1 /*-
2 * Copyright (c) 2008 Yahoo!, Inc.
3 * All rights reserved.
4 * Written by: John Baldwin <jhb@FreeBSD.org>
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of the author nor the names of any co-contributors
15 * may be used to endorse or promote products derived from this software
16 * without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 *
30 * Broadcom Inc. (LSI) MPT-Fusion Host Adapter FreeBSD userland interface
31 */
32 /*-
33 * Copyright (c) 2011-2015 LSI Corp.
34 * Copyright (c) 2013-2016 Avago Technologies
35 * Copyright 2000-2020 Broadcom Inc.
36 * All rights reserved.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 *
47 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
48 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
49 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
50 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
51 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
52 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
53 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
54 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
55 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
56 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
57 * SUCH DAMAGE.
58 *
59 * Broadcom Inc. (LSI) MPT-Fusion Host Adapter FreeBSD
60 */
61
62 #include <sys/cdefs.h>
63 /* TODO Move headers to mprvar */
64 #include <sys/types.h>
65 #include <sys/param.h>
66 #include <sys/systm.h>
67 #include <sys/kernel.h>
68 #include <sys/selinfo.h>
69 #include <sys/module.h>
70 #include <sys/bus.h>
71 #include <sys/conf.h>
72 #include <sys/bio.h>
73 #include <sys/abi_compat.h>
74 #include <sys/malloc.h>
75 #include <sys/uio.h>
76 #include <sys/sysctl.h>
77 #include <sys/ioccom.h>
78 #include <sys/endian.h>
79 #include <sys/queue.h>
80 #include <sys/kthread.h>
81 #include <sys/taskqueue.h>
82 #include <sys/proc.h>
83 #include <sys/sysent.h>
84
85 #include <machine/bus.h>
86 #include <machine/resource.h>
87 #include <sys/rman.h>
88
89 #include <cam/cam.h>
90 #include <cam/cam_ccb.h>
91
92 #include <dev/mpr/mpi/mpi2_type.h>
93 #include <dev/mpr/mpi/mpi2.h>
94 #include <dev/mpr/mpi/mpi2_ioc.h>
95 #include <dev/mpr/mpi/mpi2_cnfg.h>
96 #include <dev/mpr/mpi/mpi2_init.h>
97 #include <dev/mpr/mpi/mpi2_tool.h>
98 #include <dev/mpr/mpi/mpi2_pci.h>
99 #include <dev/mpr/mpr_ioctl.h>
100 #include <dev/mpr/mprvar.h>
101 #include <dev/mpr/mpr_table.h>
102 #include <dev/mpr/mpr_sas.h>
103 #include <dev/pci/pcivar.h>
104 #include <dev/pci/pcireg.h>
105
106 static d_open_t mpr_open;
107 static d_close_t mpr_close;
108 static d_ioctl_t mpr_ioctl_devsw;
109
110 static struct cdevsw mpr_cdevsw = {
111 .d_version = D_VERSION,
112 .d_flags = 0,
113 .d_open = mpr_open,
114 .d_close = mpr_close,
115 .d_ioctl = mpr_ioctl_devsw,
116 .d_name = "mpr",
117 };
118
119 typedef int (mpr_user_f)(struct mpr_command *, struct mpr_usr_command *);
120 static mpr_user_f mpi_pre_ioc_facts;
121 static mpr_user_f mpi_pre_port_facts;
122 static mpr_user_f mpi_pre_fw_download;
123 static mpr_user_f mpi_pre_fw_upload;
124 static mpr_user_f mpi_pre_sata_passthrough;
125 static mpr_user_f mpi_pre_smp_passthrough;
126 static mpr_user_f mpi_pre_config;
127 static mpr_user_f mpi_pre_sas_io_unit_control;
128
129 static int mpr_user_read_cfg_header(struct mpr_softc *,
130 struct mpr_cfg_page_req *);
131 static int mpr_user_read_cfg_page(struct mpr_softc *,
132 struct mpr_cfg_page_req *, void *);
133 static int mpr_user_read_extcfg_header(struct mpr_softc *,
134 struct mpr_ext_cfg_page_req *);
135 static int mpr_user_read_extcfg_page(struct mpr_softc *,
136 struct mpr_ext_cfg_page_req *, void *);
137 static int mpr_user_write_cfg_page(struct mpr_softc *,
138 struct mpr_cfg_page_req *, void *);
139 static int mpr_user_setup_request(struct mpr_command *,
140 struct mpr_usr_command *);
141 static int mpr_user_command(struct mpr_softc *, struct mpr_usr_command *);
142
143 static int mpr_user_pass_thru(struct mpr_softc *sc, mpr_pass_thru_t *data);
144 static void mpr_user_get_adapter_data(struct mpr_softc *sc,
145 mpr_adapter_data_t *data);
146 static void mpr_user_read_pci_info(struct mpr_softc *sc, mpr_pci_info_t *data);
147 static uint8_t mpr_get_fw_diag_buffer_number(struct mpr_softc *sc,
148 uint32_t unique_id);
149 static int mpr_post_fw_diag_buffer(struct mpr_softc *sc,
150 mpr_fw_diagnostic_buffer_t *pBuffer, uint32_t *return_code);
151 static int mpr_release_fw_diag_buffer(struct mpr_softc *sc,
152 mpr_fw_diagnostic_buffer_t *pBuffer, uint32_t *return_code,
153 uint32_t diag_type);
154 static int mpr_diag_register(struct mpr_softc *sc,
155 mpr_fw_diag_register_t *diag_register, uint32_t *return_code);
156 static int mpr_diag_unregister(struct mpr_softc *sc,
157 mpr_fw_diag_unregister_t *diag_unregister, uint32_t *return_code);
158 static int mpr_diag_query(struct mpr_softc *sc, mpr_fw_diag_query_t *diag_query,
159 uint32_t *return_code);
160 static int mpr_diag_read_buffer(struct mpr_softc *sc,
161 mpr_diag_read_buffer_t *diag_read_buffer, uint8_t *ioctl_buf,
162 uint32_t *return_code);
163 static int mpr_diag_release(struct mpr_softc *sc,
164 mpr_fw_diag_release_t *diag_release, uint32_t *return_code);
165 static int mpr_do_diag_action(struct mpr_softc *sc, uint32_t action,
166 uint8_t *diag_action, uint32_t length, uint32_t *return_code);
167 static int mpr_user_diag_action(struct mpr_softc *sc, mpr_diag_action_t *data);
168 static void mpr_user_event_query(struct mpr_softc *sc, mpr_event_query_t *data);
169 static void mpr_user_event_enable(struct mpr_softc *sc,
170 mpr_event_enable_t *data);
171 static int mpr_user_event_report(struct mpr_softc *sc,
172 mpr_event_report_t *data);
173 static int mpr_user_reg_access(struct mpr_softc *sc, mpr_reg_access_t *data);
174 static int mpr_user_btdh(struct mpr_softc *sc, mpr_btdh_mapping_t *data);
175
176 static MALLOC_DEFINE(M_MPRUSER, "mpr_user", "Buffers for mpr(4) ioctls");
177
178 /*
179 * MPI functions that support IEEE SGLs for SAS3.
180 */
181 static uint8_t ieee_sgl_func_list[] = {
182 MPI2_FUNCTION_SCSI_IO_REQUEST,
183 MPI2_FUNCTION_RAID_SCSI_IO_PASSTHROUGH,
184 MPI2_FUNCTION_SMP_PASSTHROUGH,
185 MPI2_FUNCTION_SATA_PASSTHROUGH,
186 MPI2_FUNCTION_FW_UPLOAD,
187 MPI2_FUNCTION_FW_DOWNLOAD,
188 MPI2_FUNCTION_TARGET_ASSIST,
189 MPI2_FUNCTION_TARGET_STATUS_SEND,
190 MPI2_FUNCTION_TOOLBOX
191 };
192
193 int
mpr_attach_user(struct mpr_softc * sc)194 mpr_attach_user(struct mpr_softc *sc)
195 {
196 int unit;
197
198 unit = device_get_unit(sc->mpr_dev);
199 sc->mpr_cdev = make_dev(&mpr_cdevsw, unit, UID_ROOT, GID_OPERATOR, 0640,
200 "mpr%d", unit);
201
202 if (sc->mpr_cdev == NULL)
203 return (ENOMEM);
204
205 sc->mpr_cdev->si_drv1 = sc;
206 return (0);
207 }
208
209 void
mpr_detach_user(struct mpr_softc * sc)210 mpr_detach_user(struct mpr_softc *sc)
211 {
212
213 /* XXX: do a purge of pending requests? */
214 if (sc->mpr_cdev != NULL)
215 destroy_dev(sc->mpr_cdev);
216 }
217
218 static int
mpr_open(struct cdev * dev,int flags,int fmt,struct thread * td)219 mpr_open(struct cdev *dev, int flags, int fmt, struct thread *td)
220 {
221
222 return (0);
223 }
224
225 static int
mpr_close(struct cdev * dev,int flags,int fmt,struct thread * td)226 mpr_close(struct cdev *dev, int flags, int fmt, struct thread *td)
227 {
228
229 return (0);
230 }
231
232 static int
mpr_user_read_cfg_header(struct mpr_softc * sc,struct mpr_cfg_page_req * page_req)233 mpr_user_read_cfg_header(struct mpr_softc *sc,
234 struct mpr_cfg_page_req *page_req)
235 {
236 MPI2_CONFIG_PAGE_HEADER *hdr;
237 struct mpr_config_params params;
238 int error;
239
240 hdr = ¶ms.hdr.Struct;
241 params.action = MPI2_CONFIG_ACTION_PAGE_HEADER;
242 params.page_address = le32toh(page_req->page_address);
243 hdr->PageVersion = 0;
244 hdr->PageLength = 0;
245 hdr->PageNumber = page_req->header.PageNumber;
246 hdr->PageType = page_req->header.PageType;
247 params.buffer = NULL;
248 params.length = 0;
249 params.callback = NULL;
250
251 if ((error = mpr_read_config_page(sc, ¶ms)) != 0) {
252 /*
253 * Leave the request. Without resetting the chip, it's
254 * still owned by it and we'll just get into trouble
255 * freeing it now. Mark it as abandoned so that if it
256 * shows up later it can be freed.
257 */
258 mpr_printf(sc, "read_cfg_header timed out\n");
259 return (ETIMEDOUT);
260 }
261
262 page_req->ioc_status = htole16(params.status);
263 if ((page_req->ioc_status & MPI2_IOCSTATUS_MASK) ==
264 MPI2_IOCSTATUS_SUCCESS) {
265 bcopy(hdr, &page_req->header, sizeof(page_req->header));
266 }
267
268 return (0);
269 }
270
271 static int
mpr_user_read_cfg_page(struct mpr_softc * sc,struct mpr_cfg_page_req * page_req,void * buf)272 mpr_user_read_cfg_page(struct mpr_softc *sc, struct mpr_cfg_page_req *page_req,
273 void *buf)
274 {
275 MPI2_CONFIG_PAGE_HEADER *reqhdr, *hdr;
276 struct mpr_config_params params;
277 int error;
278
279 reqhdr = buf;
280 hdr = ¶ms.hdr.Struct;
281 hdr->PageVersion = reqhdr->PageVersion;
282 hdr->PageLength = reqhdr->PageLength;
283 hdr->PageNumber = reqhdr->PageNumber;
284 hdr->PageType = reqhdr->PageType & MPI2_CONFIG_PAGETYPE_MASK;
285 params.action = MPI2_CONFIG_ACTION_PAGE_READ_CURRENT;
286 params.page_address = le32toh(page_req->page_address);
287 params.buffer = buf;
288 params.length = le32toh(page_req->len);
289 params.callback = NULL;
290
291 if ((error = mpr_read_config_page(sc, ¶ms)) != 0) {
292 mpr_printf(sc, "mpr_user_read_cfg_page timed out\n");
293 return (ETIMEDOUT);
294 }
295
296 page_req->ioc_status = htole16(params.status);
297 return (0);
298 }
299
300 static int
mpr_user_read_extcfg_header(struct mpr_softc * sc,struct mpr_ext_cfg_page_req * ext_page_req)301 mpr_user_read_extcfg_header(struct mpr_softc *sc,
302 struct mpr_ext_cfg_page_req *ext_page_req)
303 {
304 MPI2_CONFIG_EXTENDED_PAGE_HEADER *hdr;
305 struct mpr_config_params params;
306 int error;
307
308 hdr = ¶ms.hdr.Ext;
309 params.action = MPI2_CONFIG_ACTION_PAGE_HEADER;
310 hdr->PageVersion = ext_page_req->header.PageVersion;
311 hdr->PageType = MPI2_CONFIG_PAGETYPE_EXTENDED;
312 hdr->ExtPageLength = 0;
313 hdr->PageNumber = ext_page_req->header.PageNumber;
314 hdr->ExtPageType = ext_page_req->header.ExtPageType;
315 params.page_address = le32toh(ext_page_req->page_address);
316 params.buffer = NULL;
317 params.length = 0;
318 params.callback = NULL;
319
320 if ((error = mpr_read_config_page(sc, ¶ms)) != 0) {
321 /*
322 * Leave the request. Without resetting the chip, it's
323 * still owned by it and we'll just get into trouble
324 * freeing it now. Mark it as abandoned so that if it
325 * shows up later it can be freed.
326 */
327 mpr_printf(sc, "mpr_user_read_extcfg_header timed out\n");
328 return (ETIMEDOUT);
329 }
330
331 ext_page_req->ioc_status = htole16(params.status);
332 if ((ext_page_req->ioc_status & MPI2_IOCSTATUS_MASK) ==
333 MPI2_IOCSTATUS_SUCCESS) {
334 ext_page_req->header.PageVersion = hdr->PageVersion;
335 ext_page_req->header.PageNumber = hdr->PageNumber;
336 ext_page_req->header.PageType = hdr->PageType;
337 ext_page_req->header.ExtPageLength = hdr->ExtPageLength;
338 ext_page_req->header.ExtPageType = hdr->ExtPageType;
339 }
340
341 return (0);
342 }
343
344 static int
mpr_user_read_extcfg_page(struct mpr_softc * sc,struct mpr_ext_cfg_page_req * ext_page_req,void * buf)345 mpr_user_read_extcfg_page(struct mpr_softc *sc,
346 struct mpr_ext_cfg_page_req *ext_page_req, void *buf)
347 {
348 MPI2_CONFIG_EXTENDED_PAGE_HEADER *reqhdr, *hdr;
349 struct mpr_config_params params;
350 int error;
351
352 reqhdr = buf;
353 hdr = ¶ms.hdr.Ext;
354 params.action = MPI2_CONFIG_ACTION_PAGE_READ_CURRENT;
355 params.page_address = le32toh(ext_page_req->page_address);
356 hdr->PageVersion = reqhdr->PageVersion;
357 hdr->PageType = MPI2_CONFIG_PAGETYPE_EXTENDED;
358 hdr->PageNumber = reqhdr->PageNumber;
359 hdr->ExtPageType = reqhdr->ExtPageType;
360 hdr->ExtPageLength = reqhdr->ExtPageLength;
361 params.buffer = buf;
362 params.length = le32toh(ext_page_req->len);
363 params.callback = NULL;
364
365 if ((error = mpr_read_config_page(sc, ¶ms)) != 0) {
366 mpr_printf(sc, "mpr_user_read_extcfg_page timed out\n");
367 return (ETIMEDOUT);
368 }
369
370 ext_page_req->ioc_status = htole16(params.status);
371 return (0);
372 }
373
374 static int
mpr_user_write_cfg_page(struct mpr_softc * sc,struct mpr_cfg_page_req * page_req,void * buf)375 mpr_user_write_cfg_page(struct mpr_softc *sc,
376 struct mpr_cfg_page_req *page_req, void *buf)
377 {
378 MPI2_CONFIG_PAGE_HEADER *reqhdr, *hdr;
379 struct mpr_config_params params;
380 u_int hdr_attr;
381 int error;
382
383 reqhdr = buf;
384 hdr = ¶ms.hdr.Struct;
385 hdr_attr = reqhdr->PageType & MPI2_CONFIG_PAGEATTR_MASK;
386 if (hdr_attr != MPI2_CONFIG_PAGEATTR_CHANGEABLE &&
387 hdr_attr != MPI2_CONFIG_PAGEATTR_PERSISTENT) {
388 mpr_printf(sc, "page type 0x%x not changeable\n",
389 reqhdr->PageType & MPI2_CONFIG_PAGETYPE_MASK);
390 return (EINVAL);
391 }
392
393 /*
394 * There isn't any point in restoring stripped out attributes
395 * if you then mask them going down to issue the request.
396 */
397
398 hdr->PageVersion = reqhdr->PageVersion;
399 hdr->PageLength = reqhdr->PageLength;
400 hdr->PageNumber = reqhdr->PageNumber;
401 hdr->PageType = reqhdr->PageType;
402 params.action = MPI2_CONFIG_ACTION_PAGE_WRITE_CURRENT;
403 params.page_address = le32toh(page_req->page_address);
404 params.buffer = buf;
405 params.length = le32toh(page_req->len);
406 params.callback = NULL;
407
408 if ((error = mpr_write_config_page(sc, ¶ms)) != 0) {
409 mpr_printf(sc, "mpr_write_cfg_page timed out\n");
410 return (ETIMEDOUT);
411 }
412
413 page_req->ioc_status = htole16(params.status);
414 return (0);
415 }
416
417 void
mpr_init_sge(struct mpr_command * cm,void * req,void * sge)418 mpr_init_sge(struct mpr_command *cm, void *req, void *sge)
419 {
420 int off, space;
421
422 space = (int)cm->cm_sc->reqframesz;
423 off = (uintptr_t)sge - (uintptr_t)req;
424
425 KASSERT(off < space, ("bad pointers %p %p, off %d, space %d",
426 req, sge, off, space));
427
428 cm->cm_sge = sge;
429 cm->cm_sglsize = space - off;
430 }
431
432 /*
433 * Prepare the mpr_command for an IOC_FACTS request.
434 */
435 static int
mpi_pre_ioc_facts(struct mpr_command * cm,struct mpr_usr_command * cmd)436 mpi_pre_ioc_facts(struct mpr_command *cm, struct mpr_usr_command *cmd)
437 {
438 MPI2_IOC_FACTS_REQUEST *req = (void *)cm->cm_req;
439 MPI2_IOC_FACTS_REPLY *rpl;
440
441 if (cmd->req_len != sizeof *req)
442 return (EINVAL);
443 if (cmd->rpl_len != sizeof *rpl)
444 return (EINVAL);
445
446 cm->cm_sge = NULL;
447 cm->cm_sglsize = 0;
448 return (0);
449 }
450
451 /*
452 * Prepare the mpr_command for a PORT_FACTS request.
453 */
454 static int
mpi_pre_port_facts(struct mpr_command * cm,struct mpr_usr_command * cmd)455 mpi_pre_port_facts(struct mpr_command *cm, struct mpr_usr_command *cmd)
456 {
457 MPI2_PORT_FACTS_REQUEST *req = (void *)cm->cm_req;
458 MPI2_PORT_FACTS_REPLY *rpl;
459
460 if (cmd->req_len != sizeof *req)
461 return (EINVAL);
462 if (cmd->rpl_len != sizeof *rpl)
463 return (EINVAL);
464
465 cm->cm_sge = NULL;
466 cm->cm_sglsize = 0;
467 return (0);
468 }
469
470 /*
471 * Prepare the mpr_command for a FW_DOWNLOAD request.
472 */
473 static int
mpi_pre_fw_download(struct mpr_command * cm,struct mpr_usr_command * cmd)474 mpi_pre_fw_download(struct mpr_command *cm, struct mpr_usr_command *cmd)
475 {
476 MPI25_FW_DOWNLOAD_REQUEST *req = (void *)cm->cm_req;
477 MPI2_FW_DOWNLOAD_REPLY *rpl;
478 int error;
479
480 if (cmd->req_len != sizeof *req)
481 return (EINVAL);
482 if (cmd->rpl_len != sizeof *rpl)
483 return (EINVAL);
484
485 if (cmd->len == 0)
486 return (EINVAL);
487
488 error = copyin(cmd->buf, cm->cm_data, cmd->len);
489 if (error != 0)
490 return (error);
491
492 mpr_init_sge(cm, req, &req->SGL);
493
494 /*
495 * For now, the F/W image must be provided in a single request.
496 */
497 if ((req->MsgFlags & MPI2_FW_DOWNLOAD_MSGFLGS_LAST_SEGMENT) == 0)
498 return (EINVAL);
499 if (req->TotalImageSize != cmd->len)
500 return (EINVAL);
501
502 req->ImageOffset = 0;
503 req->ImageSize = cmd->len;
504
505 cm->cm_flags |= MPR_CM_FLAGS_DATAOUT;
506
507 return (mpr_push_ieee_sge(cm, &req->SGL, 0));
508 }
509
510 /*
511 * Prepare the mpr_command for a FW_UPLOAD request.
512 */
513 static int
mpi_pre_fw_upload(struct mpr_command * cm,struct mpr_usr_command * cmd)514 mpi_pre_fw_upload(struct mpr_command *cm, struct mpr_usr_command *cmd)
515 {
516 MPI25_FW_UPLOAD_REQUEST *req = (void *)cm->cm_req;
517 MPI2_FW_UPLOAD_REPLY *rpl;
518
519 if (cmd->req_len != sizeof *req)
520 return (EINVAL);
521 if (cmd->rpl_len != sizeof *rpl)
522 return (EINVAL);
523
524 mpr_init_sge(cm, req, &req->SGL);
525 if (cmd->len == 0) {
526 /* Perhaps just asking what the size of the fw is? */
527 return (0);
528 }
529
530 req->ImageOffset = 0;
531 req->ImageSize = cmd->len;
532
533 cm->cm_flags |= MPR_CM_FLAGS_DATAIN;
534
535 return (mpr_push_ieee_sge(cm, &req->SGL, 0));
536 }
537
538 /*
539 * Prepare the mpr_command for a SATA_PASSTHROUGH request.
540 */
541 static int
mpi_pre_sata_passthrough(struct mpr_command * cm,struct mpr_usr_command * cmd)542 mpi_pre_sata_passthrough(struct mpr_command *cm, struct mpr_usr_command *cmd)
543 {
544 MPI2_SATA_PASSTHROUGH_REQUEST *req = (void *)cm->cm_req;
545 MPI2_SATA_PASSTHROUGH_REPLY *rpl;
546
547 if (cmd->req_len != sizeof *req)
548 return (EINVAL);
549 if (cmd->rpl_len != sizeof *rpl)
550 return (EINVAL);
551
552 mpr_init_sge(cm, req, &req->SGL);
553 return (0);
554 }
555
556 /*
557 * Prepare the mpr_command for a SMP_PASSTHROUGH request.
558 */
559 static int
mpi_pre_smp_passthrough(struct mpr_command * cm,struct mpr_usr_command * cmd)560 mpi_pre_smp_passthrough(struct mpr_command *cm, struct mpr_usr_command *cmd)
561 {
562 MPI2_SMP_PASSTHROUGH_REQUEST *req = (void *)cm->cm_req;
563 MPI2_SMP_PASSTHROUGH_REPLY *rpl;
564
565 if (cmd->req_len != sizeof *req)
566 return (EINVAL);
567 if (cmd->rpl_len != sizeof *rpl)
568 return (EINVAL);
569
570 mpr_init_sge(cm, req, &req->SGL);
571 return (0);
572 }
573
574 /*
575 * Prepare the mpr_command for a CONFIG request.
576 */
577 static int
mpi_pre_config(struct mpr_command * cm,struct mpr_usr_command * cmd)578 mpi_pre_config(struct mpr_command *cm, struct mpr_usr_command *cmd)
579 {
580 MPI2_CONFIG_REQUEST *req = (void *)cm->cm_req;
581 MPI2_CONFIG_REPLY *rpl;
582
583 if (cmd->req_len != sizeof *req)
584 return (EINVAL);
585 if (cmd->rpl_len != sizeof *rpl)
586 return (EINVAL);
587
588 mpr_init_sge(cm, req, &req->PageBufferSGE);
589 return (0);
590 }
591
592 /*
593 * Prepare the mpr_command for a SAS_IO_UNIT_CONTROL request.
594 */
595 static int
mpi_pre_sas_io_unit_control(struct mpr_command * cm,struct mpr_usr_command * cmd)596 mpi_pre_sas_io_unit_control(struct mpr_command *cm,
597 struct mpr_usr_command *cmd)
598 {
599
600 cm->cm_sge = NULL;
601 cm->cm_sglsize = 0;
602 return (0);
603 }
604
605 /*
606 * A set of functions to prepare an mpr_command for the various
607 * supported requests.
608 */
609 struct mpr_user_func {
610 U8 Function;
611 mpr_user_f *f_pre;
612 } mpr_user_func_list[] = {
613 { MPI2_FUNCTION_IOC_FACTS, mpi_pre_ioc_facts },
614 { MPI2_FUNCTION_PORT_FACTS, mpi_pre_port_facts },
615 { MPI2_FUNCTION_FW_DOWNLOAD, mpi_pre_fw_download },
616 { MPI2_FUNCTION_FW_UPLOAD, mpi_pre_fw_upload },
617 { MPI2_FUNCTION_SATA_PASSTHROUGH, mpi_pre_sata_passthrough },
618 { MPI2_FUNCTION_SMP_PASSTHROUGH, mpi_pre_smp_passthrough},
619 { MPI2_FUNCTION_CONFIG, mpi_pre_config},
620 { MPI2_FUNCTION_SAS_IO_UNIT_CONTROL, mpi_pre_sas_io_unit_control },
621 { 0xFF, NULL } /* list end */
622 };
623
624 static int
mpr_user_setup_request(struct mpr_command * cm,struct mpr_usr_command * cmd)625 mpr_user_setup_request(struct mpr_command *cm, struct mpr_usr_command *cmd)
626 {
627 MPI2_REQUEST_HEADER *hdr = (MPI2_REQUEST_HEADER *)cm->cm_req;
628 struct mpr_user_func *f;
629
630 for (f = mpr_user_func_list; f->f_pre != NULL; f++) {
631 if (hdr->Function == f->Function)
632 return (f->f_pre(cm, cmd));
633 }
634 return (EINVAL);
635 }
636
637 static int
mpr_user_command(struct mpr_softc * sc,struct mpr_usr_command * cmd)638 mpr_user_command(struct mpr_softc *sc, struct mpr_usr_command *cmd)
639 {
640 MPI2_REQUEST_HEADER *hdr;
641 MPI2_DEFAULT_REPLY *rpl = NULL;
642 void *buf = NULL;
643 struct mpr_command *cm = NULL;
644 int err = 0;
645 int sz;
646
647 mpr_lock(sc);
648 cm = mpr_alloc_command(sc);
649
650 if (cm == NULL) {
651 mpr_printf(sc, "%s: no mpr requests\n", __func__);
652 err = ENOMEM;
653 goto RetFree;
654 }
655 mpr_unlock(sc);
656
657 hdr = (MPI2_REQUEST_HEADER *)cm->cm_req;
658
659 mpr_dprint(sc, MPR_USER, "%s: req %p %d rpl %p %d\n", __func__,
660 cmd->req, cmd->req_len, cmd->rpl, cmd->rpl_len);
661
662 if (cmd->req_len > (int)sc->reqframesz) {
663 err = EINVAL;
664 goto RetFreeUnlocked;
665 }
666 err = copyin(cmd->req, hdr, cmd->req_len);
667 if (err != 0)
668 goto RetFreeUnlocked;
669
670 mpr_dprint(sc, MPR_USER, "%s: Function %02X MsgFlags %02X\n", __func__,
671 hdr->Function, hdr->MsgFlags);
672
673 if (cmd->len > 0) {
674 buf = malloc(cmd->len, M_MPRUSER, M_WAITOK|M_ZERO);
675 cm->cm_data = buf;
676 cm->cm_length = cmd->len;
677 } else {
678 cm->cm_data = NULL;
679 cm->cm_length = 0;
680 }
681
682 cm->cm_flags = MPR_CM_FLAGS_SGE_SIMPLE;
683 cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
684
685 err = mpr_user_setup_request(cm, cmd);
686 if (err == EINVAL) {
687 mpr_printf(sc, "%s: unsupported parameter or unsupported "
688 "function in request (function = 0x%X)\n", __func__,
689 hdr->Function);
690 }
691 if (err != 0)
692 goto RetFreeUnlocked;
693
694 mpr_lock(sc);
695 err = mpr_wait_command(sc, &cm, 30, CAN_SLEEP);
696
697 if (err || (cm == NULL)) {
698 mpr_printf(sc, "%s: invalid request: error %d\n",
699 __func__, err);
700 goto RetFree;
701 }
702
703 if (cm != NULL)
704 rpl = (MPI2_DEFAULT_REPLY *)cm->cm_reply;
705 if (rpl != NULL)
706 sz = rpl->MsgLength * 4;
707 else
708 sz = 0;
709
710 if (sz > cmd->rpl_len) {
711 mpr_printf(sc, "%s: user reply buffer (%d) smaller than "
712 "returned buffer (%d)\n", __func__, cmd->rpl_len, sz);
713 sz = cmd->rpl_len;
714 }
715
716 mpr_unlock(sc);
717 err = copyout(rpl, cmd->rpl, sz);
718 if (buf != NULL && err == 0)
719 err = copyout(buf, cmd->buf, cmd->len);
720 mpr_dprint(sc, MPR_USER, "%s: reply size %d\n", __func__, sz);
721
722 RetFreeUnlocked:
723 mpr_lock(sc);
724 RetFree:
725 if (cm != NULL)
726 mpr_free_command(sc, cm);
727 mpr_unlock(sc);
728 if (buf != NULL)
729 free(buf, M_MPRUSER);
730 return (err);
731 }
732
733 static int
mpr_user_pass_thru(struct mpr_softc * sc,mpr_pass_thru_t * data)734 mpr_user_pass_thru(struct mpr_softc *sc, mpr_pass_thru_t *data)
735 {
736 MPI2_REQUEST_HEADER *hdr, *tmphdr;
737 MPI2_DEFAULT_REPLY *rpl;
738 Mpi26NVMeEncapsulatedErrorReply_t *nvme_error_reply = NULL;
739 Mpi26NVMeEncapsulatedRequest_t *nvme_encap_request = NULL;
740 struct mpr_command *cm = NULL;
741 void *req = NULL;
742 int i, err = 0, dir = 0, sz;
743 uint8_t tool, function = 0;
744 u_int sense_len;
745 struct mprsas_target *targ = NULL;
746
747 /*
748 * Only allow one passthru command at a time. Use the MPR_FLAGS_BUSY
749 * bit to denote that a passthru is being processed.
750 */
751 mpr_lock(sc);
752 if (sc->mpr_flags & MPR_FLAGS_BUSY) {
753 mpr_dprint(sc, MPR_USER, "%s: Only one passthru command "
754 "allowed at a single time.", __func__);
755 mpr_unlock(sc);
756 return (EBUSY);
757 }
758 sc->mpr_flags |= MPR_FLAGS_BUSY;
759 mpr_unlock(sc);
760
761 /*
762 * Do some validation on data direction. Valid cases are:
763 * 1) DataSize is 0 and direction is NONE
764 * 2) DataSize is non-zero and one of:
765 * a) direction is READ or
766 * b) direction is WRITE or
767 * c) direction is BOTH and DataOutSize is non-zero
768 * If valid and the direction is BOTH, change the direction to READ.
769 * if valid and the direction is not BOTH, make sure DataOutSize is 0.
770 */
771 if (((data->DataSize == 0) &&
772 (data->DataDirection == MPR_PASS_THRU_DIRECTION_NONE)) ||
773 ((data->DataSize != 0) &&
774 ((data->DataDirection == MPR_PASS_THRU_DIRECTION_READ) ||
775 (data->DataDirection == MPR_PASS_THRU_DIRECTION_WRITE) ||
776 ((data->DataDirection == MPR_PASS_THRU_DIRECTION_BOTH) &&
777 (data->DataOutSize != 0))))) {
778 if (data->DataDirection == MPR_PASS_THRU_DIRECTION_BOTH)
779 data->DataDirection = MPR_PASS_THRU_DIRECTION_READ;
780 else
781 data->DataOutSize = 0;
782 } else {
783 err = EINVAL;
784 goto RetFreeUnlocked;
785 }
786
787 mpr_dprint(sc, MPR_USER, "%s: req 0x%jx %d rpl 0x%jx %d "
788 "data in 0x%jx %d data out 0x%jx %d data dir %d\n", __func__,
789 data->PtrRequest, data->RequestSize, data->PtrReply,
790 data->ReplySize, data->PtrData, data->DataSize,
791 data->PtrDataOut, data->DataOutSize, data->DataDirection);
792
793 if (data->RequestSize > sc->reqframesz) {
794 err = EINVAL;
795 goto RetFreeUnlocked;
796 }
797
798 req = malloc(data->RequestSize, M_MPRUSER, M_WAITOK | M_ZERO);
799 tmphdr = (MPI2_REQUEST_HEADER *)req;
800
801 err = copyin(PTRIN(data->PtrRequest), req, data->RequestSize);
802 if (err != 0)
803 goto RetFreeUnlocked;
804
805 function = tmphdr->Function;
806 mpr_dprint(sc, MPR_USER, "%s: Function %02X MsgFlags %02X\n", __func__,
807 function, tmphdr->MsgFlags);
808
809 /*
810 * Handle a passthru TM request.
811 */
812 if (function == MPI2_FUNCTION_SCSI_TASK_MGMT) {
813 MPI2_SCSI_TASK_MANAGE_REQUEST *task;
814
815 mpr_lock(sc);
816 cm = mprsas_alloc_tm(sc);
817 if (cm == NULL) {
818 err = EINVAL;
819 goto Ret;
820 }
821
822 /* Copy the header in. Only a small fixup is needed. */
823 task = (MPI2_SCSI_TASK_MANAGE_REQUEST *)cm->cm_req;
824 memcpy(task, req, data->RequestSize);
825 task->TaskMID = cm->cm_desc.Default.SMID;
826
827 cm->cm_data = NULL;
828 cm->cm_complete = NULL;
829 cm->cm_complete_data = NULL;
830
831 targ = mprsas_find_target_by_handle(sc->sassc, 0,
832 task->DevHandle);
833 if (targ == NULL) {
834 mpr_dprint(sc, MPR_INFO,
835 "%s %d : invalid handle for requested TM 0x%x \n",
836 __func__, __LINE__, task->DevHandle);
837 err = 1;
838 } else {
839 mprsas_prepare_for_tm(sc, cm, targ, CAM_LUN_WILDCARD);
840 err = mpr_wait_command(sc, &cm, 30, CAN_SLEEP);
841 }
842
843 if (err != 0) {
844 err = EIO;
845 mpr_dprint(sc, MPR_FAULT, "%s: task management failed",
846 __func__);
847 }
848 /*
849 * Copy the reply data and sense data to user space.
850 */
851 if (err == 0 && cm != NULL && cm->cm_reply != NULL) {
852 rpl = (MPI2_DEFAULT_REPLY *)cm->cm_reply;
853 sz = rpl->MsgLength * 4;
854
855 if (bootverbose && sz > data->ReplySize) {
856 mpr_printf(sc, "%s: user reply buffer (%d) "
857 "smaller than returned buffer (%d)\n",
858 __func__, data->ReplySize, sz);
859 }
860 mpr_unlock(sc);
861 err = copyout(cm->cm_reply, PTRIN(data->PtrReply),
862 MIN(sz, data->ReplySize));
863 mpr_lock(sc);
864 }
865 mprsas_free_tm(sc, cm);
866 goto Ret;
867 }
868
869 mpr_lock(sc);
870 cm = mpr_alloc_command(sc);
871 if (cm == NULL) {
872 mpr_printf(sc, "%s: no mpr requests\n", __func__);
873 err = ENOMEM;
874 goto Ret;
875 }
876 mpr_unlock(sc);
877
878 hdr = (MPI2_REQUEST_HEADER *)cm->cm_req;
879 memcpy(hdr, req, data->RequestSize);
880
881 /*
882 * Do some checking to make sure the IOCTL request contains a valid
883 * request. Then set the SGL info.
884 */
885 mpr_init_sge(cm, hdr, (void *)((uint8_t *)hdr + data->RequestSize));
886
887 /*
888 * Set up for read, write or both. From check above, DataOutSize will
889 * be 0 if direction is READ or WRITE, but it will have some non-zero
890 * value if the direction is BOTH. So, just use the biggest size to get
891 * the cm_data buffer size. If direction is BOTH, 2 SGLs need to be set
892 * up; the first is for the request and the second will contain the
893 * response data. cm_out_len needs to be set here and this will be used
894 * when the SGLs are set up.
895 */
896 cm->cm_data = NULL;
897 cm->cm_length = MAX(data->DataSize, data->DataOutSize);
898 cm->cm_out_len = data->DataOutSize;
899 cm->cm_flags = 0;
900 if (cm->cm_length != 0) {
901 cm->cm_data = malloc(cm->cm_length, M_MPRUSER, M_WAITOK |
902 M_ZERO);
903 cm->cm_flags = MPR_CM_FLAGS_DATAIN;
904 if (data->DataOutSize) {
905 cm->cm_flags |= MPR_CM_FLAGS_DATAOUT;
906 err = copyin(PTRIN(data->PtrDataOut),
907 cm->cm_data, data->DataOutSize);
908 } else if (data->DataDirection ==
909 MPR_PASS_THRU_DIRECTION_WRITE) {
910 cm->cm_flags = MPR_CM_FLAGS_DATAOUT;
911 err = copyin(PTRIN(data->PtrData),
912 cm->cm_data, data->DataSize);
913 }
914 if (err != 0)
915 mpr_dprint(sc, MPR_FAULT, "%s: failed to copy IOCTL "
916 "data from user space\n", __func__);
917 }
918 /*
919 * Set this flag only if processing a command that does not need an
920 * IEEE SGL. The CLI Tool within the Toolbox uses IEEE SGLs, so clear
921 * the flag only for that tool if processing a Toolbox function.
922 */
923 cm->cm_flags |= MPR_CM_FLAGS_SGE_SIMPLE;
924 for (i = 0; i < sizeof (ieee_sgl_func_list); i++) {
925 if (function == ieee_sgl_func_list[i]) {
926 if (function == MPI2_FUNCTION_TOOLBOX)
927 {
928 tool = (uint8_t)hdr->FunctionDependent1;
929 if (tool != MPI2_TOOLBOX_DIAGNOSTIC_CLI_TOOL)
930 break;
931 }
932 cm->cm_flags &= ~MPR_CM_FLAGS_SGE_SIMPLE;
933 break;
934 }
935 }
936 cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
937
938 if (function == MPI2_FUNCTION_NVME_ENCAPSULATED) {
939 nvme_encap_request =
940 (Mpi26NVMeEncapsulatedRequest_t *)cm->cm_req;
941 cm->cm_desc.Default.RequestFlags =
942 MPI26_REQ_DESCRIPT_FLAGS_PCIE_ENCAPSULATED;
943
944 /*
945 * Get the Physical Address of the sense buffer.
946 * Save the user's Error Response buffer address and use that
947 * field to hold the sense buffer address.
948 * Clear the internal sense buffer, which will potentially hold
949 * the Completion Queue Entry on return, or 0 if no Entry.
950 * Build the PRPs and set direction bits.
951 * Send the request.
952 */
953 cm->nvme_error_response =
954 (uint64_t *)(uintptr_t)(((uint64_t)nvme_encap_request->
955 ErrorResponseBaseAddress.High << 32) |
956 (uint64_t)nvme_encap_request->
957 ErrorResponseBaseAddress.Low);
958 nvme_encap_request->ErrorResponseBaseAddress.High =
959 htole32((uint32_t)((uint64_t)cm->cm_sense_busaddr >> 32));
960 nvme_encap_request->ErrorResponseBaseAddress.Low =
961 htole32(cm->cm_sense_busaddr);
962 memset(cm->cm_sense, 0, NVME_ERROR_RESPONSE_SIZE);
963 mpr_build_nvme_prp(sc, cm, nvme_encap_request, cm->cm_data,
964 data->DataSize, data->DataOutSize);
965 }
966
967 /*
968 * Set up Sense buffer and SGL offset for IO passthru. SCSI IO request
969 * uses SCSI IO or Fast Path SCSI IO descriptor.
970 */
971 if ((function == MPI2_FUNCTION_SCSI_IO_REQUEST) ||
972 (function == MPI2_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)) {
973 MPI2_SCSI_IO_REQUEST *scsi_io_req;
974
975 scsi_io_req = (MPI2_SCSI_IO_REQUEST *)hdr;
976 /*
977 * Put SGE for data and data_out buffer at the end of
978 * scsi_io_request message header (64 bytes in total).
979 * Following above SGEs, the residual space will be used by
980 * sense data.
981 */
982 scsi_io_req->SenseBufferLength = (uint8_t)(data->RequestSize -
983 64);
984 scsi_io_req->SenseBufferLowAddress =
985 htole32(cm->cm_sense_busaddr);
986
987 /*
988 * Set SGLOffset0 value. This is the number of dwords that SGL
989 * is offset from the beginning of MPI2_SCSI_IO_REQUEST struct.
990 */
991 scsi_io_req->SGLOffset0 = 24;
992
993 /*
994 * Setup descriptor info. RAID passthrough must use the
995 * default request descriptor which is already set, so if this
996 * is a SCSI IO request, change the descriptor to SCSI IO or
997 * Fast Path SCSI IO. Also, if this is a SCSI IO request,
998 * handle the reply in the mprsas_scsio_complete function.
999 */
1000 if (function == MPI2_FUNCTION_SCSI_IO_REQUEST) {
1001 targ = mprsas_find_target_by_handle(sc->sassc, 0,
1002 scsi_io_req->DevHandle);
1003
1004 if (!targ) {
1005 printf("No Target found for handle %d\n",
1006 scsi_io_req->DevHandle);
1007 err = EINVAL;
1008 goto RetFreeUnlocked;
1009 }
1010
1011 if (targ->scsi_req_desc_type ==
1012 MPI25_REQ_DESCRIPT_FLAGS_FAST_PATH_SCSI_IO) {
1013 cm->cm_desc.FastPathSCSIIO.RequestFlags =
1014 MPI25_REQ_DESCRIPT_FLAGS_FAST_PATH_SCSI_IO;
1015 if (!sc->atomic_desc_capable) {
1016 cm->cm_desc.FastPathSCSIIO.DevHandle =
1017 scsi_io_req->DevHandle;
1018 }
1019 scsi_io_req->IoFlags |=
1020 MPI25_SCSIIO_IOFLAGS_FAST_PATH;
1021 } else {
1022 cm->cm_desc.SCSIIO.RequestFlags =
1023 MPI2_REQ_DESCRIPT_FLAGS_SCSI_IO;
1024 if (!sc->atomic_desc_capable) {
1025 cm->cm_desc.SCSIIO.DevHandle =
1026 scsi_io_req->DevHandle;
1027 }
1028 }
1029
1030 /*
1031 * Make sure the DevHandle is not 0 because this is a
1032 * likely error.
1033 */
1034 if (scsi_io_req->DevHandle == 0) {
1035 err = EINVAL;
1036 goto RetFreeUnlocked;
1037 }
1038 }
1039 }
1040
1041 mpr_lock(sc);
1042
1043 err = mpr_wait_command(sc, &cm, 30, CAN_SLEEP);
1044
1045 if (err || (cm == NULL)) {
1046 mpr_printf(sc, "%s: invalid request: error %d\n", __func__,
1047 err);
1048 goto RetFree;
1049 }
1050
1051 /*
1052 * Sync the DMA data, if any. Then copy the data to user space.
1053 */
1054 if (cm->cm_data != NULL) {
1055 if (cm->cm_flags & MPR_CM_FLAGS_DATAIN)
1056 dir = BUS_DMASYNC_POSTREAD;
1057 else if (cm->cm_flags & MPR_CM_FLAGS_DATAOUT)
1058 dir = BUS_DMASYNC_POSTWRITE;
1059 bus_dmamap_sync(sc->buffer_dmat, cm->cm_dmamap, dir);
1060 bus_dmamap_unload(sc->buffer_dmat, cm->cm_dmamap);
1061
1062 if (cm->cm_flags & MPR_CM_FLAGS_DATAIN) {
1063 mpr_unlock(sc);
1064 err = copyout(cm->cm_data,
1065 PTRIN(data->PtrData), data->DataSize);
1066 mpr_lock(sc);
1067 if (err != 0)
1068 mpr_dprint(sc, MPR_FAULT, "%s: failed to copy "
1069 "IOCTL data to user space\n", __func__);
1070 }
1071 }
1072
1073 /*
1074 * Copy the reply data and sense data to user space.
1075 */
1076 if (err == 0 && cm->cm_reply != NULL) {
1077 rpl = (MPI2_DEFAULT_REPLY *)cm->cm_reply;
1078 sz = rpl->MsgLength * 4;
1079
1080 if (bootverbose && sz > data->ReplySize) {
1081 mpr_printf(sc, "%s: user reply buffer (%d) smaller "
1082 "than returned buffer (%d)\n", __func__,
1083 data->ReplySize, sz);
1084 }
1085 mpr_unlock(sc);
1086 err = copyout(cm->cm_reply, PTRIN(data->PtrReply),
1087 MIN(sz, data->ReplySize));
1088 if (err != 0)
1089 mpr_dprint(sc, MPR_FAULT, "%s: failed to copy "
1090 "IOCTL data to user space\n", __func__);
1091 mpr_lock(sc);
1092
1093 if (err == 0 &&
1094 (function == MPI2_FUNCTION_SCSI_IO_REQUEST ||
1095 function == MPI2_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)) {
1096 if (((MPI2_SCSI_IO_REPLY *)rpl)->SCSIState &
1097 MPI2_SCSI_STATE_AUTOSENSE_VALID) {
1098 sense_len =
1099 MIN((le32toh(((MPI2_SCSI_IO_REPLY *)rpl)->
1100 SenseCount)), sizeof(struct
1101 scsi_sense_data));
1102 mpr_unlock(sc);
1103 err = copyout(cm->cm_sense,
1104 PTRIN(data->PtrReply +
1105 sizeof(MPI2_SCSI_IO_REPLY)), sense_len);
1106 if (err != 0)
1107 mpr_dprint(sc, MPR_FAULT,
1108 "%s: failed to copy IOCTL data to "
1109 "user space\n", __func__);
1110 mpr_lock(sc);
1111 }
1112 }
1113
1114 /*
1115 * Copy out the NVMe Error Reponse to user. The Error Response
1116 * buffer is given by the user, but a sense buffer is used to
1117 * get that data from the IOC. The user's
1118 * ErrorResponseBaseAddress is saved in the
1119 * 'nvme_error_response' field before the command because that
1120 * field is set to a sense buffer. When the command is
1121 * complete, the Error Response data from the IOC is copied to
1122 * that user address after it is checked for validity.
1123 * Also note that 'sense' buffers are not defined for
1124 * NVMe commands. Sense terminalogy is only used here so that
1125 * the same IOCTL structure and sense buffers can be used for
1126 * NVMe.
1127 */
1128 if (err == 0 && function == MPI2_FUNCTION_NVME_ENCAPSULATED) {
1129 if (cm->nvme_error_response == NULL) {
1130 mpr_dprint(sc, MPR_INFO, "NVMe Error Response "
1131 "buffer is NULL. Response data will not be "
1132 "returned.\n");
1133 mpr_unlock(sc);
1134 goto RetFreeUnlocked;
1135 }
1136
1137 nvme_error_reply =
1138 (Mpi26NVMeEncapsulatedErrorReply_t *)cm->cm_reply;
1139 sz = MIN(le32toh(nvme_error_reply->ErrorResponseCount),
1140 NVME_ERROR_RESPONSE_SIZE);
1141 mpr_unlock(sc);
1142 err = copyout(cm->cm_sense,
1143 (PTRIN(data->PtrReply +
1144 sizeof(MPI2_SCSI_IO_REPLY))), sz);
1145 if (err != 0)
1146 mpr_dprint(sc, MPR_FAULT,
1147 "%s: failed to copy IOCTL data to "
1148 "user space\n", __func__);
1149 mpr_lock(sc);
1150 }
1151 }
1152 mpr_unlock(sc);
1153
1154 RetFreeUnlocked:
1155 mpr_lock(sc);
1156
1157 RetFree:
1158 if (cm != NULL) {
1159 if (cm->cm_data)
1160 free(cm->cm_data, M_MPRUSER);
1161 mpr_free_command(sc, cm);
1162 }
1163 Ret:
1164 sc->mpr_flags &= ~MPR_FLAGS_BUSY;
1165 mpr_unlock(sc);
1166 free(req, M_MPRUSER);
1167
1168 return (err);
1169 }
1170
1171 static void
mpr_user_get_adapter_data(struct mpr_softc * sc,mpr_adapter_data_t * data)1172 mpr_user_get_adapter_data(struct mpr_softc *sc, mpr_adapter_data_t *data)
1173 {
1174 Mpi2ConfigReply_t mpi_reply;
1175 Mpi2BiosPage3_t config_page;
1176
1177 /*
1178 * Use the PCI interface functions to get the Bus, Device, and Function
1179 * information.
1180 */
1181 data->PciInformation.u.bits.BusNumber = pci_get_bus(sc->mpr_dev);
1182 data->PciInformation.u.bits.DeviceNumber = pci_get_slot(sc->mpr_dev);
1183 data->PciInformation.u.bits.FunctionNumber =
1184 pci_get_function(sc->mpr_dev);
1185
1186 /*
1187 * Get the FW version that should already be saved in IOC Facts.
1188 */
1189 data->MpiFirmwareVersion = sc->facts->FWVersion.Word;
1190
1191 /*
1192 * General device info.
1193 */
1194 if (sc->mpr_flags & MPR_FLAGS_GEN35_IOC)
1195 data->AdapterType = MPRIOCTL_ADAPTER_TYPE_SAS35;
1196 else
1197 data->AdapterType = MPRIOCTL_ADAPTER_TYPE_SAS3;
1198 data->PCIDeviceHwId = pci_get_device(sc->mpr_dev);
1199 data->PCIDeviceHwRev = pci_read_config(sc->mpr_dev, PCIR_REVID, 1);
1200 data->SubSystemId = pci_get_subdevice(sc->mpr_dev);
1201 data->SubsystemVendorId = pci_get_subvendor(sc->mpr_dev);
1202
1203 /*
1204 * Get the driver version.
1205 */
1206 strcpy((char *)&data->DriverVersion[0], MPR_DRIVER_VERSION);
1207
1208 /*
1209 * Need to get BIOS Config Page 3 for the BIOS Version.
1210 */
1211 data->BiosVersion = 0;
1212 mpr_lock(sc);
1213 if (mpr_config_get_bios_pg3(sc, &mpi_reply, &config_page))
1214 printf("%s: Error while retrieving BIOS Version\n", __func__);
1215 else
1216 data->BiosVersion = config_page.BiosVersion;
1217 mpr_unlock(sc);
1218 }
1219
1220 static void
mpr_user_read_pci_info(struct mpr_softc * sc,mpr_pci_info_t * data)1221 mpr_user_read_pci_info(struct mpr_softc *sc, mpr_pci_info_t *data)
1222 {
1223 int i;
1224
1225 /*
1226 * Use the PCI interface functions to get the Bus, Device, and Function
1227 * information.
1228 */
1229 data->BusNumber = pci_get_bus(sc->mpr_dev);
1230 data->DeviceNumber = pci_get_slot(sc->mpr_dev);
1231 data->FunctionNumber = pci_get_function(sc->mpr_dev);
1232
1233 /*
1234 * Now get the interrupt vector and the pci header. The vector can
1235 * only be 0 right now. The header is the first 256 bytes of config
1236 * space.
1237 */
1238 data->InterruptVector = 0;
1239 for (i = 0; i < sizeof (data->PciHeader); i++) {
1240 data->PciHeader[i] = pci_read_config(sc->mpr_dev, i, 1);
1241 }
1242 }
1243
1244 static uint8_t
mpr_get_fw_diag_buffer_number(struct mpr_softc * sc,uint32_t unique_id)1245 mpr_get_fw_diag_buffer_number(struct mpr_softc *sc, uint32_t unique_id)
1246 {
1247 uint8_t index;
1248
1249 for (index = 0; index < MPI2_DIAG_BUF_TYPE_COUNT; index++) {
1250 if (sc->fw_diag_buffer_list[index].unique_id == unique_id) {
1251 return (index);
1252 }
1253 }
1254
1255 return (MPR_FW_DIAGNOSTIC_UID_NOT_FOUND);
1256 }
1257
1258 static int
mpr_post_fw_diag_buffer(struct mpr_softc * sc,mpr_fw_diagnostic_buffer_t * pBuffer,uint32_t * return_code)1259 mpr_post_fw_diag_buffer(struct mpr_softc *sc,
1260 mpr_fw_diagnostic_buffer_t *pBuffer, uint32_t *return_code)
1261 {
1262 MPI2_DIAG_BUFFER_POST_REQUEST *req;
1263 MPI2_DIAG_BUFFER_POST_REPLY *reply;
1264 struct mpr_command *cm = NULL;
1265 int i, status;
1266
1267 /*
1268 * If buffer is not enabled, just leave.
1269 */
1270 *return_code = MPR_FW_DIAG_ERROR_POST_FAILED;
1271 if (!pBuffer->enabled) {
1272 return (MPR_DIAG_FAILURE);
1273 }
1274
1275 /*
1276 * Clear some flags initially.
1277 */
1278 pBuffer->force_release = FALSE;
1279 pBuffer->valid_data = FALSE;
1280 pBuffer->owned_by_firmware = FALSE;
1281
1282 /*
1283 * Get a command.
1284 */
1285 cm = mpr_alloc_command(sc);
1286 if (cm == NULL) {
1287 mpr_printf(sc, "%s: no mpr requests\n", __func__);
1288 return (MPR_DIAG_FAILURE);
1289 }
1290
1291 /*
1292 * Build the request for releasing the FW Diag Buffer and send it.
1293 */
1294 req = (MPI2_DIAG_BUFFER_POST_REQUEST *)cm->cm_req;
1295 req->Function = MPI2_FUNCTION_DIAG_BUFFER_POST;
1296 req->BufferType = pBuffer->buffer_type;
1297 req->ExtendedType = pBuffer->extended_type;
1298 req->BufferLength = pBuffer->size;
1299 for (i = 0; i < (sizeof(req->ProductSpecific) / 4); i++)
1300 req->ProductSpecific[i] = pBuffer->product_specific[i];
1301 mpr_from_u64(sc->fw_diag_busaddr, &req->BufferAddress);
1302 cm->cm_data = NULL;
1303 cm->cm_length = 0;
1304 cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
1305 cm->cm_complete_data = NULL;
1306
1307 /*
1308 * Send command synchronously.
1309 */
1310 status = mpr_wait_command(sc, &cm, 30, CAN_SLEEP);
1311 if (status || (cm == NULL)) {
1312 mpr_printf(sc, "%s: invalid request: error %d\n", __func__,
1313 status);
1314 status = MPR_DIAG_FAILURE;
1315 goto done;
1316 }
1317
1318 /*
1319 * Process POST reply.
1320 */
1321 reply = (MPI2_DIAG_BUFFER_POST_REPLY *)cm->cm_reply;
1322 if (reply == NULL) {
1323 mpr_printf(sc, "%s: reply is NULL, probably due to "
1324 "reinitialization\n", __func__);
1325 status = MPR_DIAG_FAILURE;
1326 goto done;
1327 }
1328
1329 if ((le16toh(reply->IOCStatus) & MPI2_IOCSTATUS_MASK) !=
1330 MPI2_IOCSTATUS_SUCCESS) {
1331 status = MPR_DIAG_FAILURE;
1332 mpr_dprint(sc, MPR_FAULT, "%s: post of FW Diag Buffer failed "
1333 "with IOCStatus = 0x%x, IOCLogInfo = 0x%x and "
1334 "TransferLength = 0x%x\n", __func__,
1335 le16toh(reply->IOCStatus), le32toh(reply->IOCLogInfo),
1336 le32toh(reply->TransferLength));
1337 goto done;
1338 }
1339
1340 /*
1341 * Post was successful.
1342 */
1343 pBuffer->valid_data = TRUE;
1344 pBuffer->owned_by_firmware = TRUE;
1345 *return_code = MPR_FW_DIAG_ERROR_SUCCESS;
1346 status = MPR_DIAG_SUCCESS;
1347
1348 done:
1349 if (cm != NULL)
1350 mpr_free_command(sc, cm);
1351 return (status);
1352 }
1353
1354 static int
mpr_release_fw_diag_buffer(struct mpr_softc * sc,mpr_fw_diagnostic_buffer_t * pBuffer,uint32_t * return_code,uint32_t diag_type)1355 mpr_release_fw_diag_buffer(struct mpr_softc *sc,
1356 mpr_fw_diagnostic_buffer_t *pBuffer, uint32_t *return_code,
1357 uint32_t diag_type)
1358 {
1359 MPI2_DIAG_RELEASE_REQUEST *req;
1360 MPI2_DIAG_RELEASE_REPLY *reply;
1361 struct mpr_command *cm = NULL;
1362 int status;
1363
1364 /*
1365 * If buffer is not enabled, just leave.
1366 */
1367 *return_code = MPR_FW_DIAG_ERROR_RELEASE_FAILED;
1368 if (!pBuffer->enabled) {
1369 mpr_dprint(sc, MPR_USER, "%s: This buffer type is not "
1370 "supported by the IOC", __func__);
1371 return (MPR_DIAG_FAILURE);
1372 }
1373
1374 /*
1375 * Clear some flags initially.
1376 */
1377 pBuffer->force_release = FALSE;
1378 pBuffer->valid_data = FALSE;
1379 pBuffer->owned_by_firmware = FALSE;
1380
1381 /*
1382 * Get a command.
1383 */
1384 cm = mpr_alloc_command(sc);
1385 if (cm == NULL) {
1386 mpr_printf(sc, "%s: no mpr requests\n", __func__);
1387 return (MPR_DIAG_FAILURE);
1388 }
1389
1390 /*
1391 * Build the request for releasing the FW Diag Buffer and send it.
1392 */
1393 req = (MPI2_DIAG_RELEASE_REQUEST *)cm->cm_req;
1394 req->Function = MPI2_FUNCTION_DIAG_RELEASE;
1395 req->BufferType = pBuffer->buffer_type;
1396 cm->cm_data = NULL;
1397 cm->cm_length = 0;
1398 cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
1399 cm->cm_complete_data = NULL;
1400
1401 /*
1402 * Send command synchronously.
1403 */
1404 status = mpr_wait_command(sc, &cm, 30, CAN_SLEEP);
1405 if (status || (cm == NULL)) {
1406 mpr_printf(sc, "%s: invalid request: error %d\n", __func__,
1407 status);
1408 status = MPR_DIAG_FAILURE;
1409 goto done;
1410 }
1411
1412 /*
1413 * Process RELEASE reply.
1414 */
1415 reply = (MPI2_DIAG_RELEASE_REPLY *)cm->cm_reply;
1416 if (reply == NULL) {
1417 mpr_printf(sc, "%s: reply is NULL, probably due to "
1418 "reinitialization\n", __func__);
1419 status = MPR_DIAG_FAILURE;
1420 goto done;
1421 }
1422 if (((le16toh(reply->IOCStatus) & MPI2_IOCSTATUS_MASK) !=
1423 MPI2_IOCSTATUS_SUCCESS) || pBuffer->owned_by_firmware) {
1424 status = MPR_DIAG_FAILURE;
1425 mpr_dprint(sc, MPR_FAULT, "%s: release of FW Diag Buffer "
1426 "failed with IOCStatus = 0x%x and IOCLogInfo = 0x%x\n",
1427 __func__, le16toh(reply->IOCStatus),
1428 le32toh(reply->IOCLogInfo));
1429 goto done;
1430 }
1431
1432 /*
1433 * Release was successful.
1434 */
1435 *return_code = MPR_FW_DIAG_ERROR_SUCCESS;
1436 status = MPR_DIAG_SUCCESS;
1437
1438 /*
1439 * If this was for an UNREGISTER diag type command, clear the unique ID.
1440 */
1441 if (diag_type == MPR_FW_DIAG_TYPE_UNREGISTER) {
1442 pBuffer->unique_id = MPR_FW_DIAG_INVALID_UID;
1443 }
1444
1445 done:
1446 if (cm != NULL)
1447 mpr_free_command(sc, cm);
1448
1449 return (status);
1450 }
1451
1452 static int
mpr_diag_register(struct mpr_softc * sc,mpr_fw_diag_register_t * diag_register,uint32_t * return_code)1453 mpr_diag_register(struct mpr_softc *sc, mpr_fw_diag_register_t *diag_register,
1454 uint32_t *return_code)
1455 {
1456 bus_dma_template_t t;
1457 mpr_fw_diagnostic_buffer_t *pBuffer;
1458 struct mpr_busdma_context *ctx;
1459 uint8_t extended_type, buffer_type, i;
1460 uint32_t buffer_size;
1461 uint32_t unique_id;
1462 int status;
1463 int error;
1464
1465 extended_type = diag_register->ExtendedType;
1466 buffer_type = diag_register->BufferType;
1467 buffer_size = diag_register->RequestedBufferSize;
1468 unique_id = diag_register->UniqueId;
1469 ctx = NULL;
1470 error = 0;
1471
1472 /*
1473 * Check for valid buffer type
1474 */
1475 if (buffer_type >= MPI2_DIAG_BUF_TYPE_COUNT) {
1476 *return_code = MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1477 return (MPR_DIAG_FAILURE);
1478 }
1479
1480 /*
1481 * Get the current buffer and look up the unique ID. The unique ID
1482 * should not be found. If it is, the ID is already in use.
1483 */
1484 i = mpr_get_fw_diag_buffer_number(sc, unique_id);
1485 pBuffer = &sc->fw_diag_buffer_list[buffer_type];
1486 if (i != MPR_FW_DIAGNOSTIC_UID_NOT_FOUND) {
1487 *return_code = MPR_FW_DIAG_ERROR_INVALID_UID;
1488 return (MPR_DIAG_FAILURE);
1489 }
1490
1491 /*
1492 * The buffer's unique ID should not be registered yet, and the given
1493 * unique ID cannot be 0.
1494 */
1495 if ((pBuffer->unique_id != MPR_FW_DIAG_INVALID_UID) ||
1496 (unique_id == MPR_FW_DIAG_INVALID_UID)) {
1497 *return_code = MPR_FW_DIAG_ERROR_INVALID_UID;
1498 return (MPR_DIAG_FAILURE);
1499 }
1500
1501 /*
1502 * If this buffer is already posted as immediate, just change owner.
1503 */
1504 if (pBuffer->immediate && pBuffer->owned_by_firmware &&
1505 (pBuffer->unique_id == MPR_FW_DIAG_INVALID_UID)) {
1506 pBuffer->immediate = FALSE;
1507 pBuffer->unique_id = unique_id;
1508 return (MPR_DIAG_SUCCESS);
1509 }
1510
1511 /*
1512 * Post a new buffer after checking if it's enabled. The DMA buffer
1513 * that is allocated will be contiguous (nsegments = 1).
1514 */
1515 if (!pBuffer->enabled) {
1516 *return_code = MPR_FW_DIAG_ERROR_NO_BUFFER;
1517 return (MPR_DIAG_FAILURE);
1518 }
1519 bus_dma_template_init(&t, sc->mpr_parent_dmat);
1520 BUS_DMA_TEMPLATE_FILL(&t, BD_LOWADDR(BUS_SPACE_MAXADDR_32BIT),
1521 BD_MAXSIZE(buffer_size), BD_MAXSEGSIZE(buffer_size),
1522 BD_NSEGMENTS(1));
1523 if (bus_dma_template_tag(&t, &sc->fw_diag_dmat)) {
1524 mpr_dprint(sc, MPR_ERROR,
1525 "Cannot allocate FW diag buffer DMA tag\n");
1526 *return_code = MPR_FW_DIAG_ERROR_NO_BUFFER;
1527 status = MPR_DIAG_FAILURE;
1528 goto bailout;
1529 }
1530 if (bus_dmamem_alloc(sc->fw_diag_dmat, (void **)&sc->fw_diag_buffer,
1531 BUS_DMA_NOWAIT, &sc->fw_diag_map)) {
1532 mpr_dprint(sc, MPR_ERROR,
1533 "Cannot allocate FW diag buffer memory\n");
1534 *return_code = MPR_FW_DIAG_ERROR_NO_BUFFER;
1535 status = MPR_DIAG_FAILURE;
1536 goto bailout;
1537 }
1538 bzero(sc->fw_diag_buffer, buffer_size);
1539
1540 ctx = malloc(sizeof(*ctx), M_MPR, M_WAITOK | M_ZERO);
1541 ctx->addr = &sc->fw_diag_busaddr;
1542 ctx->buffer_dmat = sc->fw_diag_dmat;
1543 ctx->buffer_dmamap = sc->fw_diag_map;
1544 ctx->softc = sc;
1545 error = bus_dmamap_load(sc->fw_diag_dmat, sc->fw_diag_map,
1546 sc->fw_diag_buffer, buffer_size, mpr_memaddr_wait_cb,
1547 ctx, 0);
1548 if (error == EINPROGRESS) {
1549 /* XXX KDM */
1550 device_printf(sc->mpr_dev, "%s: Deferred bus_dmamap_load\n",
1551 __func__);
1552 /*
1553 * Wait for the load to complete. If we're interrupted,
1554 * bail out.
1555 */
1556 mpr_lock(sc);
1557 if (ctx->completed == 0) {
1558 error = msleep(ctx, &sc->mpr_mtx, PCATCH, "mprwait", 0);
1559 if (error != 0) {
1560 /*
1561 * We got an error from msleep(9). This is
1562 * most likely due to a signal. Tell
1563 * mpr_memaddr_wait_cb() that we've abandoned
1564 * the context, so it needs to clean up when
1565 * it is called.
1566 */
1567 ctx->abandoned = 1;
1568
1569 /* The callback will free this memory */
1570 ctx = NULL;
1571 mpr_unlock(sc);
1572
1573 device_printf(sc->mpr_dev, "Cannot "
1574 "bus_dmamap_load FW diag buffer, error = "
1575 "%d returned from msleep\n", error);
1576 *return_code = MPR_FW_DIAG_ERROR_NO_BUFFER;
1577 status = MPR_DIAG_FAILURE;
1578 goto bailout;
1579 }
1580 }
1581 mpr_unlock(sc);
1582 }
1583
1584 if ((error != 0) || (ctx->error != 0)) {
1585 device_printf(sc->mpr_dev, "Cannot bus_dmamap_load FW diag "
1586 "buffer, %serror = %d\n", error ? "" : "callback ",
1587 error ? error : ctx->error);
1588 *return_code = MPR_FW_DIAG_ERROR_NO_BUFFER;
1589 status = MPR_DIAG_FAILURE;
1590 goto bailout;
1591 }
1592
1593 bus_dmamap_sync(sc->fw_diag_dmat, sc->fw_diag_map, BUS_DMASYNC_PREREAD);
1594
1595 pBuffer->size = buffer_size;
1596
1597 /*
1598 * Copy the given info to the diag buffer and post the buffer.
1599 */
1600 pBuffer->buffer_type = buffer_type;
1601 pBuffer->immediate = FALSE;
1602 if (buffer_type == MPI2_DIAG_BUF_TYPE_TRACE) {
1603 for (i = 0; i < (sizeof (pBuffer->product_specific) / 4);
1604 i++) {
1605 pBuffer->product_specific[i] =
1606 diag_register->ProductSpecific[i];
1607 }
1608 }
1609 pBuffer->extended_type = extended_type;
1610 pBuffer->unique_id = unique_id;
1611 status = mpr_post_fw_diag_buffer(sc, pBuffer, return_code);
1612
1613 bailout:
1614
1615 /*
1616 * In case there was a failure, free the DMA buffer.
1617 */
1618 if (status == MPR_DIAG_FAILURE) {
1619 if (sc->fw_diag_busaddr != 0) {
1620 bus_dmamap_unload(sc->fw_diag_dmat, sc->fw_diag_map);
1621 sc->fw_diag_busaddr = 0;
1622 }
1623 if (sc->fw_diag_buffer != NULL) {
1624 bus_dmamem_free(sc->fw_diag_dmat, sc->fw_diag_buffer,
1625 sc->fw_diag_map);
1626 sc->fw_diag_buffer = NULL;
1627 }
1628 if (sc->fw_diag_dmat != NULL) {
1629 bus_dma_tag_destroy(sc->fw_diag_dmat);
1630 sc->fw_diag_dmat = NULL;
1631 }
1632 }
1633
1634 if (ctx != NULL)
1635 free(ctx, M_MPR);
1636
1637 return (status);
1638 }
1639
1640 static int
mpr_diag_unregister(struct mpr_softc * sc,mpr_fw_diag_unregister_t * diag_unregister,uint32_t * return_code)1641 mpr_diag_unregister(struct mpr_softc *sc,
1642 mpr_fw_diag_unregister_t *diag_unregister, uint32_t *return_code)
1643 {
1644 mpr_fw_diagnostic_buffer_t *pBuffer;
1645 uint8_t i;
1646 uint32_t unique_id;
1647 int status;
1648
1649 unique_id = diag_unregister->UniqueId;
1650
1651 /*
1652 * Get the current buffer and look up the unique ID. The unique ID
1653 * should be there.
1654 */
1655 i = mpr_get_fw_diag_buffer_number(sc, unique_id);
1656 if (i == MPR_FW_DIAGNOSTIC_UID_NOT_FOUND) {
1657 *return_code = MPR_FW_DIAG_ERROR_INVALID_UID;
1658 return (MPR_DIAG_FAILURE);
1659 }
1660
1661 pBuffer = &sc->fw_diag_buffer_list[i];
1662
1663 /*
1664 * Try to release the buffer from FW before freeing it. If release
1665 * fails, don't free the DMA buffer in case FW tries to access it
1666 * later. If buffer is not owned by firmware, can't release it.
1667 */
1668 if (!pBuffer->owned_by_firmware) {
1669 status = MPR_DIAG_SUCCESS;
1670 } else {
1671 status = mpr_release_fw_diag_buffer(sc, pBuffer, return_code,
1672 MPR_FW_DIAG_TYPE_UNREGISTER);
1673 }
1674
1675 /*
1676 * At this point, return the current status no matter what happens with
1677 * the DMA buffer.
1678 */
1679 pBuffer->unique_id = MPR_FW_DIAG_INVALID_UID;
1680 if (status == MPR_DIAG_SUCCESS) {
1681 if (sc->fw_diag_busaddr != 0) {
1682 bus_dmamap_unload(sc->fw_diag_dmat, sc->fw_diag_map);
1683 sc->fw_diag_busaddr = 0;
1684 }
1685 if (sc->fw_diag_buffer != NULL) {
1686 bus_dmamem_free(sc->fw_diag_dmat, sc->fw_diag_buffer,
1687 sc->fw_diag_map);
1688 sc->fw_diag_buffer = NULL;
1689 }
1690 if (sc->fw_diag_dmat != NULL) {
1691 bus_dma_tag_destroy(sc->fw_diag_dmat);
1692 sc->fw_diag_dmat = NULL;
1693 }
1694 }
1695
1696 return (status);
1697 }
1698
1699 static int
mpr_diag_query(struct mpr_softc * sc,mpr_fw_diag_query_t * diag_query,uint32_t * return_code)1700 mpr_diag_query(struct mpr_softc *sc, mpr_fw_diag_query_t *diag_query,
1701 uint32_t *return_code)
1702 {
1703 mpr_fw_diagnostic_buffer_t *pBuffer;
1704 uint8_t i;
1705 uint32_t unique_id;
1706
1707 unique_id = diag_query->UniqueId;
1708
1709 /*
1710 * If ID is valid, query on ID.
1711 * If ID is invalid, query on buffer type.
1712 */
1713 if (unique_id == MPR_FW_DIAG_INVALID_UID) {
1714 i = diag_query->BufferType;
1715 if (i >= MPI2_DIAG_BUF_TYPE_COUNT) {
1716 *return_code = MPR_FW_DIAG_ERROR_INVALID_UID;
1717 return (MPR_DIAG_FAILURE);
1718 }
1719 } else {
1720 i = mpr_get_fw_diag_buffer_number(sc, unique_id);
1721 if (i == MPR_FW_DIAGNOSTIC_UID_NOT_FOUND) {
1722 *return_code = MPR_FW_DIAG_ERROR_INVALID_UID;
1723 return (MPR_DIAG_FAILURE);
1724 }
1725 }
1726
1727 /*
1728 * Fill query structure with the diag buffer info.
1729 */
1730 pBuffer = &sc->fw_diag_buffer_list[i];
1731 diag_query->BufferType = pBuffer->buffer_type;
1732 diag_query->ExtendedType = pBuffer->extended_type;
1733 if (diag_query->BufferType == MPI2_DIAG_BUF_TYPE_TRACE) {
1734 for (i = 0; i < (sizeof(diag_query->ProductSpecific) / 4);
1735 i++) {
1736 diag_query->ProductSpecific[i] =
1737 pBuffer->product_specific[i];
1738 }
1739 }
1740 diag_query->TotalBufferSize = pBuffer->size;
1741 diag_query->DriverAddedBufferSize = 0;
1742 diag_query->UniqueId = pBuffer->unique_id;
1743 diag_query->ApplicationFlags = 0;
1744 diag_query->DiagnosticFlags = 0;
1745
1746 /*
1747 * Set/Clear application flags
1748 */
1749 if (pBuffer->immediate) {
1750 diag_query->ApplicationFlags &= ~MPR_FW_DIAG_FLAG_APP_OWNED;
1751 } else {
1752 diag_query->ApplicationFlags |= MPR_FW_DIAG_FLAG_APP_OWNED;
1753 }
1754 if (pBuffer->valid_data || pBuffer->owned_by_firmware) {
1755 diag_query->ApplicationFlags |= MPR_FW_DIAG_FLAG_BUFFER_VALID;
1756 } else {
1757 diag_query->ApplicationFlags &= ~MPR_FW_DIAG_FLAG_BUFFER_VALID;
1758 }
1759 if (pBuffer->owned_by_firmware) {
1760 diag_query->ApplicationFlags |=
1761 MPR_FW_DIAG_FLAG_FW_BUFFER_ACCESS;
1762 } else {
1763 diag_query->ApplicationFlags &=
1764 ~MPR_FW_DIAG_FLAG_FW_BUFFER_ACCESS;
1765 }
1766
1767 return (MPR_DIAG_SUCCESS);
1768 }
1769
1770 static int
mpr_diag_read_buffer(struct mpr_softc * sc,mpr_diag_read_buffer_t * diag_read_buffer,uint8_t * ioctl_buf,uint32_t * return_code)1771 mpr_diag_read_buffer(struct mpr_softc *sc,
1772 mpr_diag_read_buffer_t *diag_read_buffer, uint8_t *ioctl_buf,
1773 uint32_t *return_code)
1774 {
1775 mpr_fw_diagnostic_buffer_t *pBuffer;
1776 uint8_t i, *pData;
1777 uint32_t unique_id;
1778 int status;
1779
1780 unique_id = diag_read_buffer->UniqueId;
1781
1782 /*
1783 * Get the current buffer and look up the unique ID. The unique ID
1784 * should be there.
1785 */
1786 i = mpr_get_fw_diag_buffer_number(sc, unique_id);
1787 if (i == MPR_FW_DIAGNOSTIC_UID_NOT_FOUND) {
1788 *return_code = MPR_FW_DIAG_ERROR_INVALID_UID;
1789 return (MPR_DIAG_FAILURE);
1790 }
1791
1792 pBuffer = &sc->fw_diag_buffer_list[i];
1793
1794 /*
1795 * Make sure requested read is within limits
1796 */
1797 if (diag_read_buffer->StartingOffset + diag_read_buffer->BytesToRead >
1798 pBuffer->size) {
1799 *return_code = MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1800 return (MPR_DIAG_FAILURE);
1801 }
1802
1803 /* Sync the DMA map before we copy to userland. */
1804 bus_dmamap_sync(sc->fw_diag_dmat, sc->fw_diag_map,
1805 BUS_DMASYNC_POSTREAD);
1806
1807 /*
1808 * Copy the requested data from DMA to the diag_read_buffer. The DMA
1809 * buffer that was allocated is one contiguous buffer.
1810 */
1811 pData = (uint8_t *)(sc->fw_diag_buffer +
1812 diag_read_buffer->StartingOffset);
1813 if (copyout(pData, ioctl_buf, diag_read_buffer->BytesToRead) != 0)
1814 return (MPR_DIAG_FAILURE);
1815 diag_read_buffer->Status = 0;
1816
1817 /*
1818 * Set or clear the Force Release flag.
1819 */
1820 if (pBuffer->force_release) {
1821 diag_read_buffer->Flags |= MPR_FW_DIAG_FLAG_FORCE_RELEASE;
1822 } else {
1823 diag_read_buffer->Flags &= ~MPR_FW_DIAG_FLAG_FORCE_RELEASE;
1824 }
1825
1826 /*
1827 * If buffer is to be reregistered, make sure it's not already owned by
1828 * firmware first.
1829 */
1830 status = MPR_DIAG_SUCCESS;
1831 if (!pBuffer->owned_by_firmware) {
1832 if (diag_read_buffer->Flags & MPR_FW_DIAG_FLAG_REREGISTER) {
1833 status = mpr_post_fw_diag_buffer(sc, pBuffer,
1834 return_code);
1835 }
1836 }
1837
1838 return (status);
1839 }
1840
1841 static int
mpr_diag_release(struct mpr_softc * sc,mpr_fw_diag_release_t * diag_release,uint32_t * return_code)1842 mpr_diag_release(struct mpr_softc *sc, mpr_fw_diag_release_t *diag_release,
1843 uint32_t *return_code)
1844 {
1845 mpr_fw_diagnostic_buffer_t *pBuffer;
1846 uint8_t i;
1847 uint32_t unique_id;
1848 int status;
1849
1850 unique_id = diag_release->UniqueId;
1851
1852 /*
1853 * Get the current buffer and look up the unique ID. The unique ID
1854 * should be there.
1855 */
1856 i = mpr_get_fw_diag_buffer_number(sc, unique_id);
1857 if (i == MPR_FW_DIAGNOSTIC_UID_NOT_FOUND) {
1858 *return_code = MPR_FW_DIAG_ERROR_INVALID_UID;
1859 return (MPR_DIAG_FAILURE);
1860 }
1861
1862 pBuffer = &sc->fw_diag_buffer_list[i];
1863
1864 /*
1865 * If buffer is not owned by firmware, it's already been released.
1866 */
1867 if (!pBuffer->owned_by_firmware) {
1868 *return_code = MPR_FW_DIAG_ERROR_ALREADY_RELEASED;
1869 return (MPR_DIAG_FAILURE);
1870 }
1871
1872 /*
1873 * Release the buffer.
1874 */
1875 status = mpr_release_fw_diag_buffer(sc, pBuffer, return_code,
1876 MPR_FW_DIAG_TYPE_RELEASE);
1877 return (status);
1878 }
1879
1880 static int
mpr_do_diag_action(struct mpr_softc * sc,uint32_t action,uint8_t * diag_action,uint32_t length,uint32_t * return_code)1881 mpr_do_diag_action(struct mpr_softc *sc, uint32_t action, uint8_t *diag_action,
1882 uint32_t length, uint32_t *return_code)
1883 {
1884 mpr_fw_diag_register_t diag_register;
1885 mpr_fw_diag_unregister_t diag_unregister;
1886 mpr_fw_diag_query_t diag_query;
1887 mpr_diag_read_buffer_t diag_read_buffer;
1888 mpr_fw_diag_release_t diag_release;
1889 int status = MPR_DIAG_SUCCESS;
1890 uint32_t original_return_code;
1891
1892 original_return_code = *return_code;
1893 *return_code = MPR_FW_DIAG_ERROR_SUCCESS;
1894
1895 switch (action) {
1896 case MPR_FW_DIAG_TYPE_REGISTER:
1897 if (!length) {
1898 *return_code =
1899 MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1900 status = MPR_DIAG_FAILURE;
1901 break;
1902 }
1903 if (copyin(diag_action, &diag_register,
1904 sizeof(diag_register)) != 0)
1905 return (MPR_DIAG_FAILURE);
1906 status = mpr_diag_register(sc, &diag_register,
1907 return_code);
1908 break;
1909
1910 case MPR_FW_DIAG_TYPE_UNREGISTER:
1911 if (length < sizeof(diag_unregister)) {
1912 *return_code =
1913 MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1914 status = MPR_DIAG_FAILURE;
1915 break;
1916 }
1917 if (copyin(diag_action, &diag_unregister,
1918 sizeof(diag_unregister)) != 0)
1919 return (MPR_DIAG_FAILURE);
1920 status = mpr_diag_unregister(sc, &diag_unregister,
1921 return_code);
1922 break;
1923
1924 case MPR_FW_DIAG_TYPE_QUERY:
1925 if (length < sizeof (diag_query)) {
1926 *return_code =
1927 MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1928 status = MPR_DIAG_FAILURE;
1929 break;
1930 }
1931 if (copyin(diag_action, &diag_query, sizeof(diag_query))
1932 != 0)
1933 return (MPR_DIAG_FAILURE);
1934 status = mpr_diag_query(sc, &diag_query, return_code);
1935 if (status == MPR_DIAG_SUCCESS)
1936 if (copyout(&diag_query, diag_action,
1937 sizeof (diag_query)) != 0)
1938 return (MPR_DIAG_FAILURE);
1939 break;
1940
1941 case MPR_FW_DIAG_TYPE_READ_BUFFER:
1942 if (copyin(diag_action, &diag_read_buffer,
1943 sizeof(diag_read_buffer)) != 0)
1944 return (MPR_DIAG_FAILURE);
1945 if (length < diag_read_buffer.BytesToRead) {
1946 *return_code =
1947 MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1948 status = MPR_DIAG_FAILURE;
1949 break;
1950 }
1951 status = mpr_diag_read_buffer(sc, &diag_read_buffer,
1952 PTRIN(diag_read_buffer.PtrDataBuffer),
1953 return_code);
1954 if (status == MPR_DIAG_SUCCESS) {
1955 if (copyout(&diag_read_buffer, diag_action,
1956 sizeof(diag_read_buffer) -
1957 sizeof(diag_read_buffer.PtrDataBuffer)) !=
1958 0)
1959 return (MPR_DIAG_FAILURE);
1960 }
1961 break;
1962
1963 case MPR_FW_DIAG_TYPE_RELEASE:
1964 if (length < sizeof(diag_release)) {
1965 *return_code =
1966 MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1967 status = MPR_DIAG_FAILURE;
1968 break;
1969 }
1970 if (copyin(diag_action, &diag_release,
1971 sizeof(diag_release)) != 0)
1972 return (MPR_DIAG_FAILURE);
1973 status = mpr_diag_release(sc, &diag_release,
1974 return_code);
1975 break;
1976
1977 default:
1978 *return_code = MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1979 status = MPR_DIAG_FAILURE;
1980 break;
1981 }
1982
1983 if ((status == MPR_DIAG_FAILURE) &&
1984 (original_return_code == MPR_FW_DIAG_NEW) &&
1985 (*return_code != MPR_FW_DIAG_ERROR_SUCCESS))
1986 status = MPR_DIAG_SUCCESS;
1987
1988 return (status);
1989 }
1990
1991 static int
mpr_user_diag_action(struct mpr_softc * sc,mpr_diag_action_t * data)1992 mpr_user_diag_action(struct mpr_softc *sc, mpr_diag_action_t *data)
1993 {
1994 int status;
1995
1996 /*
1997 * Only allow one diag action at one time.
1998 */
1999 if (sc->mpr_flags & MPR_FLAGS_BUSY) {
2000 mpr_dprint(sc, MPR_USER, "%s: Only one FW diag command "
2001 "allowed at a single time.", __func__);
2002 return (EBUSY);
2003 }
2004 sc->mpr_flags |= MPR_FLAGS_BUSY;
2005
2006 /*
2007 * Send diag action request
2008 */
2009 if (data->Action == MPR_FW_DIAG_TYPE_REGISTER ||
2010 data->Action == MPR_FW_DIAG_TYPE_UNREGISTER ||
2011 data->Action == MPR_FW_DIAG_TYPE_QUERY ||
2012 data->Action == MPR_FW_DIAG_TYPE_READ_BUFFER ||
2013 data->Action == MPR_FW_DIAG_TYPE_RELEASE) {
2014 status = mpr_do_diag_action(sc, data->Action,
2015 PTRIN(data->PtrDiagAction), data->Length,
2016 &data->ReturnCode);
2017 } else
2018 status = EINVAL;
2019
2020 sc->mpr_flags &= ~MPR_FLAGS_BUSY;
2021 return (status);
2022 }
2023
2024 /*
2025 * Copy the event recording mask and the event queue size out. For
2026 * clarification, the event recording mask (events_to_record) is not the same
2027 * thing as the event mask (event_mask). events_to_record has a bit set for
2028 * every event type that is to be recorded by the driver, and event_mask has a
2029 * bit cleared for every event that is allowed into the driver from the IOC.
2030 * They really have nothing to do with each other.
2031 */
2032 static void
mpr_user_event_query(struct mpr_softc * sc,mpr_event_query_t * data)2033 mpr_user_event_query(struct mpr_softc *sc, mpr_event_query_t *data)
2034 {
2035 uint8_t i;
2036
2037 mpr_lock(sc);
2038 data->Entries = MPR_EVENT_QUEUE_SIZE;
2039
2040 for (i = 0; i < 4; i++) {
2041 data->Types[i] = sc->events_to_record[i];
2042 }
2043 mpr_unlock(sc);
2044 }
2045
2046 /*
2047 * Set the driver's event mask according to what's been given. See
2048 * mpr_user_event_query for explanation of the event recording mask and the IOC
2049 * event mask. It's the app's responsibility to enable event logging by setting
2050 * the bits in events_to_record. Initially, no events will be logged.
2051 */
2052 static void
mpr_user_event_enable(struct mpr_softc * sc,mpr_event_enable_t * data)2053 mpr_user_event_enable(struct mpr_softc *sc, mpr_event_enable_t *data)
2054 {
2055 uint8_t i;
2056
2057 mpr_lock(sc);
2058 for (i = 0; i < 4; i++) {
2059 sc->events_to_record[i] = data->Types[i];
2060 }
2061 mpr_unlock(sc);
2062 }
2063
2064 /*
2065 * Copy out the events that have been recorded, up to the max events allowed.
2066 */
2067 static int
mpr_user_event_report(struct mpr_softc * sc,mpr_event_report_t * data)2068 mpr_user_event_report(struct mpr_softc *sc, mpr_event_report_t *data)
2069 {
2070 int status = 0;
2071 uint32_t size;
2072
2073 mpr_lock(sc);
2074 size = data->Size;
2075 if ((size >= sizeof(sc->recorded_events)) && (status == 0)) {
2076 mpr_unlock(sc);
2077 if (copyout((void *)sc->recorded_events,
2078 PTRIN(data->PtrEvents), sizeof(sc->recorded_events)) != 0)
2079 status = EFAULT;
2080 mpr_lock(sc);
2081 } else {
2082 /*
2083 * data->Size value is not large enough to copy event data.
2084 */
2085 status = EFAULT;
2086 }
2087
2088 /*
2089 * Change size value to match the number of bytes that were copied.
2090 */
2091 if (status == 0)
2092 data->Size = sizeof(sc->recorded_events);
2093 mpr_unlock(sc);
2094
2095 return (status);
2096 }
2097
2098 /*
2099 * Record events into the driver from the IOC if they are not masked.
2100 */
2101 void
mprsas_record_event(struct mpr_softc * sc,MPI2_EVENT_NOTIFICATION_REPLY * event_reply)2102 mprsas_record_event(struct mpr_softc *sc,
2103 MPI2_EVENT_NOTIFICATION_REPLY *event_reply)
2104 {
2105 uint32_t event;
2106 int i, j;
2107 uint16_t event_data_len;
2108 boolean_t sendAEN = FALSE;
2109
2110 event = event_reply->Event;
2111
2112 /*
2113 * Generate a system event to let anyone who cares know that a
2114 * LOG_ENTRY_ADDED event has occurred. This is sent no matter what the
2115 * event mask is set to.
2116 */
2117 if (event == MPI2_EVENT_LOG_ENTRY_ADDED) {
2118 sendAEN = TRUE;
2119 }
2120
2121 /*
2122 * Record the event only if its corresponding bit is set in
2123 * events_to_record. event_index is the index into recorded_events and
2124 * event_number is the overall number of an event being recorded since
2125 * start-of-day. event_index will roll over; event_number will never
2126 * roll over.
2127 */
2128 i = (uint8_t)(event / 32);
2129 j = (uint8_t)(event % 32);
2130 if ((i < 4) && ((1 << j) & sc->events_to_record[i])) {
2131 i = sc->event_index;
2132 sc->recorded_events[i].Type = event;
2133 sc->recorded_events[i].Number = ++sc->event_number;
2134 bzero(sc->recorded_events[i].Data, MPR_MAX_EVENT_DATA_LENGTH *
2135 4);
2136 event_data_len = event_reply->EventDataLength;
2137
2138 if (event_data_len > 0) {
2139 /*
2140 * Limit data to size in m_event entry
2141 */
2142 if (event_data_len > MPR_MAX_EVENT_DATA_LENGTH) {
2143 event_data_len = MPR_MAX_EVENT_DATA_LENGTH;
2144 }
2145 for (j = 0; j < event_data_len; j++) {
2146 sc->recorded_events[i].Data[j] =
2147 event_reply->EventData[j];
2148 }
2149
2150 /*
2151 * check for index wrap-around
2152 */
2153 if (++i == MPR_EVENT_QUEUE_SIZE) {
2154 i = 0;
2155 }
2156 sc->event_index = (uint8_t)i;
2157
2158 /*
2159 * Set flag to send the event.
2160 */
2161 sendAEN = TRUE;
2162 }
2163 }
2164
2165 /*
2166 * Generate a system event if flag is set to let anyone who cares know
2167 * that an event has occurred.
2168 */
2169 if (sendAEN) {
2170 //SLM-how to send a system event (see kqueue, kevent)
2171 // (void) ddi_log_sysevent(mpt->m_dip, DDI_VENDOR_LSI, "MPT_SAS",
2172 // "SAS", NULL, NULL, DDI_NOSLEEP);
2173 }
2174 }
2175
2176 static int
mpr_user_reg_access(struct mpr_softc * sc,mpr_reg_access_t * data)2177 mpr_user_reg_access(struct mpr_softc *sc, mpr_reg_access_t *data)
2178 {
2179 int status = 0;
2180
2181 switch (data->Command) {
2182 /*
2183 * IO access is not supported.
2184 */
2185 case REG_IO_READ:
2186 case REG_IO_WRITE:
2187 mpr_dprint(sc, MPR_USER, "IO access is not supported. "
2188 "Use memory access.");
2189 status = EINVAL;
2190 break;
2191
2192 case REG_MEM_READ:
2193 data->RegData = mpr_regread(sc, data->RegOffset);
2194 break;
2195
2196 case REG_MEM_WRITE:
2197 mpr_regwrite(sc, data->RegOffset, data->RegData);
2198 break;
2199
2200 default:
2201 status = EINVAL;
2202 break;
2203 }
2204
2205 return (status);
2206 }
2207
2208 static int
mpr_user_btdh(struct mpr_softc * sc,mpr_btdh_mapping_t * data)2209 mpr_user_btdh(struct mpr_softc *sc, mpr_btdh_mapping_t *data)
2210 {
2211 uint8_t bt2dh = FALSE;
2212 uint8_t dh2bt = FALSE;
2213 uint16_t dev_handle, bus, target;
2214
2215 bus = data->Bus;
2216 target = data->TargetID;
2217 dev_handle = data->DevHandle;
2218
2219 /*
2220 * When DevHandle is 0xFFFF and Bus/Target are not 0xFFFF, use Bus/
2221 * Target to get DevHandle. When Bus/Target are 0xFFFF and DevHandle is
2222 * not 0xFFFF, use DevHandle to get Bus/Target. Anything else is
2223 * invalid.
2224 */
2225 if ((bus == 0xFFFF) && (target == 0xFFFF) && (dev_handle != 0xFFFF))
2226 dh2bt = TRUE;
2227 if ((dev_handle == 0xFFFF) && (bus != 0xFFFF) && (target != 0xFFFF))
2228 bt2dh = TRUE;
2229 if (!dh2bt && !bt2dh)
2230 return (EINVAL);
2231
2232 /*
2233 * Only handle bus of 0. Make sure target is within range.
2234 */
2235 if (bt2dh) {
2236 if (bus != 0)
2237 return (EINVAL);
2238
2239 if (target >= sc->max_devices) {
2240 mpr_dprint(sc, MPR_XINFO, "Target ID is out of range "
2241 "for Bus/Target to DevHandle mapping.");
2242 return (EINVAL);
2243 }
2244 dev_handle = sc->mapping_table[target].dev_handle;
2245 if (dev_handle)
2246 data->DevHandle = dev_handle;
2247 } else {
2248 bus = 0;
2249 target = mpr_mapping_get_tid_from_handle(sc, dev_handle);
2250 data->Bus = bus;
2251 data->TargetID = target;
2252 }
2253
2254 return (0);
2255 }
2256
2257 static int
mpr_ioctl(struct cdev * dev,u_long cmd,void * arg,int flag,struct thread * td)2258 mpr_ioctl(struct cdev *dev, u_long cmd, void *arg, int flag,
2259 struct thread *td)
2260 {
2261 struct mpr_softc *sc;
2262 struct mpr_cfg_page_req *page_req;
2263 struct mpr_ext_cfg_page_req *ext_page_req;
2264 void *mpr_page;
2265 int error, msleep_ret;
2266
2267 mpr_page = NULL;
2268 sc = dev->si_drv1;
2269 page_req = (void *)arg;
2270 ext_page_req = (void *)arg;
2271
2272 switch (cmd) {
2273 case MPRIO_READ_CFG_HEADER:
2274 mpr_lock(sc);
2275 error = mpr_user_read_cfg_header(sc, page_req);
2276 mpr_unlock(sc);
2277 break;
2278 case MPRIO_READ_CFG_PAGE:
2279 if (page_req->len < (int)sizeof(MPI2_CONFIG_PAGE_HEADER)) {
2280 error = EINVAL;
2281 break;
2282 }
2283 mpr_page = malloc(page_req->len, M_MPRUSER, M_WAITOK | M_ZERO);
2284 error = copyin(page_req->buf, mpr_page,
2285 sizeof(MPI2_CONFIG_PAGE_HEADER));
2286 if (error)
2287 break;
2288 mpr_lock(sc);
2289 error = mpr_user_read_cfg_page(sc, page_req, mpr_page);
2290 mpr_unlock(sc);
2291 if (error)
2292 break;
2293 error = copyout(mpr_page, page_req->buf, page_req->len);
2294 break;
2295 case MPRIO_READ_EXT_CFG_HEADER:
2296 mpr_lock(sc);
2297 error = mpr_user_read_extcfg_header(sc, ext_page_req);
2298 mpr_unlock(sc);
2299 break;
2300 case MPRIO_READ_EXT_CFG_PAGE:
2301 if (ext_page_req->len <
2302 (int)sizeof(MPI2_CONFIG_EXTENDED_PAGE_HEADER)) {
2303 error = EINVAL;
2304 break;
2305 }
2306 mpr_page = malloc(ext_page_req->len, M_MPRUSER,
2307 M_WAITOK | M_ZERO);
2308 error = copyin(ext_page_req->buf, mpr_page,
2309 sizeof(MPI2_CONFIG_EXTENDED_PAGE_HEADER));
2310 if (error)
2311 break;
2312 mpr_lock(sc);
2313 error = mpr_user_read_extcfg_page(sc, ext_page_req, mpr_page);
2314 mpr_unlock(sc);
2315 if (error)
2316 break;
2317 error = copyout(mpr_page, ext_page_req->buf, ext_page_req->len);
2318 break;
2319 case MPRIO_WRITE_CFG_PAGE:
2320 if (page_req->len < (int)sizeof(MPI2_CONFIG_PAGE_HEADER)) {
2321 error = EINVAL;
2322 break;
2323 }
2324 mpr_page = malloc(page_req->len, M_MPRUSER, M_WAITOK|M_ZERO);
2325 error = copyin(page_req->buf, mpr_page, page_req->len);
2326 if (error)
2327 break;
2328 mpr_lock(sc);
2329 error = mpr_user_write_cfg_page(sc, page_req, mpr_page);
2330 mpr_unlock(sc);
2331 break;
2332 case MPRIO_MPR_COMMAND:
2333 error = mpr_user_command(sc, (struct mpr_usr_command *)arg);
2334 break;
2335 case MPTIOCTL_PASS_THRU:
2336 /*
2337 * The user has requested to pass through a command to be
2338 * executed by the MPT firmware. Call our routine which does
2339 * this. Only allow one passthru IOCTL at one time.
2340 */
2341 error = mpr_user_pass_thru(sc, (mpr_pass_thru_t *)arg);
2342 break;
2343 case MPTIOCTL_GET_ADAPTER_DATA:
2344 /*
2345 * The user has requested to read adapter data. Call our
2346 * routine which does this.
2347 */
2348 error = 0;
2349 mpr_user_get_adapter_data(sc, (mpr_adapter_data_t *)arg);
2350 break;
2351 case MPTIOCTL_GET_PCI_INFO:
2352 /*
2353 * The user has requested to read pci info. Call
2354 * our routine which does this.
2355 */
2356 mpr_lock(sc);
2357 error = 0;
2358 mpr_user_read_pci_info(sc, (mpr_pci_info_t *)arg);
2359 mpr_unlock(sc);
2360 break;
2361 case MPTIOCTL_RESET_ADAPTER:
2362 mpr_lock(sc);
2363 sc->port_enable_complete = 0;
2364 uint32_t reinit_start = time_uptime;
2365 error = mpr_reinit(sc);
2366 /* Sleep for 300 second. */
2367 msleep_ret = msleep(&sc->port_enable_complete, &sc->mpr_mtx,
2368 PRIBIO, "mpr_porten", 300 * hz);
2369 mpr_unlock(sc);
2370 if (msleep_ret)
2371 printf("Port Enable did not complete after Diag "
2372 "Reset msleep error %d.\n", msleep_ret);
2373 else
2374 mpr_dprint(sc, MPR_USER, "Hard Reset with Port Enable "
2375 "completed in %d seconds.\n",
2376 (uint32_t)(time_uptime - reinit_start));
2377 break;
2378 case MPTIOCTL_DIAG_ACTION:
2379 /*
2380 * The user has done a diag buffer action. Call our routine
2381 * which does this. Only allow one diag action at one time.
2382 */
2383 mpr_lock(sc);
2384 error = mpr_user_diag_action(sc, (mpr_diag_action_t *)arg);
2385 mpr_unlock(sc);
2386 break;
2387 case MPTIOCTL_EVENT_QUERY:
2388 /*
2389 * The user has done an event query. Call our routine which does
2390 * this.
2391 */
2392 error = 0;
2393 mpr_user_event_query(sc, (mpr_event_query_t *)arg);
2394 break;
2395 case MPTIOCTL_EVENT_ENABLE:
2396 /*
2397 * The user has done an event enable. Call our routine which
2398 * does this.
2399 */
2400 error = 0;
2401 mpr_user_event_enable(sc, (mpr_event_enable_t *)arg);
2402 break;
2403 case MPTIOCTL_EVENT_REPORT:
2404 /*
2405 * The user has done an event report. Call our routine which
2406 * does this.
2407 */
2408 error = mpr_user_event_report(sc, (mpr_event_report_t *)arg);
2409 break;
2410 case MPTIOCTL_REG_ACCESS:
2411 /*
2412 * The user has requested register access. Call our routine
2413 * which does this.
2414 */
2415 mpr_lock(sc);
2416 error = mpr_user_reg_access(sc, (mpr_reg_access_t *)arg);
2417 mpr_unlock(sc);
2418 break;
2419 case MPTIOCTL_BTDH_MAPPING:
2420 /*
2421 * The user has requested to translate a bus/target to a
2422 * DevHandle or a DevHandle to a bus/target. Call our routine
2423 * which does this.
2424 */
2425 error = mpr_user_btdh(sc, (mpr_btdh_mapping_t *)arg);
2426 break;
2427 default:
2428 error = ENOIOCTL;
2429 break;
2430 }
2431
2432 if (mpr_page != NULL)
2433 free(mpr_page, M_MPRUSER);
2434
2435 return (error);
2436 }
2437
2438 #ifdef COMPAT_FREEBSD32
2439
2440 struct mpr_cfg_page_req32 {
2441 MPI2_CONFIG_PAGE_HEADER header;
2442 uint32_t page_address;
2443 uint32_t buf;
2444 int len;
2445 uint16_t ioc_status;
2446 };
2447
2448 struct mpr_ext_cfg_page_req32 {
2449 MPI2_CONFIG_EXTENDED_PAGE_HEADER header;
2450 uint32_t page_address;
2451 uint32_t buf;
2452 int len;
2453 uint16_t ioc_status;
2454 };
2455
2456 struct mpr_raid_action32 {
2457 uint8_t action;
2458 uint8_t volume_bus;
2459 uint8_t volume_id;
2460 uint8_t phys_disk_num;
2461 uint32_t action_data_word;
2462 uint32_t buf;
2463 int len;
2464 uint32_t volume_status;
2465 uint32_t action_data[4];
2466 uint16_t action_status;
2467 uint16_t ioc_status;
2468 uint8_t write;
2469 };
2470
2471 struct mpr_usr_command32 {
2472 uint32_t req;
2473 uint32_t req_len;
2474 uint32_t rpl;
2475 uint32_t rpl_len;
2476 uint32_t buf;
2477 int len;
2478 uint32_t flags;
2479 };
2480
2481 #define MPRIO_READ_CFG_HEADER32 _IOWR('M', 200, struct mpr_cfg_page_req32)
2482 #define MPRIO_READ_CFG_PAGE32 _IOWR('M', 201, struct mpr_cfg_page_req32)
2483 #define MPRIO_READ_EXT_CFG_HEADER32 _IOWR('M', 202, struct mpr_ext_cfg_page_req32)
2484 #define MPRIO_READ_EXT_CFG_PAGE32 _IOWR('M', 203, struct mpr_ext_cfg_page_req32)
2485 #define MPRIO_WRITE_CFG_PAGE32 _IOWR('M', 204, struct mpr_cfg_page_req32)
2486 #define MPRIO_RAID_ACTION32 _IOWR('M', 205, struct mpr_raid_action32)
2487 #define MPRIO_MPR_COMMAND32 _IOWR('M', 210, struct mpr_usr_command32)
2488
2489 static int
mpr_ioctl32(struct cdev * dev,u_long cmd32,void * _arg,int flag,struct thread * td)2490 mpr_ioctl32(struct cdev *dev, u_long cmd32, void *_arg, int flag,
2491 struct thread *td)
2492 {
2493 struct mpr_cfg_page_req32 *page32 = _arg;
2494 struct mpr_ext_cfg_page_req32 *ext32 = _arg;
2495 struct mpr_raid_action32 *raid32 = _arg;
2496 struct mpr_usr_command32 *user32 = _arg;
2497 union {
2498 struct mpr_cfg_page_req page;
2499 struct mpr_ext_cfg_page_req ext;
2500 struct mpr_raid_action raid;
2501 struct mpr_usr_command user;
2502 } arg;
2503 u_long cmd;
2504 int error;
2505
2506 switch (cmd32) {
2507 case MPRIO_READ_CFG_HEADER32:
2508 case MPRIO_READ_CFG_PAGE32:
2509 case MPRIO_WRITE_CFG_PAGE32:
2510 if (cmd32 == MPRIO_READ_CFG_HEADER32)
2511 cmd = MPRIO_READ_CFG_HEADER;
2512 else if (cmd32 == MPRIO_READ_CFG_PAGE32)
2513 cmd = MPRIO_READ_CFG_PAGE;
2514 else
2515 cmd = MPRIO_WRITE_CFG_PAGE;
2516 CP(*page32, arg.page, header);
2517 CP(*page32, arg.page, page_address);
2518 PTRIN_CP(*page32, arg.page, buf);
2519 CP(*page32, arg.page, len);
2520 CP(*page32, arg.page, ioc_status);
2521 break;
2522
2523 case MPRIO_READ_EXT_CFG_HEADER32:
2524 case MPRIO_READ_EXT_CFG_PAGE32:
2525 if (cmd32 == MPRIO_READ_EXT_CFG_HEADER32)
2526 cmd = MPRIO_READ_EXT_CFG_HEADER;
2527 else
2528 cmd = MPRIO_READ_EXT_CFG_PAGE;
2529 CP(*ext32, arg.ext, header);
2530 CP(*ext32, arg.ext, page_address);
2531 PTRIN_CP(*ext32, arg.ext, buf);
2532 CP(*ext32, arg.ext, len);
2533 CP(*ext32, arg.ext, ioc_status);
2534 break;
2535
2536 case MPRIO_RAID_ACTION32:
2537 cmd = MPRIO_RAID_ACTION;
2538 CP(*raid32, arg.raid, action);
2539 CP(*raid32, arg.raid, volume_bus);
2540 CP(*raid32, arg.raid, volume_id);
2541 CP(*raid32, arg.raid, phys_disk_num);
2542 CP(*raid32, arg.raid, action_data_word);
2543 PTRIN_CP(*raid32, arg.raid, buf);
2544 CP(*raid32, arg.raid, len);
2545 CP(*raid32, arg.raid, volume_status);
2546 bcopy(raid32->action_data, arg.raid.action_data,
2547 sizeof arg.raid.action_data);
2548 CP(*raid32, arg.raid, ioc_status);
2549 CP(*raid32, arg.raid, write);
2550 break;
2551
2552 case MPRIO_MPR_COMMAND32:
2553 cmd = MPRIO_MPR_COMMAND;
2554 PTRIN_CP(*user32, arg.user, req);
2555 CP(*user32, arg.user, req_len);
2556 PTRIN_CP(*user32, arg.user, rpl);
2557 CP(*user32, arg.user, rpl_len);
2558 PTRIN_CP(*user32, arg.user, buf);
2559 CP(*user32, arg.user, len);
2560 CP(*user32, arg.user, flags);
2561 break;
2562 default:
2563 return (ENOIOCTL);
2564 }
2565
2566 error = mpr_ioctl(dev, cmd, &arg, flag, td);
2567 if (error == 0 && (cmd32 & IOC_OUT) != 0) {
2568 switch (cmd32) {
2569 case MPRIO_READ_CFG_HEADER32:
2570 case MPRIO_READ_CFG_PAGE32:
2571 case MPRIO_WRITE_CFG_PAGE32:
2572 CP(arg.page, *page32, header);
2573 CP(arg.page, *page32, page_address);
2574 PTROUT_CP(arg.page, *page32, buf);
2575 CP(arg.page, *page32, len);
2576 CP(arg.page, *page32, ioc_status);
2577 break;
2578
2579 case MPRIO_READ_EXT_CFG_HEADER32:
2580 case MPRIO_READ_EXT_CFG_PAGE32:
2581 CP(arg.ext, *ext32, header);
2582 CP(arg.ext, *ext32, page_address);
2583 PTROUT_CP(arg.ext, *ext32, buf);
2584 CP(arg.ext, *ext32, len);
2585 CP(arg.ext, *ext32, ioc_status);
2586 break;
2587
2588 case MPRIO_RAID_ACTION32:
2589 CP(arg.raid, *raid32, action);
2590 CP(arg.raid, *raid32, volume_bus);
2591 CP(arg.raid, *raid32, volume_id);
2592 CP(arg.raid, *raid32, phys_disk_num);
2593 CP(arg.raid, *raid32, action_data_word);
2594 PTROUT_CP(arg.raid, *raid32, buf);
2595 CP(arg.raid, *raid32, len);
2596 CP(arg.raid, *raid32, volume_status);
2597 bcopy(arg.raid.action_data, raid32->action_data,
2598 sizeof arg.raid.action_data);
2599 CP(arg.raid, *raid32, ioc_status);
2600 CP(arg.raid, *raid32, write);
2601 break;
2602
2603 case MPRIO_MPR_COMMAND32:
2604 PTROUT_CP(arg.user, *user32, req);
2605 CP(arg.user, *user32, req_len);
2606 PTROUT_CP(arg.user, *user32, rpl);
2607 CP(arg.user, *user32, rpl_len);
2608 PTROUT_CP(arg.user, *user32, buf);
2609 CP(arg.user, *user32, len);
2610 CP(arg.user, *user32, flags);
2611 break;
2612 }
2613 }
2614
2615 return (error);
2616 }
2617 #endif /* COMPAT_FREEBSD32 */
2618
2619 static int
mpr_ioctl_devsw(struct cdev * dev,u_long com,caddr_t arg,int flag,struct thread * td)2620 mpr_ioctl_devsw(struct cdev *dev, u_long com, caddr_t arg, int flag,
2621 struct thread *td)
2622 {
2623 #ifdef COMPAT_FREEBSD32
2624 if (SV_CURPROC_FLAG(SV_ILP32))
2625 return (mpr_ioctl32(dev, com, arg, flag, td));
2626 #endif
2627 return (mpr_ioctl(dev, com, arg, flag, td));
2628 }
2629