/*
 * This file and its contents are supplied under the terms of the
 * Common Development and Distribution License ("CDDL"), version 1.0.
 * You may only use this file in accordance with the terms of version
 * 1.0 of the CDDL.
 *
 * A full copy of the text of the CDDL should have accompanied this
 * source.  A copy of the CDDL is also available via the Internet at
 * http://www.illumos.org/license/CDDL.
 */

/*
 * Copyright (C) 2013 Hewlett-Packard Development Company, L.P.
 */

/*
 * Supported IOCTLs :
 *      CPQARY3_IOCTL_DRIVER_INFO       - to get driver details
 *      CPQARY3_IOCTL_CTLR_INFO         - to get controller details
 *      CPQARY3_IOCTL_BMIC_PASS         - to pass BMIC commands
 *      CPQARY3_IOCTL_SCSI_PASS         - to pass SCSI commands
 */

#include "cpqary3.h"

/*
 * Local Functions Declaration
 */

static int32_t cpqary3_ioctl_send_bmiccmd(cpqary3_t *, cpqary3_bmic_pass_t *,
    int);
static void cpqary3_ioctl_fil_bmic(CommandList_t *, cpqary3_bmic_pass_t *);
static void cpqary3_ioctl_fil_bmic_sas(CommandList_t *, cpqary3_bmic_pass_t *);
static int32_t cpqary3_ioctl_send_scsicmd(cpqary3_t *, cpqary3_scsi_pass_t *,
    int);
static void cpqary3_ioctl_fil_scsi(CommandList_t *, cpqary3_scsi_pass_t *);

/*
 * Global Variables Definitions
 */

cpqary3_driver_info_t gdriver_info = {0};

/* Function Definitions  */

/*
 * Function     :       cpqary3_ioctl_driver_info
 * Description  :       This routine will get major/ minor versions, Number of
 *                      controllers detected & MAX Number of controllers
 *                      supported
 * Called By    :       cpqary3_ioctl
 * Parameters   :       ioctl_reqp      - address of the parameter sent from
 *                                        the application
 *                      cpqary3p        - address of the PerController structure
 *                      mode            - mode which comes from application
 * Return Values:       EFAULT on Failure, 0 on SUCCESS
 */
int32_t
cpqary3_ioctl_driver_info(uintptr_t ioctl_reqp, int mode)
{
        cpqary3_ioctl_request_t *request;

        request = (cpqary3_ioctl_request_t *)
            MEM_ZALLOC(sizeof (cpqary3_ioctl_request_t));

        if (NULL == request)
                return (FAILURE);

        /*
         * First let us copyin the ioctl_reqp user buffer to request(kernel)
         * memory.  This is very much recomended before we access any of the
         * fields.
         */
        if (ddi_copyin((void *)ioctl_reqp, (void *)request,
            sizeof (cpqary3_ioctl_request_t), mode)) {
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                return (EFAULT);
        }

        /*
         * Fill up the global structure "gdriver_info" memory.
         * Fill this structure with available info, which will be copied
         * back later
         */

        (void) strcpy(gdriver_info.name, "cpqary3");
        gdriver_info.version.minor = CPQARY3_MINOR_REV_NO;
        gdriver_info.version.major = CPQARY3_MAJOR_REV_NO;
        gdriver_info.version.dd = CPQARY3_REV_MONTH;
        gdriver_info.version.mm = CPQARY3_REV_DATE;
        gdriver_info.version.yyyy = CPQARY3_REV_YEAR;
        gdriver_info.max_num_ctlr = MAX_CTLRS;

        /*
         * First Copy out the driver_info structure
         */

        if (ddi_copyout((void *)&gdriver_info, (void *)(uintptr_t)request->argp,
            sizeof (cpqary3_driver_info_t), mode)) {
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                return (EFAULT);
        }

        /*
         * Copy out the request structure back
         */

        if (ddi_copyout((void *)request, (void *)ioctl_reqp,
            sizeof (cpqary3_ioctl_request_t), mode)) {
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                return (EFAULT);
        }

        MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));

        /*
         * Everything looks fine. So return SUCCESS
         */

        return (SUCCESS);
}

/*
 * Function     :       cpqary3_ioctl_ctlr_info
 * Description  :       This routine will get the controller related info, like
 *                      board-id, subsystem-id, num of logical drives,
 *                      slot number
 * Called By    :       cpqary3_ioctl
 * Parameters   :       ioctl_reqp - address of the parameter sent form the
 *                                   application
 *                      cpqary3p   - address of the PerController structure
 *                      mode       - mode which comes from application
 * Return Values:       EFAULT on Failure, 0 on SUCCESS
 */
int32_t
cpqary3_ioctl_ctlr_info(uintptr_t ioctl_reqp, cpqary3_t *cpqary3p, int mode)
{
        cpqary3_ioctl_request_t *request;
        cpqary3_ctlr_info_t     *ctlr_info;

        request = (cpqary3_ioctl_request_t *)
            MEM_ZALLOC(sizeof (cpqary3_ioctl_request_t));

        if (NULL == request)
                return (FAILURE);

        /*
         * First let us copyin the buffer to kernel memory. This is very much
         * recomended before we access any of the fields.
         */

        if (ddi_copyin((void *) ioctl_reqp, (void *)request,
            sizeof (cpqary3_ioctl_request_t), mode)) {
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                return (EFAULT);
        }

        ctlr_info = (cpqary3_ctlr_info_t *)
            MEM_ZALLOC(sizeof (cpqary3_ctlr_info_t));

        if (NULL == ctlr_info) {
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                return (FAILURE);
        }

        /*
         * in the driver, board_id is actually subsystem_id
         */

        ctlr_info->subsystem_id = cpqary3p->board_id;
        ctlr_info->bus = cpqary3p->bus;
        ctlr_info->dev = cpqary3p->dev;
        ctlr_info->fun = cpqary3p->fun;
        ctlr_info->num_of_tgts = cpqary3p->num_of_targets;
        ctlr_info->controller_instance = cpqary3p->instance;

        /*
         * TODO: ctlr_info.slot_num has to be implemented
         * state & board_id fields are kept for future implementation i
         * if required!
         */

        /*
         * First Copy out the ctlr_info structure
         */

        if (ddi_copyout((void *)ctlr_info, (void *)(uintptr_t)request->argp,
            sizeof (cpqary3_ctlr_info_t), mode)) {
                MEM_SFREE(ctlr_info, sizeof (cpqary3_ctlr_info_t));
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                return (EFAULT);
        }

        /*
         * Copy out the request structure back
         */

        if (ddi_copyout((void *)request, (void *)ioctl_reqp,
            sizeof (cpqary3_ioctl_request_t), mode)) {
                MEM_SFREE(ctlr_info, sizeof (cpqary3_ctlr_info_t));
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                return (EFAULT);
        }

        MEM_SFREE(ctlr_info, sizeof (cpqary3_ctlr_info_t));
        MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));

        /*
         * Everything looks fine. So return SUCCESS
         */

        return (SUCCESS);
}

/*
 * Function     :       cpqary3_ioctl_bmic_pass
 * Description  :       This routine will pass the BMIC commands to controller
 * Called By    :       cpqary3_ioctl
 * Parameters   :       ioctl_reqp - address of the parameter sent from the
 *                                   application
 *                      cpqary3p   - address of the PerController structure
 *                      mode       - mode which comes directly from application
 * Return Values:       EFAULT on Failure, 0 on SUCCESS
 */
int32_t
cpqary3_ioctl_bmic_pass(uintptr_t ioctl_reqp, cpqary3_t *cpqary3p, int mode)
{
        cpqary3_ioctl_request_t *request;
        cpqary3_bmic_pass_t     *bmic_pass;
        int32_t                 retval = SUCCESS;

        request = (cpqary3_ioctl_request_t *)
            MEM_ZALLOC(sizeof (cpqary3_ioctl_request_t));

        if (NULL == request)
                return (FAILURE);

        /*
         * First let us copyin the ioctl_reqp(user) buffer to request(kernel)
         * memory.  This is very much recommended before we access any of the
         * fields.
         */

        if (ddi_copyin((void *)ioctl_reqp, (void *)request,
            sizeof (cpqary3_ioctl_request_t), mode)) {
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                return (EFAULT);
        }

        bmic_pass = (cpqary3_bmic_pass_t *)
            MEM_ZALLOC(sizeof (cpqary3_bmic_pass_t));

        if (NULL == bmic_pass) {
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                return (FAILURE);
        }

        /*
         * Copy in "cpqary3_bmic_pass_t" structure from argp member
         * of ioctl_reqp.
         */

        if (ddi_copyin((void *)(uintptr_t)request->argp, (void *)bmic_pass,
            sizeof (cpqary3_bmic_pass_t), mode)) {
                MEM_SFREE(bmic_pass, sizeof (cpqary3_bmic_pass_t));
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                return (EFAULT);
        }

        /*
         * Get the free command list, fill in the bmic command and send it
         * to the controller. This will return 0 on success.
         */

        retval = cpqary3_ioctl_send_bmiccmd(cpqary3p, bmic_pass, mode);

        /*
         * Now copy the  bmic_pass (kernel) to the user argp
         */

        if (ddi_copyout((void *) bmic_pass, (void *)(uintptr_t)request->argp,
            sizeof (cpqary3_bmic_pass_t), mode)) {
                MEM_SFREE(bmic_pass, sizeof (cpqary3_bmic_pass_t));
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                retval = EFAULT; /* copyout failed */
        }

        /*
         * Now copy the  request(kernel) to ioctl_reqp(user)
         */

        if (ddi_copyout((void *) request, (void *)ioctl_reqp,
            sizeof (cpqary3_ioctl_request_t), mode)) {
                MEM_SFREE(bmic_pass, sizeof (cpqary3_bmic_pass_t));
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                retval = EFAULT;
        }

        MEM_SFREE(bmic_pass, sizeof (cpqary3_bmic_pass_t));
        MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));

        return (retval);
}

/*
 * Function     :       cpqary3_ioctl_send_bmiccmd
 * Description  :       This routine will get the free command,
 *                      allocate memory and send it to controller.
 * Called By    :       cpqary3_ioctl_bmic_pass
 * Parameters   :       cpqary3_t - PerController structure
 *                      cpqary3_bmic_pass_t - bmic structure
 *                      mode - mode value sent from application
 * Return Values:       0 on success
 *                      FAILURE, EFAULT, ETIMEOUT based on the failure
 */

uint32_t cpqary3_ioctl_wait_ms = 30000;

static int32_t
cpqary3_ioctl_send_bmiccmd(cpqary3_t *cpqary3p,
    cpqary3_bmic_pass_t *bmic_pass, int mode)
{
        cpqary3_cmdpvt_t        *memp    = NULL;
        CommandList_t           *cmdlist = NULL;
        int8_t                  *databuf = NULL;
        uint8_t                 retval  = 0;

        /* allocate a command with a dma buffer */
        memp = cpqary3_synccmd_alloc(cpqary3p, bmic_pass->buf_len);
        if (memp == NULL)
                return (FAILURE);

        /* Get the databuf when buf_len is greater than zero */
        if (bmic_pass->buf_len > 0) {
                databuf = memp->driverdata->sg;
        }

        cmdlist = memp->cmdlist_memaddr;

        /*
         * If io_direction is CPQARY3_SCSI_OUT, we have to copy user buffer
         * to databuf
         */

        if (bmic_pass->io_direction == CPQARY3_SCSI_OUT) {
                /* Do a copyin when buf_len is greater than zero */
                if (bmic_pass->buf_len > 0) {
                        if (ddi_copyin((void*)(uintptr_t)(bmic_pass->buf),
                            (void*)databuf, bmic_pass->buf_len, mode)) {
                                cpqary3_synccmd_free(cpqary3p, memp);
                                return (EFAULT);
                        }
                }
        }

        /*
         * Now fill the command as per the BMIC
         */
        if (cpqary3p->bddef->bd_flags & SA_BD_SAS) {
                cpqary3_ioctl_fil_bmic_sas(cmdlist, bmic_pass);
        } else {
                cpqary3_ioctl_fil_bmic(cmdlist, bmic_pass);
        }


        /* PERF */

        memp->complete = cpqary3_synccmd_complete;

        /* PERF */

        /* send command to controller and wait for a reply */
        if (cpqary3_synccmd_send(cpqary3p, memp, cpqary3_ioctl_wait_ms,
            CPQARY3_SYNCCMD_SEND_WAITSIG) != 0) {
                cpqary3_synccmd_free(cpqary3p, memp);
                return (ETIMEDOUT);
        }

        /*
         * Now the command is completed and copy the buffers back
         * First copy the buffer databuf to bmic_pass.buf
         * which is used as a buffer before passing the command to the
         * controller.
         */

        if (bmic_pass->io_direction == CPQARY3_SCSI_IN) {
                /* Do a copyout when buf_len is greater than zero */
                if (bmic_pass->buf_len > 0) {
                        if (ddi_copyout((void *)databuf,
                            (void *)(uintptr_t)bmic_pass->buf,
                            bmic_pass->buf_len, mode)) {
                                retval = EFAULT;
                        }
                }
        }

        /*
         * This is case where the command completes with error,
         * Then tag would have set its 1st(10) bit.
         */

        if (cmdlist->Header.Tag.drvinfo_n_err == CPQARY3_SYNCCMD_FAILURE) {
                bmic_pass->err_status = 1;
                bcopy((caddr_t)memp->errorinfop, &bmic_pass->err_info,
                    sizeof (ErrorInfo_t));
                switch (memp->errorinfop->CommandStatus) {
                case CISS_CMD_DATA_OVERRUN :
                case CISS_CMD_DATA_UNDERRUN :
                case CISS_CMD_SUCCESS :
                case CISS_CMD_TARGET_STATUS :
                        retval = SUCCESS;
                        break;
                default :
                        retval = EIO;
                        break;
                }
        }

        cpqary3_synccmd_free(cpqary3p, memp);

        return (retval);
}

/*
 * Function     :       cpqary3_ioctl_fil_bmic
 * Description  :       This routine will fill the cmdlist with BMIC details
 * Called By    :       cpqary3_ioctl_send_bmiccmd
 * Parameters   :       cmdlist         - command packet
 *                      bmic_pass       - bmic structure
 * Return Values:       void
 */
static void
cpqary3_ioctl_fil_bmic(CommandList_t *cmdlist,
    cpqary3_bmic_pass_t *bmic_pass)
{
        cmdlist->Header.SGTotal = 1;
        cmdlist->Header.SGList = 1;
        cmdlist->Request.CDBLen = bmic_pass->cmd_len;
        cmdlist->Request.Timeout = bmic_pass->timeout;
        cmdlist->Request.Type.Type = CISS_TYPE_CMD;
        cmdlist->Request.Type.Attribute = CISS_ATTR_HEADOFQUEUE;

        switch (bmic_pass->io_direction) {
        case CPQARY3_SCSI_OUT:
                cmdlist->Request.Type.Direction = CISS_XFER_WRITE;
                break;
        case CPQARY3_SCSI_IN:
                cmdlist->Request.Type.Direction = CISS_XFER_READ;
                break;
        case CPQARY3_NODATA_XFER:
                cmdlist->Request.Type.Direction = CISS_XFER_NONE;
                break;
        default:
                cmdlist->Request.Type.Direction = CISS_XFER_RSVD;
                break;
        }

        cmdlist ->Request.CDB[0] =
            (bmic_pass->io_direction == CPQARY3_SCSI_IN) ? 0x26: 0x27;
        cmdlist ->Request.CDB[1] = bmic_pass->unit_number; /* Unit Number */

        /*
         * BMIC Detail - bytes 2[MSB] to 5[LSB]
         */

        cmdlist->Request.CDB[2] = (bmic_pass->blk_number >> 24) & 0xff;
        cmdlist->Request.CDB[3] = (bmic_pass->blk_number >> 16) & 0xff;
        cmdlist->Request.CDB[4] = (bmic_pass->blk_number >> 8) & 0xff;
        cmdlist->Request.CDB[5] = bmic_pass->blk_number;

        cmdlist->Request.CDB[6] = bmic_pass->cmd; /* BMIC Command */

        /* Transfer Length - bytes 7[MSB] to 8[LSB] */

        cmdlist->Request.CDB[7] = (bmic_pass->buf_len >> 8) & 0xff;
        cmdlist->Request.CDB[8] = bmic_pass->buf_len & 0xff;
        cmdlist->Request.CDB[9] = 0x00; /* Reserved */

        /*
         * Copy the Lun address from the request
         */

        bcopy(&bmic_pass->lun_addr[0], &(cmdlist->Header.LUN),
            sizeof (LUNAddr_t));
        cmdlist->SG[0].Len = bmic_pass->buf_len;
}

/*
 * Function     :       cpqary3_ioctl_scsi_pass
 * Description  :       This routine will pass the SCSI commands to controller
 * Called By    :       cpqary3_ioctl
 * Parameters   :       ioctl_reqp - address of the parameter sent
 *                                   from the application
 *                      cpqary3p   - Addess of the percontroller stucture
 *                      mode       - mode which comes directly from application
 * Return Values:       EFAULT on Failure, 0 on SUCCESS
 */
int32_t
cpqary3_ioctl_scsi_pass(uintptr_t ioctl_reqp, cpqary3_t *cpqary3p, int mode)
{
        cpqary3_ioctl_request_t *request;
        cpqary3_scsi_pass_t     *scsi_pass;
        int32_t                 retval = SUCCESS;

        request = (cpqary3_ioctl_request_t *)
            MEM_ZALLOC(sizeof (cpqary3_ioctl_request_t));

        if (NULL == request)
                return (FAILURE);

        /*
         * First let us copyin the ioctl_reqp(user) buffer to request(kernel)
         * memory.  * This is very much recommended before we access any of
         * the fields.
         */

        if (ddi_copyin((void *)ioctl_reqp, (void *)request,
            sizeof (cpqary3_ioctl_request_t), mode)) {
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                return (EFAULT);
        }

        scsi_pass = (cpqary3_scsi_pass_t *)
            MEM_ZALLOC(sizeof (cpqary3_scsi_pass_t));

        if (NULL == scsi_pass) {
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                return (FAILURE);
        }

        /*
         * Copy in "cpqary3_scsi_pass_t" structure from argp member
         * of ioctl_reqp.
         */

        if (ddi_copyin((void *)(uintptr_t)request->argp, (void *)scsi_pass,
            sizeof (cpqary3_scsi_pass_t), mode)) {
                MEM_SFREE(scsi_pass, sizeof (cpqary3_scsi_pass_t));
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                return (EFAULT);
        }

        /*
         * Get the free command list, fill in the scsi command and send it
         * to the controller. This will return 0 on success.
         */

        retval = cpqary3_ioctl_send_scsicmd(cpqary3p, scsi_pass, mode);

        /*
         * Now copy the  scsi_pass (kernel) to the user argp
         */

        if (ddi_copyout((void *)scsi_pass, (void *)(uintptr_t)request->argp,
            sizeof (cpqary3_scsi_pass_t), mode)) {
                MEM_SFREE(scsi_pass, sizeof (cpqary3_scsi_pass_t));
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                retval = EFAULT; /* copyout failed */
        }

        /*
         * Now copy the  request(kernel) to ioctl_reqp(user)
         */

        if (ddi_copyout((void *)request, (void *)ioctl_reqp,
            sizeof (cpqary3_ioctl_request_t), mode)) {
                MEM_SFREE(scsi_pass, sizeof (cpqary3_scsi_pass_t));
                MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));
                retval = EFAULT;
        }

        MEM_SFREE(scsi_pass, sizeof (cpqary3_scsi_pass_t));
        MEM_SFREE(request, sizeof (cpqary3_ioctl_request_t));

        return (retval);
}

/*
 * Function     :       cpqary3_ioctl_send_scsiccmd
 * Description  :       This routine will pass the SCSI commands to controller
 * Called By    :       cpqary3_ioctl_scsi_pass
 * Parameters   :       cpqary3_t               - PerController structure,
 *                      cpqary3_scsi_pass_t     - scsi parameter
 *                      mode                    - sent from the application
 * Return Values:       0 on success
 *                      FAILURE, EFAULT, ETIMEOUT based on the failure
 */
static int32_t
cpqary3_ioctl_send_scsicmd(cpqary3_t *cpqary3p,
    cpqary3_scsi_pass_t *scsi_pass, int mode)
{
        cpqary3_cmdpvt_t        *memp    = NULL;
        CommandList_t           *cmdlist = NULL;
        int8_t                  *databuf = NULL;
        uint8_t                 retval  = 0;
        NoeBuffer               *evt;
        uint16_t                drive = 0;

        /* allocate a command with a dma buffer */
        memp = cpqary3_synccmd_alloc(cpqary3p, scsi_pass->buf_len);
        if (memp == NULL)
                return (FAILURE);

        /* Get the databuf when buf_len is greater than zero */
        if (scsi_pass->buf_len > 0) {
                databuf = memp->driverdata->sg;
        }

        cmdlist = memp->cmdlist_memaddr;

        if (scsi_pass->io_direction == CPQARY3_SCSI_OUT) {
                /* Do a copyin when buf_len is greater than zero */
                if (scsi_pass->buf_len > 0) {
                        if (ddi_copyin((void*)(uintptr_t)(scsi_pass->buf),
                            (void*)databuf, scsi_pass->buf_len, mode)) {
                                cpqary3_synccmd_free(cpqary3p, memp);
                                return (EFAULT);
                        }
                }
        }

        /*
         * Fill the scsi command
         */
        cpqary3_ioctl_fil_scsi(cmdlist, scsi_pass);

        /* PERF */
        memp->complete = cpqary3_synccmd_complete;
        /* PERF */

        /* send command to controller and wait for a reply */
        if (cpqary3_synccmd_send(cpqary3p, memp, cpqary3_ioctl_wait_ms,
            CPQARY3_SYNCCMD_SEND_WAITSIG) != 0) {
                cpqary3_synccmd_free(cpqary3p, memp);
                return (ETIMEDOUT);
        }

        /*
         * If the command sent is NOE
         * if the event class is CLASS_LOGICAL_DRIVE
         * if the subcalls code is zero and if detail change is zero
         * if the event specific data[3] is either 1 or 2 ie., if
         * if the logical drive is failed set the target type to
         * CPQARY3_TARGET_NONE
         */

        /* NOE */
        if (cpqary3p->noe_support == 0 &&
            cmdlist->Request.CDB[0] == 0x26 &&
            cmdlist->Request.CDB[6] == BMIC_NOTIFY_ON_EVENT) {

                evt = (NoeBuffer*)MEM2DRVPVT(memp)->sg;

                if (evt->event_class_code == CLASS_LOGICAL_DRIVE &&
                    evt->event_subclass_code == SUB_CLASS_STATUS &&
                    evt->event_detail_code == DETAIL_CHANGE &&
                    evt->event_specific_data[3] == 1) {
                        /* LINTED: alignment */
                        drive = *(uint16_t *)(&evt->event_specific_data[0]);
                        drive = ((drive < CTLR_SCSI_ID) ?
                            drive : drive + CPQARY3_TGT_ALIGNMENT);

                        if (cpqary3p && cpqary3p->cpqary3_tgtp[drive]) {
                                cpqary3p->cpqary3_tgtp[drive]->type =
                                    CPQARY3_TARGET_NONE;
                        }
                }
        }

        /*
         * Now the command is completed and copy the buffers back
         * First copy the buffer databuf to scsi_pass->buf
         * which is used as a buffer before passing the command to the
         * controller.
         */

        if (scsi_pass->io_direction == CPQARY3_SCSI_IN) {
                if (scsi_pass->buf_len > 0) {
                        if (ddi_copyout((void *)databuf,
                            (void *)(uintptr_t)scsi_pass->buf,
                            scsi_pass->buf_len, mode)) {
                                retval = EFAULT;
                        }
                }
        }

        /*
         * This is case where the command completes with error,
         * Then tag would have set its 1st(10) bit.
         */

        if (cmdlist->Header.Tag.drvinfo_n_err == CPQARY3_SYNCCMD_FAILURE) {
                scsi_pass->err_status = 1;
                bcopy((caddr_t)memp->errorinfop, &scsi_pass->err_info,
                    sizeof (ErrorInfo_t));
                switch (memp->errorinfop->CommandStatus) {
                case CISS_CMD_DATA_OVERRUN:
                case CISS_CMD_DATA_UNDERRUN:
                case CISS_CMD_SUCCESS:
                case CISS_CMD_TARGET_STATUS:
                        retval = SUCCESS;
                        break;
                default:
                        retval = EIO;
                        break;
                }
        }

        cpqary3_synccmd_free(cpqary3p, memp);

        return (retval);
}

/*
 * Function     :       cpqary3_ioctl_fil_scsi_
 * Description  :       This routine will fill the cmdlist with SCSI CDB
 * Called By    :       cpqary3_ioctl_send_scsicmd
 * Parameters   :       cmdlist                 - command packet
 *                      cpqary3_scsi_pass_t     - scsi parameter
 * Return Values:       void
 */
static void
cpqary3_ioctl_fil_scsi(CommandList_t *cmdlist,
                        cpqary3_scsi_pass_t *scsi_pass)
{
        cmdlist->Header.SGTotal = 1;
        cmdlist->Header.SGList = 1;
        cmdlist->Request.CDBLen = scsi_pass->cdb_len;
        cmdlist->Request.Timeout = scsi_pass->timeout;
        cmdlist->Request.Type.Type = CISS_TYPE_CMD;
        cmdlist->Request.Type.Attribute = CISS_ATTR_HEADOFQUEUE;

        switch (scsi_pass->io_direction) {
        case CPQARY3_SCSI_OUT:
                cmdlist->Request.Type.Direction = CISS_XFER_WRITE;
                break;
        case CPQARY3_SCSI_IN:
                cmdlist->Request.Type.Direction = CISS_XFER_READ;
                break;
        case CPQARY3_NODATA_XFER:
                cmdlist->Request.Type.Direction = CISS_XFER_NONE;
                break;
        default:
                cmdlist->Request.Type.Direction = CISS_XFER_RSVD;
                break;
        }

        /*
         * Copy the SCSI CDB as is
         */

        bcopy(&scsi_pass->cdb[0], &cmdlist->Request.CDB[0],
            scsi_pass->cdb_len);

        /*
         * Copy the Lun address from the request
         */

        bcopy(&scsi_pass->lun_addr[0], &(cmdlist->Header.LUN),
            sizeof (LUNAddr_t));

        cmdlist->SG[0].Len      = scsi_pass->buf_len;
}

/*
 * Function     :       cpqary3_ioctl_fil_bmic_sas
 * Description  :       This routine will fill the cmdlist with BMIC details
 * Called By    :       cpqary3_ioctl_send_bmiccmd
 * Parameters   :       cmdlist         - command packet
 *                      bmic_pass       - bmic structure
 * Return Values:       void
 */
static void
cpqary3_ioctl_fil_bmic_sas(CommandList_t *cmdlist,
    cpqary3_bmic_pass_t *bmic_pass)
{
        cmdlist->Header.SGTotal = 1;
        cmdlist->Header.SGList = 1;
        cmdlist->Request.CDBLen = bmic_pass->cmd_len;
        cmdlist->Request.Timeout = bmic_pass->timeout;
        cmdlist->Request.Type.Type = CISS_TYPE_CMD;
        cmdlist->Request.Type.Attribute = CISS_ATTR_HEADOFQUEUE;

        switch (bmic_pass->io_direction) {
                case CPQARY3_SCSI_OUT:
                        cmdlist->Request.Type.Direction = CISS_XFER_WRITE;
                        break;
                case CPQARY3_SCSI_IN:
                        cmdlist->Request.Type.Direction = CISS_XFER_READ;
                        break;
                case CPQARY3_NODATA_XFER:
                        cmdlist->Request.Type.Direction = CISS_XFER_NONE;
                        break;
                default:
                        cmdlist->Request.Type.Direction = CISS_XFER_RSVD;
                        break;
        }

        cmdlist->Request.CDB[0] =
            (bmic_pass->io_direction == CPQARY3_SCSI_IN) ? 0x26: 0x27;
        cmdlist->Request.CDB[1] = bmic_pass->unit_number; /* Unit Number */

        /*
         * BMIC Detail - bytes 2[MSB] to 5[LSB]
         */

        cmdlist->Request.CDB[2] = (bmic_pass->blk_number >> 24) & 0xff;
        cmdlist->Request.CDB[3] = (bmic_pass->blk_number >> 16) & 0xff;
        cmdlist->Request.CDB[4] = (bmic_pass->blk_number >> 8) & 0xff;
        cmdlist->Request.CDB[5] = bmic_pass->blk_number;

        cmdlist->Request.CDB[6] = bmic_pass->cmd; /* BMIC Command */

        /* Transfer Length - bytes 7[MSB] to 8[LSB] */

        cmdlist->Request.CDB[7] = (bmic_pass->buf_len >> 8) & 0xff;
        cmdlist->Request.CDB[8] = bmic_pass->buf_len & 0xff;
        cmdlist->Request.CDB[9] = 0x00; /* Reserved */

        /* Update CDB[2] = LSB bmix_index and CDB[9] = MSB bmic_index */
        switch (bmic_pass->cmd) {
        case HPSAS_ID_PHYSICAL_DRIVE:
        case HPSAS_TAPE_INQUIRY:
        case HPSAS_SENSE_MP_STAT:
        case HPSAS_SET_MP_THRESHOLD:
        case HPSAS_MP_PARAM_CONTROL:
        case HPSAS_SENSE_DRV_ERR_LOG:
        case HPSAS_SET_MP_VALUE:
                cmdlist -> Request.CDB[2] = bmic_pass->bmic_index & 0xff;
                cmdlist -> Request.CDB[9] = (bmic_pass->bmic_index >>8) & 0xff;
                break;

        case HPSAS_ID_LOG_DRIVE:
        case HPSAS_SENSE_LOG_DRIVE:
        case HPSAS_READ:
        case HPSAS_WRITE:
        case HPSAS_WRITE_THROUGH:
        case HPSAS_SENSE_CONFIG:
        case HPSAS_SET_CONFIG:
        case HPSAS_BYPASS_VOL_STATE:
        case HPSAS_CHANGE_CONFIG:
        case HPSAS_SENSE_ORIG_CONFIG:
        case HPSAS_LABEL_LOG_DRIVE:
                /* Unit Number MSB */
                cmdlist->Request.CDB[9] = (bmic_pass->unit_number >> 8) & 0xff;
                break;

        default:
                break;
        }


        /*
         * Copy the Lun address from the request
         */

        bcopy(&bmic_pass->lun_addr[0], &(cmdlist->Header.LUN),
            sizeof (LUNAddr_t));

        cmdlist->SG[0].Len = bmic_pass->buf_len;
}