mpr_user.c revision 302408
1/*-
2 * Copyright (c) 2008 Yahoo!, Inc.
3 * All rights reserved.
4 * Written by: John Baldwin <jhb@FreeBSD.org>
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of the author nor the names of any co-contributors
15 *    may be used to endorse or promote products derived from this software
16 *    without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 *
30 * Avago Technologies (LSI) MPT-Fusion Host Adapter FreeBSD userland interface
31 */
32/*-
33 * Copyright (c) 2011-2015 LSI Corp.
34 * Copyright (c) 2013-2016 Avago Technologies
35 * All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 *    notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 *    notice, this list of conditions and the following disclaimer in the
44 *    documentation and/or other materials provided with the distribution.
45 *
46 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
47 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
48 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
49 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
50 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
51 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
52 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
53 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
54 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
55 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
56 * SUCH DAMAGE.
57 *
58 * Avago Technologies (LSI) MPT-Fusion Host Adapter FreeBSD
59 *
60 * $FreeBSD: stable/11/sys/dev/mpr/mpr_user.c 299369 2016-05-10 15:04:24Z trasz $
61 */
62
63#include <sys/cdefs.h>
64__FBSDID("$FreeBSD: stable/11/sys/dev/mpr/mpr_user.c 299369 2016-05-10 15:04:24Z trasz $");
65
66#include "opt_compat.h"
67
68/* TODO Move headers to mprvar */
69#include <sys/types.h>
70#include <sys/param.h>
71#include <sys/systm.h>
72#include <sys/kernel.h>
73#include <sys/selinfo.h>
74#include <sys/module.h>
75#include <sys/bus.h>
76#include <sys/conf.h>
77#include <sys/bio.h>
78#include <sys/malloc.h>
79#include <sys/uio.h>
80#include <sys/sysctl.h>
81#include <sys/ioccom.h>
82#include <sys/endian.h>
83#include <sys/queue.h>
84#include <sys/kthread.h>
85#include <sys/taskqueue.h>
86#include <sys/proc.h>
87#include <sys/sysent.h>
88
89#include <machine/bus.h>
90#include <machine/resource.h>
91#include <sys/rman.h>
92
93#include <cam/cam.h>
94#include <cam/cam_ccb.h>
95
96#include <dev/mpr/mpi/mpi2_type.h>
97#include <dev/mpr/mpi/mpi2.h>
98#include <dev/mpr/mpi/mpi2_ioc.h>
99#include <dev/mpr/mpi/mpi2_cnfg.h>
100#include <dev/mpr/mpi/mpi2_init.h>
101#include <dev/mpr/mpi/mpi2_tool.h>
102#include <dev/mpr/mpr_ioctl.h>
103#include <dev/mpr/mprvar.h>
104#include <dev/mpr/mpr_table.h>
105#include <dev/mpr/mpr_sas.h>
106#include <dev/pci/pcivar.h>
107#include <dev/pci/pcireg.h>
108
109static d_open_t		mpr_open;
110static d_close_t	mpr_close;
111static d_ioctl_t	mpr_ioctl_devsw;
112
113static struct cdevsw mpr_cdevsw = {
114	.d_version =	D_VERSION,
115	.d_flags =	0,
116	.d_open =	mpr_open,
117	.d_close =	mpr_close,
118	.d_ioctl =	mpr_ioctl_devsw,
119	.d_name =	"mpr",
120};
121
122typedef int (mpr_user_f)(struct mpr_command *, struct mpr_usr_command *);
123static mpr_user_f	mpi_pre_ioc_facts;
124static mpr_user_f	mpi_pre_port_facts;
125static mpr_user_f	mpi_pre_fw_download;
126static mpr_user_f	mpi_pre_fw_upload;
127static mpr_user_f	mpi_pre_sata_passthrough;
128static mpr_user_f	mpi_pre_smp_passthrough;
129static mpr_user_f	mpi_pre_config;
130static mpr_user_f	mpi_pre_sas_io_unit_control;
131
132static int mpr_user_read_cfg_header(struct mpr_softc *,
133    struct mpr_cfg_page_req *);
134static int mpr_user_read_cfg_page(struct mpr_softc *,
135    struct mpr_cfg_page_req *, void *);
136static int mpr_user_read_extcfg_header(struct mpr_softc *,
137    struct mpr_ext_cfg_page_req *);
138static int mpr_user_read_extcfg_page(struct mpr_softc *,
139    struct mpr_ext_cfg_page_req *, void *);
140static int mpr_user_write_cfg_page(struct mpr_softc *,
141    struct mpr_cfg_page_req *, void *);
142static int mpr_user_setup_request(struct mpr_command *,
143    struct mpr_usr_command *);
144static int mpr_user_command(struct mpr_softc *, struct mpr_usr_command *);
145
146static int mpr_user_pass_thru(struct mpr_softc *sc, mpr_pass_thru_t *data);
147static void mpr_user_get_adapter_data(struct mpr_softc *sc,
148    mpr_adapter_data_t *data);
149static void mpr_user_read_pci_info(struct mpr_softc *sc, mpr_pci_info_t *data);
150static uint8_t mpr_get_fw_diag_buffer_number(struct mpr_softc *sc,
151    uint32_t unique_id);
152static int mpr_post_fw_diag_buffer(struct mpr_softc *sc,
153    mpr_fw_diagnostic_buffer_t *pBuffer, uint32_t *return_code);
154static int mpr_release_fw_diag_buffer(struct mpr_softc *sc,
155    mpr_fw_diagnostic_buffer_t *pBuffer, uint32_t *return_code,
156    uint32_t diag_type);
157static int mpr_diag_register(struct mpr_softc *sc,
158    mpr_fw_diag_register_t *diag_register, uint32_t *return_code);
159static int mpr_diag_unregister(struct mpr_softc *sc,
160    mpr_fw_diag_unregister_t *diag_unregister, uint32_t *return_code);
161static int mpr_diag_query(struct mpr_softc *sc, mpr_fw_diag_query_t *diag_query,
162    uint32_t *return_code);
163static int mpr_diag_read_buffer(struct mpr_softc *sc,
164    mpr_diag_read_buffer_t *diag_read_buffer, uint8_t *ioctl_buf,
165    uint32_t *return_code);
166static int mpr_diag_release(struct mpr_softc *sc,
167    mpr_fw_diag_release_t *diag_release, uint32_t *return_code);
168static int mpr_do_diag_action(struct mpr_softc *sc, uint32_t action,
169    uint8_t *diag_action, uint32_t length, uint32_t *return_code);
170static int mpr_user_diag_action(struct mpr_softc *sc, mpr_diag_action_t *data);
171static void mpr_user_event_query(struct mpr_softc *sc, mpr_event_query_t *data);
172static void mpr_user_event_enable(struct mpr_softc *sc,
173    mpr_event_enable_t *data);
174static int mpr_user_event_report(struct mpr_softc *sc,
175    mpr_event_report_t *data);
176static int mpr_user_reg_access(struct mpr_softc *sc, mpr_reg_access_t *data);
177static int mpr_user_btdh(struct mpr_softc *sc, mpr_btdh_mapping_t *data);
178
179static MALLOC_DEFINE(M_MPRUSER, "mpr_user", "Buffers for mpr(4) ioctls");
180
181/* Macros from compat/freebsd32/freebsd32.h */
182#define	PTRIN(v)	(void *)(uintptr_t)(v)
183#define	PTROUT(v)	(uint32_t)(uintptr_t)(v)
184
185#define	CP(src,dst,fld) do { (dst).fld = (src).fld; } while (0)
186#define	PTRIN_CP(src,dst,fld)				\
187	do { (dst).fld = PTRIN((src).fld); } while (0)
188#define	PTROUT_CP(src,dst,fld) \
189	do { (dst).fld = PTROUT((src).fld); } while (0)
190
191/*
192 * MPI functions that support IEEE SGLs for SAS3.
193 */
194static uint8_t ieee_sgl_func_list[] = {
195	MPI2_FUNCTION_SCSI_IO_REQUEST,
196	MPI2_FUNCTION_RAID_SCSI_IO_PASSTHROUGH,
197	MPI2_FUNCTION_SMP_PASSTHROUGH,
198	MPI2_FUNCTION_SATA_PASSTHROUGH,
199	MPI2_FUNCTION_FW_UPLOAD,
200	MPI2_FUNCTION_FW_DOWNLOAD,
201	MPI2_FUNCTION_TARGET_ASSIST,
202	MPI2_FUNCTION_TARGET_STATUS_SEND,
203	MPI2_FUNCTION_TOOLBOX
204};
205
206int
207mpr_attach_user(struct mpr_softc *sc)
208{
209	int unit;
210
211	unit = device_get_unit(sc->mpr_dev);
212	sc->mpr_cdev = make_dev(&mpr_cdevsw, unit, UID_ROOT, GID_OPERATOR, 0640,
213	    "mpr%d", unit);
214
215	if (sc->mpr_cdev == NULL)
216		return (ENOMEM);
217
218	sc->mpr_cdev->si_drv1 = sc;
219	return (0);
220}
221
222void
223mpr_detach_user(struct mpr_softc *sc)
224{
225
226	/* XXX: do a purge of pending requests? */
227	if (sc->mpr_cdev != NULL)
228		destroy_dev(sc->mpr_cdev);
229}
230
231static int
232mpr_open(struct cdev *dev, int flags, int fmt, struct thread *td)
233{
234
235	return (0);
236}
237
238static int
239mpr_close(struct cdev *dev, int flags, int fmt, struct thread *td)
240{
241
242	return (0);
243}
244
245static int
246mpr_user_read_cfg_header(struct mpr_softc *sc,
247    struct mpr_cfg_page_req *page_req)
248{
249	MPI2_CONFIG_PAGE_HEADER *hdr;
250	struct mpr_config_params params;
251	int	    error;
252
253	hdr = &params.hdr.Struct;
254	params.action = MPI2_CONFIG_ACTION_PAGE_HEADER;
255	params.page_address = le32toh(page_req->page_address);
256	hdr->PageVersion = 0;
257	hdr->PageLength = 0;
258	hdr->PageNumber = page_req->header.PageNumber;
259	hdr->PageType = page_req->header.PageType;
260	params.buffer = NULL;
261	params.length = 0;
262	params.callback = NULL;
263
264	if ((error = mpr_read_config_page(sc, &params)) != 0) {
265		/*
266		 * Leave the request. Without resetting the chip, it's
267		 * still owned by it and we'll just get into trouble
268		 * freeing it now. Mark it as abandoned so that if it
269		 * shows up later it can be freed.
270		 */
271		mpr_printf(sc, "read_cfg_header timed out\n");
272		return (ETIMEDOUT);
273	}
274
275	page_req->ioc_status = htole16(params.status);
276	if ((page_req->ioc_status & MPI2_IOCSTATUS_MASK) ==
277	    MPI2_IOCSTATUS_SUCCESS) {
278		bcopy(hdr, &page_req->header, sizeof(page_req->header));
279	}
280
281	return (0);
282}
283
284static int
285mpr_user_read_cfg_page(struct mpr_softc *sc, struct mpr_cfg_page_req *page_req,
286    void *buf)
287{
288	MPI2_CONFIG_PAGE_HEADER *reqhdr, *hdr;
289	struct mpr_config_params params;
290	int	      error;
291
292	reqhdr = buf;
293	hdr = &params.hdr.Struct;
294	hdr->PageVersion = reqhdr->PageVersion;
295	hdr->PageLength = reqhdr->PageLength;
296	hdr->PageNumber = reqhdr->PageNumber;
297	hdr->PageType = reqhdr->PageType & MPI2_CONFIG_PAGETYPE_MASK;
298	params.action = MPI2_CONFIG_ACTION_PAGE_READ_CURRENT;
299	params.page_address = le32toh(page_req->page_address);
300	params.buffer = buf;
301	params.length = le32toh(page_req->len);
302	params.callback = NULL;
303
304	if ((error = mpr_read_config_page(sc, &params)) != 0) {
305		mpr_printf(sc, "mpr_user_read_cfg_page timed out\n");
306		return (ETIMEDOUT);
307	}
308
309	page_req->ioc_status = htole16(params.status);
310	return (0);
311}
312
313static int
314mpr_user_read_extcfg_header(struct mpr_softc *sc,
315    struct mpr_ext_cfg_page_req *ext_page_req)
316{
317	MPI2_CONFIG_EXTENDED_PAGE_HEADER *hdr;
318	struct mpr_config_params params;
319	int	    error;
320
321	hdr = &params.hdr.Ext;
322	params.action = MPI2_CONFIG_ACTION_PAGE_HEADER;
323	hdr->PageVersion = ext_page_req->header.PageVersion;
324	hdr->PageType = MPI2_CONFIG_PAGETYPE_EXTENDED;
325	hdr->ExtPageLength = 0;
326	hdr->PageNumber = ext_page_req->header.PageNumber;
327	hdr->ExtPageType = ext_page_req->header.ExtPageType;
328	params.page_address = le32toh(ext_page_req->page_address);
329	params.buffer = NULL;
330	params.length = 0;
331	params.callback = NULL;
332
333	if ((error = mpr_read_config_page(sc, &params)) != 0) {
334		/*
335		 * Leave the request. Without resetting the chip, it's
336		 * still owned by it and we'll just get into trouble
337		 * freeing it now. Mark it as abandoned so that if it
338		 * shows up later it can be freed.
339		 */
340		mpr_printf(sc, "mpr_user_read_extcfg_header timed out\n");
341		return (ETIMEDOUT);
342	}
343
344	ext_page_req->ioc_status = htole16(params.status);
345	if ((ext_page_req->ioc_status & MPI2_IOCSTATUS_MASK) ==
346	    MPI2_IOCSTATUS_SUCCESS) {
347		ext_page_req->header.PageVersion = hdr->PageVersion;
348		ext_page_req->header.PageNumber = hdr->PageNumber;
349		ext_page_req->header.PageType = hdr->PageType;
350		ext_page_req->header.ExtPageLength = hdr->ExtPageLength;
351		ext_page_req->header.ExtPageType = hdr->ExtPageType;
352	}
353
354	return (0);
355}
356
357static int
358mpr_user_read_extcfg_page(struct mpr_softc *sc,
359    struct mpr_ext_cfg_page_req *ext_page_req, void *buf)
360{
361	MPI2_CONFIG_EXTENDED_PAGE_HEADER *reqhdr, *hdr;
362	struct mpr_config_params params;
363	int error;
364
365	reqhdr = buf;
366	hdr = &params.hdr.Ext;
367	params.action = MPI2_CONFIG_ACTION_PAGE_READ_CURRENT;
368	params.page_address = le32toh(ext_page_req->page_address);
369	hdr->PageVersion = reqhdr->PageVersion;
370	hdr->PageType = MPI2_CONFIG_PAGETYPE_EXTENDED;
371	hdr->PageNumber = reqhdr->PageNumber;
372	hdr->ExtPageType = reqhdr->ExtPageType;
373	hdr->ExtPageLength = reqhdr->ExtPageLength;
374	params.buffer = buf;
375	params.length = le32toh(ext_page_req->len);
376	params.callback = NULL;
377
378	if ((error = mpr_read_config_page(sc, &params)) != 0) {
379		mpr_printf(sc, "mpr_user_read_extcfg_page timed out\n");
380		return (ETIMEDOUT);
381	}
382
383	ext_page_req->ioc_status = htole16(params.status);
384	return (0);
385}
386
387static int
388mpr_user_write_cfg_page(struct mpr_softc *sc,
389    struct mpr_cfg_page_req *page_req, void *buf)
390{
391	MPI2_CONFIG_PAGE_HEADER *reqhdr, *hdr;
392	struct mpr_config_params params;
393	u_int	      hdr_attr;
394	int	      error;
395
396	reqhdr = buf;
397	hdr = &params.hdr.Struct;
398	hdr_attr = reqhdr->PageType & MPI2_CONFIG_PAGEATTR_MASK;
399	if (hdr_attr != MPI2_CONFIG_PAGEATTR_CHANGEABLE &&
400	    hdr_attr != MPI2_CONFIG_PAGEATTR_PERSISTENT) {
401		mpr_printf(sc, "page type 0x%x not changeable\n",
402			reqhdr->PageType & MPI2_CONFIG_PAGETYPE_MASK);
403		return (EINVAL);
404	}
405
406	/*
407	 * There isn't any point in restoring stripped out attributes
408	 * if you then mask them going down to issue the request.
409	 */
410
411	hdr->PageVersion = reqhdr->PageVersion;
412	hdr->PageLength = reqhdr->PageLength;
413	hdr->PageNumber = reqhdr->PageNumber;
414	hdr->PageType = reqhdr->PageType;
415	params.action = MPI2_CONFIG_ACTION_PAGE_WRITE_CURRENT;
416	params.page_address = le32toh(page_req->page_address);
417	params.buffer = buf;
418	params.length = le32toh(page_req->len);
419	params.callback = NULL;
420
421	if ((error = mpr_write_config_page(sc, &params)) != 0) {
422		mpr_printf(sc, "mpr_write_cfg_page timed out\n");
423		return (ETIMEDOUT);
424	}
425
426	page_req->ioc_status = htole16(params.status);
427	return (0);
428}
429
430void
431mpr_init_sge(struct mpr_command *cm, void *req, void *sge)
432{
433	int off, space;
434
435	space = (int)cm->cm_sc->facts->IOCRequestFrameSize * 4;
436	off = (uintptr_t)sge - (uintptr_t)req;
437
438	KASSERT(off < space, ("bad pointers %p %p, off %d, space %d",
439            req, sge, off, space));
440
441	cm->cm_sge = sge;
442	cm->cm_sglsize = space - off;
443}
444
445/*
446 * Prepare the mpr_command for an IOC_FACTS request.
447 */
448static int
449mpi_pre_ioc_facts(struct mpr_command *cm, struct mpr_usr_command *cmd)
450{
451	MPI2_IOC_FACTS_REQUEST *req = (void *)cm->cm_req;
452	MPI2_IOC_FACTS_REPLY *rpl;
453
454	if (cmd->req_len != sizeof *req)
455		return (EINVAL);
456	if (cmd->rpl_len != sizeof *rpl)
457		return (EINVAL);
458
459	cm->cm_sge = NULL;
460	cm->cm_sglsize = 0;
461	return (0);
462}
463
464/*
465 * Prepare the mpr_command for a PORT_FACTS request.
466 */
467static int
468mpi_pre_port_facts(struct mpr_command *cm, struct mpr_usr_command *cmd)
469{
470	MPI2_PORT_FACTS_REQUEST *req = (void *)cm->cm_req;
471	MPI2_PORT_FACTS_REPLY *rpl;
472
473	if (cmd->req_len != sizeof *req)
474		return (EINVAL);
475	if (cmd->rpl_len != sizeof *rpl)
476		return (EINVAL);
477
478	cm->cm_sge = NULL;
479	cm->cm_sglsize = 0;
480	return (0);
481}
482
483/*
484 * Prepare the mpr_command for a FW_DOWNLOAD request.
485 */
486static int
487mpi_pre_fw_download(struct mpr_command *cm, struct mpr_usr_command *cmd)
488{
489	MPI25_FW_DOWNLOAD_REQUEST *req = (void *)cm->cm_req;
490	MPI2_FW_DOWNLOAD_REPLY *rpl;
491	int error;
492
493	if (cmd->req_len != sizeof *req)
494		return (EINVAL);
495	if (cmd->rpl_len != sizeof *rpl)
496		return (EINVAL);
497
498	if (cmd->len == 0)
499		return (EINVAL);
500
501	error = copyin(cmd->buf, cm->cm_data, cmd->len);
502	if (error != 0)
503		return (error);
504
505	mpr_init_sge(cm, req, &req->SGL);
506
507	/*
508	 * For now, the F/W image must be provided in a single request.
509	 */
510	if ((req->MsgFlags & MPI2_FW_DOWNLOAD_MSGFLGS_LAST_SEGMENT) == 0)
511		return (EINVAL);
512	if (req->TotalImageSize != cmd->len)
513		return (EINVAL);
514
515	req->ImageOffset = 0;
516	req->ImageSize = cmd->len;
517
518	cm->cm_flags |= MPR_CM_FLAGS_DATAOUT;
519
520	return (mpr_push_ieee_sge(cm, &req->SGL, 0));
521}
522
523/*
524 * Prepare the mpr_command for a FW_UPLOAD request.
525 */
526static int
527mpi_pre_fw_upload(struct mpr_command *cm, struct mpr_usr_command *cmd)
528{
529	MPI25_FW_UPLOAD_REQUEST *req = (void *)cm->cm_req;
530	MPI2_FW_UPLOAD_REPLY *rpl;
531
532	if (cmd->req_len != sizeof *req)
533		return (EINVAL);
534	if (cmd->rpl_len != sizeof *rpl)
535		return (EINVAL);
536
537	mpr_init_sge(cm, req, &req->SGL);
538	if (cmd->len == 0) {
539		/* Perhaps just asking what the size of the fw is? */
540		return (0);
541	}
542
543	req->ImageOffset = 0;
544	req->ImageSize = cmd->len;
545
546	cm->cm_flags |= MPR_CM_FLAGS_DATAIN;
547
548	return (mpr_push_ieee_sge(cm, &req->SGL, 0));
549}
550
551/*
552 * Prepare the mpr_command for a SATA_PASSTHROUGH request.
553 */
554static int
555mpi_pre_sata_passthrough(struct mpr_command *cm, struct mpr_usr_command *cmd)
556{
557	MPI2_SATA_PASSTHROUGH_REQUEST *req = (void *)cm->cm_req;
558	MPI2_SATA_PASSTHROUGH_REPLY *rpl;
559
560	if (cmd->req_len != sizeof *req)
561		return (EINVAL);
562	if (cmd->rpl_len != sizeof *rpl)
563		return (EINVAL);
564
565	mpr_init_sge(cm, req, &req->SGL);
566	return (0);
567}
568
569/*
570 * Prepare the mpr_command for a SMP_PASSTHROUGH request.
571 */
572static int
573mpi_pre_smp_passthrough(struct mpr_command *cm, struct mpr_usr_command *cmd)
574{
575	MPI2_SMP_PASSTHROUGH_REQUEST *req = (void *)cm->cm_req;
576	MPI2_SMP_PASSTHROUGH_REPLY *rpl;
577
578	if (cmd->req_len != sizeof *req)
579		return (EINVAL);
580	if (cmd->rpl_len != sizeof *rpl)
581		return (EINVAL);
582
583	mpr_init_sge(cm, req, &req->SGL);
584	return (0);
585}
586
587/*
588 * Prepare the mpr_command for a CONFIG request.
589 */
590static int
591mpi_pre_config(struct mpr_command *cm, struct mpr_usr_command *cmd)
592{
593	MPI2_CONFIG_REQUEST *req = (void *)cm->cm_req;
594	MPI2_CONFIG_REPLY *rpl;
595
596	if (cmd->req_len != sizeof *req)
597		return (EINVAL);
598	if (cmd->rpl_len != sizeof *rpl)
599		return (EINVAL);
600
601	mpr_init_sge(cm, req, &req->PageBufferSGE);
602	return (0);
603}
604
605/*
606 * Prepare the mpr_command for a SAS_IO_UNIT_CONTROL request.
607 */
608static int
609mpi_pre_sas_io_unit_control(struct mpr_command *cm,
610			     struct mpr_usr_command *cmd)
611{
612
613	cm->cm_sge = NULL;
614	cm->cm_sglsize = 0;
615	return (0);
616}
617
618/*
619 * A set of functions to prepare an mpr_command for the various
620 * supported requests.
621 */
622struct mpr_user_func {
623	U8		Function;
624	mpr_user_f	*f_pre;
625} mpr_user_func_list[] = {
626	{ MPI2_FUNCTION_IOC_FACTS,		mpi_pre_ioc_facts },
627	{ MPI2_FUNCTION_PORT_FACTS,		mpi_pre_port_facts },
628	{ MPI2_FUNCTION_FW_DOWNLOAD, 		mpi_pre_fw_download },
629	{ MPI2_FUNCTION_FW_UPLOAD,		mpi_pre_fw_upload },
630	{ MPI2_FUNCTION_SATA_PASSTHROUGH,	mpi_pre_sata_passthrough },
631	{ MPI2_FUNCTION_SMP_PASSTHROUGH,	mpi_pre_smp_passthrough},
632	{ MPI2_FUNCTION_CONFIG,			mpi_pre_config},
633	{ MPI2_FUNCTION_SAS_IO_UNIT_CONTROL,	mpi_pre_sas_io_unit_control },
634	{ 0xFF,					NULL } /* list end */
635};
636
637static int
638mpr_user_setup_request(struct mpr_command *cm, struct mpr_usr_command *cmd)
639{
640	MPI2_REQUEST_HEADER *hdr = (MPI2_REQUEST_HEADER *)cm->cm_req;
641	struct mpr_user_func *f;
642
643	for (f = mpr_user_func_list; f->f_pre != NULL; f++) {
644		if (hdr->Function == f->Function)
645			return (f->f_pre(cm, cmd));
646	}
647	return (EINVAL);
648}
649
650static int
651mpr_user_command(struct mpr_softc *sc, struct mpr_usr_command *cmd)
652{
653	MPI2_REQUEST_HEADER *hdr;
654	MPI2_DEFAULT_REPLY *rpl;
655	void *buf = NULL;
656	struct mpr_command *cm = NULL;
657	int err = 0;
658	int sz;
659
660	mpr_lock(sc);
661	cm = mpr_alloc_command(sc);
662
663	if (cm == NULL) {
664		mpr_printf(sc, "%s: no mpr requests\n", __func__);
665		err = ENOMEM;
666		goto Ret;
667	}
668	mpr_unlock(sc);
669
670	hdr = (MPI2_REQUEST_HEADER *)cm->cm_req;
671
672	mpr_dprint(sc, MPR_USER, "%s: req %p %d  rpl %p %d\n", __func__,
673	    cmd->req, cmd->req_len, cmd->rpl, cmd->rpl_len);
674
675	if (cmd->req_len > (int)sc->facts->IOCRequestFrameSize * 4) {
676		err = EINVAL;
677		goto RetFreeUnlocked;
678	}
679	err = copyin(cmd->req, hdr, cmd->req_len);
680	if (err != 0)
681		goto RetFreeUnlocked;
682
683	mpr_dprint(sc, MPR_USER, "%s: Function %02X MsgFlags %02X\n", __func__,
684	    hdr->Function, hdr->MsgFlags);
685
686	if (cmd->len > 0) {
687		buf = malloc(cmd->len, M_MPRUSER, M_WAITOK|M_ZERO);
688		cm->cm_data = buf;
689		cm->cm_length = cmd->len;
690	} else {
691		cm->cm_data = NULL;
692		cm->cm_length = 0;
693	}
694
695	cm->cm_flags = MPR_CM_FLAGS_SGE_SIMPLE;
696	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
697
698	err = mpr_user_setup_request(cm, cmd);
699	if (err == EINVAL) {
700		mpr_printf(sc, "%s: unsupported parameter or unsupported "
701		    "function in request (function = 0x%X)\n", __func__,
702		    hdr->Function);
703	}
704	if (err != 0)
705		goto RetFreeUnlocked;
706
707	mpr_lock(sc);
708	err = mpr_wait_command(sc, cm, 30, CAN_SLEEP);
709
710	if (err) {
711		mpr_printf(sc, "%s: invalid request: error %d\n",
712		    __func__, err);
713		goto Ret;
714	}
715
716	rpl = (MPI2_DEFAULT_REPLY *)cm->cm_reply;
717	if (rpl != NULL)
718		sz = rpl->MsgLength * 4;
719	else
720		sz = 0;
721
722	if (sz > cmd->rpl_len) {
723		mpr_printf(sc, "%s: user reply buffer (%d) smaller than "
724		    "returned buffer (%d)\n", __func__, cmd->rpl_len, sz);
725		sz = cmd->rpl_len;
726	}
727
728	mpr_unlock(sc);
729	copyout(rpl, cmd->rpl, sz);
730	if (buf != NULL)
731		copyout(buf, cmd->buf, cmd->len);
732	mpr_dprint(sc, MPR_USER, "%s: reply size %d\n", __func__, sz);
733
734RetFreeUnlocked:
735	mpr_lock(sc);
736	if (cm != NULL)
737		mpr_free_command(sc, cm);
738Ret:
739	mpr_unlock(sc);
740	if (buf != NULL)
741		free(buf, M_MPRUSER);
742	return (err);
743}
744
745static int
746mpr_user_pass_thru(struct mpr_softc *sc, mpr_pass_thru_t *data)
747{
748	MPI2_REQUEST_HEADER	*hdr, tmphdr;
749	MPI2_DEFAULT_REPLY	*rpl;
750	struct mpr_command	*cm = NULL;
751	int			i, err = 0, dir = 0, sz;
752	uint8_t			tool, function = 0;
753	u_int			sense_len;
754	struct mprsas_target	*targ = NULL;
755
756	/*
757	 * Only allow one passthru command at a time.  Use the MPR_FLAGS_BUSY
758	 * bit to denote that a passthru is being processed.
759	 */
760	mpr_lock(sc);
761	if (sc->mpr_flags & MPR_FLAGS_BUSY) {
762		mpr_dprint(sc, MPR_USER, "%s: Only one passthru command "
763		    "allowed at a single time.", __func__);
764		mpr_unlock(sc);
765		return (EBUSY);
766	}
767	sc->mpr_flags |= MPR_FLAGS_BUSY;
768	mpr_unlock(sc);
769
770	/*
771	 * Do some validation on data direction.  Valid cases are:
772	 *    1) DataSize is 0 and direction is NONE
773	 *    2) DataSize is non-zero and one of:
774	 *        a) direction is READ or
775	 *        b) direction is WRITE or
776	 *        c) direction is BOTH and DataOutSize is non-zero
777	 * If valid and the direction is BOTH, change the direction to READ.
778	 * if valid and the direction is not BOTH, make sure DataOutSize is 0.
779	 */
780	if (((data->DataSize == 0) &&
781	    (data->DataDirection == MPR_PASS_THRU_DIRECTION_NONE)) ||
782	    ((data->DataSize != 0) &&
783	    ((data->DataDirection == MPR_PASS_THRU_DIRECTION_READ) ||
784	    (data->DataDirection == MPR_PASS_THRU_DIRECTION_WRITE) ||
785	    ((data->DataDirection == MPR_PASS_THRU_DIRECTION_BOTH) &&
786	    (data->DataOutSize != 0))))) {
787		if (data->DataDirection == MPR_PASS_THRU_DIRECTION_BOTH)
788			data->DataDirection = MPR_PASS_THRU_DIRECTION_READ;
789		else
790			data->DataOutSize = 0;
791	} else
792		return (EINVAL);
793
794	mpr_dprint(sc, MPR_USER, "%s: req 0x%jx %d  rpl 0x%jx %d "
795	    "data in 0x%jx %d data out 0x%jx %d data dir %d\n", __func__,
796	    data->PtrRequest, data->RequestSize, data->PtrReply,
797	    data->ReplySize, data->PtrData, data->DataSize,
798	    data->PtrDataOut, data->DataOutSize, data->DataDirection);
799
800	/*
801	 * copy in the header so we know what we're dealing with before we
802	 * commit to allocating a command for it.
803	 */
804	err = copyin(PTRIN(data->PtrRequest), &tmphdr, data->RequestSize);
805	if (err != 0)
806		goto RetFreeUnlocked;
807
808	if (data->RequestSize > (int)sc->facts->IOCRequestFrameSize * 4) {
809		err = EINVAL;
810		goto RetFreeUnlocked;
811	}
812
813	function = tmphdr.Function;
814	mpr_dprint(sc, MPR_USER, "%s: Function %02X MsgFlags %02X\n", __func__,
815	    function, tmphdr.MsgFlags);
816
817	/*
818	 * Handle a passthru TM request.
819	 */
820	if (function == MPI2_FUNCTION_SCSI_TASK_MGMT) {
821		MPI2_SCSI_TASK_MANAGE_REQUEST	*task;
822
823		mpr_lock(sc);
824		cm = mprsas_alloc_tm(sc);
825		if (cm == NULL) {
826			err = EINVAL;
827			goto Ret;
828		}
829
830		/* Copy the header in.  Only a small fixup is needed. */
831		task = (MPI2_SCSI_TASK_MANAGE_REQUEST *)cm->cm_req;
832		bcopy(&tmphdr, task, data->RequestSize);
833		task->TaskMID = cm->cm_desc.Default.SMID;
834
835		cm->cm_data = NULL;
836		cm->cm_desc.HighPriority.RequestFlags =
837		    MPI2_REQ_DESCRIPT_FLAGS_HIGH_PRIORITY;
838		cm->cm_complete = NULL;
839		cm->cm_complete_data = NULL;
840
841		targ = mprsas_find_target_by_handle(sc->sassc, 0,
842		    task->DevHandle);
843		if (targ == NULL) {
844			mpr_dprint(sc, MPR_INFO,
845			   "%s %d : invalid handle for requested TM 0x%x \n",
846			   __func__, __LINE__, task->DevHandle);
847			err = 1;
848		} else {
849			mprsas_prepare_for_tm(sc, cm, targ, CAM_LUN_WILDCARD);
850			err = mpr_wait_command(sc, cm, 30, CAN_SLEEP);
851		}
852
853		if (err != 0) {
854			err = EIO;
855			mpr_dprint(sc, MPR_FAULT, "%s: task management failed",
856			    __func__);
857		}
858		/*
859		 * Copy the reply data and sense data to user space.
860		 */
861		if (cm->cm_reply != NULL) {
862			rpl = (MPI2_DEFAULT_REPLY *)cm->cm_reply;
863			sz = rpl->MsgLength * 4;
864
865			if (sz > data->ReplySize) {
866				mpr_printf(sc, "%s: user reply buffer (%d) "
867				    "smaller than returned buffer (%d)\n",
868				    __func__, data->ReplySize, sz);
869			}
870			mpr_unlock(sc);
871			copyout(cm->cm_reply, PTRIN(data->PtrReply),
872			    data->ReplySize);
873			mpr_lock(sc);
874		}
875		mprsas_free_tm(sc, cm);
876		goto Ret;
877	}
878
879	mpr_lock(sc);
880	cm = mpr_alloc_command(sc);
881
882	if (cm == NULL) {
883		mpr_printf(sc, "%s: no mpr requests\n", __func__);
884		err = ENOMEM;
885		goto Ret;
886	}
887	mpr_unlock(sc);
888
889	hdr = (MPI2_REQUEST_HEADER *)cm->cm_req;
890	bcopy(&tmphdr, hdr, data->RequestSize);
891
892	/*
893	 * Do some checking to make sure the IOCTL request contains a valid
894	 * request.  Then set the SGL info.
895	 */
896	mpr_init_sge(cm, hdr, (void *)((uint8_t *)hdr + data->RequestSize));
897
898	/*
899	 * Set up for read, write or both.  From check above, DataOutSize will
900	 * be 0 if direction is READ or WRITE, but it will have some non-zero
901	 * value if the direction is BOTH.  So, just use the biggest size to get
902	 * the cm_data buffer size.  If direction is BOTH, 2 SGLs need to be set
903	 * up; the first is for the request and the second will contain the
904	 * response data. cm_out_len needs to be set here and this will be used
905	 * when the SGLs are set up.
906	 */
907	cm->cm_data = NULL;
908	cm->cm_length = MAX(data->DataSize, data->DataOutSize);
909	cm->cm_out_len = data->DataOutSize;
910	cm->cm_flags = 0;
911	if (cm->cm_length != 0) {
912		cm->cm_data = malloc(cm->cm_length, M_MPRUSER, M_WAITOK |
913		    M_ZERO);
914		cm->cm_flags = MPR_CM_FLAGS_DATAIN;
915		if (data->DataOutSize) {
916			cm->cm_flags |= MPR_CM_FLAGS_DATAOUT;
917			err = copyin(PTRIN(data->PtrDataOut),
918			    cm->cm_data, data->DataOutSize);
919		} else if (data->DataDirection ==
920		    MPR_PASS_THRU_DIRECTION_WRITE) {
921			cm->cm_flags = MPR_CM_FLAGS_DATAOUT;
922			err = copyin(PTRIN(data->PtrData),
923			    cm->cm_data, data->DataSize);
924		}
925		if (err != 0)
926			mpr_dprint(sc, MPR_FAULT, "%s: failed to copy "
927			    "IOCTL data from user space\n", __func__);
928	}
929	/*
930	 * Set this flag only if processing a command that does not need an
931	 * IEEE SGL.  The CLI Tool within the Toolbox uses IEEE SGLs, so clear
932	 * the flag only for that tool if processing a Toolbox function.
933	 */
934	cm->cm_flags |= MPR_CM_FLAGS_SGE_SIMPLE;
935	for (i = 0; i < sizeof (ieee_sgl_func_list); i++) {
936		if (function == ieee_sgl_func_list[i]) {
937			if (function == MPI2_FUNCTION_TOOLBOX)
938			{
939				tool = (uint8_t)hdr->FunctionDependent1;
940				if (tool != MPI2_TOOLBOX_DIAGNOSTIC_CLI_TOOL)
941					break;
942			}
943			cm->cm_flags &= ~MPR_CM_FLAGS_SGE_SIMPLE;
944			break;
945		}
946	}
947	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
948
949	/*
950	 * Set up Sense buffer and SGL offset for IO passthru.  SCSI IO request
951	 * uses SCSI IO or Fast Path SCSI IO descriptor.
952	 */
953	if ((function == MPI2_FUNCTION_SCSI_IO_REQUEST) ||
954	    (function == MPI2_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)) {
955		MPI2_SCSI_IO_REQUEST	*scsi_io_req;
956
957		scsi_io_req = (MPI2_SCSI_IO_REQUEST *)hdr;
958		/*
959		 * Put SGE for data and data_out buffer at the end of
960		 * scsi_io_request message header (64 bytes in total).
961		 * Following above SGEs, the residual space will be used by
962		 * sense data.
963		 */
964		scsi_io_req->SenseBufferLength = (uint8_t)(data->RequestSize -
965		    64);
966		scsi_io_req->SenseBufferLowAddress =
967		    htole32(cm->cm_sense_busaddr);
968
969		/*
970		 * Set SGLOffset0 value.  This is the number of dwords that SGL
971		 * is offset from the beginning of MPI2_SCSI_IO_REQUEST struct.
972		 */
973		scsi_io_req->SGLOffset0 = 24;
974
975		/*
976		 * Setup descriptor info.  RAID passthrough must use the
977		 * default request descriptor which is already set, so if this
978		 * is a SCSI IO request, change the descriptor to SCSI IO or
979		 * Fast Path SCSI IO.  Also, if this is a SCSI IO request,
980		 * handle the reply in the mprsas_scsio_complete function.
981		 */
982		if (function == MPI2_FUNCTION_SCSI_IO_REQUEST) {
983			targ = mprsas_find_target_by_handle(sc->sassc, 0,
984			    scsi_io_req->DevHandle);
985
986			if (!targ) {
987				printf("No Target found for handle %d\n",
988				    scsi_io_req->DevHandle);
989				err = EINVAL;
990				goto RetFreeUnlocked;
991			}
992
993			if (targ->scsi_req_desc_type ==
994			    MPI25_REQ_DESCRIPT_FLAGS_FAST_PATH_SCSI_IO) {
995				cm->cm_desc.FastPathSCSIIO.RequestFlags =
996				    MPI25_REQ_DESCRIPT_FLAGS_FAST_PATH_SCSI_IO;
997				cm->cm_desc.FastPathSCSIIO.DevHandle =
998				    scsi_io_req->DevHandle;
999				scsi_io_req->IoFlags |=
1000				    MPI25_SCSIIO_IOFLAGS_FAST_PATH;
1001			} else {
1002				cm->cm_desc.SCSIIO.RequestFlags =
1003				    MPI2_REQ_DESCRIPT_FLAGS_SCSI_IO;
1004				cm->cm_desc.SCSIIO.DevHandle =
1005				    scsi_io_req->DevHandle;
1006			}
1007
1008			/*
1009			 * Make sure the DevHandle is not 0 because this is a
1010			 * likely error.
1011			 */
1012			if (scsi_io_req->DevHandle == 0) {
1013				err = EINVAL;
1014				goto RetFreeUnlocked;
1015			}
1016		}
1017	}
1018
1019	mpr_lock(sc);
1020
1021	err = mpr_wait_command(sc, cm, 30, CAN_SLEEP);
1022
1023	if (err) {
1024		mpr_printf(sc, "%s: invalid request: error %d\n", __func__,
1025		    err);
1026		mpr_unlock(sc);
1027		goto RetFreeUnlocked;
1028	}
1029
1030	/*
1031	 * Sync the DMA data, if any.  Then copy the data to user space.
1032	 */
1033	if (cm->cm_data != NULL) {
1034		if (cm->cm_flags & MPR_CM_FLAGS_DATAIN)
1035			dir = BUS_DMASYNC_POSTREAD;
1036		else if (cm->cm_flags & MPR_CM_FLAGS_DATAOUT)
1037			dir = BUS_DMASYNC_POSTWRITE;
1038		bus_dmamap_sync(sc->buffer_dmat, cm->cm_dmamap, dir);
1039		bus_dmamap_unload(sc->buffer_dmat, cm->cm_dmamap);
1040
1041		if (cm->cm_flags & MPR_CM_FLAGS_DATAIN) {
1042			mpr_unlock(sc);
1043			err = copyout(cm->cm_data,
1044			    PTRIN(data->PtrData), data->DataSize);
1045			mpr_lock(sc);
1046			if (err != 0)
1047				mpr_dprint(sc, MPR_FAULT, "%s: failed to copy "
1048				    "IOCTL data to user space\n", __func__);
1049		}
1050	}
1051
1052	/*
1053	 * Copy the reply data and sense data to user space.
1054	 */
1055	if (cm->cm_reply != NULL) {
1056		rpl = (MPI2_DEFAULT_REPLY *)cm->cm_reply;
1057		sz = rpl->MsgLength * 4;
1058
1059		if (sz > data->ReplySize) {
1060			mpr_printf(sc, "%s: user reply buffer (%d) smaller "
1061			    "than returned buffer (%d)\n", __func__,
1062			    data->ReplySize, sz);
1063		}
1064		mpr_unlock(sc);
1065		copyout(cm->cm_reply, PTRIN(data->PtrReply), data->ReplySize);
1066		mpr_lock(sc);
1067
1068		if ((function == MPI2_FUNCTION_SCSI_IO_REQUEST) ||
1069		    (function == MPI2_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)) {
1070			if (((MPI2_SCSI_IO_REPLY *)rpl)->SCSIState &
1071			    MPI2_SCSI_STATE_AUTOSENSE_VALID) {
1072				sense_len =
1073				    MIN((le32toh(((MPI2_SCSI_IO_REPLY *)rpl)->
1074				    SenseCount)), sizeof(struct
1075				    scsi_sense_data));
1076				mpr_unlock(sc);
1077				copyout(cm->cm_sense, cm->cm_req + 64,
1078				    sense_len);
1079				mpr_lock(sc);
1080			}
1081		}
1082	}
1083	mpr_unlock(sc);
1084
1085RetFreeUnlocked:
1086	mpr_lock(sc);
1087
1088	if (cm != NULL) {
1089		if (cm->cm_data)
1090			free(cm->cm_data, M_MPRUSER);
1091		mpr_free_command(sc, cm);
1092	}
1093Ret:
1094	sc->mpr_flags &= ~MPR_FLAGS_BUSY;
1095	mpr_unlock(sc);
1096
1097	return (err);
1098}
1099
1100static void
1101mpr_user_get_adapter_data(struct mpr_softc *sc, mpr_adapter_data_t *data)
1102{
1103	Mpi2ConfigReply_t	mpi_reply;
1104	Mpi2BiosPage3_t		config_page;
1105
1106	/*
1107	 * Use the PCI interface functions to get the Bus, Device, and Function
1108	 * information.
1109	 */
1110	data->PciInformation.u.bits.BusNumber = pci_get_bus(sc->mpr_dev);
1111	data->PciInformation.u.bits.DeviceNumber = pci_get_slot(sc->mpr_dev);
1112	data->PciInformation.u.bits.FunctionNumber =
1113	    pci_get_function(sc->mpr_dev);
1114
1115	/*
1116	 * Get the FW version that should already be saved in IOC Facts.
1117	 */
1118	data->MpiFirmwareVersion = sc->facts->FWVersion.Word;
1119
1120	/*
1121	 * General device info.
1122	 */
1123	data->AdapterType = MPRIOCTL_ADAPTER_TYPE_SAS3;
1124	data->PCIDeviceHwId = pci_get_device(sc->mpr_dev);
1125	data->PCIDeviceHwRev = pci_read_config(sc->mpr_dev, PCIR_REVID, 1);
1126	data->SubSystemId = pci_get_subdevice(sc->mpr_dev);
1127	data->SubsystemVendorId = pci_get_subvendor(sc->mpr_dev);
1128
1129	/*
1130	 * Get the driver version.
1131	 */
1132	strcpy((char *)&data->DriverVersion[0], MPR_DRIVER_VERSION);
1133
1134	/*
1135	 * Need to get BIOS Config Page 3 for the BIOS Version.
1136	 */
1137	data->BiosVersion = 0;
1138	mpr_lock(sc);
1139	if (mpr_config_get_bios_pg3(sc, &mpi_reply, &config_page))
1140		printf("%s: Error while retrieving BIOS Version\n", __func__);
1141	else
1142		data->BiosVersion = config_page.BiosVersion;
1143	mpr_unlock(sc);
1144}
1145
1146static void
1147mpr_user_read_pci_info(struct mpr_softc *sc, mpr_pci_info_t *data)
1148{
1149	int	i;
1150
1151	/*
1152	 * Use the PCI interface functions to get the Bus, Device, and Function
1153	 * information.
1154	 */
1155	data->BusNumber = pci_get_bus(sc->mpr_dev);
1156	data->DeviceNumber = pci_get_slot(sc->mpr_dev);
1157	data->FunctionNumber = pci_get_function(sc->mpr_dev);
1158
1159	/*
1160	 * Now get the interrupt vector and the pci header.  The vector can
1161	 * only be 0 right now.  The header is the first 256 bytes of config
1162	 * space.
1163	 */
1164	data->InterruptVector = 0;
1165	for (i = 0; i < sizeof (data->PciHeader); i++) {
1166		data->PciHeader[i] = pci_read_config(sc->mpr_dev, i, 1);
1167	}
1168}
1169
1170static uint8_t
1171mpr_get_fw_diag_buffer_number(struct mpr_softc *sc, uint32_t unique_id)
1172{
1173	uint8_t	index;
1174
1175	for (index = 0; index < MPI2_DIAG_BUF_TYPE_COUNT; index++) {
1176		if (sc->fw_diag_buffer_list[index].unique_id == unique_id) {
1177			return (index);
1178		}
1179	}
1180
1181	return (MPR_FW_DIAGNOSTIC_UID_NOT_FOUND);
1182}
1183
1184static int
1185mpr_post_fw_diag_buffer(struct mpr_softc *sc,
1186    mpr_fw_diagnostic_buffer_t *pBuffer, uint32_t *return_code)
1187{
1188	MPI2_DIAG_BUFFER_POST_REQUEST	*req;
1189	MPI2_DIAG_BUFFER_POST_REPLY	*reply;
1190	struct mpr_command		*cm = NULL;
1191	int				i, status;
1192
1193	/*
1194	 * If buffer is not enabled, just leave.
1195	 */
1196	*return_code = MPR_FW_DIAG_ERROR_POST_FAILED;
1197	if (!pBuffer->enabled) {
1198		return (MPR_DIAG_FAILURE);
1199	}
1200
1201	/*
1202	 * Clear some flags initially.
1203	 */
1204	pBuffer->force_release = FALSE;
1205	pBuffer->valid_data = FALSE;
1206	pBuffer->owned_by_firmware = FALSE;
1207
1208	/*
1209	 * Get a command.
1210	 */
1211	cm = mpr_alloc_command(sc);
1212	if (cm == NULL) {
1213		mpr_printf(sc, "%s: no mpr requests\n", __func__);
1214		return (MPR_DIAG_FAILURE);
1215	}
1216
1217	/*
1218	 * Build the request for releasing the FW Diag Buffer and send it.
1219	 */
1220	req = (MPI2_DIAG_BUFFER_POST_REQUEST *)cm->cm_req;
1221	req->Function = MPI2_FUNCTION_DIAG_BUFFER_POST;
1222	req->BufferType = pBuffer->buffer_type;
1223	req->ExtendedType = pBuffer->extended_type;
1224	req->BufferLength = pBuffer->size;
1225	for (i = 0; i < (sizeof(req->ProductSpecific) / 4); i++)
1226		req->ProductSpecific[i] = pBuffer->product_specific[i];
1227	mpr_from_u64(sc->fw_diag_busaddr, &req->BufferAddress);
1228	cm->cm_data = NULL;
1229	cm->cm_length = 0;
1230	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
1231	cm->cm_complete_data = NULL;
1232
1233	/*
1234	 * Send command synchronously.
1235	 */
1236	status = mpr_wait_command(sc, cm, 30, CAN_SLEEP);
1237	if (status) {
1238		mpr_printf(sc, "%s: invalid request: error %d\n", __func__,
1239		    status);
1240		status = MPR_DIAG_FAILURE;
1241		goto done;
1242	}
1243
1244	/*
1245	 * Process POST reply.
1246	 */
1247	reply = (MPI2_DIAG_BUFFER_POST_REPLY *)cm->cm_reply;
1248	if ((le16toh(reply->IOCStatus) & MPI2_IOCSTATUS_MASK) !=
1249	    MPI2_IOCSTATUS_SUCCESS) {
1250		status = MPR_DIAG_FAILURE;
1251		mpr_dprint(sc, MPR_FAULT, "%s: post of FW  Diag Buffer failed "
1252		    "with IOCStatus = 0x%x, IOCLogInfo = 0x%x and "
1253		    "TransferLength = 0x%x\n", __func__,
1254		    le16toh(reply->IOCStatus), le32toh(reply->IOCLogInfo),
1255		    le32toh(reply->TransferLength));
1256		goto done;
1257	}
1258
1259	/*
1260	 * Post was successful.
1261	 */
1262	pBuffer->valid_data = TRUE;
1263	pBuffer->owned_by_firmware = TRUE;
1264	*return_code = MPR_FW_DIAG_ERROR_SUCCESS;
1265	status = MPR_DIAG_SUCCESS;
1266
1267done:
1268	mpr_free_command(sc, cm);
1269	return (status);
1270}
1271
1272static int
1273mpr_release_fw_diag_buffer(struct mpr_softc *sc,
1274    mpr_fw_diagnostic_buffer_t *pBuffer, uint32_t *return_code,
1275    uint32_t diag_type)
1276{
1277	MPI2_DIAG_RELEASE_REQUEST	*req;
1278	MPI2_DIAG_RELEASE_REPLY		*reply;
1279	struct mpr_command		*cm = NULL;
1280	int				status;
1281
1282	/*
1283	 * If buffer is not enabled, just leave.
1284	 */
1285	*return_code = MPR_FW_DIAG_ERROR_RELEASE_FAILED;
1286	if (!pBuffer->enabled) {
1287		mpr_dprint(sc, MPR_USER, "%s: This buffer type is not "
1288		    "supported by the IOC", __func__);
1289		return (MPR_DIAG_FAILURE);
1290	}
1291
1292	/*
1293	 * Clear some flags initially.
1294	 */
1295	pBuffer->force_release = FALSE;
1296	pBuffer->valid_data = FALSE;
1297	pBuffer->owned_by_firmware = FALSE;
1298
1299	/*
1300	 * Get a command.
1301	 */
1302	cm = mpr_alloc_command(sc);
1303	if (cm == NULL) {
1304		mpr_printf(sc, "%s: no mpr requests\n", __func__);
1305		return (MPR_DIAG_FAILURE);
1306	}
1307
1308	/*
1309	 * Build the request for releasing the FW Diag Buffer and send it.
1310	 */
1311	req = (MPI2_DIAG_RELEASE_REQUEST *)cm->cm_req;
1312	req->Function = MPI2_FUNCTION_DIAG_RELEASE;
1313	req->BufferType = pBuffer->buffer_type;
1314	cm->cm_data = NULL;
1315	cm->cm_length = 0;
1316	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
1317	cm->cm_complete_data = NULL;
1318
1319	/*
1320	 * Send command synchronously.
1321	 */
1322	status = mpr_wait_command(sc, cm, 30, CAN_SLEEP);
1323	if (status) {
1324		mpr_printf(sc, "%s: invalid request: error %d\n", __func__,
1325		    status);
1326		status = MPR_DIAG_FAILURE;
1327		goto done;
1328	}
1329
1330	/*
1331	 * Process RELEASE reply.
1332	 */
1333	reply = (MPI2_DIAG_RELEASE_REPLY *)cm->cm_reply;
1334	if (((le16toh(reply->IOCStatus) & MPI2_IOCSTATUS_MASK) !=
1335	    MPI2_IOCSTATUS_SUCCESS) || pBuffer->owned_by_firmware) {
1336		status = MPR_DIAG_FAILURE;
1337		mpr_dprint(sc, MPR_FAULT, "%s: release of FW Diag Buffer "
1338		    "failed with IOCStatus = 0x%x and IOCLogInfo = 0x%x\n",
1339		    __func__, le16toh(reply->IOCStatus),
1340		    le32toh(reply->IOCLogInfo));
1341		goto done;
1342	}
1343
1344	/*
1345	 * Release was successful.
1346	 */
1347	*return_code = MPR_FW_DIAG_ERROR_SUCCESS;
1348	status = MPR_DIAG_SUCCESS;
1349
1350	/*
1351	 * If this was for an UNREGISTER diag type command, clear the unique ID.
1352	 */
1353	if (diag_type == MPR_FW_DIAG_TYPE_UNREGISTER) {
1354		pBuffer->unique_id = MPR_FW_DIAG_INVALID_UID;
1355	}
1356
1357done:
1358	return (status);
1359}
1360
1361static int
1362mpr_diag_register(struct mpr_softc *sc, mpr_fw_diag_register_t *diag_register,
1363    uint32_t *return_code)
1364{
1365	mpr_fw_diagnostic_buffer_t	*pBuffer;
1366	uint8_t				extended_type, buffer_type, i;
1367	uint32_t			buffer_size;
1368	uint32_t			unique_id;
1369	int				status;
1370
1371	extended_type = diag_register->ExtendedType;
1372	buffer_type = diag_register->BufferType;
1373	buffer_size = diag_register->RequestedBufferSize;
1374	unique_id = diag_register->UniqueId;
1375
1376	/*
1377	 * Check for valid buffer type
1378	 */
1379	if (buffer_type >= MPI2_DIAG_BUF_TYPE_COUNT) {
1380		*return_code = MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1381		return (MPR_DIAG_FAILURE);
1382	}
1383
1384	/*
1385	 * Get the current buffer and look up the unique ID.  The unique ID
1386	 * should not be found.  If it is, the ID is already in use.
1387	 */
1388	i = mpr_get_fw_diag_buffer_number(sc, unique_id);
1389	pBuffer = &sc->fw_diag_buffer_list[buffer_type];
1390	if (i != MPR_FW_DIAGNOSTIC_UID_NOT_FOUND) {
1391		*return_code = MPR_FW_DIAG_ERROR_INVALID_UID;
1392		return (MPR_DIAG_FAILURE);
1393	}
1394
1395	/*
1396	 * The buffer's unique ID should not be registered yet, and the given
1397	 * unique ID cannot be 0.
1398	 */
1399	if ((pBuffer->unique_id != MPR_FW_DIAG_INVALID_UID) ||
1400	    (unique_id == MPR_FW_DIAG_INVALID_UID)) {
1401		*return_code = MPR_FW_DIAG_ERROR_INVALID_UID;
1402		return (MPR_DIAG_FAILURE);
1403	}
1404
1405	/*
1406	 * If this buffer is already posted as immediate, just change owner.
1407	 */
1408	if (pBuffer->immediate && pBuffer->owned_by_firmware &&
1409	    (pBuffer->unique_id == MPR_FW_DIAG_INVALID_UID)) {
1410		pBuffer->immediate = FALSE;
1411		pBuffer->unique_id = unique_id;
1412		return (MPR_DIAG_SUCCESS);
1413	}
1414
1415	/*
1416	 * Post a new buffer after checking if it's enabled.  The DMA buffer
1417	 * that is allocated will be contiguous (nsegments = 1).
1418	 */
1419	if (!pBuffer->enabled) {
1420		*return_code = MPR_FW_DIAG_ERROR_NO_BUFFER;
1421		return (MPR_DIAG_FAILURE);
1422	}
1423        if (bus_dma_tag_create( sc->mpr_parent_dmat,    /* parent */
1424				1, 0,			/* algnmnt, boundary */
1425				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
1426				BUS_SPACE_MAXADDR,	/* highaddr */
1427				NULL, NULL,		/* filter, filterarg */
1428                                buffer_size,		/* maxsize */
1429                                1,			/* nsegments */
1430                                buffer_size,		/* maxsegsize */
1431                                0,			/* flags */
1432                                NULL, NULL,		/* lockfunc, lockarg */
1433                                &sc->fw_diag_dmat)) {
1434		device_printf(sc->mpr_dev, "Cannot allocate FW diag buffer DMA "
1435		    "tag\n");
1436		return (ENOMEM);
1437        }
1438        if (bus_dmamem_alloc(sc->fw_diag_dmat, (void **)&sc->fw_diag_buffer,
1439	    BUS_DMA_NOWAIT, &sc->fw_diag_map)) {
1440		device_printf(sc->mpr_dev, "Cannot allocate FW diag buffer "
1441		    "memory\n");
1442		return (ENOMEM);
1443        }
1444        bzero(sc->fw_diag_buffer, buffer_size);
1445        bus_dmamap_load(sc->fw_diag_dmat, sc->fw_diag_map, sc->fw_diag_buffer,
1446	    buffer_size, mpr_memaddr_cb, &sc->fw_diag_busaddr, 0);
1447	pBuffer->size = buffer_size;
1448
1449	/*
1450	 * Copy the given info to the diag buffer and post the buffer.
1451	 */
1452	pBuffer->buffer_type = buffer_type;
1453	pBuffer->immediate = FALSE;
1454	if (buffer_type == MPI2_DIAG_BUF_TYPE_TRACE) {
1455		for (i = 0; i < (sizeof (pBuffer->product_specific) / 4);
1456		    i++) {
1457			pBuffer->product_specific[i] =
1458			    diag_register->ProductSpecific[i];
1459		}
1460	}
1461	pBuffer->extended_type = extended_type;
1462	pBuffer->unique_id = unique_id;
1463	status = mpr_post_fw_diag_buffer(sc, pBuffer, return_code);
1464
1465	/*
1466	 * In case there was a failure, free the DMA buffer.
1467	 */
1468	if (status == MPR_DIAG_FAILURE) {
1469		if (sc->fw_diag_busaddr != 0)
1470			bus_dmamap_unload(sc->fw_diag_dmat, sc->fw_diag_map);
1471		if (sc->fw_diag_buffer != NULL)
1472			bus_dmamem_free(sc->fw_diag_dmat, sc->fw_diag_buffer,
1473			    sc->fw_diag_map);
1474		if (sc->fw_diag_dmat != NULL)
1475			bus_dma_tag_destroy(sc->fw_diag_dmat);
1476	}
1477
1478	return (status);
1479}
1480
1481static int
1482mpr_diag_unregister(struct mpr_softc *sc,
1483    mpr_fw_diag_unregister_t *diag_unregister, uint32_t *return_code)
1484{
1485	mpr_fw_diagnostic_buffer_t	*pBuffer;
1486	uint8_t				i;
1487	uint32_t			unique_id;
1488	int				status;
1489
1490	unique_id = diag_unregister->UniqueId;
1491
1492	/*
1493	 * Get the current buffer and look up the unique ID.  The unique ID
1494	 * should be there.
1495	 */
1496	i = mpr_get_fw_diag_buffer_number(sc, unique_id);
1497	if (i == MPR_FW_DIAGNOSTIC_UID_NOT_FOUND) {
1498		*return_code = MPR_FW_DIAG_ERROR_INVALID_UID;
1499		return (MPR_DIAG_FAILURE);
1500	}
1501
1502	pBuffer = &sc->fw_diag_buffer_list[i];
1503
1504	/*
1505	 * Try to release the buffer from FW before freeing it.  If release
1506	 * fails, don't free the DMA buffer in case FW tries to access it
1507	 * later.  If buffer is not owned by firmware, can't release it.
1508	 */
1509	if (!pBuffer->owned_by_firmware) {
1510		status = MPR_DIAG_SUCCESS;
1511	} else {
1512		status = mpr_release_fw_diag_buffer(sc, pBuffer, return_code,
1513		    MPR_FW_DIAG_TYPE_UNREGISTER);
1514	}
1515
1516	/*
1517	 * At this point, return the current status no matter what happens with
1518	 * the DMA buffer.
1519	 */
1520	pBuffer->unique_id = MPR_FW_DIAG_INVALID_UID;
1521	if (status == MPR_DIAG_SUCCESS) {
1522		if (sc->fw_diag_busaddr != 0)
1523			bus_dmamap_unload(sc->fw_diag_dmat, sc->fw_diag_map);
1524		if (sc->fw_diag_buffer != NULL)
1525			bus_dmamem_free(sc->fw_diag_dmat, sc->fw_diag_buffer,
1526			    sc->fw_diag_map);
1527		if (sc->fw_diag_dmat != NULL)
1528			bus_dma_tag_destroy(sc->fw_diag_dmat);
1529	}
1530
1531	return (status);
1532}
1533
1534static int
1535mpr_diag_query(struct mpr_softc *sc, mpr_fw_diag_query_t *diag_query,
1536    uint32_t *return_code)
1537{
1538	mpr_fw_diagnostic_buffer_t	*pBuffer;
1539	uint8_t				i;
1540	uint32_t			unique_id;
1541
1542	unique_id = diag_query->UniqueId;
1543
1544	/*
1545	 * If ID is valid, query on ID.
1546	 * If ID is invalid, query on buffer type.
1547	 */
1548	if (unique_id == MPR_FW_DIAG_INVALID_UID) {
1549		i = diag_query->BufferType;
1550		if (i >= MPI2_DIAG_BUF_TYPE_COUNT) {
1551			*return_code = MPR_FW_DIAG_ERROR_INVALID_UID;
1552			return (MPR_DIAG_FAILURE);
1553		}
1554	} else {
1555		i = mpr_get_fw_diag_buffer_number(sc, unique_id);
1556		if (i == MPR_FW_DIAGNOSTIC_UID_NOT_FOUND) {
1557			*return_code = MPR_FW_DIAG_ERROR_INVALID_UID;
1558			return (MPR_DIAG_FAILURE);
1559		}
1560	}
1561
1562	/*
1563	 * Fill query structure with the diag buffer info.
1564	 */
1565	pBuffer = &sc->fw_diag_buffer_list[i];
1566	diag_query->BufferType = pBuffer->buffer_type;
1567	diag_query->ExtendedType = pBuffer->extended_type;
1568	if (diag_query->BufferType == MPI2_DIAG_BUF_TYPE_TRACE) {
1569		for (i = 0; i < (sizeof(diag_query->ProductSpecific) / 4);
1570		    i++) {
1571			diag_query->ProductSpecific[i] =
1572			    pBuffer->product_specific[i];
1573		}
1574	}
1575	diag_query->TotalBufferSize = pBuffer->size;
1576	diag_query->DriverAddedBufferSize = 0;
1577	diag_query->UniqueId = pBuffer->unique_id;
1578	diag_query->ApplicationFlags = 0;
1579	diag_query->DiagnosticFlags = 0;
1580
1581	/*
1582	 * Set/Clear application flags
1583	 */
1584	if (pBuffer->immediate) {
1585		diag_query->ApplicationFlags &= ~MPR_FW_DIAG_FLAG_APP_OWNED;
1586	} else {
1587		diag_query->ApplicationFlags |= MPR_FW_DIAG_FLAG_APP_OWNED;
1588	}
1589	if (pBuffer->valid_data || pBuffer->owned_by_firmware) {
1590		diag_query->ApplicationFlags |= MPR_FW_DIAG_FLAG_BUFFER_VALID;
1591	} else {
1592		diag_query->ApplicationFlags &= ~MPR_FW_DIAG_FLAG_BUFFER_VALID;
1593	}
1594	if (pBuffer->owned_by_firmware) {
1595		diag_query->ApplicationFlags |=
1596		    MPR_FW_DIAG_FLAG_FW_BUFFER_ACCESS;
1597	} else {
1598		diag_query->ApplicationFlags &=
1599		    ~MPR_FW_DIAG_FLAG_FW_BUFFER_ACCESS;
1600	}
1601
1602	return (MPR_DIAG_SUCCESS);
1603}
1604
1605static int
1606mpr_diag_read_buffer(struct mpr_softc *sc,
1607    mpr_diag_read_buffer_t *diag_read_buffer, uint8_t *ioctl_buf,
1608    uint32_t *return_code)
1609{
1610	mpr_fw_diagnostic_buffer_t	*pBuffer;
1611	uint8_t				i, *pData;
1612	uint32_t			unique_id;
1613	int				status;
1614
1615	unique_id = diag_read_buffer->UniqueId;
1616
1617	/*
1618	 * Get the current buffer and look up the unique ID.  The unique ID
1619	 * should be there.
1620	 */
1621	i = mpr_get_fw_diag_buffer_number(sc, unique_id);
1622	if (i == MPR_FW_DIAGNOSTIC_UID_NOT_FOUND) {
1623		*return_code = MPR_FW_DIAG_ERROR_INVALID_UID;
1624		return (MPR_DIAG_FAILURE);
1625	}
1626
1627	pBuffer = &sc->fw_diag_buffer_list[i];
1628
1629	/*
1630	 * Make sure requested read is within limits
1631	 */
1632	if (diag_read_buffer->StartingOffset + diag_read_buffer->BytesToRead >
1633	    pBuffer->size) {
1634		*return_code = MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1635		return (MPR_DIAG_FAILURE);
1636	}
1637
1638	/*
1639	 * Copy the requested data from DMA to the diag_read_buffer.  The DMA
1640	 * buffer that was allocated is one contiguous buffer.
1641	 */
1642	pData = (uint8_t *)(sc->fw_diag_buffer +
1643	    diag_read_buffer->StartingOffset);
1644	if (copyout(pData, ioctl_buf, diag_read_buffer->BytesToRead) != 0)
1645		return (MPR_DIAG_FAILURE);
1646	diag_read_buffer->Status = 0;
1647
1648	/*
1649	 * Set or clear the Force Release flag.
1650	 */
1651	if (pBuffer->force_release) {
1652		diag_read_buffer->Flags |= MPR_FW_DIAG_FLAG_FORCE_RELEASE;
1653	} else {
1654		diag_read_buffer->Flags &= ~MPR_FW_DIAG_FLAG_FORCE_RELEASE;
1655	}
1656
1657	/*
1658	 * If buffer is to be reregistered, make sure it's not already owned by
1659	 * firmware first.
1660	 */
1661	status = MPR_DIAG_SUCCESS;
1662	if (!pBuffer->owned_by_firmware) {
1663		if (diag_read_buffer->Flags & MPR_FW_DIAG_FLAG_REREGISTER) {
1664			status = mpr_post_fw_diag_buffer(sc, pBuffer,
1665			    return_code);
1666		}
1667	}
1668
1669	return (status);
1670}
1671
1672static int
1673mpr_diag_release(struct mpr_softc *sc, mpr_fw_diag_release_t *diag_release,
1674    uint32_t *return_code)
1675{
1676	mpr_fw_diagnostic_buffer_t	*pBuffer;
1677	uint8_t				i;
1678	uint32_t			unique_id;
1679	int				status;
1680
1681	unique_id = diag_release->UniqueId;
1682
1683	/*
1684	 * Get the current buffer and look up the unique ID.  The unique ID
1685	 * should be there.
1686	 */
1687	i = mpr_get_fw_diag_buffer_number(sc, unique_id);
1688	if (i == MPR_FW_DIAGNOSTIC_UID_NOT_FOUND) {
1689		*return_code = MPR_FW_DIAG_ERROR_INVALID_UID;
1690		return (MPR_DIAG_FAILURE);
1691	}
1692
1693	pBuffer = &sc->fw_diag_buffer_list[i];
1694
1695	/*
1696	 * If buffer is not owned by firmware, it's already been released.
1697	 */
1698	if (!pBuffer->owned_by_firmware) {
1699		*return_code = MPR_FW_DIAG_ERROR_ALREADY_RELEASED;
1700		return (MPR_DIAG_FAILURE);
1701	}
1702
1703	/*
1704	 * Release the buffer.
1705	 */
1706	status = mpr_release_fw_diag_buffer(sc, pBuffer, return_code,
1707	    MPR_FW_DIAG_TYPE_RELEASE);
1708	return (status);
1709}
1710
1711static int
1712mpr_do_diag_action(struct mpr_softc *sc, uint32_t action, uint8_t *diag_action,
1713    uint32_t length, uint32_t *return_code)
1714{
1715	mpr_fw_diag_register_t		diag_register;
1716	mpr_fw_diag_unregister_t	diag_unregister;
1717	mpr_fw_diag_query_t		diag_query;
1718	mpr_diag_read_buffer_t		diag_read_buffer;
1719	mpr_fw_diag_release_t		diag_release;
1720	int				status = MPR_DIAG_SUCCESS;
1721	uint32_t			original_return_code;
1722
1723	original_return_code = *return_code;
1724	*return_code = MPR_FW_DIAG_ERROR_SUCCESS;
1725
1726	switch (action) {
1727		case MPR_FW_DIAG_TYPE_REGISTER:
1728			if (!length) {
1729				*return_code =
1730				    MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1731				status = MPR_DIAG_FAILURE;
1732				break;
1733			}
1734			if (copyin(diag_action, &diag_register,
1735			    sizeof(diag_register)) != 0)
1736				return (MPR_DIAG_FAILURE);
1737			status = mpr_diag_register(sc, &diag_register,
1738			    return_code);
1739			break;
1740
1741		case MPR_FW_DIAG_TYPE_UNREGISTER:
1742			if (length < sizeof(diag_unregister)) {
1743				*return_code =
1744				    MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1745				status = MPR_DIAG_FAILURE;
1746				break;
1747			}
1748			if (copyin(diag_action, &diag_unregister,
1749			    sizeof(diag_unregister)) != 0)
1750				return (MPR_DIAG_FAILURE);
1751			status = mpr_diag_unregister(sc, &diag_unregister,
1752			    return_code);
1753			break;
1754
1755		case MPR_FW_DIAG_TYPE_QUERY:
1756			if (length < sizeof (diag_query)) {
1757				*return_code =
1758				    MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1759				status = MPR_DIAG_FAILURE;
1760				break;
1761			}
1762			if (copyin(diag_action, &diag_query, sizeof(diag_query))
1763			    != 0)
1764				return (MPR_DIAG_FAILURE);
1765			status = mpr_diag_query(sc, &diag_query, return_code);
1766			if (status == MPR_DIAG_SUCCESS)
1767				if (copyout(&diag_query, diag_action,
1768				    sizeof (diag_query)) != 0)
1769					return (MPR_DIAG_FAILURE);
1770			break;
1771
1772		case MPR_FW_DIAG_TYPE_READ_BUFFER:
1773			if (copyin(diag_action, &diag_read_buffer,
1774			    sizeof(diag_read_buffer)) != 0)
1775				return (MPR_DIAG_FAILURE);
1776			if (length < diag_read_buffer.BytesToRead) {
1777				*return_code =
1778				    MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1779				status = MPR_DIAG_FAILURE;
1780				break;
1781			}
1782			status = mpr_diag_read_buffer(sc, &diag_read_buffer,
1783			    PTRIN(diag_read_buffer.PtrDataBuffer),
1784			    return_code);
1785			if (status == MPR_DIAG_SUCCESS) {
1786				if (copyout(&diag_read_buffer, diag_action,
1787				    sizeof(diag_read_buffer) -
1788				    sizeof(diag_read_buffer.PtrDataBuffer)) !=
1789				    0)
1790					return (MPR_DIAG_FAILURE);
1791			}
1792			break;
1793
1794		case MPR_FW_DIAG_TYPE_RELEASE:
1795			if (length < sizeof(diag_release)) {
1796				*return_code =
1797				    MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1798				status = MPR_DIAG_FAILURE;
1799				break;
1800			}
1801			if (copyin(diag_action, &diag_release,
1802			    sizeof(diag_release)) != 0)
1803				return (MPR_DIAG_FAILURE);
1804			status = mpr_diag_release(sc, &diag_release,
1805			    return_code);
1806			break;
1807
1808		default:
1809			*return_code = MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
1810			status = MPR_DIAG_FAILURE;
1811			break;
1812	}
1813
1814	if ((status == MPR_DIAG_FAILURE) &&
1815	    (original_return_code == MPR_FW_DIAG_NEW) &&
1816	    (*return_code != MPR_FW_DIAG_ERROR_SUCCESS))
1817		status = MPR_DIAG_SUCCESS;
1818
1819	return (status);
1820}
1821
1822static int
1823mpr_user_diag_action(struct mpr_softc *sc, mpr_diag_action_t *data)
1824{
1825	int			status;
1826
1827	/*
1828	 * Only allow one diag action at one time.
1829	 */
1830	if (sc->mpr_flags & MPR_FLAGS_BUSY) {
1831		mpr_dprint(sc, MPR_USER, "%s: Only one FW diag command "
1832		    "allowed at a single time.", __func__);
1833		return (EBUSY);
1834	}
1835	sc->mpr_flags |= MPR_FLAGS_BUSY;
1836
1837	/*
1838	 * Send diag action request
1839	 */
1840	if (data->Action == MPR_FW_DIAG_TYPE_REGISTER ||
1841	    data->Action == MPR_FW_DIAG_TYPE_UNREGISTER ||
1842	    data->Action == MPR_FW_DIAG_TYPE_QUERY ||
1843	    data->Action == MPR_FW_DIAG_TYPE_READ_BUFFER ||
1844	    data->Action == MPR_FW_DIAG_TYPE_RELEASE) {
1845		status = mpr_do_diag_action(sc, data->Action,
1846		    PTRIN(data->PtrDiagAction), data->Length,
1847		    &data->ReturnCode);
1848	} else
1849		status = EINVAL;
1850
1851	sc->mpr_flags &= ~MPR_FLAGS_BUSY;
1852	return (status);
1853}
1854
1855/*
1856 * Copy the event recording mask and the event queue size out.  For
1857 * clarification, the event recording mask (events_to_record) is not the same
1858 * thing as the event mask (event_mask).  events_to_record has a bit set for
1859 * every event type that is to be recorded by the driver, and event_mask has a
1860 * bit cleared for every event that is allowed into the driver from the IOC.
1861 * They really have nothing to do with each other.
1862 */
1863static void
1864mpr_user_event_query(struct mpr_softc *sc, mpr_event_query_t *data)
1865{
1866	uint8_t	i;
1867
1868	mpr_lock(sc);
1869	data->Entries = MPR_EVENT_QUEUE_SIZE;
1870
1871	for (i = 0; i < 4; i++) {
1872		data->Types[i] = sc->events_to_record[i];
1873	}
1874	mpr_unlock(sc);
1875}
1876
1877/*
1878 * Set the driver's event mask according to what's been given.  See
1879 * mpr_user_event_query for explanation of the event recording mask and the IOC
1880 * event mask.  It's the app's responsibility to enable event logging by setting
1881 * the bits in events_to_record.  Initially, no events will be logged.
1882 */
1883static void
1884mpr_user_event_enable(struct mpr_softc *sc, mpr_event_enable_t *data)
1885{
1886	uint8_t	i;
1887
1888	mpr_lock(sc);
1889	for (i = 0; i < 4; i++) {
1890		sc->events_to_record[i] = data->Types[i];
1891	}
1892	mpr_unlock(sc);
1893}
1894
1895/*
1896 * Copy out the events that have been recorded, up to the max events allowed.
1897 */
1898static int
1899mpr_user_event_report(struct mpr_softc *sc, mpr_event_report_t *data)
1900{
1901	int		status = 0;
1902	uint32_t	size;
1903
1904	mpr_lock(sc);
1905	size = data->Size;
1906	if ((size >= sizeof(sc->recorded_events)) && (status == 0)) {
1907		mpr_unlock(sc);
1908		if (copyout((void *)sc->recorded_events,
1909		    PTRIN(data->PtrEvents), size) != 0)
1910			status = EFAULT;
1911		mpr_lock(sc);
1912	} else {
1913		/*
1914		 * data->Size value is not large enough to copy event data.
1915		 */
1916		status = EFAULT;
1917	}
1918
1919	/*
1920	 * Change size value to match the number of bytes that were copied.
1921	 */
1922	if (status == 0)
1923		data->Size = sizeof(sc->recorded_events);
1924	mpr_unlock(sc);
1925
1926	return (status);
1927}
1928
1929/*
1930 * Record events into the driver from the IOC if they are not masked.
1931 */
1932void
1933mprsas_record_event(struct mpr_softc *sc,
1934    MPI2_EVENT_NOTIFICATION_REPLY *event_reply)
1935{
1936	uint32_t	event;
1937	int		i, j;
1938	uint16_t	event_data_len;
1939	boolean_t	sendAEN = FALSE;
1940
1941	event = event_reply->Event;
1942
1943	/*
1944	 * Generate a system event to let anyone who cares know that a
1945	 * LOG_ENTRY_ADDED event has occurred.  This is sent no matter what the
1946	 * event mask is set to.
1947	 */
1948	if (event == MPI2_EVENT_LOG_ENTRY_ADDED) {
1949		sendAEN = TRUE;
1950	}
1951
1952	/*
1953	 * Record the event only if its corresponding bit is set in
1954	 * events_to_record.  event_index is the index into recorded_events and
1955	 * event_number is the overall number of an event being recorded since
1956	 * start-of-day.  event_index will roll over; event_number will never
1957	 * roll over.
1958	 */
1959	i = (uint8_t)(event / 32);
1960	j = (uint8_t)(event % 32);
1961	if ((i < 4) && ((1 << j) & sc->events_to_record[i])) {
1962		i = sc->event_index;
1963		sc->recorded_events[i].Type = event;
1964		sc->recorded_events[i].Number = ++sc->event_number;
1965		bzero(sc->recorded_events[i].Data, MPR_MAX_EVENT_DATA_LENGTH *
1966		    4);
1967		event_data_len = event_reply->EventDataLength;
1968
1969		if (event_data_len > 0) {
1970			/*
1971			 * Limit data to size in m_event entry
1972			 */
1973			if (event_data_len > MPR_MAX_EVENT_DATA_LENGTH) {
1974				event_data_len = MPR_MAX_EVENT_DATA_LENGTH;
1975			}
1976			for (j = 0; j < event_data_len; j++) {
1977				sc->recorded_events[i].Data[j] =
1978				    event_reply->EventData[j];
1979			}
1980
1981			/*
1982			 * check for index wrap-around
1983			 */
1984			if (++i == MPR_EVENT_QUEUE_SIZE) {
1985				i = 0;
1986			}
1987			sc->event_index = (uint8_t)i;
1988
1989			/*
1990			 * Set flag to send the event.
1991			 */
1992			sendAEN = TRUE;
1993		}
1994	}
1995
1996	/*
1997	 * Generate a system event if flag is set to let anyone who cares know
1998	 * that an event has occurred.
1999	 */
2000	if (sendAEN) {
2001//SLM-how to send a system event (see kqueue, kevent)
2002//		(void) ddi_log_sysevent(mpt->m_dip, DDI_VENDOR_LSI, "MPT_SAS",
2003//		    "SAS", NULL, NULL, DDI_NOSLEEP);
2004	}
2005}
2006
2007static int
2008mpr_user_reg_access(struct mpr_softc *sc, mpr_reg_access_t *data)
2009{
2010	int	status = 0;
2011
2012	switch (data->Command) {
2013		/*
2014		 * IO access is not supported.
2015		 */
2016		case REG_IO_READ:
2017		case REG_IO_WRITE:
2018			mpr_dprint(sc, MPR_USER, "IO access is not supported. "
2019			    "Use memory access.");
2020			status = EINVAL;
2021			break;
2022
2023		case REG_MEM_READ:
2024			data->RegData = mpr_regread(sc, data->RegOffset);
2025			break;
2026
2027		case REG_MEM_WRITE:
2028			mpr_regwrite(sc, data->RegOffset, data->RegData);
2029			break;
2030
2031		default:
2032			status = EINVAL;
2033			break;
2034	}
2035
2036	return (status);
2037}
2038
2039static int
2040mpr_user_btdh(struct mpr_softc *sc, mpr_btdh_mapping_t *data)
2041{
2042	uint8_t		bt2dh = FALSE;
2043	uint8_t		dh2bt = FALSE;
2044	uint16_t	dev_handle, bus, target;
2045
2046	bus = data->Bus;
2047	target = data->TargetID;
2048	dev_handle = data->DevHandle;
2049
2050	/*
2051	 * When DevHandle is 0xFFFF and Bus/Target are not 0xFFFF, use Bus/
2052	 * Target to get DevHandle.  When Bus/Target are 0xFFFF and DevHandle is
2053	 * not 0xFFFF, use DevHandle to get Bus/Target.  Anything else is
2054	 * invalid.
2055	 */
2056	if ((bus == 0xFFFF) && (target == 0xFFFF) && (dev_handle != 0xFFFF))
2057		dh2bt = TRUE;
2058	if ((dev_handle == 0xFFFF) && (bus != 0xFFFF) && (target != 0xFFFF))
2059		bt2dh = TRUE;
2060	if (!dh2bt && !bt2dh)
2061		return (EINVAL);
2062
2063	/*
2064	 * Only handle bus of 0.  Make sure target is within range.
2065	 */
2066	if (bt2dh) {
2067		if (bus != 0)
2068			return (EINVAL);
2069
2070		if (target > sc->max_devices) {
2071			mpr_dprint(sc, MPR_FAULT, "Target ID is out of range "
2072			   "for Bus/Target to DevHandle mapping.");
2073			return (EINVAL);
2074		}
2075		dev_handle = sc->mapping_table[target].dev_handle;
2076		if (dev_handle)
2077			data->DevHandle = dev_handle;
2078	} else {
2079		bus = 0;
2080		target = mpr_mapping_get_sas_id_from_handle(sc, dev_handle);
2081		data->Bus = bus;
2082		data->TargetID = target;
2083	}
2084
2085	return (0);
2086}
2087
2088static int
2089mpr_ioctl(struct cdev *dev, u_long cmd, void *arg, int flag,
2090    struct thread *td)
2091{
2092	struct mpr_softc *sc;
2093	struct mpr_cfg_page_req *page_req;
2094	struct mpr_ext_cfg_page_req *ext_page_req;
2095	void *mpr_page;
2096	int error, msleep_ret;
2097
2098	mpr_page = NULL;
2099	sc = dev->si_drv1;
2100	page_req = (void *)arg;
2101	ext_page_req = (void *)arg;
2102
2103	switch (cmd) {
2104	case MPRIO_READ_CFG_HEADER:
2105		mpr_lock(sc);
2106		error = mpr_user_read_cfg_header(sc, page_req);
2107		mpr_unlock(sc);
2108		break;
2109	case MPRIO_READ_CFG_PAGE:
2110		mpr_page = malloc(page_req->len, M_MPRUSER, M_WAITOK | M_ZERO);
2111		error = copyin(page_req->buf, mpr_page,
2112		    sizeof(MPI2_CONFIG_PAGE_HEADER));
2113		if (error)
2114			break;
2115		mpr_lock(sc);
2116		error = mpr_user_read_cfg_page(sc, page_req, mpr_page);
2117		mpr_unlock(sc);
2118		if (error)
2119			break;
2120		error = copyout(mpr_page, page_req->buf, page_req->len);
2121		break;
2122	case MPRIO_READ_EXT_CFG_HEADER:
2123		mpr_lock(sc);
2124		error = mpr_user_read_extcfg_header(sc, ext_page_req);
2125		mpr_unlock(sc);
2126		break;
2127	case MPRIO_READ_EXT_CFG_PAGE:
2128		mpr_page = malloc(ext_page_req->len, M_MPRUSER,
2129		    M_WAITOK | M_ZERO);
2130		error = copyin(ext_page_req->buf, mpr_page,
2131		    sizeof(MPI2_CONFIG_EXTENDED_PAGE_HEADER));
2132		if (error)
2133			break;
2134		mpr_lock(sc);
2135		error = mpr_user_read_extcfg_page(sc, ext_page_req, mpr_page);
2136		mpr_unlock(sc);
2137		if (error)
2138			break;
2139		error = copyout(mpr_page, ext_page_req->buf, ext_page_req->len);
2140		break;
2141	case MPRIO_WRITE_CFG_PAGE:
2142		mpr_page = malloc(page_req->len, M_MPRUSER, M_WAITOK|M_ZERO);
2143		error = copyin(page_req->buf, mpr_page, page_req->len);
2144		if (error)
2145			break;
2146		mpr_lock(sc);
2147		error = mpr_user_write_cfg_page(sc, page_req, mpr_page);
2148		mpr_unlock(sc);
2149		break;
2150	case MPRIO_MPR_COMMAND:
2151		error = mpr_user_command(sc, (struct mpr_usr_command *)arg);
2152		break;
2153	case MPTIOCTL_PASS_THRU:
2154		/*
2155		 * The user has requested to pass through a command to be
2156		 * executed by the MPT firmware.  Call our routine which does
2157		 * this.  Only allow one passthru IOCTL at one time.
2158		 */
2159		error = mpr_user_pass_thru(sc, (mpr_pass_thru_t *)arg);
2160		break;
2161	case MPTIOCTL_GET_ADAPTER_DATA:
2162		/*
2163		 * The user has requested to read adapter data.  Call our
2164		 * routine which does this.
2165		 */
2166		error = 0;
2167		mpr_user_get_adapter_data(sc, (mpr_adapter_data_t *)arg);
2168		break;
2169	case MPTIOCTL_GET_PCI_INFO:
2170		/*
2171		 * The user has requested to read pci info.  Call
2172		 * our routine which does this.
2173		 */
2174		mpr_lock(sc);
2175		error = 0;
2176		mpr_user_read_pci_info(sc, (mpr_pci_info_t *)arg);
2177		mpr_unlock(sc);
2178		break;
2179	case MPTIOCTL_RESET_ADAPTER:
2180		mpr_lock(sc);
2181		sc->port_enable_complete = 0;
2182		uint32_t reinit_start = time_uptime;
2183		error = mpr_reinit(sc);
2184		/* Sleep for 300 second. */
2185		msleep_ret = msleep(&sc->port_enable_complete, &sc->mpr_mtx,
2186		    PRIBIO, "mpr_porten", 300 * hz);
2187		mpr_unlock(sc);
2188		if (msleep_ret)
2189			printf("Port Enable did not complete after Diag "
2190			    "Reset msleep error %d.\n", msleep_ret);
2191		else
2192			mpr_dprint(sc, MPR_USER, "Hard Reset with Port Enable "
2193			    "completed in %d seconds.\n",
2194			    (uint32_t)(time_uptime - reinit_start));
2195		break;
2196	case MPTIOCTL_DIAG_ACTION:
2197		/*
2198		 * The user has done a diag buffer action.  Call our routine
2199		 * which does this.  Only allow one diag action at one time.
2200		 */
2201		mpr_lock(sc);
2202		error = mpr_user_diag_action(sc, (mpr_diag_action_t *)arg);
2203		mpr_unlock(sc);
2204		break;
2205	case MPTIOCTL_EVENT_QUERY:
2206		/*
2207		 * The user has done an event query. Call our routine which does
2208		 * this.
2209		 */
2210		error = 0;
2211		mpr_user_event_query(sc, (mpr_event_query_t *)arg);
2212		break;
2213	case MPTIOCTL_EVENT_ENABLE:
2214		/*
2215		 * The user has done an event enable. Call our routine which
2216		 * does this.
2217		 */
2218		error = 0;
2219		mpr_user_event_enable(sc, (mpr_event_enable_t *)arg);
2220		break;
2221	case MPTIOCTL_EVENT_REPORT:
2222		/*
2223		 * The user has done an event report. Call our routine which
2224		 * does this.
2225		 */
2226		error = mpr_user_event_report(sc, (mpr_event_report_t *)arg);
2227		break;
2228	case MPTIOCTL_REG_ACCESS:
2229		/*
2230		 * The user has requested register access.  Call our routine
2231		 * which does this.
2232		 */
2233		mpr_lock(sc);
2234		error = mpr_user_reg_access(sc, (mpr_reg_access_t *)arg);
2235		mpr_unlock(sc);
2236		break;
2237	case MPTIOCTL_BTDH_MAPPING:
2238		/*
2239		 * The user has requested to translate a bus/target to a
2240		 * DevHandle or a DevHandle to a bus/target.  Call our routine
2241		 * which does this.
2242		 */
2243		error = mpr_user_btdh(sc, (mpr_btdh_mapping_t *)arg);
2244		break;
2245	default:
2246		error = ENOIOCTL;
2247		break;
2248	}
2249
2250	if (mpr_page != NULL)
2251		free(mpr_page, M_MPRUSER);
2252
2253	return (error);
2254}
2255
2256#ifdef COMPAT_FREEBSD32
2257
2258struct mpr_cfg_page_req32 {
2259	MPI2_CONFIG_PAGE_HEADER header;
2260	uint32_t page_address;
2261	uint32_t buf;
2262	int	len;
2263	uint16_t ioc_status;
2264};
2265
2266struct mpr_ext_cfg_page_req32 {
2267	MPI2_CONFIG_EXTENDED_PAGE_HEADER header;
2268	uint32_t page_address;
2269	uint32_t buf;
2270	int	len;
2271	uint16_t ioc_status;
2272};
2273
2274struct mpr_raid_action32 {
2275	uint8_t action;
2276	uint8_t volume_bus;
2277	uint8_t volume_id;
2278	uint8_t phys_disk_num;
2279	uint32_t action_data_word;
2280	uint32_t buf;
2281	int len;
2282	uint32_t volume_status;
2283	uint32_t action_data[4];
2284	uint16_t action_status;
2285	uint16_t ioc_status;
2286	uint8_t write;
2287};
2288
2289struct mpr_usr_command32 {
2290	uint32_t req;
2291	uint32_t req_len;
2292	uint32_t rpl;
2293	uint32_t rpl_len;
2294	uint32_t buf;
2295	int len;
2296	uint32_t flags;
2297};
2298
2299#define	MPRIO_READ_CFG_HEADER32	_IOWR('M', 200, struct mpr_cfg_page_req32)
2300#define	MPRIO_READ_CFG_PAGE32	_IOWR('M', 201, struct mpr_cfg_page_req32)
2301#define	MPRIO_READ_EXT_CFG_HEADER32 _IOWR('M', 202, struct mpr_ext_cfg_page_req32)
2302#define	MPRIO_READ_EXT_CFG_PAGE32 _IOWR('M', 203, struct mpr_ext_cfg_page_req32)
2303#define	MPRIO_WRITE_CFG_PAGE32	_IOWR('M', 204, struct mpr_cfg_page_req32)
2304#define	MPRIO_RAID_ACTION32	_IOWR('M', 205, struct mpr_raid_action32)
2305#define	MPRIO_MPR_COMMAND32	_IOWR('M', 210, struct mpr_usr_command32)
2306
2307static int
2308mpr_ioctl32(struct cdev *dev, u_long cmd32, void *_arg, int flag,
2309    struct thread *td)
2310{
2311	struct mpr_cfg_page_req32 *page32 = _arg;
2312	struct mpr_ext_cfg_page_req32 *ext32 = _arg;
2313	struct mpr_raid_action32 *raid32 = _arg;
2314	struct mpr_usr_command32 *user32 = _arg;
2315	union {
2316		struct mpr_cfg_page_req page;
2317		struct mpr_ext_cfg_page_req ext;
2318		struct mpr_raid_action raid;
2319		struct mpr_usr_command user;
2320	} arg;
2321	u_long cmd;
2322	int error;
2323
2324	switch (cmd32) {
2325	case MPRIO_READ_CFG_HEADER32:
2326	case MPRIO_READ_CFG_PAGE32:
2327	case MPRIO_WRITE_CFG_PAGE32:
2328		if (cmd32 == MPRIO_READ_CFG_HEADER32)
2329			cmd = MPRIO_READ_CFG_HEADER;
2330		else if (cmd32 == MPRIO_READ_CFG_PAGE32)
2331			cmd = MPRIO_READ_CFG_PAGE;
2332		else
2333			cmd = MPRIO_WRITE_CFG_PAGE;
2334		CP(*page32, arg.page, header);
2335		CP(*page32, arg.page, page_address);
2336		PTRIN_CP(*page32, arg.page, buf);
2337		CP(*page32, arg.page, len);
2338		CP(*page32, arg.page, ioc_status);
2339		break;
2340
2341	case MPRIO_READ_EXT_CFG_HEADER32:
2342	case MPRIO_READ_EXT_CFG_PAGE32:
2343		if (cmd32 == MPRIO_READ_EXT_CFG_HEADER32)
2344			cmd = MPRIO_READ_EXT_CFG_HEADER;
2345		else
2346			cmd = MPRIO_READ_EXT_CFG_PAGE;
2347		CP(*ext32, arg.ext, header);
2348		CP(*ext32, arg.ext, page_address);
2349		PTRIN_CP(*ext32, arg.ext, buf);
2350		CP(*ext32, arg.ext, len);
2351		CP(*ext32, arg.ext, ioc_status);
2352		break;
2353
2354	case MPRIO_RAID_ACTION32:
2355		cmd = MPRIO_RAID_ACTION;
2356		CP(*raid32, arg.raid, action);
2357		CP(*raid32, arg.raid, volume_bus);
2358		CP(*raid32, arg.raid, volume_id);
2359		CP(*raid32, arg.raid, phys_disk_num);
2360		CP(*raid32, arg.raid, action_data_word);
2361		PTRIN_CP(*raid32, arg.raid, buf);
2362		CP(*raid32, arg.raid, len);
2363		CP(*raid32, arg.raid, volume_status);
2364		bcopy(raid32->action_data, arg.raid.action_data,
2365		    sizeof arg.raid.action_data);
2366		CP(*raid32, arg.raid, ioc_status);
2367		CP(*raid32, arg.raid, write);
2368		break;
2369
2370	case MPRIO_MPR_COMMAND32:
2371		cmd = MPRIO_MPR_COMMAND;
2372		PTRIN_CP(*user32, arg.user, req);
2373		CP(*user32, arg.user, req_len);
2374		PTRIN_CP(*user32, arg.user, rpl);
2375		CP(*user32, arg.user, rpl_len);
2376		PTRIN_CP(*user32, arg.user, buf);
2377		CP(*user32, arg.user, len);
2378		CP(*user32, arg.user, flags);
2379		break;
2380	default:
2381		return (ENOIOCTL);
2382	}
2383
2384	error = mpr_ioctl(dev, cmd, &arg, flag, td);
2385	if (error == 0 && (cmd32 & IOC_OUT) != 0) {
2386		switch (cmd32) {
2387		case MPRIO_READ_CFG_HEADER32:
2388		case MPRIO_READ_CFG_PAGE32:
2389		case MPRIO_WRITE_CFG_PAGE32:
2390			CP(arg.page, *page32, header);
2391			CP(arg.page, *page32, page_address);
2392			PTROUT_CP(arg.page, *page32, buf);
2393			CP(arg.page, *page32, len);
2394			CP(arg.page, *page32, ioc_status);
2395			break;
2396
2397		case MPRIO_READ_EXT_CFG_HEADER32:
2398		case MPRIO_READ_EXT_CFG_PAGE32:
2399			CP(arg.ext, *ext32, header);
2400			CP(arg.ext, *ext32, page_address);
2401			PTROUT_CP(arg.ext, *ext32, buf);
2402			CP(arg.ext, *ext32, len);
2403			CP(arg.ext, *ext32, ioc_status);
2404			break;
2405
2406		case MPRIO_RAID_ACTION32:
2407			CP(arg.raid, *raid32, action);
2408			CP(arg.raid, *raid32, volume_bus);
2409			CP(arg.raid, *raid32, volume_id);
2410			CP(arg.raid, *raid32, phys_disk_num);
2411			CP(arg.raid, *raid32, action_data_word);
2412			PTROUT_CP(arg.raid, *raid32, buf);
2413			CP(arg.raid, *raid32, len);
2414			CP(arg.raid, *raid32, volume_status);
2415			bcopy(arg.raid.action_data, raid32->action_data,
2416			    sizeof arg.raid.action_data);
2417			CP(arg.raid, *raid32, ioc_status);
2418			CP(arg.raid, *raid32, write);
2419			break;
2420
2421		case MPRIO_MPR_COMMAND32:
2422			PTROUT_CP(arg.user, *user32, req);
2423			CP(arg.user, *user32, req_len);
2424			PTROUT_CP(arg.user, *user32, rpl);
2425			CP(arg.user, *user32, rpl_len);
2426			PTROUT_CP(arg.user, *user32, buf);
2427			CP(arg.user, *user32, len);
2428			CP(arg.user, *user32, flags);
2429			break;
2430		}
2431	}
2432
2433	return (error);
2434}
2435#endif /* COMPAT_FREEBSD32 */
2436
2437static int
2438mpr_ioctl_devsw(struct cdev *dev, u_long com, caddr_t arg, int flag,
2439    struct thread *td)
2440{
2441#ifdef COMPAT_FREEBSD32
2442	if (SV_CURPROC_FLAG(SV_ILP32))
2443		return (mpr_ioctl32(dev, com, arg, flag, td));
2444#endif
2445	return (mpr_ioctl(dev, com, arg, flag, td));
2446}
2447