
3679 static void
3680 lpfc_bsg_sli_cfg_dma_desc_setup(struct lpfc_hba *phba, enum nemb_type nemb_tp,
3681 				uint32_t index, struct lpfc_dmabuf *mbx_dmabuf,
3682 				struct lpfc_dmabuf *ext_dmabuf)
3683 {
3684 	struct lpfc_sli_config_mbox *sli_cfg_mbx;
3685 
3686 	/* pointer to the start of mailbox command */
3687 	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)mbx_dmabuf->virt;
3688 
3689 	if (nemb_tp == nemb_mse) {
3690 		if (index == 0) {
3691 			sli_cfg_mbx->un.sli_config_emb0_subsys.
3692 				mse[index].pa_hi =
3693 				putPaddrHigh(mbx_dmabuf->phys +
3694 					     sizeof(MAILBOX_t));
3695 			sli_cfg_mbx->un.sli_config_emb0_subsys.
3696 				mse[index].pa_lo =
3697 				putPaddrLow(mbx_dmabuf->phys +
3698 					    sizeof(MAILBOX_t));
3699 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3700 					"2943 SLI_CONFIG(mse)[%d], "
3701 					"bufLen:%d, addrHi:x%x, addrLo:x%x\n",
3702 					index,
3703 					sli_cfg_mbx->un.sli_config_emb0_subsys.
3704 					mse[index].buf_len,
3705 					sli_cfg_mbx->un.sli_config_emb0_subsys.
3706 					mse[index].pa_hi,
3707 					sli_cfg_mbx->un.sli_config_emb0_subsys.
3708 					mse[index].pa_lo);
3709 		} else {
3710 			sli_cfg_mbx->un.sli_config_emb0_subsys.
3711 				mse[index].pa_hi =
3712 				putPaddrHigh(ext_dmabuf->phys);
3713 			sli_cfg_mbx->un.sli_config_emb0_subsys.
3714 				mse[index].pa_lo =
3715 				putPaddrLow(ext_dmabuf->phys);
3716 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3717 					"2944 SLI_CONFIG(mse)[%d], "
3718 					"bufLen:%d, addrHi:x%x, addrLo:x%x\n",
3719 					index,
3720 					sli_cfg_mbx->un.sli_config_emb0_subsys.
3721 					mse[index].buf_len,
3722 					sli_cfg_mbx->un.sli_config_emb0_subsys.
3723 					mse[index].pa_hi,
3724 					sli_cfg_mbx->un.sli_config_emb0_subsys.
3725 					mse[index].pa_lo);
3726 		}
3727 	} else {
3728 		if (index == 0) {
3729 			sli_cfg_mbx->un.sli_config_emb1_subsys.
3730 				hbd[index].pa_hi =
3731 				putPaddrHigh(mbx_dmabuf->phys +
3732 					     sizeof(MAILBOX_t));
3733 			sli_cfg_mbx->un.sli_config_emb1_subsys.
3734 				hbd[index].pa_lo =
3735 				putPaddrLow(mbx_dmabuf->phys +
3736 					    sizeof(MAILBOX_t));
3737 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3738 					"3007 SLI_CONFIG(hbd)[%d], "
3739 					"bufLen:%d, addrHi:x%x, addrLo:x%x\n",
3740 				index,
3741 				bsg_bf_get(lpfc_mbox_sli_config_ecmn_hbd_len,
3742 				&sli_cfg_mbx->un.
3743 				sli_config_emb1_subsys.hbd[index]),
3744 				sli_cfg_mbx->un.sli_config_emb1_subsys.
3745 				hbd[index].pa_hi,
3746 				sli_cfg_mbx->un.sli_config_emb1_subsys.
3747 				hbd[index].pa_lo);
3748 
3749 		} else {
3750 			sli_cfg_mbx->un.sli_config_emb1_subsys.
3751 				hbd[index].pa_hi =
3752 				putPaddrHigh(ext_dmabuf->phys);
3753 			sli_cfg_mbx->un.sli_config_emb1_subsys.
3754 				hbd[index].pa_lo =
3755 				putPaddrLow(ext_dmabuf->phys);
3756 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3757 					"3008 SLI_CONFIG(hbd)[%d], "
3758 					"bufLen:%d, addrHi:x%x, addrLo:x%x\n",
3759 				index,
3760 				bsg_bf_get(lpfc_mbox_sli_config_ecmn_hbd_len,
3761 				&sli_cfg_mbx->un.
3762 				sli_config_emb1_subsys.hbd[index]),
3763 				sli_cfg_mbx->un.sli_config_emb1_subsys.
3764 				hbd[index].pa_hi,
3765 				sli_cfg_mbx->un.sli_config_emb1_subsys.
3766 				hbd[index].pa_lo);
3767 		}
3768 	}
3769 	return;
3770 }
3771 
3772 /**
3773  * lpfc_bsg_sli_cfg_mse_read_cmd_ext - sli_config non-embedded mailbox cmd read
3774  * @phba: Pointer to HBA context object.
3775  * @mb: Pointer to a BSG mailbox object.
3776  * @nemb_tp: Enumerate of non-embedded mailbox command type.
3777  * @dmabuff: Pointer to a DMA buffer descriptor.
3778  *
3779  * This routine performs SLI_CONFIG (0x9B) read mailbox command operation with
3780  * non-embedded external bufffers.
3781  **/
3782 static int
3783 lpfc_bsg_sli_cfg_read_cmd_ext(struct lpfc_hba *phba, struct fc_bsg_job *job,
3784 			      enum nemb_type nemb_tp,
3785 			      struct lpfc_dmabuf *dmabuf)
3786 {
3787 	struct lpfc_sli_config_mbox *sli_cfg_mbx;
3788 	struct dfc_mbox_req *mbox_req;
3789 	struct lpfc_dmabuf *curr_dmabuf, *next_dmabuf;
3790 	uint32_t ext_buf_cnt, ext_buf_index;
3791 	struct lpfc_dmabuf *ext_dmabuf = NULL;
3792 	struct bsg_job_data *dd_data = NULL;
3793 	LPFC_MBOXQ_t *pmboxq = NULL;
3794 	MAILBOX_t *pmb;
3795 	uint8_t *pmbx;
3796 	int rc, i;
3797 
3798 	mbox_req =
3799 	   (struct dfc_mbox_req *)job->request->rqst_data.h_vendor.vendor_cmd;
3800 
3801 	/* pointer to the start of mailbox command */
3802 	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)dmabuf->virt;
3803 
3804 	if (nemb_tp == nemb_mse) {
3805 		ext_buf_cnt = bsg_bf_get(lpfc_mbox_hdr_mse_cnt,
3806 			&sli_cfg_mbx->un.sli_config_emb0_subsys.sli_config_hdr);
3807 		if (ext_buf_cnt > LPFC_MBX_SLI_CONFIG_MAX_MSE) {
3808 			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3809 					"2945 Handled SLI_CONFIG(mse) rd, "
3810 					"ext_buf_cnt(%d) out of range(%d)\n",
3811 					ext_buf_cnt,
3812 					LPFC_MBX_SLI_CONFIG_MAX_MSE);
3813 			rc = -ERANGE;
3814 			goto job_error;
3815 		}
3816 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3817 				"2941 Handled SLI_CONFIG(mse) rd, "
3818 				"ext_buf_cnt:%d\n", ext_buf_cnt);
3819 	} else {
3820 		/* sanity check on interface type for support */
3821 		if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
3822 		    LPFC_SLI_INTF_IF_TYPE_2) {
3823 			rc = -ENODEV;
3824 			goto job_error;
3825 		}
3826 		/* nemb_tp == nemb_hbd */
3827 		ext_buf_cnt = sli_cfg_mbx->un.sli_config_emb1_subsys.hbd_count;
3828 		if (ext_buf_cnt > LPFC_MBX_SLI_CONFIG_MAX_HBD) {
3829 			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3830 					"2946 Handled SLI_CONFIG(hbd) rd, "
3831 					"ext_buf_cnt(%d) out of range(%d)\n",
3832 					ext_buf_cnt,
3833 					LPFC_MBX_SLI_CONFIG_MAX_HBD);
3834 			rc = -ERANGE;
3835 			goto job_error;
3836 		}
3837 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3838 				"2942 Handled SLI_CONFIG(hbd) rd, "
3839 				"ext_buf_cnt:%d\n", ext_buf_cnt);
3840 	}
3841 
3842 	/* before dma descriptor setup */
3843 	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, nemb_tp, mbox_rd, dma_mbox,
3844 					sta_pre_addr, dmabuf, ext_buf_cnt);
3845 
3846 	/* reject non-embedded mailbox command with none external buffer */
3847 	if (ext_buf_cnt == 0) {
3848 		rc = -EPERM;
3849 		goto job_error;
3850 	} else if (ext_buf_cnt > 1) {
3851 		/* additional external read buffers */
3852 		for (i = 1; i < ext_buf_cnt; i++) {
3853 			ext_dmabuf = lpfc_bsg_dma_page_alloc(phba);
3854 			if (!ext_dmabuf) {
3855 				rc = -ENOMEM;
3856 				goto job_error;
3857 			}
3858 			list_add_tail(&ext_dmabuf->list,
3859 				      &phba->mbox_ext_buf_ctx.ext_dmabuf_list);
3860 		}
3861 	}
3862 
3863 	/* bsg tracking structure */
3864 	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
3865 	if (!dd_data) {
3866 		rc = -ENOMEM;
3867 		goto job_error;
3868 	}
3869 
3870 	/* mailbox command structure for base driver */
3871 	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
3872 	if (!pmboxq) {
3873 		rc = -ENOMEM;
3874 		goto job_error;
3875 	}
3876 	memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
3877 
3878 	/* for the first external buffer */
3879 	lpfc_bsg_sli_cfg_dma_desc_setup(phba, nemb_tp, 0, dmabuf, dmabuf);
3880 
3881 	/* for the rest of external buffer descriptors if any */
3882 	if (ext_buf_cnt > 1) {
3883 		ext_buf_index = 1;
3884 		list_for_each_entry_safe(curr_dmabuf, next_dmabuf,
3885 				&phba->mbox_ext_buf_ctx.ext_dmabuf_list, list) {
3886 			lpfc_bsg_sli_cfg_dma_desc_setup(phba, nemb_tp,
3887 						ext_buf_index, dmabuf,
3888 						curr_dmabuf);
3889 			ext_buf_index++;
3890 		}
3891 	}
3892 
3893 	/* after dma descriptor setup */
3894 	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, nemb_tp, mbox_rd, dma_mbox,
3895 					sta_pos_addr, dmabuf, ext_buf_cnt);
3896 
3897 	/* construct base driver mbox command */
3898 	pmb = &pmboxq->u.mb;
3899 	pmbx = (uint8_t *)dmabuf->virt;
3900 	memcpy(pmb, pmbx, sizeof(*pmb));
3901 	pmb->mbxOwner = OWN_HOST;
3902 	pmboxq->vport = phba->pport;
3903 
3904 	/* multi-buffer handling context */
3905 	phba->mbox_ext_buf_ctx.nembType = nemb_tp;
3906 	phba->mbox_ext_buf_ctx.mboxType = mbox_rd;
3907 	phba->mbox_ext_buf_ctx.numBuf = ext_buf_cnt;
3908 	phba->mbox_ext_buf_ctx.mbxTag = mbox_req->extMboxTag;
3909 	phba->mbox_ext_buf_ctx.seqNum = mbox_req->extSeqNum;
3910 	phba->mbox_ext_buf_ctx.mbx_dmabuf = dmabuf;
3911 
3912 	/* callback for multi-buffer read mailbox command */
3913 	pmboxq->mbox_cmpl = lpfc_bsg_issue_read_mbox_ext_cmpl;
3914 
3915 	/* context fields to callback function */
3916 	pmboxq->context1 = dd_data;
3917 	dd_data->type = TYPE_MBOX;
3918 	dd_data->set_job = job;
3919 	dd_data->context_un.mbox.pmboxq = pmboxq;
3920 	dd_data->context_un.mbox.mb = (MAILBOX_t *)pmbx;
3921 	job->dd_data = dd_data;
3922 
3923 	/* state change */
3924 	phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_PORT;
3925 
3926 	/*
3927 	 * Non-embedded mailbox subcommand data gets byte swapped here because
3928 	 * the lower level driver code only does the first 64 mailbox words.
3929 	 */
3930 	if ((!bsg_bf_get(lpfc_mbox_hdr_emb,
3931 	    &sli_cfg_mbx->un.sli_config_emb0_subsys.sli_config_hdr)) &&
3932 		(nemb_tp == nemb_mse))
3933 		lpfc_sli_pcimem_bcopy(&pmbx[sizeof(MAILBOX_t)],
3934 			&pmbx[sizeof(MAILBOX_t)],
3935 				sli_cfg_mbx->un.sli_config_emb0_subsys.
3936 					mse[0].buf_len);
3937 
3938 	rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
3939 	if ((rc == MBX_SUCCESS) || (rc == MBX_BUSY)) {
3940 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3941 				"2947 Issued SLI_CONFIG ext-buffer "
3942 				"maibox command, rc:x%x\n", rc);
3943 		return SLI_CONFIG_HANDLED;
3944 	}
3945 	lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3946 			"2948 Failed to issue SLI_CONFIG ext-buffer "
3947 			"maibox command, rc:x%x\n", rc);
3948 	rc = -EPIPE;
3949 
3950 job_error:
3951 	if (pmboxq)
3952 		mempool_free(pmboxq, phba->mbox_mem_pool);
3953 	lpfc_bsg_dma_page_list_free(phba,
3954 				    &phba->mbox_ext_buf_ctx.ext_dmabuf_list);
3955 	kfree(dd_data);
3956 	phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_IDLE;
3957 	return rc;
3958 }
3959 
3960 /**
3961  * lpfc_bsg_sli_cfg_write_cmd_ext - sli_config non-embedded mailbox cmd write
3962  * @phba: Pointer to HBA context object.
3963  * @mb: Pointer to a BSG mailbox object.
3964  * @dmabuff: Pointer to a DMA buffer descriptor.
3965  *
3966  * This routine performs SLI_CONFIG (0x9B) write mailbox command operation with
3967  * non-embedded external bufffers.
3968  **/
3969 static int
3970 lpfc_bsg_sli_cfg_write_cmd_ext(struct lpfc_hba *phba, struct fc_bsg_job *job,
3971 			       enum nemb_type nemb_tp,
3972 			       struct lpfc_dmabuf *dmabuf)
3973 {
3974 	struct dfc_mbox_req *mbox_req;
3975 	struct lpfc_sli_config_mbox *sli_cfg_mbx;
3976 	uint32_t ext_buf_cnt;
3977 	struct bsg_job_data *dd_data = NULL;
3978 	LPFC_MBOXQ_t *pmboxq = NULL;
3979 	MAILBOX_t *pmb;
3980 	uint8_t *mbx;
3981 	int rc = SLI_CONFIG_NOT_HANDLED, i;
3982 
3983 	mbox_req =
3984 	   (struct dfc_mbox_req *)job->request->rqst_data.h_vendor.vendor_cmd;
3985 
3986 	/* pointer to the start of mailbox command */
3987 	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)dmabuf->virt;
3988 
3989 	if (nemb_tp == nemb_mse) {
3990 		ext_buf_cnt = bsg_bf_get(lpfc_mbox_hdr_mse_cnt,
3991 			&sli_cfg_mbx->un.sli_config_emb0_subsys.sli_config_hdr);
3992 		if (ext_buf_cnt > LPFC_MBX_SLI_CONFIG_MAX_MSE) {
3993 			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3994 					"2953 Failed SLI_CONFIG(mse) wr, "
3995 					"ext_buf_cnt(%d) out of range(%d)\n",
3996 					ext_buf_cnt,
3997 					LPFC_MBX_SLI_CONFIG_MAX_MSE);
3998 			return -ERANGE;
3999 		}
4000 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4001 				"2949 Handled SLI_CONFIG(mse) wr, "
4002 				"ext_buf_cnt:%d\n", ext_buf_cnt);
4003 	} else {
4004 		/* sanity check on interface type for support */
4005 		if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
4006 		    LPFC_SLI_INTF_IF_TYPE_2)
4007 			return -ENODEV;
4008 		/* nemb_tp == nemb_hbd */
4009 		ext_buf_cnt = sli_cfg_mbx->un.sli_config_emb1_subsys.hbd_count;
4010 		if (ext_buf_cnt > LPFC_MBX_SLI_CONFIG_MAX_HBD) {
4011 			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4012 					"2954 Failed SLI_CONFIG(hbd) wr, "
4013 					"ext_buf_cnt(%d) out of range(%d)\n",
4014 					ext_buf_cnt,
4015 					LPFC_MBX_SLI_CONFIG_MAX_HBD);
4016 			return -ERANGE;
4017 		}
4018 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4019 				"2950 Handled SLI_CONFIG(hbd) wr, "
4020 				"ext_buf_cnt:%d\n", ext_buf_cnt);
4021 	}
4022 
4023 	/* before dma buffer descriptor setup */
4024 	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, nemb_tp, mbox_wr, dma_mbox,
4025 					sta_pre_addr, dmabuf, ext_buf_cnt);
4026 
4027 	if (ext_buf_cnt == 0)
4028 		return -EPERM;
4029 
4030 	/* for the first external buffer */
4031 	lpfc_bsg_sli_cfg_dma_desc_setup(phba, nemb_tp, 0, dmabuf, dmabuf);
4032 
4033 	/* after dma descriptor setup */
4034 	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, nemb_tp, mbox_wr, dma_mbox,
4035 					sta_pos_addr, dmabuf, ext_buf_cnt);
4036 
4037 	/* log for looking forward */
4038 	for (i = 1; i < ext_buf_cnt; i++) {
4039 		if (nemb_tp == nemb_mse)
4040 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4041 				"2951 SLI_CONFIG(mse), buf[%d]-length:%d\n",
4042 				i, sli_cfg_mbx->un.sli_config_emb0_subsys.
4043 				mse[i].buf_len);
4044 		else
4045 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4046 				"2952 SLI_CONFIG(hbd), buf[%d]-length:%d\n",
4047 				i, bsg_bf_get(lpfc_mbox_sli_config_ecmn_hbd_len,
4048 				&sli_cfg_mbx->un.sli_config_emb1_subsys.
4049 				hbd[i]));
4050 	}
4051 
4052 	/* multi-buffer handling context */
4053 	phba->mbox_ext_buf_ctx.nembType = nemb_tp;
4054 	phba->mbox_ext_buf_ctx.mboxType = mbox_wr;
4055 	phba->mbox_ext_buf_ctx.numBuf = ext_buf_cnt;
4056 	phba->mbox_ext_buf_ctx.mbxTag = mbox_req->extMboxTag;
4057 	phba->mbox_ext_buf_ctx.seqNum = mbox_req->extSeqNum;
4058 	phba->mbox_ext_buf_ctx.mbx_dmabuf = dmabuf;
4059 
4060 	if (ext_buf_cnt == 1) {
4061 		/* bsg tracking structure */
4062 		dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
4063 		if (!dd_data) {
4064 			rc = -ENOMEM;
4065 			goto job_error;
4066 		}
4067 
4068 		/* mailbox command structure for base driver */
4069 		pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
4070 		if (!pmboxq) {
4071 			rc = -ENOMEM;
4072 			goto job_error;
4073 		}
4074 		memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
4075 		pmb = &pmboxq->u.mb;
4076 		mbx = (uint8_t *)dmabuf->virt;
4077 		memcpy(pmb, mbx, sizeof(*pmb));
4078 		pmb->mbxOwner = OWN_HOST;
4079 		pmboxq->vport = phba->pport;
4080 
4081 		/* callback for multi-buffer read mailbox command */
4082 		pmboxq->mbox_cmpl = lpfc_bsg_issue_write_mbox_ext_cmpl;
4083 
4084 		/* context fields to callback function */
4085 		pmboxq->context1 = dd_data;
4086 		dd_data->type = TYPE_MBOX;
4087 		dd_data->set_job = job;
4088 		dd_data->context_un.mbox.pmboxq = pmboxq;
4089 		dd_data->context_un.mbox.mb = (MAILBOX_t *)mbx;
4090 		job->dd_data = dd_data;
4091 
4092 		/* state change */
4093 
4094 		phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_PORT;
4095 		rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
4096 		if ((rc == MBX_SUCCESS) || (rc == MBX_BUSY)) {
4097 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4098 					"2955 Issued SLI_CONFIG ext-buffer "
4099 					"maibox command, rc:x%x\n", rc);
4100 			return SLI_CONFIG_HANDLED;
4101 		}
4102 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4103 				"2956 Failed to issue SLI_CONFIG ext-buffer "
4104 				"maibox command, rc:x%x\n", rc);
4105 		rc = -EPIPE;
4106 		goto job_error;
4107 	}
4108 
4109 	/* wait for additoinal external buffers */
4110 
4111 	job->reply->result = 0;
4112 	job->job_done(job);
4113 	return SLI_CONFIG_HANDLED;
4114 
4115 job_error:
4116 	if (pmboxq)
4117 		mempool_free(pmboxq, phba->mbox_mem_pool);
4118 	kfree(dd_data);
4119 
4120 	return rc;
4121 }
4122 
4123 /**
4124  * lpfc_bsg_handle_sli_cfg_mbox - handle sli-cfg mailbox cmd with ext buffer
4125  * @phba: Pointer to HBA context object.
4126  * @mb: Pointer to a BSG mailbox object.
4127  * @dmabuff: Pointer to a DMA buffer descriptor.
4128  *
4129  * This routine handles SLI_CONFIG (0x9B) mailbox command with non-embedded
4130  * external bufffers, including both 0x9B with non-embedded MSEs and 0x9B
4131  * with embedded sussystem 0x1 and opcodes with external HBDs.
4132  **/
4133 static int
4134 lpfc_bsg_handle_sli_cfg_mbox(struct lpfc_hba *phba, struct fc_bsg_job *job,
4135 			     struct lpfc_dmabuf *dmabuf)
4136 {
4137 	struct lpfc_sli_config_mbox *sli_cfg_mbx;
4138 	uint32_t subsys;
4139 	uint32_t opcode;
4140 	int rc = SLI_CONFIG_NOT_HANDLED;
4141 
4142 	/* state change on new multi-buffer pass-through mailbox command */
4143 	phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_HOST;
4144 
4145 	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)dmabuf->virt;
4146 
4147 	if (!bsg_bf_get(lpfc_mbox_hdr_emb,
4148 	    &sli_cfg_mbx->un.sli_config_emb0_subsys.sli_config_hdr)) {
4149 		subsys = bsg_bf_get(lpfc_emb0_subcmnd_subsys,
4150 				    &sli_cfg_mbx->un.sli_config_emb0_subsys);
4151 		opcode = bsg_bf_get(lpfc_emb0_subcmnd_opcode,
4152 				    &sli_cfg_mbx->un.sli_config_emb0_subsys);
4153 		if (subsys == SLI_CONFIG_SUBSYS_FCOE) {
4154 			switch (opcode) {
4155 			case FCOE_OPCODE_READ_FCF:
4156 			case FCOE_OPCODE_GET_DPORT_RESULTS:
4157 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4158 						"2957 Handled SLI_CONFIG "
4159 						"subsys_fcoe, opcode:x%x\n",
4160 						opcode);
4161 				rc = lpfc_bsg_sli_cfg_read_cmd_ext(phba, job,
4162 							nemb_mse, dmabuf);
4163 				break;
4164 			case FCOE_OPCODE_ADD_FCF:
4165 			case FCOE_OPCODE_SET_DPORT_MODE:
4166 			case LPFC_MBOX_OPCODE_FCOE_LINK_DIAG_STATE:
4167 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4168 						"2958 Handled SLI_CONFIG "
4169 						"subsys_fcoe, opcode:x%x\n",
4170 						opcode);
4171 				rc = lpfc_bsg_sli_cfg_write_cmd_ext(phba, job,
4172 							nemb_mse, dmabuf);
4173 				break;
4174 			default:
4175 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4176 						"2959 Reject SLI_CONFIG "
4177 						"subsys_fcoe, opcode:x%x\n",
4178 						opcode);
4179 				rc = -EPERM;
4180 				break;
4181 			}
4182 		} else if (subsys == SLI_CONFIG_SUBSYS_COMN) {
4183 			switch (opcode) {
4184 			case COMN_OPCODE_GET_CNTL_ADDL_ATTRIBUTES:
4185 			case COMN_OPCODE_GET_CNTL_ATTRIBUTES:
4186 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4187 						"3106 Handled SLI_CONFIG "
4188 						"subsys_comn, opcode:x%x\n",
4189 						opcode);
4190 				rc = lpfc_bsg_sli_cfg_read_cmd_ext(phba, job,
4191 							nemb_mse, dmabuf);
4192 				break;
4193 			default:
4194 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4195 						"3107 Reject SLI_CONFIG "
4196 						"subsys_comn, opcode:x%x\n",
4197 						opcode);
4198 				rc = -EPERM;
4199 				break;
4200 			}
4201 		} else {
4202 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4203 					"2977 Reject SLI_CONFIG "
4204 					"subsys:x%d, opcode:x%x\n",
4205 					subsys, opcode);
4206 			rc = -EPERM;
4207 		}
4208 	} else {
4209 		subsys = bsg_bf_get(lpfc_emb1_subcmnd_subsys,
4210 				    &sli_cfg_mbx->un.sli_config_emb1_subsys);
4211 		opcode = bsg_bf_get(lpfc_emb1_subcmnd_opcode,
4212 				    &sli_cfg_mbx->un.sli_config_emb1_subsys);
4213 		if (subsys == SLI_CONFIG_SUBSYS_COMN) {
4214 			switch (opcode) {
4215 			case COMN_OPCODE_READ_OBJECT:
4216 			case COMN_OPCODE_READ_OBJECT_LIST:
4217 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4218 						"2960 Handled SLI_CONFIG "
4219 						"subsys_comn, opcode:x%x\n",
4220 						opcode);
4221 				rc = lpfc_bsg_sli_cfg_read_cmd_ext(phba, job,
4222 							nemb_hbd, dmabuf);
4223 				break;
4224 			case COMN_OPCODE_WRITE_OBJECT:
4225 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4226 						"2961 Handled SLI_CONFIG "
4227 						"subsys_comn, opcode:x%x\n",
4228 						opcode);
4229 				rc = lpfc_bsg_sli_cfg_write_cmd_ext(phba, job,
4230 							nemb_hbd, dmabuf);
4231 				break;
4232 			default:
4233 				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4234 						"2962 Not handled SLI_CONFIG "
4235 						"subsys_comn, opcode:x%x\n",
4236 						opcode);
4237 				rc = SLI_CONFIG_NOT_HANDLED;
4238 				break;
4239 			}
4240 		} else {
4241 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4242 					"2978 Not handled SLI_CONFIG "
4243 					"subsys:x%d, opcode:x%x\n",
4244 					subsys, opcode);
4245 			rc = SLI_CONFIG_NOT_HANDLED;
4246 		}
4247 	}
4248 
4249 	/* state reset on not handled new multi-buffer mailbox command */
4250 	if (rc != SLI_CONFIG_HANDLED)
4251 		phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_IDLE;
4252 
4253 	return rc;
4254 }
4255 
4256 /**
4257  * lpfc_bsg_mbox_ext_abort_req - request to abort mbox command with ext buffers
4258  * @phba: Pointer to HBA context object.
4259  *
4260  * This routine is for requesting to abort a pass-through mailbox command with
4261  * multiple external buffers due to error condition.
4262  **/
4263 static void
4264 lpfc_bsg_mbox_ext_abort(struct lpfc_hba *phba)
4265 {
4266 	if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_PORT)
4267 		phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_ABTS;
4268 	else
4269 		lpfc_bsg_mbox_ext_session_reset(phba);
4270 	return;
4271 }
4272 
4273 /**
4274  * lpfc_bsg_read_ebuf_get - get the next mailbox read external buffer
4275  * @phba: Pointer to HBA context object.
4276  * @dmabuf: Pointer to a DMA buffer descriptor.
4277  *
4278  * This routine extracts the next mailbox read external buffer back to
4279  * user space through BSG.
4280  **/
4281 static int
4282 lpfc_bsg_read_ebuf_get(struct lpfc_hba *phba, struct fc_bsg_job *job)
4283 {
4284 	struct lpfc_sli_config_mbox *sli_cfg_mbx;
4285 	struct lpfc_dmabuf *dmabuf;
4286 	uint8_t *pbuf;
4287 	uint32_t size;
4288 	uint32_t index;
4289 
4290 	index = phba->mbox_ext_buf_ctx.seqNum;
4291 	phba->mbox_ext_buf_ctx.seqNum++;
4292 
4293 	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)
4294 			phba->mbox_ext_buf_ctx.mbx_dmabuf->virt;
4295 
4296 	if (phba->mbox_ext_buf_ctx.nembType == nemb_mse) {
4297 		size = bsg_bf_get(lpfc_mbox_sli_config_mse_len,
4298 			&sli_cfg_mbx->un.sli_config_emb0_subsys.mse[index]);
4299 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4300 				"2963 SLI_CONFIG (mse) ext-buffer rd get "
4301 				"buffer[%d], size:%d\n", index, size);
4302 	} else {
4303 		size = bsg_bf_get(lpfc_mbox_sli_config_ecmn_hbd_len,
4304 			&sli_cfg_mbx->un.sli_config_emb1_subsys.hbd[index]);
4305 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4306 				"2964 SLI_CONFIG (hbd) ext-buffer rd get "
4307 				"buffer[%d], size:%d\n", index, size);
4308 	}
4309 	if (list_empty(&phba->mbox_ext_buf_ctx.ext_dmabuf_list))
4310 		return -EPIPE;
4311 	dmabuf = list_first_entry(&phba->mbox_ext_buf_ctx.ext_dmabuf_list,
4312 				  struct lpfc_dmabuf, list);
4313 	list_del_init(&dmabuf->list);
4314 
4315 	/* after dma buffer descriptor setup */
4316 	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, phba->mbox_ext_buf_ctx.nembType,
4317 					mbox_rd, dma_ebuf, sta_pos_addr,
4318 					dmabuf, index);
4319 
4320 	pbuf = (uint8_t *)dmabuf->virt;
4321 	job->reply->reply_payload_rcv_len =
4322 		sg_copy_from_buffer(job->reply_payload.sg_list,
4323 				    job->reply_payload.sg_cnt,
4324 				    pbuf, size);
4325 
4326 	lpfc_bsg_dma_page_free(phba, dmabuf);
4327 
4328 	if (phba->mbox_ext_buf_ctx.seqNum == phba->mbox_ext_buf_ctx.numBuf) {
4329 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4330 				"2965 SLI_CONFIG (hbd) ext-buffer rd mbox "
4331 				"command session done\n");
4332 		lpfc_bsg_mbox_ext_session_reset(phba);
4333 	}
4334 
4335 	job->reply->result = 0;
4336 	job->job_done(job);
4337 
4338 	return SLI_CONFIG_HANDLED;
4339 }
4340 
4341 /**
4342  * lpfc_bsg_write_ebuf_set - set the next mailbox write external buffer
4343  * @phba: Pointer to HBA context object.
4344  * @dmabuf: Pointer to a DMA buffer descriptor.
4345  *
4346  * This routine sets up the next mailbox read external buffer obtained
4347  * from user space through BSG.
4348  **/
4349 static int
4350 lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct fc_bsg_job *job,
4351 			struct lpfc_dmabuf *dmabuf)
4352 {
4353 	struct lpfc_sli_config_mbox *sli_cfg_mbx;
4354 	struct bsg_job_data *dd_data = NULL;
4355 	LPFC_MBOXQ_t *pmboxq = NULL;
4356 	MAILBOX_t *pmb;
4357 	enum nemb_type nemb_tp;
4358 	uint8_t *pbuf;
4359 	uint32_t size;
4360 	uint32_t index;
4361 	int rc;
4362 
4363 	index = phba->mbox_ext_buf_ctx.seqNum;
4364 	phba->mbox_ext_buf_ctx.seqNum++;
4365 	nemb_tp = phba->mbox_ext_buf_ctx.nembType;
4366 
4367 	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)
4368 			phba->mbox_ext_buf_ctx.mbx_dmabuf->virt;
4369 
4370 	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
4371 	if (!dd_data) {
4372 		rc = -ENOMEM;
4373 		goto job_error;
4374 	}
4375 
4376 	pbuf = (uint8_t *)dmabuf->virt;
4377 	size = job->request_payload.payload_len;
4378 	sg_copy_to_buffer(job->request_payload.sg_list,
4379 			  job->request_payload.sg_cnt,
4380 			  pbuf, size);
4381 
4382 	if (phba->mbox_ext_buf_ctx.nembType == nemb_mse) {
4383 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4384 				"2966 SLI_CONFIG (mse) ext-buffer wr set "
4385 				"buffer[%d], size:%d\n",
4386 				phba->mbox_ext_buf_ctx.seqNum, size);
4387 
4388 	} else {
4389 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4390 				"2967 SLI_CONFIG (hbd) ext-buffer wr set "
4391 				"buffer[%d], size:%d\n",
4392 				phba->mbox_ext_buf_ctx.seqNum, size);
4393 
4394 	}
4395 
4396 	/* set up external buffer descriptor and add to external buffer list */
4397 	lpfc_bsg_sli_cfg_dma_desc_setup(phba, nemb_tp, index,
4398 					phba->mbox_ext_buf_ctx.mbx_dmabuf,
4399 					dmabuf);
4400 	list_add_tail(&dmabuf->list, &phba->mbox_ext_buf_ctx.ext_dmabuf_list);
4401 
4402 	/* after write dma buffer */
4403 	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, phba->mbox_ext_buf_ctx.nembType,
4404 					mbox_wr, dma_ebuf, sta_pos_addr,
4405 					dmabuf, index);
4406 
4407 	if (phba->mbox_ext_buf_ctx.seqNum == phba->mbox_ext_buf_ctx.numBuf) {
4408 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4409 				"2968 SLI_CONFIG ext-buffer wr all %d "
4410 				"ebuffers received\n",
4411 				phba->mbox_ext_buf_ctx.numBuf);
4412 		/* mailbox command structure for base driver */
4413 		pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
4414 		if (!pmboxq) {
4415 			rc = -ENOMEM;
4416 			goto job_error;
4417 		}
4418 		memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
4419 		pbuf = (uint8_t *)phba->mbox_ext_buf_ctx.mbx_dmabuf->virt;
4420 		pmb = &pmboxq->u.mb;
4421 		memcpy(pmb, pbuf, sizeof(*pmb));
4422 		pmb->mbxOwner = OWN_HOST;
4423 		pmboxq->vport = phba->pport;
4424 
4425 		/* callback for multi-buffer write mailbox command */
4426 		pmboxq->mbox_cmpl = lpfc_bsg_issue_write_mbox_ext_cmpl;
4427 
4428 		/* context fields to callback function */
4429 		pmboxq->context1 = dd_data;
4430 		dd_data->type = TYPE_MBOX;
4431 		dd_data->set_job = job;
4432 		dd_data->context_un.mbox.pmboxq = pmboxq;
4433 		dd_data->context_un.mbox.mb = (MAILBOX_t *)pbuf;
4434 		job->dd_data = dd_data;
4435 
4436 		/* state change */
4437 		phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_PORT;
4438 
4439 		rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
4440 		if ((rc == MBX_SUCCESS) || (rc == MBX_BUSY)) {
4441 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4442 					"2969 Issued SLI_CONFIG ext-buffer "
4443 					"maibox command, rc:x%x\n", rc);
4444 			return SLI_CONFIG_HANDLED;
4445 		}
4446 		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4447 				"2970 Failed to issue SLI_CONFIG ext-buffer "
4448 				"maibox command, rc:x%x\n", rc);
4449 		rc = -EPIPE;
4450 		goto job_error;
4451 	}
4452 
4453 	/* wait for additoinal external buffers */
4454 	job->reply->result = 0;
4455 	job->job_done(job);
4456 	return SLI_CONFIG_HANDLED;
4457 
4458 job_error:
4459 	lpfc_bsg_dma_page_free(phba, dmabuf);
4460 	kfree(dd_data);
4461 
4462 	return rc;
4463 }
4464 
4465 /**
4466  * lpfc_bsg_handle_sli_cfg_ebuf - handle ext buffer with sli-cfg mailbox cmd
4467  * @phba: Pointer to HBA context object.
4468  * @mb: Pointer to a BSG mailbox object.
4469  * @dmabuff: Pointer to a DMA buffer descriptor.
4470  *
4471  * This routine handles the external buffer with SLI_CONFIG (0x9B) mailbox
4472  * command with multiple non-embedded external buffers.
4473  **/
4474 static int
4475 lpfc_bsg_handle_sli_cfg_ebuf(struct lpfc_hba *phba, struct fc_bsg_job *job,
4476 			     struct lpfc_dmabuf *dmabuf)
4477 {
4478 	int rc;
4479 
4480 	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4481 			"2971 SLI_CONFIG buffer (type:x%x)\n",
4482 			phba->mbox_ext_buf_ctx.mboxType);
4483 
4484 	if (phba->mbox_ext_buf_ctx.mboxType == mbox_rd) {
4485 		if (phba->mbox_ext_buf_ctx.state != LPFC_BSG_MBOX_DONE) {
4486 			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4487 					"2972 SLI_CONFIG rd buffer state "
4488 					"mismatch:x%x\n",
4489 					phba->mbox_ext_buf_ctx.state);
4490 			lpfc_bsg_mbox_ext_abort(phba);
4491 			return -EPIPE;
4492 		}
4493 		rc = lpfc_bsg_read_ebuf_get(phba, job);
4494 		if (rc == SLI_CONFIG_HANDLED)
4495 			lpfc_bsg_dma_page_free(phba, dmabuf);
4496 	} else { /* phba->mbox_ext_buf_ctx.mboxType == mbox_wr */
4497 		if (phba->mbox_ext_buf_ctx.state != LPFC_BSG_MBOX_HOST) {
4498 			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4499 					"2973 SLI_CONFIG wr buffer state "
4500 					"mismatch:x%x\n",
4501 					phba->mbox_ext_buf_ctx.state);
4502 			lpfc_bsg_mbox_ext_abort(phba);
4503 			return -EPIPE;
4504 		}
4505 		rc = lpfc_bsg_write_ebuf_set(phba, job, dmabuf);
4506 	}
4507 	return rc;
4508 }
4509 
4510 /**
4511  * lpfc_bsg_handle_sli_cfg_ext - handle sli-cfg mailbox with external buffer
4512  * @phba: Pointer to HBA context object.
4513  * @mb: Pointer to a BSG mailbox object.
4514  * @dmabuff: Pointer to a DMA buffer descriptor.
4515  *
4516  * This routine checkes and handles non-embedded multi-buffer SLI_CONFIG
4517  * (0x9B) mailbox commands and external buffers.
4518  **/
4519 static int
4520 lpfc_bsg_handle_sli_cfg_ext(struct lpfc_hba *phba, struct fc_bsg_job *job,
4521 			    struct lpfc_dmabuf *dmabuf)
4522 {
4523 	struct dfc_mbox_req *mbox_req;
4524 	int rc = SLI_CONFIG_NOT_HANDLED;
4525 
4526 	mbox_req =
4527 	   (struct dfc_mbox_req *)job->request->rqst_data.h_vendor.vendor_cmd;
4528 
4529 	/* mbox command with/without single external buffer */
4530 	if (mbox_req->extMboxTag == 0 && mbox_req->extSeqNum == 0)
4531 		return rc;
4532 
4533 	/* mbox command and first external buffer */
4534 	if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_IDLE) {
4535 		if (mbox_req->extSeqNum == 1) {
4536 			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4537 					"2974 SLI_CONFIG mailbox: tag:%d, "
4538 					"seq:%d\n", mbox_req->extMboxTag,
4539 					mbox_req->extSeqNum);
4540 			rc = lpfc_bsg_handle_sli_cfg_mbox(phba, job, dmabuf);
4541 			return rc;
4542 		} else
4543 			goto sli_cfg_ext_error;
4544 	}
4545 
4546 	/*
4547 	 * handle additional external buffers
4548 	 */
4549 
4550 	/* check broken pipe conditions */
4551 	if (mbox_req->extMboxTag != phba->mbox_ext_buf_ctx.mbxTag)
4552 		goto sli_cfg_ext_error;
4553 	if (mbox_req->extSeqNum > phba->mbox_ext_buf_ctx.numBuf)
4554 		goto sli_cfg_ext_error;
4555 	if (mbox_req->extSeqNum != phba->mbox_ext_buf_ctx.seqNum + 1)
4556 		goto sli_cfg_ext_error;
4557 
4558 	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4559 			"2975 SLI_CONFIG mailbox external buffer: "
4560 			"extSta:x%x, tag:%d, seq:%d\n",
4561 			phba->mbox_ext_buf_ctx.state, mbox_req->extMboxTag,
4562 			mbox_req->extSeqNum);
4563 	rc = lpfc_bsg_handle_sli_cfg_ebuf(phba, job, dmabuf);
4564 	return rc;
4565 
4566 sli_cfg_ext_error:
4567 	/* all other cases, broken pipe */
4568 	lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4569 			"2976 SLI_CONFIG mailbox broken pipe: "
4570 			"ctxSta:x%x, ctxNumBuf:%d "
4571 			"ctxTag:%d, ctxSeq:%d, tag:%d, seq:%d\n",
4572 			phba->mbox_ext_buf_ctx.state,
4573 			phba->mbox_ext_buf_ctx.numBuf,
4574 			phba->mbox_ext_buf_ctx.mbxTag,
4575 			phba->mbox_ext_buf_ctx.seqNum,
4576 			mbox_req->extMboxTag, mbox_req->extSeqNum);
4577 
4578 	lpfc_bsg_mbox_ext_session_reset(phba);
4579 
4580 	return -EPIPE;
4581 }
4582 
4583 /**
4584  * lpfc_bsg_issue_mbox - issues a mailbox command on behalf of an app
4585  * @phba: Pointer to HBA context object.
4586  * @mb: Pointer to a mailbox object.
4587  * @vport: Pointer to a vport object.
4588  *
4589  * Allocate a tracking object, mailbox command memory, get a mailbox
4590  * from the mailbox pool, copy the caller mailbox command.
4591  *
4592  * If offline and the sli is active we need to poll for the command (port is
4593  * being reset) and com-plete the job, otherwise issue the mailbox command and
4594  * let our completion handler finish the command.
4595  **/
4596 static uint32_t
4597 lpfc_bsg_issue_mbox(struct lpfc_hba *phba, struct fc_bsg_job *job,
4598 	struct lpfc_vport *vport)
4599 {
4600 	LPFC_MBOXQ_t *pmboxq = NULL; /* internal mailbox queue */
4601 	MAILBOX_t *pmb; /* shortcut to the pmboxq mailbox */
4602 	/* a 4k buffer to hold the mb and extended data from/to the bsg */
4603 	uint8_t *pmbx = NULL;
4604 	struct bsg_job_data *dd_data = NULL; /* bsg data tracking structure */
4605 	struct lpfc_dmabuf *dmabuf = NULL;
4606 	struct dfc_mbox_req *mbox_req;
4607 	struct READ_EVENT_LOG_VAR *rdEventLog;
4608 	uint32_t transmit_length, receive_length, mode;
4609 	struct lpfc_mbx_sli4_config *sli4_config;
4610 	struct lpfc_mbx_nembed_cmd *nembed_sge;
4611 	struct mbox_header *header;
4612 	struct ulp_bde64 *bde;
4613 	uint8_t *ext = NULL;
4614 	int rc = 0;
4615 	uint8_t *from;
4616 	uint32_t size;
4617 
4618 	/* in case no data is transferred */
4619 	job->reply->reply_payload_rcv_len = 0;
4620 
4621 	/* sanity check to protect driver */
4622 	if (job->reply_payload.payload_len > BSG_MBOX_SIZE ||
4623 	    job->request_payload.payload_len > BSG_MBOX_SIZE) {
4624 		rc = -ERANGE;
4625 		goto job_done;
4626 	}
4627 
4628 	/*
4629 	 * Don't allow mailbox commands to be sent when blocked or when in
4630 	 * the middle of discovery
4631 	 */
4632 	 if (phba->sli.sli_flag & LPFC_BLOCK_MGMT_IO) {
4633 		rc = -EAGAIN;
4634 		goto job_done;
4635 	}
4636 
4637 	mbox_req =
4638 	    (struct dfc_mbox_req *)job->request->rqst_data.h_vendor.vendor_cmd;
4639 
4640 	/* check if requested extended data lengths are valid */
4641 	if ((mbox_req->inExtWLen > BSG_MBOX_SIZE/sizeof(uint32_t)) ||
4642 	    (mbox_req->outExtWLen > BSG_MBOX_SIZE/sizeof(uint32_t))) {
4643 		rc = -ERANGE;
4644 		goto job_done;
4645 	}
4646 
4647 	dmabuf = lpfc_bsg_dma_page_alloc(phba);
4648 	if (!dmabuf || !dmabuf->virt) {
4649 		rc = -ENOMEM;
4650 		goto job_done;
4651 	}
4652 
4653 	/* Get the mailbox command or external buffer from BSG */
4654 	pmbx = (uint8_t *)dmabuf->virt;
4655 	size = job->request_payload.payload_len;
4656 	sg_copy_to_buffer(job->request_payload.sg_list,
4657 			  job->request_payload.sg_cnt, pmbx, size);
4658 
4659 	/* Handle possible SLI_CONFIG with non-embedded payloads */
4660 	if (phba->sli_rev == LPFC_SLI_REV4) {
4661 		rc = lpfc_bsg_handle_sli_cfg_ext(phba, job, dmabuf);
4662 		if (rc == SLI_CONFIG_HANDLED)
4663 			goto job_cont;
4664 		if (rc)
4665 			goto job_done;
4666 		/* SLI_CONFIG_NOT_HANDLED for other mailbox commands */
4667 	}
4668 
4669 	rc = lpfc_bsg_check_cmd_access(phba, (MAILBOX_t *)pmbx, vport);
4670 	if (rc != 0)
4671 		goto job_done; /* must be negative */
4672 
4673 	/* allocate our bsg tracking structure */
4674 	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
4675 	if (!dd_data) {
4676 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
4677 				"2727 Failed allocation of dd_data\n");
4678 		rc = -ENOMEM;
4679 		goto job_done;
4680 	}
4681 
4682 	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
4683 	if (!pmboxq) {
4684 		rc = -ENOMEM;
4685 		goto job_done;
4686 	}
4687 	memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
4688 
4689 	pmb = &pmboxq->u.mb;
4690 	memcpy(pmb, pmbx, sizeof(*pmb));
4691 	pmb->mbxOwner = OWN_HOST;
4692 	pmboxq->vport = vport;
4693 
4694 	/* If HBA encountered an error attention, allow only DUMP
4695 	 * or RESTART mailbox commands until the HBA is restarted.
4696 	 */
4697 	if (phba->pport->stopped &&
4698 	    pmb->mbxCommand != MBX_DUMP_MEMORY &&
4699 	    pmb->mbxCommand != MBX_RESTART &&
4700 	    pmb->mbxCommand != MBX_WRITE_VPARMS &&
4701 	    pmb->mbxCommand != MBX_WRITE_WWN)
4702 		lpfc_printf_log(phba, KERN_WARNING, LOG_MBOX,
4703 				"2797 mbox: Issued mailbox cmd "
4704 				"0x%x while in stopped state.\n",
4705 				pmb->mbxCommand);
4706 
4707 	/* extended mailbox commands will need an extended buffer */
4708 	if (mbox_req->inExtWLen || mbox_req->outExtWLen) {
4709 		from = pmbx;
4710 		ext = from + sizeof(MAILBOX_t);
4711 		pmboxq->context2 = ext;
4712 		pmboxq->in_ext_byte_len =
4713 			mbox_req->inExtWLen * sizeof(uint32_t);
4714 		pmboxq->out_ext_byte_len =
4715 			mbox_req->outExtWLen * sizeof(uint32_t);
4716 		pmboxq->mbox_offset_word = mbox_req->mbOffset;
4717 	}
4718 
4719 	/* biu diag will need a kernel buffer to transfer the data
4720 	 * allocate our own buffer and setup the mailbox command to
4721 	 * use ours
4722 	 */
4723 	if (pmb->mbxCommand == MBX_RUN_BIU_DIAG64) {
4724 		transmit_length = pmb->un.varWords[1];
4725 		receive_length = pmb->un.varWords[4];
4726 		/* transmit length cannot be greater than receive length or
4727 		 * mailbox extension size
4728 		 */
4729 		if ((transmit_length > receive_length) ||
4730 			(transmit_length > BSG_MBOX_SIZE - sizeof(MAILBOX_t))) {
4731 			rc = -ERANGE;
4732 			goto job_done;
4733 		}
4734 		pmb->un.varBIUdiag.un.s2.xmit_bde64.addrHigh =
4735 			putPaddrHigh(dmabuf->phys + sizeof(MAILBOX_t));
4736 		pmb->un.varBIUdiag.un.s2.xmit_bde64.addrLow =
4737 			putPaddrLow(dmabuf->phys + sizeof(MAILBOX_t));
4738 
4739 		pmb->un.varBIUdiag.un.s2.rcv_bde64.addrHigh =
4740 			putPaddrHigh(dmabuf->phys + sizeof(MAILBOX_t)
4741 			  + pmb->un.varBIUdiag.un.s2.xmit_bde64.tus.f.bdeSize);
4742 		pmb->un.varBIUdiag.un.s2.rcv_bde64.addrLow =
4743 			putPaddrLow(dmabuf->phys + sizeof(MAILBOX_t)
4744 			  + pmb->un.varBIUdiag.un.s2.xmit_bde64.tus.f.bdeSize);
4745 	} else if (pmb->mbxCommand == MBX_READ_EVENT_LOG) {
4746 		rdEventLog = &pmb->un.varRdEventLog;
4747 		receive_length = rdEventLog->rcv_bde64.tus.f.bdeSize;
4748 		mode = bf_get(lpfc_event_log, rdEventLog);
4749 
4750 		/* receive length cannot be greater than mailbox
4751 		 * extension size
4752 		 */
4753 		if (receive_length > BSG_MBOX_SIZE - sizeof(MAILBOX_t)) {
4754 			rc = -ERANGE;
4755 			goto job_done;
4756 		}
4757 
4758 		/* mode zero uses a bde like biu diags command */
4759 		if (mode == 0) {
4760 			pmb->un.varWords[3] = putPaddrLow(dmabuf->phys
4761 							+ sizeof(MAILBOX_t));
4762 			pmb->un.varWords[4] = putPaddrHigh(dmabuf->phys
4763 							+ sizeof(MAILBOX_t));
4764 		}
4765 	} else if (phba->sli_rev == LPFC_SLI_REV4) {
4766 		/* Let type 4 (well known data) through because the data is
4767 		 * returned in varwords[4-8]
4768 		 * otherwise check the recieve length and fetch the buffer addr
4769 		 */
4770 		if ((pmb->mbxCommand == MBX_DUMP_MEMORY) &&
4771 			(pmb->un.varDmp.type != DMP_WELL_KNOWN)) {
4772 			/* rebuild the command for sli4 using our own buffers
4773 			* like we do for biu diags
4774 			*/
4775 			receive_length = pmb->un.varWords[2];
4776 			/* receive length cannot be greater than mailbox
4777 			 * extension size
4778 			 */
4779 			if (receive_length == 0) {
4780 				rc = -ERANGE;
4781 				goto job_done;
4782 			}
4783 			pmb->un.varWords[3] = putPaddrLow(dmabuf->phys
4784 						+ sizeof(MAILBOX_t));
4785 			pmb->un.varWords[4] = putPaddrHigh(dmabuf->phys
4786 						+ sizeof(MAILBOX_t));
4787 		} else if ((pmb->mbxCommand == MBX_UPDATE_CFG) &&
4788 			pmb->un.varUpdateCfg.co) {
4789 			bde = (struct ulp_bde64 *)&pmb->un.varWords[4];
4790 
4791 			/* bde size cannot be greater than mailbox ext size */
4792 			if (bde->tus.f.bdeSize >
4793 			    BSG_MBOX_SIZE - sizeof(MAILBOX_t)) {
4794 				rc = -ERANGE;
4795 				goto job_done;
4796 			}
4797 			bde->addrHigh = putPaddrHigh(dmabuf->phys
4798 						+ sizeof(MAILBOX_t));
4799 			bde->addrLow = putPaddrLow(dmabuf->phys
4800 						+ sizeof(MAILBOX_t));
4801 		} else if (pmb->mbxCommand == MBX_SLI4_CONFIG) {
4802 			/* Handling non-embedded SLI_CONFIG mailbox command */
4803 			sli4_config = &pmboxq->u.mqe.un.sli4_config;
4804 			if (!bf_get(lpfc_mbox_hdr_emb,
4805 			    &sli4_config->header.cfg_mhdr)) {
4806 				/* rebuild the command for sli4 using our
4807 				 * own buffers like we do for biu diags
4808 				 */
4809 				header = (struct mbox_header *)
4810 						&pmb->un.varWords[0];
4811 				nembed_sge = (struct lpfc_mbx_nembed_cmd *)
4812 						&pmb->un.varWords[0];
4813 				receive_length = nembed_sge->sge[0].length;
4814 
4815 				/* receive length cannot be greater than
4816 				 * mailbox extension size
4817 				 */
4818 				if ((receive_length == 0) ||
4819 				    (receive_length >
4820 				     BSG_MBOX_SIZE - sizeof(MAILBOX_t))) {
4821 					rc = -ERANGE;
4822 					goto job_done;
4823 				}
4824 
4825 				nembed_sge->sge[0].pa_hi =
4826 						putPaddrHigh(dmabuf->phys
4827 						   + sizeof(MAILBOX_t));
4828 				nembed_sge->sge[0].pa_lo =
4829 						putPaddrLow(dmabuf->phys
4830 						   + sizeof(MAILBOX_t));
4831 			}
4832 		}
4833 	}
4834 
4835 	dd_data->context_un.mbox.dmabuffers = dmabuf;
4836 
4837 	/* setup wake call as IOCB callback */
4838 	pmboxq->mbox_cmpl = lpfc_bsg_issue_mbox_cmpl;
4839 
4840 	/* setup context field to pass wait_queue pointer to wake function */
4841 	pmboxq->context1 = dd_data;
4842 	dd_data->type = TYPE_MBOX;
4843 	dd_data->set_job = job;
4844 	dd_data->context_un.mbox.pmboxq = pmboxq;
4845 	dd_data->context_un.mbox.mb = (MAILBOX_t *)pmbx;
4846 	dd_data->context_un.mbox.ext = ext;
4847 	dd_data->context_un.mbox.mbOffset = mbox_req->mbOffset;
4848 	dd_data->context_un.mbox.inExtWLen = mbox_req->inExtWLen;
4849 	dd_data->context_un.mbox.outExtWLen = mbox_req->outExtWLen;
4850 	job->dd_data = dd_data;
4851 
4852 	if ((vport->fc_flag & FC_OFFLINE_MODE) ||
4853 	    (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))) {
4854 		rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_POLL);
4855 		if (rc != MBX_SUCCESS) {
4856 			rc = (rc == MBX_TIMEOUT) ? -ETIME : -ENODEV;
4857 			goto job_done;
4858 		}
4859 
4860 		/* job finished, copy the data */
4861 		memcpy(pmbx, pmb, sizeof(*pmb));
4862 		job->reply->reply_payload_rcv_len =
4863 			sg_copy_from_buffer(job->reply_payload.sg_list,
4864 					    job->reply_payload.sg_cnt,
4865 					    pmbx, size);
4866 		/* not waiting mbox already done */
4867 		rc = 0;
4868 		goto job_done;
4869 	}
4870 
4871 	rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
4872 	if ((rc == MBX_SUCCESS) || (rc == MBX_BUSY))
4873 		return 1; /* job started */
4874 
4875 job_done:
4876 	/* common exit for error or job completed inline */
4877 	if (pmboxq)
4878 		mempool_free(pmboxq, phba->mbox_mem_pool);
4879 	lpfc_bsg_dma_page_free(phba, dmabuf);
4880 	kfree(dd_data);
4881 
4882 job_cont:
4883 	return rc;
4884 }
4885 
4886 /**
4887  * lpfc_bsg_mbox_cmd - process an fc bsg LPFC_BSG_VENDOR_MBOX command
4888  * @job: MBOX fc_bsg_job for LPFC_BSG_VENDOR_MBOX.
4889  **/
4890 static int
4891 lpfc_bsg_mbox_cmd(struct fc_bsg_job *job)
4892 {
4893 	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
4894 	struct lpfc_hba *phba = vport->phba;
4895 	struct dfc_mbox_req *mbox_req;
4896 	int rc = 0;
4897 
4898 	/* mix-and-match backward compatibility */
4899 	job->reply->reply_payload_rcv_len = 0;
4900 	if (job->request_len <
4901 	    sizeof(struct fc_bsg_request) + sizeof(struct dfc_mbox_req)) {
4902 		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4903 				"2737 Mix-and-match backward compatibility "
4904 				"between MBOX_REQ old size:%d and "
4905 				"new request size:%d\n",
4906 				(int)(job->request_len -
4907 				      sizeof(struct fc_bsg_request)),
4908 				(int)sizeof(struct dfc_mbox_req));
4909 		mbox_req = (struct dfc_mbox_req *)
4910 				job->request->rqst_data.h_vendor.vendor_cmd;
4911 		mbox_req->extMboxTag = 0;
4912 		mbox_req->extSeqNum = 0;
4913 	}
4914 
4915 	rc = lpfc_bsg_issue_mbox(phba, job, vport);
4916 
4917 	if (rc == 0) {
4918 		/* job done */
4919 		job->reply->result = 0;
4920 		job->dd_data = NULL;
4921 		job->job_done(job);
4922 	} else if (rc == 1)
4923 		/* job submitted, will complete later*/
4924 		rc = 0; /* return zero, no error */
4925 	else {
4926 		/* some error occurred */
4927 		job->reply->result = rc;
4928 		job->dd_data = NULL;
4929 	}
4930 
4931 	return rc;
4932 }
4933 
4934 /**
4935  * lpfc_bsg_menlo_cmd_cmp - lpfc_menlo_cmd completion handler
4936  * @phba: Pointer to HBA context object.
4937  * @cmdiocbq: Pointer to command iocb.
4938  * @rspiocbq: Pointer to response iocb.
4939  *
4940  * This function is the completion handler for iocbs issued using
4941  * lpfc_menlo_cmd function. This function is called by the
4942  * ring event handler function without any lock held. This function
4943  * can be called from both worker thread context and interrupt
4944  * context. This function also can be called from another thread which
4945  * cleans up the SLI layer objects.
4946  * This function copies the contents of the response iocb to the
4947  * response iocb memory object provided by the caller of
4948  * lpfc_sli_issue_iocb_wait and then wakes up the thread which
4949  * sleeps for the iocb completion.
4950  **/
4951 static void
4952 lpfc_bsg_menlo_cmd_cmp(struct lpfc_hba *phba,
4953 			struct lpfc_iocbq *cmdiocbq,
4954 			struct lpfc_iocbq *rspiocbq)
4955 {
4956 	struct bsg_job_data *dd_data;
4957 	struct fc_bsg_job *job;
4958 	IOCB_t *rsp;
4959 	struct lpfc_dmabuf *bmp, *cmp, *rmp;
4960 	struct lpfc_bsg_menlo *menlo;
4961 	unsigned long flags;
4962 	struct menlo_response *menlo_resp;
4963 	unsigned int rsp_size;
4964 	int rc = 0;
4965 
4966 	dd_data = cmdiocbq->context1;
4967 	cmp = cmdiocbq->context2;
4968 	bmp = cmdiocbq->context3;
4969 	menlo = &dd_data->context_un.menlo;
4970 	rmp = menlo->rmp;
4971 	rsp = &rspiocbq->iocb;
4972 
4973 	/* Determine if job has been aborted */
4974 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
4975 	job = dd_data->set_job;
4976 	if (job) {
4977 		/* Prevent timeout handling from trying to abort job  */
4978 		job->dd_data = NULL;
4979 	}
4980 	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
4981 
4982 	/* Copy the job data or set the failing status for the job */
4983 
4984 	if (job) {
4985 		/* always return the xri, this would be used in the case
4986 		 * of a menlo download to allow the data to be sent as a
4987 		 * continuation of the exchange.
4988 		 */
4989 
4990 		menlo_resp = (struct menlo_response *)
4991 			job->reply->reply_data.vendor_reply.vendor_rsp;
4992 		menlo_resp->xri = rsp->ulpContext;
4993 		if (rsp->ulpStatus) {
4994 			if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
4995 				switch (rsp->un.ulpWord[4] & IOERR_PARAM_MASK) {
4996 				case IOERR_SEQUENCE_TIMEOUT:
4997 					rc = -ETIMEDOUT;
4998 					break;
4999 				case IOERR_INVALID_RPI:
5000 					rc = -EFAULT;
5001 					break;
5002 				default:
5003 					rc = -EACCES;
5004 					break;
5005 				}
5006 			} else {
5007 				rc = -EACCES;
5008 			}
5009 		} else {
5010 			rsp_size = rsp->un.genreq64.bdl.bdeSize;
5011 			job->reply->reply_payload_rcv_len =
5012 				lpfc_bsg_copy_data(rmp, &job->reply_payload,
5013 						   rsp_size, 0);
5014 		}
5015 
5016 	}
5017 
5018 	lpfc_sli_release_iocbq(phba, cmdiocbq);
5019 	lpfc_free_bsg_buffers(phba, cmp);
5020 	lpfc_free_bsg_buffers(phba, rmp);
5021 	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
5022 	kfree(bmp);
5023 	kfree(dd_data);
5024 
5025 	/* Complete the job if active */
5026 
5027 	if (job) {
5028 		job->reply->result = rc;
5029 		job->job_done(job);
5030 	}
5031 
5032 	return;
5033 }
5034 
5035 /**
5036  * lpfc_menlo_cmd - send an ioctl for menlo hardware
5037  * @job: fc_bsg_job to handle
5038  *
5039  * This function issues a gen request 64 CR ioctl for all menlo cmd requests,
5040  * all the command completions will return the xri for the command.
5041  * For menlo data requests a gen request 64 CX is used to continue the exchange
5042  * supplied in the menlo request header xri field.
5043  **/
5044 static int
5045 lpfc_menlo_cmd(struct fc_bsg_job *job)
5046 {
5047 	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
5048 	struct lpfc_hba *phba = vport->phba;
5049 	struct lpfc_iocbq *cmdiocbq;
5050 	IOCB_t *cmd;
5051 	int rc = 0;
5052 	struct menlo_command *menlo_cmd;
5053 	struct menlo_response *menlo_resp;
5054 	struct lpfc_dmabuf *bmp = NULL, *cmp = NULL, *rmp = NULL;
5055 	int request_nseg;
5056 	int reply_nseg;
5057 	struct bsg_job_data *dd_data;
5058 	struct ulp_bde64 *bpl = NULL;
5059 
5060 	/* in case no data is returned return just the return code */
5061 	job->reply->reply_payload_rcv_len = 0;
5062 
5063 	if (job->request_len <
5064 	    sizeof(struct fc_bsg_request) +
5065 		sizeof(struct menlo_command)) {
5066 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
5067 				"2784 Received MENLO_CMD request below "
5068 				"minimum size\n");
5069 		rc = -ERANGE;
5070 		goto no_dd_data;
5071 	}
5072 
5073 	if (job->reply_len <
5074 	    sizeof(struct fc_bsg_request) + sizeof(struct menlo_response)) {
5075 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
5076 				"2785 Received MENLO_CMD reply below "
5077 				"minimum size\n");
5078 		rc = -ERANGE;
5079 		goto no_dd_data;
5080 	}
5081 
5082 	if (!(phba->menlo_flag & HBA_MENLO_SUPPORT)) {
5083 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
5084 				"2786 Adapter does not support menlo "
5085 				"commands\n");
5086 		rc = -EPERM;
5087 		goto no_dd_data;
5088 	}
5089 
5090 	menlo_cmd = (struct menlo_command *)
5091 		job->request->rqst_data.h_vendor.vendor_cmd;
5092 
5093 	menlo_resp = (struct menlo_response *)
5094 		job->reply->reply_data.vendor_reply.vendor_rsp;
5095 
5096 	/* allocate our bsg tracking structure */
5097 	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
5098 	if (!dd_data) {
5099 		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
5100 				"2787 Failed allocation of dd_data\n");
5101 		rc = -ENOMEM;
5102 		goto no_dd_data;
5103 	}
5104 
5105 	bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
5106 	if (!bmp) {
5107 		rc = -ENOMEM;
5108 		goto free_dd;
5109 	}
5110 
5111 	bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
5112 	if (!bmp->virt) {
5113 		rc = -ENOMEM;
5114 		goto free_bmp;
5115 	}
5116 
5117 	INIT_LIST_HEAD(&bmp->list);
5118 
5119 	bpl = (struct ulp_bde64 *)bmp->virt;
5120 	request_nseg = LPFC_BPL_SIZE/sizeof(struct ulp_bde64);
5121 	cmp = lpfc_alloc_bsg_buffers(phba, job->request_payload.payload_len,
5122 				     1, bpl, &request_nseg);
5123 	if (!cmp) {
5124 		rc = -ENOMEM;
5125 		goto free_bmp;
5126 	}
5127 	lpfc_bsg_copy_data(cmp, &job->request_payload,
5128 			   job->request_payload.payload_len, 1);
5129 
5130 	bpl += request_nseg;
5131 	reply_nseg = LPFC_BPL_SIZE/sizeof(struct ulp_bde64) - request_nseg;
5132 	rmp = lpfc_alloc_bsg_buffers(phba, job->reply_payload.payload_len, 0,
5133 				     bpl, &reply_nseg);
5134 	if (!rmp) {
5135 		rc = -ENOMEM;
5136 		goto free_cmp;
5137 	}
5138 
5139 	cmdiocbq = lpfc_sli_get_iocbq(phba);
5140 	if (!cmdiocbq) {
5141 		rc = -ENOMEM;
5142 		goto free_rmp;
5143 	}
5144 
5145 	cmd = &cmdiocbq->iocb;
5146 	cmd->un.genreq64.bdl.ulpIoTag32 = 0;
5147 	cmd->un.genreq64.bdl.addrHigh = putPaddrHigh(bmp->phys);
5148 	cmd->un.genreq64.bdl.addrLow = putPaddrLow(bmp->phys);
5149 	cmd->un.genreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
5150 	cmd->un.genreq64.bdl.bdeSize =
5151 	    (request_nseg + reply_nseg) * sizeof(struct ulp_bde64);
5152 	cmd->un.genreq64.w5.hcsw.Fctl = (SI | LA);
5153 	cmd->un.genreq64.w5.hcsw.Dfctl = 0;
5154 	cmd->un.genreq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CMD;
5155 	cmd->un.genreq64.w5.hcsw.Type = MENLO_TRANSPORT_TYPE; /* 0xfe */
5156 	cmd->ulpBdeCount = 1;
5157 	cmd->ulpClass = CLASS3;
5158 	cmd->ulpOwner = OWN_CHIP;
5159 	cmd->ulpLe = 1; /* Limited Edition */
5160 	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
5161 	cmdiocbq->vport = phba->pport;
5162 	/* We want the firmware to timeout before we do */
5163 	cmd->ulpTimeout = MENLO_TIMEOUT - 5;
5164 	cmdiocbq->iocb_cmpl = lpfc_bsg_menlo_cmd_cmp;
5165 	cmdiocbq->context1 = dd_data;
5166 	cmdiocbq->context2 = cmp;
5167 	cmdiocbq->context3 = bmp;
5168 	if (menlo_cmd->cmd == LPFC_BSG_VENDOR_MENLO_CMD) {
5169 		cmd->ulpCommand = CMD_GEN_REQUEST64_CR;
5170 		cmd->ulpPU = MENLO_PU; /* 3 */
5171 		cmd->un.ulpWord[4] = MENLO_DID; /* 0x0000FC0E */
5172 		cmd->ulpContext = MENLO_CONTEXT; /* 0 */
5173 	} else {
5174 		cmd->ulpCommand = CMD_GEN_REQUEST64_CX;
5175 		cmd->ulpPU = 1;
5176 		cmd->un.ulpWord[4] = 0;
5177 		cmd->ulpContext = menlo_cmd->xri;
5178 	}
5179 
5180 	dd_data->type = TYPE_MENLO;
5181 	dd_data->set_job = job;
5182 	dd_data->context_un.menlo.cmdiocbq = cmdiocbq;
5183 	dd_data->context_un.menlo.rmp = rmp;
5184 	job->dd_data = dd_data;
5185 
5186 	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq,
5187 		MENLO_TIMEOUT - 5);
5188 	if (rc == IOCB_SUCCESS)
5189 		return 0; /* done for now */
5190 
5191 	lpfc_sli_release_iocbq(phba, cmdiocbq);
5192 
5193 free_rmp:
5194 	lpfc_free_bsg_buffers(phba, rmp);
5195 free_cmp:
5196 	lpfc_free_bsg_buffers(phba, cmp);
5197 free_bmp:
5198 	if (bmp->virt)
5199 		lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
5200 	kfree(bmp);
5201 free_dd:
5202 	kfree(dd_data);
5203 no_dd_data:
5204 	/* make error code available to userspace */
5205 	job->reply->result = rc;
5206 	job->dd_data = NULL;
5207 	return rc;
5208 }
5209 
5210 /**
5211  * lpfc_bsg_hst_vendor - process a vendor-specific fc_bsg_job
5212  * @job: fc_bsg_job to handle
5213  **/
5214 static int
5215 lpfc_bsg_hst_vendor(struct fc_bsg_job *job)
5216 {
5217 	int command = job->request->rqst_data.h_vendor.vendor_cmd[0];
5218 	int rc;
5219 
5220 	switch (command) {
5221 	case LPFC_BSG_VENDOR_SET_CT_EVENT:
5222 		rc = lpfc_bsg_hba_set_event(job);
5223 		break;
5224 	case LPFC_BSG_VENDOR_GET_CT_EVENT:
5225 		rc = lpfc_bsg_hba_get_event(job);
5226 		break;
5227 	case LPFC_BSG_VENDOR_SEND_MGMT_RESP:
5228 		rc = lpfc_bsg_send_mgmt_rsp(job);
5229 		break;
5230 	case LPFC_BSG_VENDOR_DIAG_MODE:
5231 		rc = lpfc_bsg_diag_loopback_mode(job);
5232 		break;
5233 	case LPFC_BSG_VENDOR_DIAG_MODE_END:
5234 		rc = lpfc_sli4_bsg_diag_mode_end(job);
5235 		break;
5236 	case LPFC_BSG_VENDOR_DIAG_RUN_LOOPBACK:
5237 		rc = lpfc_bsg_diag_loopback_run(job);
5238 		break;
5239 	case LPFC_BSG_VENDOR_LINK_DIAG_TEST:
5240 		rc = lpfc_sli4_bsg_link_diag_test(job);
5241 		break;
5242 	case LPFC_BSG_VENDOR_GET_MGMT_REV:
5243 		rc = lpfc_bsg_get_dfc_rev(job);
5244 		break;
5245 	case LPFC_BSG_VENDOR_MBOX:
5246 		rc = lpfc_bsg_mbox_cmd(job);
5247 		break;
5248 	case LPFC_BSG_VENDOR_MENLO_CMD:
5249 	case LPFC_BSG_VENDOR_MENLO_DATA:
5250 		rc = lpfc_menlo_cmd(job);
5251 		break;
5252 	default:
5253 		rc = -EINVAL;
5254 		job->reply->reply_payload_rcv_len = 0;
5255 		/* make error code available to userspace */
5256 		job->reply->result = rc;
5257 		break;
5258 	}
5259 
5260 	return rc;
5261 }
5262 
5263 /**
5264  * lpfc_bsg_request - handle a bsg request from the FC transport
5265  * @job: fc_bsg_job to handle
5266  **/
5267 int
5268 lpfc_bsg_request(struct fc_bsg_job *job)
5269 {
5270 	uint32_t msgcode;
5271 	int rc;
5272 
5273 	msgcode = job->request->msgcode;
5274 	switch (msgcode) {
5275 	case FC_BSG_HST_VENDOR:
5276 		rc = lpfc_bsg_hst_vendor(job);
5277 		break;
5278 	case FC_BSG_RPT_ELS:
5279 		rc = lpfc_bsg_rport_els(job);
5280 		break;
5281 	case FC_BSG_RPT_CT:
5282 		rc = lpfc_bsg_send_mgmt_cmd(job);
5283 		break;
5284 	default:
5285 		rc = -EINVAL;
5286 		job->reply->reply_payload_rcv_len = 0;
5287 		/* make error code available to userspace */
5288 		job->reply->result = rc;
5289 		break;
5290 	}
5291 
5292 	return rc;
5293 }
5294 
5295 /**
5296  * lpfc_bsg_timeout - handle timeout of a bsg request from the FC transport
5297  * @job: fc_bsg_job that has timed out
5298  *
5299  * This function just aborts the job's IOCB.  The aborted IOCB will return to
5300  * the waiting function which will handle passing the error back to userspace
5301  **/
5302 int
5303 lpfc_bsg_timeout(struct fc_bsg_job *job)
5304 {
5305 	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
5306 	struct lpfc_hba *phba = vport->phba;
5307 	struct lpfc_iocbq *cmdiocb;
5308 	struct lpfc_sli_ring *pring = &phba->sli.ring[LPFC_ELS_RING];
5309 	struct bsg_job_data *dd_data;
5310 	unsigned long flags;
5311 	int rc = 0;
5312 	LIST_HEAD(completions);
5313 	struct lpfc_iocbq *check_iocb, *next_iocb;
5314 
5315 	/* if job's driver data is NULL, the command completed or is in the
5316 	 * the process of completing.  In this case, return status to request
5317 	 * so the timeout is retried.  This avoids double completion issues
5318 	 * and the request will be pulled off the timer queue when the
5319 	 * command's completion handler executes.  Otherwise, prevent the
5320 	 * command's completion handler from executing the job done callback
5321 	 * and continue processing to abort the outstanding the command.
5322 	 */
5323 
5324 	spin_lock_irqsave(&phba->ct_ev_lock, flags);
5325 	dd_data = (struct bsg_job_data *)job->dd_data;
5326 	if (dd_data) {
5327 		dd_data->set_job = NULL;
5328 		job->dd_data = NULL;
5329 	} else {
5330 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5331 		return -EAGAIN;
5332 	}
5333 
5334 	switch (dd_data->type) {
5335 	case TYPE_IOCB:
5336 		/* Check to see if IOCB was issued to the port or not. If not,
5337 		 * remove it from the txq queue and call cancel iocbs.
5338 		 * Otherwise, call abort iotag
5339 		 */
5340 		cmdiocb = dd_data->context_un.iocb.cmdiocbq;
5341 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5342 
5343 		spin_lock_irqsave(&phba->hbalock, flags);
5344 		/* make sure the I/O abort window is still open */
5345 		if (!(cmdiocb->iocb_flag & LPFC_IO_CMD_OUTSTANDING)) {
5346 			spin_unlock_irqrestore(&phba->hbalock, flags);
5347 			return -EAGAIN;
5348 		}
5349 		list_for_each_entry_safe(check_iocb, next_iocb, &pring->txq,
5350 					 list) {
5351 			if (check_iocb == cmdiocb) {
5352 				list_move_tail(&check_iocb->list, &completions);
5353 				break;
5354 			}
5355 		}
5356 		if (list_empty(&completions))
5357 			lpfc_sli_issue_abort_iotag(phba, pring, cmdiocb);
5358 		spin_unlock_irqrestore(&phba->hbalock, flags);
5359 		if (!list_empty(&completions)) {
5360 			lpfc_sli_cancel_iocbs(phba, &completions,
5361 					      IOSTAT_LOCAL_REJECT,
5362 					      IOERR_SLI_ABORTED);
5363 		}
5364 		break;
5365 
5366 	case TYPE_EVT:
5367 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5368 		break;
5369 
5370 	case TYPE_MBOX:
5371 		/* Update the ext buf ctx state if needed */
5372 
5373 		if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_PORT)
5374 			phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_ABTS;
5375 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5376 		break;
5377 	case TYPE_MENLO:
5378 		/* Check to see if IOCB was issued to the port or not. If not,
5379 		 * remove it from the txq queue and call cancel iocbs.
5380 		 * Otherwise, call abort iotag.
5381 		 */
5382 		cmdiocb = dd_data->context_un.menlo.cmdiocbq;
5383 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5384 
5385 		spin_lock_irqsave(&phba->hbalock, flags);
5386 		list_for_each_entry_safe(check_iocb, next_iocb, &pring->txq,
5387 					 list) {
5388 			if (check_iocb == cmdiocb) {
5389 				list_move_tail(&check_iocb->list, &completions);
5390 				break;
5391 			}
5392 		}
5393 		if (list_empty(&completions))
5394 			lpfc_sli_issue_abort_iotag(phba, pring, cmdiocb);
5395 		spin_unlock_irqrestore(&phba->hbalock, flags);
5396 		if (!list_empty(&completions)) {
5397 			lpfc_sli_cancel_iocbs(phba, &completions,
5398 					      IOSTAT_LOCAL_REJECT,
5399 					      IOERR_SLI_ABORTED);
5400 		}
5401 		break;
5402 	default:
5403 		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5404 		break;
5405 	}
5406 
5407 	/* scsi transport fc fc_bsg_job_timeout expects a zero return code,
5408 	 * otherwise an error message will be displayed on the console
5409 	 * so always return success (zero)
5410 	 */
5411 	return rc;
5412 }
5413