Minor overhaul of SMBus support:

- Change smbus_callback() to pass a void * rather than caddr_t.
- Change smbus_bread() to pass a pointer to the count and have it be an
  in/out parameter.  The input is the size of the buffer (same as before),
  but on return it will contain the actual amount of data read back from
  the bus.  Note that this value may be larger than the input value.  It
  is up to the caller to treat this as an error if desired.
- Change the SMB_BREAD ioctl to write out the updated struct smbcmd which
  will contain the actual number of bytes read in the 'count' field.  To
  preserve the previous ABI, the old ioctl value is mapped to SMB_OLD_BREAD
  which doesn't copy the updated smbcmd back out to userland.  I doubt anyone
  actually used the old BREAD anyway as it was rediculous to do a bulk-read
  but not tell the using program how much data was actually read.
- Make the smbus driver and devclass public in the smbus module and
  push all the DRIVER_MODULE()'s for attaching the smbus driver to
  various foosmb drivers out into the foosmb modules.  This makes all
  the foosmb logic centralized and allows new foosmb modules to be
  self-contained w/o having to hack smbus.c everytime a new smbus driver
  is added.
- Add a new SMB_EINVAL error bit and use it in place of EINVAL to return
  an error for bad arguments (such as invalid counts for bread and bwrite).
- Map SMB bus error bits to EIO in smbus_error().
- Make the smbus driver call bus_generic_probe() and require child drivers
  such as smb(4) to create device_t's via identify routines.  Previously,
  smbus just created one anonymous device during attach, and if you had
  multiple drivers that could attach it was just random chance as to which
  driver got to probe for the sole device_t first.
- Add a mutex to the smbus(4) softc and use it in place of dummy splhigh()
  to protect the 'owner' field and perform necessary synchronization for
  smbus_request_bus() and smbus_release_bus().
- Change the bread() and bwrite() methods of alpm(4), amdpm(4), and
  viapm(4) to only perform a single transaction and not try to use a
  loop of multiple transactions for a large request.  The framing and
  commands to use for a large transaction depend on the upper-layer
  protocol (such as SSIF for IPMI over SMBus) from what I can tell, and the
  smb(4) driver never allowed bulk read/writes of more than 32-bytes
  anyway.  The other smb drivers only performed single transactions.
- Fix buffer overflows in the bread() methods of ichsmb(4), alpm(4),
  amdpm(4), amdsmb(4), intpm(4), and nfsmb(4).
- Use SMB_xxx errors in viapm(4).
- Destroy ichsmb(4)'s mutex after bus_generic_detach() to avoid problems
  from child devices making smb upcalls that would use the mutex during
  their detach methods.

MFC after:	1 week
Reviewed by:	jmg (mostly)

1 files changed, 45 insertions, 50 deletions

diff --git a/sys/pci/amdpm.c b/sys/pci/amdpm.c
index 841b0373d425..fb34642d4765 100644
--- a/sys/pci/amdpm.c
+++ b/sys/pci/amdpm.c
@@ -236,7 +236,7 @@ amdpm_detach(device_t dev)
 }
 
 static int
-amdpm_callback(device_t dev, int index, caddr_t *data)
+amdpm_callback(device_t dev, int index, void *data)
 {
 	int error = 0;
 
@@ -504,84 +504,79 @@ static int
 amdpm_bwrite(device_t dev, u_char slave, char cmd, u_char count, char *buf)
 {
 	struct amdpm_softc *sc = (struct amdpm_softc *)device_get_softc(dev);
-	u_char remain, len, i;
-	int error = SMB_ENOERR;
+	u_char i;
+	int error;
 	u_short l;
 
+	if (count < 1 || count > 32)
+		return (SMB_EINVAL);
 	amdpm_clear(sc);
 	if(!amdpm_idle(sc))
 		return (SMB_EBUSY);
 
-	remain = count;
-	while (remain) {
-		len = min(remain, 32);
-
-		AMDPM_SMBOUTW(sc, AMDSMB_HSTADDR, slave & ~LSB);
+	AMDPM_SMBOUTW(sc, AMDSMB_HSTADDR, slave & ~LSB);
 	
-		/*
-		 * Do we have to reset the internal 32-byte buffer?
-		 * Can't see how to do this from the data sheet.
-		 */
-
-		AMDPM_SMBOUTW(sc, AMDSMB_HSTDATA, len);
-
-		/* Fill the 32-byte internal buffer */
-		for (i=0; i<len; i++) {
-			AMDPM_SMBOUTB(sc, AMDSMB_HSTDFIFO, buf[count-remain+i]);
-			DELAY(2);
-		}
-		AMDPM_SMBOUTB(sc, AMDSMB_HSTCMD, cmd);
-		l = AMDPM_SMBINW(sc, AMDSMB_GLOBAL_ENABLE);
-		AMDPM_SMBOUTW(sc, AMDSMB_GLOBAL_ENABLE, (l & 0xfff8) | AMDSMB_GE_CYC_BLOCK | AMDSMB_GE_HOST_STC);
-
-		if ((error = amdpm_wait(sc)) != SMB_ENOERR)
-			goto error;
-
-		remain -= len;
+	/*
+	 * Do we have to reset the internal 32-byte buffer?
+	 * Can't see how to do this from the data sheet.
+	 */
+	AMDPM_SMBOUTW(sc, AMDSMB_HSTDATA, count);
+
+	/* Fill the 32-byte internal buffer */
+	for (i = 0; i < count; i++) {
+		AMDPM_SMBOUTB(sc, AMDSMB_HSTDFIFO, buf[i]);
+		DELAY(2);
 	}
+	AMDPM_SMBOUTB(sc, AMDSMB_HSTCMD, cmd);
+	l = AMDPM_SMBINW(sc, AMDSMB_GLOBAL_ENABLE);
+	AMDPM_SMBOUTW(sc, AMDSMB_GLOBAL_ENABLE,
+	    (l & 0xfff8) | AMDSMB_GE_CYC_BLOCK | AMDSMB_GE_HOST_STC);
+
+	error = amdpm_wait(sc);
 
-error:
 	AMDPM_DEBUG(printf("amdpm: WRITEBLK to 0x%x, count=0x%x, cmd=0x%x, error=0x%x", slave, count, cmd, error));
 
 	return (error);
 }
 
 static int
-amdpm_bread(device_t dev, u_char slave, char cmd, u_char count, char *buf)
+amdpm_bread(device_t dev, u_char slave, char cmd, u_char *count, char *buf)
 {
 	struct amdpm_softc *sc = (struct amdpm_softc *)device_get_softc(dev);
-	u_char remain, len, i;
-	int error = SMB_ENOERR;
+	u_char data, len, i;
+	int error;
 	u_short l;
 
+	if (*count < 1 || *count > 32)
+		return (SMB_EINVAL);
 	amdpm_clear(sc);
 	if (!amdpm_idle(sc))
 		return (SMB_EBUSY);
 
-	remain = count;
-	while (remain) {
-		AMDPM_SMBOUTW(sc, AMDSMB_HSTADDR, slave | LSB);
+	AMDPM_SMBOUTW(sc, AMDSMB_HSTADDR, slave | LSB);
 	
-		AMDPM_SMBOUTB(sc, AMDSMB_HSTCMD, cmd);
+	AMDPM_SMBOUTB(sc, AMDSMB_HSTCMD, cmd);
 
-		l = AMDPM_SMBINW(sc, AMDSMB_GLOBAL_ENABLE);
-		AMDPM_SMBOUTW(sc, AMDSMB_GLOBAL_ENABLE, (l & 0xfff8) | AMDSMB_GE_CYC_BLOCK | AMDSMB_GE_HOST_STC);
+	l = AMDPM_SMBINW(sc, AMDSMB_GLOBAL_ENABLE);
+	AMDPM_SMBOUTW(sc, AMDSMB_GLOBAL_ENABLE,
+	    (l & 0xfff8) | AMDSMB_GE_CYC_BLOCK | AMDSMB_GE_HOST_STC);
 		
-		if ((error = amdpm_wait(sc)) != SMB_ENOERR)
-			goto error;
-
-		len = AMDPM_SMBINW(sc, AMDSMB_HSTDATA);
+	if ((error = amdpm_wait(sc)) != SMB_ENOERR)
+		goto error;
 
-		/* Read the 32-byte internal buffer */
-		for (i=0; i<len; i++) {
-			buf[count-remain+i] = AMDPM_SMBINB(sc, AMDSMB_HSTDFIFO);
-			DELAY(2);
-		}
+	len = AMDPM_SMBINW(sc, AMDSMB_HSTDATA);
 
-		remain -= len;
+	/* Read the 32-byte internal buffer */
+	for (i = 0; i < len; i++) {
+		data = AMDPM_SMBINB(sc, AMDSMB_HSTDFIFO);
+		if (i < *count)
+			buf[i] = data;
+		DELAY(2);
 	}
+	*count = len;
+
 error:
-	AMDPM_DEBUG(printf("amdpm: READBLK to 0x%x, count=0x%x, cmd=0x%x, error=0x%x", slave, count, cmd, error));
+	AMDPM_DEBUG(printf("amdpm: READBLK to 0x%x, count=0x%x, cmd=0x%x, error=0x%x", slave, *count, cmd, error));
 
 	return (error);
 }
@@ -616,8 +611,8 @@ static driver_t amdpm_driver = {
 };
 
 DRIVER_MODULE(amdpm, pci, amdpm_driver, amdpm_devclass, 0, 0);
+DRIVER_MODULE(smbus, amdpm, smbus_driver, smbus_devclass, 0, 0);
 
 MODULE_DEPEND(amdpm, pci, 1, 1, 1);
 MODULE_DEPEND(amdpm, smbus, SMBUS_MINVER, SMBUS_PREFVER, SMBUS_MAXVER);
 MODULE_VERSION(amdpm, 1);
-