xref: /linux/drivers/scsi/aacraid/commctrl.c (revision 173d6681380aa1d60dfc35ed7178bd7811ba2784)
1 /*
2  *	Adaptec AAC series RAID controller driver
3  *	(c) Copyright 2001 Red Hat Inc.	<alan@redhat.com>
4  *
5  * based on the old aacraid driver that is..
6  * Adaptec aacraid device driver for Linux.
7  *
8  * Copyright (c) 2000 Adaptec, Inc. (aacraid@adaptec.com)
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License as published by
12  * the Free Software Foundation; either version 2, or (at your option)
13  * any later version.
14  *
15  * This program is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18  * GNU General Public License for more details.
19  *
20  * You should have received a copy of the GNU General Public License
21  * along with this program; see the file COPYING.  If not, write to
22  * the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
23  *
24  * Module Name:
25  *  commctrl.c
26  *
27  * Abstract: Contains all routines for control of the AFA comm layer
28  *
29  */
30 
31 #include <linux/kernel.h>
32 #include <linux/init.h>
33 #include <linux/types.h>
34 #include <linux/sched.h>
35 #include <linux/pci.h>
36 #include <linux/spinlock.h>
37 #include <linux/slab.h>
38 #include <linux/completion.h>
39 #include <linux/dma-mapping.h>
40 #include <linux/blkdev.h>
41 #include <linux/delay.h> /* ssleep prototype */
42 #include <linux/kthread.h>
43 #include <asm/semaphore.h>
44 #include <asm/uaccess.h>
45 
46 #include "aacraid.h"
47 
48 /**
49  *	ioctl_send_fib	-	send a FIB from userspace
50  *	@dev:	adapter is being processed
51  *	@arg:	arguments to the ioctl call
52  *
53  *	This routine sends a fib to the adapter on behalf of a user level
54  *	program.
55  */
56 # define AAC_DEBUG_PREAMBLE	KERN_INFO
57 # define AAC_DEBUG_POSTAMBLE
58 
59 static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
60 {
61 	struct hw_fib * kfib;
62 	struct fib *fibptr;
63 	struct hw_fib * hw_fib = (struct hw_fib *)0;
64 	dma_addr_t hw_fib_pa = (dma_addr_t)0LL;
65 	unsigned size;
66 	int retval;
67 
68 	fibptr = aac_fib_alloc(dev);
69 	if(fibptr == NULL) {
70 		return -ENOMEM;
71 	}
72 
73 	kfib = fibptr->hw_fib;
74 	/*
75 	 *	First copy in the header so that we can check the size field.
76 	 */
77 	if (copy_from_user((void *)kfib, arg, sizeof(struct aac_fibhdr))) {
78 		aac_fib_free(fibptr);
79 		return -EFAULT;
80 	}
81 	/*
82 	 *	Since we copy based on the fib header size, make sure that we
83 	 *	will not overrun the buffer when we copy the memory. Return
84 	 *	an error if we would.
85 	 */
86 	size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr);
87 	if (size < le16_to_cpu(kfib->header.SenderSize))
88 		size = le16_to_cpu(kfib->header.SenderSize);
89 	if (size > dev->max_fib_size) {
90 		if (size > 2048) {
91 			retval = -EINVAL;
92 			goto cleanup;
93 		}
94 		/* Highjack the hw_fib */
95 		hw_fib = fibptr->hw_fib;
96 		hw_fib_pa = fibptr->hw_fib_pa;
97 		fibptr->hw_fib = kfib = pci_alloc_consistent(dev->pdev, size, &fibptr->hw_fib_pa);
98 		memset(((char *)kfib) + dev->max_fib_size, 0, size - dev->max_fib_size);
99 		memcpy(kfib, hw_fib, dev->max_fib_size);
100 	}
101 
102 	if (copy_from_user(kfib, arg, size)) {
103 		retval = -EFAULT;
104 		goto cleanup;
105 	}
106 
107 	if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) {
108 		aac_adapter_interrupt(dev);
109 		/*
110 		 * Since we didn't really send a fib, zero out the state to allow
111 		 * cleanup code not to assert.
112 		 */
113 		kfib->header.XferState = 0;
114 	} else {
115 		retval = aac_fib_send(le16_to_cpu(kfib->header.Command), fibptr,
116 				le16_to_cpu(kfib->header.Size) , FsaNormal,
117 				1, 1, NULL, NULL);
118 		if (retval) {
119 			goto cleanup;
120 		}
121 		if (aac_fib_complete(fibptr) != 0) {
122 			retval = -EINVAL;
123 			goto cleanup;
124 		}
125 	}
126 	/*
127 	 *	Make sure that the size returned by the adapter (which includes
128 	 *	the header) is less than or equal to the size of a fib, so we
129 	 *	don't corrupt application data. Then copy that size to the user
130 	 *	buffer. (Don't try to add the header information again, since it
131 	 *	was already included by the adapter.)
132 	 */
133 
134 	retval = 0;
135 	if (copy_to_user(arg, (void *)kfib, size))
136 		retval = -EFAULT;
137 cleanup:
138 	if (hw_fib) {
139 		pci_free_consistent(dev->pdev, size, kfib, fibptr->hw_fib_pa);
140 		fibptr->hw_fib_pa = hw_fib_pa;
141 		fibptr->hw_fib = hw_fib;
142 	}
143 	if (retval != -EINTR)
144 		aac_fib_free(fibptr);
145 	return retval;
146 }
147 
148 /**
149  *	open_getadapter_fib	-	Get the next fib
150  *
151  *	This routine will get the next Fib, if available, from the AdapterFibContext
152  *	passed in from the user.
153  */
154 
155 static int open_getadapter_fib(struct aac_dev * dev, void __user *arg)
156 {
157 	struct aac_fib_context * fibctx;
158 	int status;
159 
160 	fibctx = kmalloc(sizeof(struct aac_fib_context), GFP_KERNEL);
161 	if (fibctx == NULL) {
162 		status = -ENOMEM;
163 	} else {
164 		unsigned long flags;
165 		struct list_head * entry;
166 		struct aac_fib_context * context;
167 
168 		fibctx->type = FSAFS_NTC_GET_ADAPTER_FIB_CONTEXT;
169 		fibctx->size = sizeof(struct aac_fib_context);
170  		/*
171 		 *	Yes yes, I know this could be an index, but we have a
172 		 * better guarantee of uniqueness for the locked loop below.
173 		 * Without the aid of a persistent history, this also helps
174 		 * reduce the chance that the opaque context would be reused.
175 		 */
176 		fibctx->unique = (u32)((ulong)fibctx & 0xFFFFFFFF);
177 		/*
178 		 *	Initialize the mutex used to wait for the next AIF.
179 		 */
180 		init_MUTEX_LOCKED(&fibctx->wait_sem);
181 		fibctx->wait = 0;
182 		/*
183 		 *	Initialize the fibs and set the count of fibs on
184 		 *	the list to 0.
185 		 */
186 		fibctx->count = 0;
187 		INIT_LIST_HEAD(&fibctx->fib_list);
188 		fibctx->jiffies = jiffies/HZ;
189 		/*
190 		 *	Now add this context onto the adapter's
191 		 *	AdapterFibContext list.
192 		 */
193 		spin_lock_irqsave(&dev->fib_lock, flags);
194 		/* Ensure that we have a unique identifier */
195 		entry = dev->fib_list.next;
196 		while (entry != &dev->fib_list) {
197 			context = list_entry(entry, struct aac_fib_context, next);
198 			if (context->unique == fibctx->unique) {
199 				/* Not unique (32 bits) */
200 				fibctx->unique++;
201 				entry = dev->fib_list.next;
202 			} else {
203 				entry = entry->next;
204 			}
205 		}
206 		list_add_tail(&fibctx->next, &dev->fib_list);
207 		spin_unlock_irqrestore(&dev->fib_lock, flags);
208 		if (copy_to_user(arg,  &fibctx->unique,
209 						sizeof(fibctx->unique))) {
210 			status = -EFAULT;
211 		} else {
212 			status = 0;
213 		}
214 	}
215 	return status;
216 }
217 
218 /**
219  *	next_getadapter_fib	-	get the next fib
220  *	@dev: adapter to use
221  *	@arg: ioctl argument
222  *
223  * 	This routine will get the next Fib, if available, from the AdapterFibContext
224  *	passed in from the user.
225  */
226 
227 static int next_getadapter_fib(struct aac_dev * dev, void __user *arg)
228 {
229 	struct fib_ioctl f;
230 	struct fib *fib;
231 	struct aac_fib_context *fibctx;
232 	int status;
233 	struct list_head * entry;
234 	unsigned long flags;
235 
236 	if(copy_from_user((void *)&f, arg, sizeof(struct fib_ioctl)))
237 		return -EFAULT;
238 	/*
239 	 *	Verify that the HANDLE passed in was a valid AdapterFibContext
240 	 *
241 	 *	Search the list of AdapterFibContext addresses on the adapter
242 	 *	to be sure this is a valid address
243 	 */
244 	entry = dev->fib_list.next;
245 	fibctx = NULL;
246 
247 	while (entry != &dev->fib_list) {
248 		fibctx = list_entry(entry, struct aac_fib_context, next);
249 		/*
250 		 *	Extract the AdapterFibContext from the Input parameters.
251 		 */
252 		if (fibctx->unique == f.fibctx) {   /* We found a winner */
253 			break;
254 		}
255 		entry = entry->next;
256 		fibctx = NULL;
257 	}
258 	if (!fibctx) {
259 		dprintk ((KERN_INFO "Fib Context not found\n"));
260 		return -EINVAL;
261 	}
262 
263 	if((fibctx->type != FSAFS_NTC_GET_ADAPTER_FIB_CONTEXT) ||
264 		 (fibctx->size != sizeof(struct aac_fib_context))) {
265 		dprintk ((KERN_INFO "Fib Context corrupt?\n"));
266 		return -EINVAL;
267 	}
268 	status = 0;
269 	spin_lock_irqsave(&dev->fib_lock, flags);
270 	/*
271 	 *	If there are no fibs to send back, then either wait or return
272 	 *	-EAGAIN
273 	 */
274 return_fib:
275 	if (!list_empty(&fibctx->fib_list)) {
276 		struct list_head * entry;
277 		/*
278 		 *	Pull the next fib from the fibs
279 		 */
280 		entry = fibctx->fib_list.next;
281 		list_del(entry);
282 
283 		fib = list_entry(entry, struct fib, fiblink);
284 		fibctx->count--;
285 		spin_unlock_irqrestore(&dev->fib_lock, flags);
286 		if (copy_to_user(f.fib, fib->hw_fib, sizeof(struct hw_fib))) {
287 			kfree(fib->hw_fib);
288 			kfree(fib);
289 			return -EFAULT;
290 		}
291 		/*
292 		 *	Free the space occupied by this copy of the fib.
293 		 */
294 		kfree(fib->hw_fib);
295 		kfree(fib);
296 		status = 0;
297 	} else {
298 		spin_unlock_irqrestore(&dev->fib_lock, flags);
299 		/* If someone killed the AIF aacraid thread, restart it */
300 		status = !dev->aif_thread;
301 		if (status && !dev->in_reset && dev->queues && dev->fsa_dev) {
302 			/* Be paranoid, be very paranoid! */
303 			kthread_stop(dev->thread);
304 			ssleep(1);
305 			dev->aif_thread = 0;
306 			dev->thread = kthread_run(aac_command_thread, dev, dev->name);
307 			ssleep(1);
308 		}
309 		if (f.wait) {
310 			if(down_interruptible(&fibctx->wait_sem) < 0) {
311 				status = -EINTR;
312 			} else {
313 				/* Lock again and retry */
314 				spin_lock_irqsave(&dev->fib_lock, flags);
315 				goto return_fib;
316 			}
317 		} else {
318 			status = -EAGAIN;
319 		}
320 	}
321 	fibctx->jiffies = jiffies/HZ;
322 	return status;
323 }
324 
325 int aac_close_fib_context(struct aac_dev * dev, struct aac_fib_context * fibctx)
326 {
327 	struct fib *fib;
328 
329 	/*
330 	 *	First free any FIBs that have not been consumed.
331 	 */
332 	while (!list_empty(&fibctx->fib_list)) {
333 		struct list_head * entry;
334 		/*
335 		 *	Pull the next fib from the fibs
336 		 */
337 		entry = fibctx->fib_list.next;
338 		list_del(entry);
339 		fib = list_entry(entry, struct fib, fiblink);
340 		fibctx->count--;
341 		/*
342 		 *	Free the space occupied by this copy of the fib.
343 		 */
344 		kfree(fib->hw_fib);
345 		kfree(fib);
346 	}
347 	/*
348 	 *	Remove the Context from the AdapterFibContext List
349 	 */
350 	list_del(&fibctx->next);
351 	/*
352 	 *	Invalidate context
353 	 */
354 	fibctx->type = 0;
355 	/*
356 	 *	Free the space occupied by the Context
357 	 */
358 	kfree(fibctx);
359 	return 0;
360 }
361 
362 /**
363  *	close_getadapter_fib	-	close down user fib context
364  *	@dev: adapter
365  *	@arg: ioctl arguments
366  *
367  *	This routine will close down the fibctx passed in from the user.
368  */
369 
370 static int close_getadapter_fib(struct aac_dev * dev, void __user *arg)
371 {
372 	struct aac_fib_context *fibctx;
373 	int status;
374 	unsigned long flags;
375 	struct list_head * entry;
376 
377 	/*
378 	 *	Verify that the HANDLE passed in was a valid AdapterFibContext
379 	 *
380 	 *	Search the list of AdapterFibContext addresses on the adapter
381 	 *	to be sure this is a valid address
382 	 */
383 
384 	entry = dev->fib_list.next;
385 	fibctx = NULL;
386 
387 	while(entry != &dev->fib_list) {
388 		fibctx = list_entry(entry, struct aac_fib_context, next);
389 		/*
390 		 *	Extract the fibctx from the input parameters
391 		 */
392 		if (fibctx->unique == (u32)(unsigned long)arg) {
393 			/* We found a winner */
394 			break;
395 		}
396 		entry = entry->next;
397 		fibctx = NULL;
398 	}
399 
400 	if (!fibctx)
401 		return 0; /* Already gone */
402 
403 	if((fibctx->type != FSAFS_NTC_GET_ADAPTER_FIB_CONTEXT) ||
404 		 (fibctx->size != sizeof(struct aac_fib_context)))
405 		return -EINVAL;
406 	spin_lock_irqsave(&dev->fib_lock, flags);
407 	status = aac_close_fib_context(dev, fibctx);
408 	spin_unlock_irqrestore(&dev->fib_lock, flags);
409 	return status;
410 }
411 
412 /**
413  *	check_revision	-	close down user fib context
414  *	@dev: adapter
415  *	@arg: ioctl arguments
416  *
417  *	This routine returns the driver version.
418  *      Under Linux, there have been no version incompatibilities, so this is
419  *      simple!
420  */
421 
422 static int check_revision(struct aac_dev *dev, void __user *arg)
423 {
424 	struct revision response;
425 	char *driver_version = aac_driver_version;
426 	u32 version;
427 
428 	response.compat = 1;
429 	version = (simple_strtol(driver_version,
430 				&driver_version, 10) << 24) | 0x00000400;
431 	version += simple_strtol(driver_version + 1, &driver_version, 10) << 16;
432 	version += simple_strtol(driver_version + 1, NULL, 10);
433 	response.version = cpu_to_le32(version);
434 #	if (defined(AAC_DRIVER_BUILD))
435 		response.build = cpu_to_le32(AAC_DRIVER_BUILD);
436 #	else
437 		response.build = cpu_to_le32(9999);
438 #	endif
439 
440 	if (copy_to_user(arg, &response, sizeof(response)))
441 		return -EFAULT;
442 	return 0;
443 }
444 
445 
446 /**
447  *
448  * aac_send_raw_scb
449  *
450  */
451 
452 static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
453 {
454 	struct fib* srbfib;
455 	int status;
456 	struct aac_srb *srbcmd = NULL;
457 	struct user_aac_srb *user_srbcmd = NULL;
458 	struct user_aac_srb __user *user_srb = arg;
459 	struct aac_srb_reply __user *user_reply;
460 	struct aac_srb_reply* reply;
461 	u32 fibsize = 0;
462 	u32 flags = 0;
463 	s32 rcode = 0;
464 	u32 data_dir;
465 	void __user *sg_user[32];
466 	void *sg_list[32];
467 	u32   sg_indx = 0;
468 	u32 byte_count = 0;
469 	u32 actual_fibsize = 0;
470 	int i;
471 
472 
473 	if (!capable(CAP_SYS_ADMIN)){
474 		dprintk((KERN_DEBUG"aacraid: No permission to send raw srb\n"));
475 		return -EPERM;
476 	}
477 	/*
478 	 *	Allocate and initialize a Fib then setup a BlockWrite command
479 	 */
480 	if (!(srbfib = aac_fib_alloc(dev))) {
481 		return -ENOMEM;
482 	}
483 	aac_fib_init(srbfib);
484 
485 	srbcmd = (struct aac_srb*) fib_data(srbfib);
486 
487 	memset(sg_list, 0, sizeof(sg_list)); /* cleanup may take issue */
488 	if(copy_from_user(&fibsize, &user_srb->count,sizeof(u32))){
489 		dprintk((KERN_DEBUG"aacraid: Could not copy data size from user\n"));
490 		rcode = -EFAULT;
491 		goto cleanup;
492 	}
493 
494 	if (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr))) {
495 		rcode = -EINVAL;
496 		goto cleanup;
497 	}
498 
499 	user_srbcmd = kmalloc(fibsize, GFP_KERNEL);
500 	if (!user_srbcmd) {
501 		dprintk((KERN_DEBUG"aacraid: Could not make a copy of the srb\n"));
502 		rcode = -ENOMEM;
503 		goto cleanup;
504 	}
505 	if(copy_from_user(user_srbcmd, user_srb,fibsize)){
506 		dprintk((KERN_DEBUG"aacraid: Could not copy srb from user\n"));
507 		rcode = -EFAULT;
508 		goto cleanup;
509 	}
510 
511 	user_reply = arg+fibsize;
512 
513 	flags = user_srbcmd->flags; /* from user in cpu order */
514 	// Fix up srb for endian and force some values
515 
516 	srbcmd->function = cpu_to_le32(SRBF_ExecuteScsi);	// Force this
517 	srbcmd->channel  = cpu_to_le32(user_srbcmd->channel);
518 	srbcmd->id	 = cpu_to_le32(user_srbcmd->id);
519 	srbcmd->lun      = cpu_to_le32(user_srbcmd->lun);
520 	srbcmd->timeout  = cpu_to_le32(user_srbcmd->timeout);
521 	srbcmd->flags    = cpu_to_le32(flags);
522 	srbcmd->retry_limit = 0; // Obsolete parameter
523 	srbcmd->cdb_size = cpu_to_le32(user_srbcmd->cdb_size);
524 	memcpy(srbcmd->cdb, user_srbcmd->cdb, sizeof(srbcmd->cdb));
525 
526 	switch (flags & (SRB_DataIn | SRB_DataOut)) {
527 	case SRB_DataOut:
528 		data_dir = DMA_TO_DEVICE;
529 		break;
530 	case (SRB_DataIn | SRB_DataOut):
531 		data_dir = DMA_BIDIRECTIONAL;
532 		break;
533 	case SRB_DataIn:
534 		data_dir = DMA_FROM_DEVICE;
535 		break;
536 	default:
537 		data_dir = DMA_NONE;
538 	}
539 	if (user_srbcmd->sg.count > ARRAY_SIZE(sg_list)) {
540 		dprintk((KERN_DEBUG"aacraid: too many sg entries %d\n",
541 		  le32_to_cpu(srbcmd->sg.count)));
542 		rcode = -EINVAL;
543 		goto cleanup;
544 	}
545 	if (dev->dac_support == 1) {
546 		struct user_sgmap64* upsg = (struct user_sgmap64*)&user_srbcmd->sg;
547 		struct sgmap64* psg = (struct sgmap64*)&srbcmd->sg;
548 		struct user_sgmap* usg;
549 		byte_count = 0;
550 
551 		/*
552 		 * This should also catch if user used the 32 bit sgmap
553 		 */
554 		actual_fibsize = sizeof(struct aac_srb) -
555 			sizeof(struct sgentry) +
556 			((upsg->count & 0xff) *
557 		 	sizeof(struct sgentry));
558 		if(actual_fibsize != fibsize){ // User made a mistake - should not continue
559 			dprintk((KERN_DEBUG"aacraid: Bad Size specified in Raw SRB command\n"));
560 			rcode = -EINVAL;
561 			goto cleanup;
562 		}
563 		usg = kmalloc(actual_fibsize - sizeof(struct aac_srb)
564 		  + sizeof(struct sgmap), GFP_KERNEL);
565 		if (!usg) {
566 			dprintk((KERN_DEBUG"aacraid: Allocation error in Raw SRB command\n"));
567 			rcode = -ENOMEM;
568 			goto cleanup;
569 		}
570 		memcpy (usg, upsg, actual_fibsize - sizeof(struct aac_srb)
571 		  + sizeof(struct sgmap));
572 		actual_fibsize = sizeof(struct aac_srb) -
573 			sizeof(struct sgentry) + ((usg->count & 0xff) *
574 			 	sizeof(struct sgentry64));
575 		if ((data_dir == DMA_NONE) && upsg->count) {
576 			kfree (usg);
577 			dprintk((KERN_DEBUG"aacraid: SG with no direction specified in Raw SRB command\n"));
578 			rcode = -EINVAL;
579 			goto cleanup;
580 		}
581 
582 		for (i = 0; i < usg->count; i++) {
583 			u64 addr;
584 			void* p;
585 			/* Does this really need to be GFP_DMA? */
586 			p = kmalloc(usg->sg[i].count,GFP_KERNEL|__GFP_DMA);
587 			if(p == 0) {
588 				kfree (usg);
589 				dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
590 				  usg->sg[i].count,i,usg->count));
591 				rcode = -ENOMEM;
592 				goto cleanup;
593 			}
594 			sg_user[i] = (void __user *)(long)usg->sg[i].addr;
595 			sg_list[i] = p; // save so we can clean up later
596 			sg_indx = i;
597 
598 			if( flags & SRB_DataOut ){
599 				if(copy_from_user(p,sg_user[i],upsg->sg[i].count)){
600 					kfree (usg);
601 					dprintk((KERN_DEBUG"aacraid: Could not copy sg data from user\n"));
602 					rcode = -EFAULT;
603 					goto cleanup;
604 				}
605 			}
606 			addr = pci_map_single(dev->pdev, p, usg->sg[i].count, data_dir);
607 
608 			psg->sg[i].addr[0] = cpu_to_le32(addr & 0xffffffff);
609 			psg->sg[i].addr[1] = cpu_to_le32(addr>>32);
610 			psg->sg[i].count = cpu_to_le32(usg->sg[i].count);
611 			byte_count += usg->sg[i].count;
612 		}
613 		kfree (usg);
614 
615 		srbcmd->count = cpu_to_le32(byte_count);
616 		psg->count = cpu_to_le32(sg_indx+1);
617 		status = aac_fib_send(ScsiPortCommand64, srbfib, actual_fibsize, FsaNormal, 1, 1,NULL,NULL);
618 	} else {
619 		struct user_sgmap* upsg = &user_srbcmd->sg;
620 		struct sgmap* psg = &srbcmd->sg;
621 		byte_count = 0;
622 
623 		actual_fibsize = sizeof (struct aac_srb) + (((user_srbcmd->sg.count & 0xff) - 1) * sizeof (struct sgentry));
624 		if(actual_fibsize != fibsize){ // User made a mistake - should not continue
625 			dprintk((KERN_DEBUG"aacraid: Bad Size specified in "
626 			  "Raw SRB command calculated fibsize=%d "
627 			  "user_srbcmd->sg.count=%d aac_srb=%d sgentry=%d "
628 			  "issued fibsize=%d\n",
629 			  actual_fibsize, user_srbcmd->sg.count,
630 			  sizeof(struct aac_srb), sizeof(struct sgentry),
631 			  fibsize));
632 			rcode = -EINVAL;
633 			goto cleanup;
634 		}
635 		if ((data_dir == DMA_NONE) && upsg->count) {
636 			dprintk((KERN_DEBUG"aacraid: SG with no direction specified in Raw SRB command\n"));
637 			rcode = -EINVAL;
638 			goto cleanup;
639 		}
640 		for (i = 0; i < upsg->count; i++) {
641 			dma_addr_t addr;
642 			void* p;
643 			p = kmalloc(upsg->sg[i].count, GFP_KERNEL);
644 			if(p == 0) {
645 				dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
646 				  upsg->sg[i].count, i, upsg->count));
647 				rcode = -ENOMEM;
648 				goto cleanup;
649 			}
650 			sg_user[i] = (void __user *)(long)upsg->sg[i].addr;
651 			sg_list[i] = p; // save so we can clean up later
652 			sg_indx = i;
653 
654 			if( flags & SRB_DataOut ){
655 				if(copy_from_user(p, sg_user[i],
656 						upsg->sg[i].count)) {
657 					dprintk((KERN_DEBUG"aacraid: Could not copy sg data from user\n"));
658 					rcode = -EFAULT;
659 					goto cleanup;
660 				}
661 			}
662 			addr = pci_map_single(dev->pdev, p,
663 				upsg->sg[i].count, data_dir);
664 
665 			psg->sg[i].addr = cpu_to_le32(addr);
666 			psg->sg[i].count = cpu_to_le32(upsg->sg[i].count);
667 			byte_count += upsg->sg[i].count;
668 		}
669 		srbcmd->count = cpu_to_le32(byte_count);
670 		psg->count = cpu_to_le32(sg_indx+1);
671 		status = aac_fib_send(ScsiPortCommand, srbfib, actual_fibsize, FsaNormal, 1, 1, NULL, NULL);
672 	}
673 	if (status == -EINTR) {
674 		rcode = -EINTR;
675 		goto cleanup;
676 	}
677 
678 	if (status != 0){
679 		dprintk((KERN_DEBUG"aacraid: Could not send raw srb fib to hba\n"));
680 		rcode = -ENXIO;
681 		goto cleanup;
682 	}
683 
684 	if( flags & SRB_DataIn ) {
685 		for(i = 0 ; i <= sg_indx; i++){
686 			byte_count = le32_to_cpu((dev->dac_support == 1)
687 			      ? ((struct sgmap64*)&srbcmd->sg)->sg[i].count
688 			      : srbcmd->sg.sg[i].count);
689 			if(copy_to_user(sg_user[i], sg_list[i], byte_count)){
690 				dprintk((KERN_DEBUG"aacraid: Could not copy sg data to user\n"));
691 				rcode = -EFAULT;
692 				goto cleanup;
693 
694 			}
695 		}
696 	}
697 
698 	reply = (struct aac_srb_reply *) fib_data(srbfib);
699 	if(copy_to_user(user_reply,reply,sizeof(struct aac_srb_reply))){
700 		dprintk((KERN_DEBUG"aacraid: Could not copy reply to user\n"));
701 		rcode = -EFAULT;
702 		goto cleanup;
703 	}
704 
705 cleanup:
706 	kfree(user_srbcmd);
707 	for(i=0; i <= sg_indx; i++){
708 		kfree(sg_list[i]);
709 	}
710 	if (rcode != -EINTR) {
711 		aac_fib_complete(srbfib);
712 		aac_fib_free(srbfib);
713 	}
714 
715 	return rcode;
716 }
717 
718 struct aac_pci_info {
719         u32 bus;
720         u32 slot;
721 };
722 
723 
724 static int aac_get_pci_info(struct aac_dev* dev, void __user *arg)
725 {
726         struct aac_pci_info pci_info;
727 
728 	pci_info.bus = dev->pdev->bus->number;
729 	pci_info.slot = PCI_SLOT(dev->pdev->devfn);
730 
731        if (copy_to_user(arg, &pci_info, sizeof(struct aac_pci_info))) {
732                dprintk((KERN_DEBUG "aacraid: Could not copy pci info\n"));
733                return -EFAULT;
734 	}
735         return 0;
736 }
737 
738 
739 int aac_do_ioctl(struct aac_dev * dev, int cmd, void __user *arg)
740 {
741 	int status;
742 
743 	/*
744 	 *	HBA gets first crack
745 	 */
746 
747 	status = aac_dev_ioctl(dev, cmd, arg);
748 	if(status != -ENOTTY)
749 		return status;
750 
751 	switch (cmd) {
752 	case FSACTL_MINIPORT_REV_CHECK:
753 		status = check_revision(dev, arg);
754 		break;
755 	case FSACTL_SEND_LARGE_FIB:
756 	case FSACTL_SENDFIB:
757 		status = ioctl_send_fib(dev, arg);
758 		break;
759 	case FSACTL_OPEN_GET_ADAPTER_FIB:
760 		status = open_getadapter_fib(dev, arg);
761 		break;
762 	case FSACTL_GET_NEXT_ADAPTER_FIB:
763 		status = next_getadapter_fib(dev, arg);
764 		break;
765 	case FSACTL_CLOSE_GET_ADAPTER_FIB:
766 		status = close_getadapter_fib(dev, arg);
767 		break;
768 	case FSACTL_SEND_RAW_SRB:
769 		status = aac_send_raw_srb(dev,arg);
770 		break;
771 	case FSACTL_GET_PCI_INFO:
772 		status = aac_get_pci_info(dev,arg);
773 		break;
774 	default:
775 		status = -ENOTTY;
776 	  	break;
777 	}
778 	return status;
779 }
780 
781