1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Adaptec AAC series RAID controller driver 4 * (c) Copyright 2001 Red Hat Inc. 5 * 6 * based on the old aacraid driver that is.. 7 * Adaptec aacraid device driver for Linux. 8 * 9 * Copyright (c) 2000-2010 Adaptec, Inc. 10 * 2010-2015 PMC-Sierra, Inc. (aacraid@pmc-sierra.com) 11 * 2016-2017 Microsemi Corp. (aacraid@microsemi.com) 12 * 13 * Module Name: 14 * commctrl.c 15 * 16 * Abstract: Contains all routines for control of the AFA comm layer 17 */ 18 19 #include <linux/kernel.h> 20 #include <linux/init.h> 21 #include <linux/types.h> 22 #include <linux/pci.h> 23 #include <linux/spinlock.h> 24 #include <linux/slab.h> 25 #include <linux/completion.h> 26 #include <linux/dma-mapping.h> 27 #include <linux/blkdev.h> 28 #include <linux/delay.h> /* ssleep prototype */ 29 #include <linux/kthread.h> 30 #include <linux/uaccess.h> 31 #include <scsi/scsi_host.h> 32 33 #include "aacraid.h" 34 35 /** 36 * ioctl_send_fib - send a FIB from userspace 37 * @dev: adapter is being processed 38 * @arg: arguments to the ioctl call 39 * 40 * This routine sends a fib to the adapter on behalf of a user level 41 * program. 42 */ 43 # define AAC_DEBUG_PREAMBLE KERN_INFO 44 # define AAC_DEBUG_POSTAMBLE 45 46 static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) 47 { 48 struct hw_fib * kfib; 49 struct fib *fibptr; 50 struct hw_fib * hw_fib = (struct hw_fib *)0; 51 dma_addr_t hw_fib_pa = (dma_addr_t)0LL; 52 unsigned int size, osize; 53 int retval; 54 55 if (dev->in_reset) { 56 return -EBUSY; 57 } 58 fibptr = aac_fib_alloc(dev); 59 if(fibptr == NULL) { 60 return -ENOMEM; 61 } 62 63 kfib = fibptr->hw_fib_va; 64 /* 65 * First copy in the header so that we can check the size field. 66 */ 67 if (copy_from_user((void *)kfib, arg, sizeof(struct aac_fibhdr))) { 68 aac_fib_free(fibptr); 69 return -EFAULT; 70 } 71 /* 72 * Since we copy based on the fib header size, make sure that we 73 * will not overrun the buffer when we copy the memory. Return 74 * an error if we would. 75 */ 76 osize = size = le16_to_cpu(kfib->header.Size) + 77 sizeof(struct aac_fibhdr); 78 if (size < le16_to_cpu(kfib->header.SenderSize)) 79 size = le16_to_cpu(kfib->header.SenderSize); 80 if (size > dev->max_fib_size) { 81 dma_addr_t daddr; 82 83 if (size > 2048) { 84 retval = -EINVAL; 85 goto cleanup; 86 } 87 88 kfib = dma_alloc_coherent(&dev->pdev->dev, size, &daddr, 89 GFP_KERNEL); 90 if (!kfib) { 91 retval = -ENOMEM; 92 goto cleanup; 93 } 94 95 /* Highjack the hw_fib */ 96 hw_fib = fibptr->hw_fib_va; 97 hw_fib_pa = fibptr->hw_fib_pa; 98 fibptr->hw_fib_va = kfib; 99 fibptr->hw_fib_pa = daddr; 100 memset(((char *)kfib) + dev->max_fib_size, 0, size - dev->max_fib_size); 101 memcpy(kfib, hw_fib, dev->max_fib_size); 102 } 103 104 if (copy_from_user(kfib, arg, size)) { 105 retval = -EFAULT; 106 goto cleanup; 107 } 108 109 /* Sanity check the second copy */ 110 if ((osize != le16_to_cpu(kfib->header.Size) + 111 sizeof(struct aac_fibhdr)) 112 || (size < le16_to_cpu(kfib->header.SenderSize))) { 113 retval = -EINVAL; 114 goto cleanup; 115 } 116 117 if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) { 118 aac_adapter_interrupt(dev); 119 /* 120 * Since we didn't really send a fib, zero out the state to allow 121 * cleanup code not to assert. 122 */ 123 kfib->header.XferState = 0; 124 } else { 125 retval = aac_fib_send(le16_to_cpu(kfib->header.Command), fibptr, 126 le16_to_cpu(kfib->header.Size) , FsaNormal, 127 1, 1, NULL, NULL); 128 if (retval) { 129 goto cleanup; 130 } 131 if (aac_fib_complete(fibptr) != 0) { 132 retval = -EINVAL; 133 goto cleanup; 134 } 135 } 136 /* 137 * Make sure that the size returned by the adapter (which includes 138 * the header) is less than or equal to the size of a fib, so we 139 * don't corrupt application data. Then copy that size to the user 140 * buffer. (Don't try to add the header information again, since it 141 * was already included by the adapter.) 142 */ 143 144 retval = 0; 145 if (copy_to_user(arg, (void *)kfib, size)) 146 retval = -EFAULT; 147 cleanup: 148 if (hw_fib) { 149 dma_free_coherent(&dev->pdev->dev, size, kfib, 150 fibptr->hw_fib_pa); 151 fibptr->hw_fib_pa = hw_fib_pa; 152 fibptr->hw_fib_va = hw_fib; 153 } 154 if (retval != -ERESTARTSYS) 155 aac_fib_free(fibptr); 156 return retval; 157 } 158 159 /** 160 * open_getadapter_fib - Get the next fib 161 * 162 * This routine will get the next Fib, if available, from the AdapterFibContext 163 * passed in from the user. 164 */ 165 166 static int open_getadapter_fib(struct aac_dev * dev, void __user *arg) 167 { 168 struct aac_fib_context * fibctx; 169 int status; 170 171 fibctx = kmalloc(sizeof(struct aac_fib_context), GFP_KERNEL); 172 if (fibctx == NULL) { 173 status = -ENOMEM; 174 } else { 175 unsigned long flags; 176 struct list_head * entry; 177 struct aac_fib_context * context; 178 179 fibctx->type = FSAFS_NTC_GET_ADAPTER_FIB_CONTEXT; 180 fibctx->size = sizeof(struct aac_fib_context); 181 /* 182 * Yes yes, I know this could be an index, but we have a 183 * better guarantee of uniqueness for the locked loop below. 184 * Without the aid of a persistent history, this also helps 185 * reduce the chance that the opaque context would be reused. 186 */ 187 fibctx->unique = (u32)((ulong)fibctx & 0xFFFFFFFF); 188 /* 189 * Initialize the mutex used to wait for the next AIF. 190 */ 191 init_completion(&fibctx->completion); 192 fibctx->wait = 0; 193 /* 194 * Initialize the fibs and set the count of fibs on 195 * the list to 0. 196 */ 197 fibctx->count = 0; 198 INIT_LIST_HEAD(&fibctx->fib_list); 199 fibctx->jiffies = jiffies/HZ; 200 /* 201 * Now add this context onto the adapter's 202 * AdapterFibContext list. 203 */ 204 spin_lock_irqsave(&dev->fib_lock, flags); 205 /* Ensure that we have a unique identifier */ 206 entry = dev->fib_list.next; 207 while (entry != &dev->fib_list) { 208 context = list_entry(entry, struct aac_fib_context, next); 209 if (context->unique == fibctx->unique) { 210 /* Not unique (32 bits) */ 211 fibctx->unique++; 212 entry = dev->fib_list.next; 213 } else { 214 entry = entry->next; 215 } 216 } 217 list_add_tail(&fibctx->next, &dev->fib_list); 218 spin_unlock_irqrestore(&dev->fib_lock, flags); 219 if (copy_to_user(arg, &fibctx->unique, 220 sizeof(fibctx->unique))) { 221 status = -EFAULT; 222 } else { 223 status = 0; 224 } 225 } 226 return status; 227 } 228 229 /** 230 * next_getadapter_fib - get the next fib 231 * @dev: adapter to use 232 * @arg: ioctl argument 233 * 234 * This routine will get the next Fib, if available, from the AdapterFibContext 235 * passed in from the user. 236 */ 237 238 static int next_getadapter_fib(struct aac_dev * dev, void __user *arg) 239 { 240 struct fib_ioctl f; 241 struct fib *fib; 242 struct aac_fib_context *fibctx; 243 int status; 244 struct list_head * entry; 245 unsigned long flags; 246 247 if(copy_from_user((void *)&f, arg, sizeof(struct fib_ioctl))) 248 return -EFAULT; 249 /* 250 * Verify that the HANDLE passed in was a valid AdapterFibContext 251 * 252 * Search the list of AdapterFibContext addresses on the adapter 253 * to be sure this is a valid address 254 */ 255 spin_lock_irqsave(&dev->fib_lock, flags); 256 entry = dev->fib_list.next; 257 fibctx = NULL; 258 259 while (entry != &dev->fib_list) { 260 fibctx = list_entry(entry, struct aac_fib_context, next); 261 /* 262 * Extract the AdapterFibContext from the Input parameters. 263 */ 264 if (fibctx->unique == f.fibctx) { /* We found a winner */ 265 break; 266 } 267 entry = entry->next; 268 fibctx = NULL; 269 } 270 if (!fibctx) { 271 spin_unlock_irqrestore(&dev->fib_lock, flags); 272 dprintk ((KERN_INFO "Fib Context not found\n")); 273 return -EINVAL; 274 } 275 276 if((fibctx->type != FSAFS_NTC_GET_ADAPTER_FIB_CONTEXT) || 277 (fibctx->size != sizeof(struct aac_fib_context))) { 278 spin_unlock_irqrestore(&dev->fib_lock, flags); 279 dprintk ((KERN_INFO "Fib Context corrupt?\n")); 280 return -EINVAL; 281 } 282 status = 0; 283 /* 284 * If there are no fibs to send back, then either wait or return 285 * -EAGAIN 286 */ 287 return_fib: 288 if (!list_empty(&fibctx->fib_list)) { 289 /* 290 * Pull the next fib from the fibs 291 */ 292 entry = fibctx->fib_list.next; 293 list_del(entry); 294 295 fib = list_entry(entry, struct fib, fiblink); 296 fibctx->count--; 297 spin_unlock_irqrestore(&dev->fib_lock, flags); 298 if (copy_to_user(f.fib, fib->hw_fib_va, sizeof(struct hw_fib))) { 299 kfree(fib->hw_fib_va); 300 kfree(fib); 301 return -EFAULT; 302 } 303 /* 304 * Free the space occupied by this copy of the fib. 305 */ 306 kfree(fib->hw_fib_va); 307 kfree(fib); 308 status = 0; 309 } else { 310 spin_unlock_irqrestore(&dev->fib_lock, flags); 311 /* If someone killed the AIF aacraid thread, restart it */ 312 status = !dev->aif_thread; 313 if (status && !dev->in_reset && dev->queues && dev->fsa_dev) { 314 /* Be paranoid, be very paranoid! */ 315 kthread_stop(dev->thread); 316 ssleep(1); 317 dev->aif_thread = 0; 318 dev->thread = kthread_run(aac_command_thread, dev, 319 "%s", dev->name); 320 ssleep(1); 321 } 322 if (f.wait) { 323 if (wait_for_completion_interruptible(&fibctx->completion) < 0) { 324 status = -ERESTARTSYS; 325 } else { 326 /* Lock again and retry */ 327 spin_lock_irqsave(&dev->fib_lock, flags); 328 goto return_fib; 329 } 330 } else { 331 status = -EAGAIN; 332 } 333 } 334 fibctx->jiffies = jiffies/HZ; 335 return status; 336 } 337 338 int aac_close_fib_context(struct aac_dev * dev, struct aac_fib_context * fibctx) 339 { 340 struct fib *fib; 341 342 /* 343 * First free any FIBs that have not been consumed. 344 */ 345 while (!list_empty(&fibctx->fib_list)) { 346 struct list_head * entry; 347 /* 348 * Pull the next fib from the fibs 349 */ 350 entry = fibctx->fib_list.next; 351 list_del(entry); 352 fib = list_entry(entry, struct fib, fiblink); 353 fibctx->count--; 354 /* 355 * Free the space occupied by this copy of the fib. 356 */ 357 kfree(fib->hw_fib_va); 358 kfree(fib); 359 } 360 /* 361 * Remove the Context from the AdapterFibContext List 362 */ 363 list_del(&fibctx->next); 364 /* 365 * Invalidate context 366 */ 367 fibctx->type = 0; 368 /* 369 * Free the space occupied by the Context 370 */ 371 kfree(fibctx); 372 return 0; 373 } 374 375 /** 376 * close_getadapter_fib - close down user fib context 377 * @dev: adapter 378 * @arg: ioctl arguments 379 * 380 * This routine will close down the fibctx passed in from the user. 381 */ 382 383 static int close_getadapter_fib(struct aac_dev * dev, void __user *arg) 384 { 385 struct aac_fib_context *fibctx; 386 int status; 387 unsigned long flags; 388 struct list_head * entry; 389 390 /* 391 * Verify that the HANDLE passed in was a valid AdapterFibContext 392 * 393 * Search the list of AdapterFibContext addresses on the adapter 394 * to be sure this is a valid address 395 */ 396 397 entry = dev->fib_list.next; 398 fibctx = NULL; 399 400 while(entry != &dev->fib_list) { 401 fibctx = list_entry(entry, struct aac_fib_context, next); 402 /* 403 * Extract the fibctx from the input parameters 404 */ 405 if (fibctx->unique == (u32)(uintptr_t)arg) /* We found a winner */ 406 break; 407 entry = entry->next; 408 fibctx = NULL; 409 } 410 411 if (!fibctx) 412 return 0; /* Already gone */ 413 414 if((fibctx->type != FSAFS_NTC_GET_ADAPTER_FIB_CONTEXT) || 415 (fibctx->size != sizeof(struct aac_fib_context))) 416 return -EINVAL; 417 spin_lock_irqsave(&dev->fib_lock, flags); 418 status = aac_close_fib_context(dev, fibctx); 419 spin_unlock_irqrestore(&dev->fib_lock, flags); 420 return status; 421 } 422 423 /** 424 * check_revision - close down user fib context 425 * @dev: adapter 426 * @arg: ioctl arguments 427 * 428 * This routine returns the driver version. 429 * Under Linux, there have been no version incompatibilities, so this is 430 * simple! 431 */ 432 433 static int check_revision(struct aac_dev *dev, void __user *arg) 434 { 435 struct revision response; 436 char *driver_version = aac_driver_version; 437 u32 version; 438 439 response.compat = 1; 440 version = (simple_strtol(driver_version, 441 &driver_version, 10) << 24) | 0x00000400; 442 version += simple_strtol(driver_version + 1, &driver_version, 10) << 16; 443 version += simple_strtol(driver_version + 1, NULL, 10); 444 response.version = cpu_to_le32(version); 445 # ifdef AAC_DRIVER_BUILD 446 response.build = cpu_to_le32(AAC_DRIVER_BUILD); 447 # else 448 response.build = cpu_to_le32(9999); 449 # endif 450 451 if (copy_to_user(arg, &response, sizeof(response))) 452 return -EFAULT; 453 return 0; 454 } 455 456 457 /** 458 * 459 * aac_send_raw_scb 460 * 461 */ 462 463 static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg) 464 { 465 struct fib* srbfib; 466 int status; 467 struct aac_srb *srbcmd = NULL; 468 struct aac_hba_cmd_req *hbacmd = NULL; 469 struct user_aac_srb *user_srbcmd = NULL; 470 struct user_aac_srb __user *user_srb = arg; 471 struct aac_srb_reply __user *user_reply; 472 u32 chn; 473 u32 fibsize = 0; 474 u32 flags = 0; 475 s32 rcode = 0; 476 u32 data_dir; 477 void __user *sg_user[HBA_MAX_SG_EMBEDDED]; 478 void *sg_list[HBA_MAX_SG_EMBEDDED]; 479 u32 sg_count[HBA_MAX_SG_EMBEDDED]; 480 u32 sg_indx = 0; 481 u32 byte_count = 0; 482 u32 actual_fibsize64, actual_fibsize = 0; 483 int i; 484 int is_native_device; 485 u64 address; 486 487 488 if (dev->in_reset) { 489 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n")); 490 return -EBUSY; 491 } 492 if (!capable(CAP_SYS_ADMIN)){ 493 dprintk((KERN_DEBUG"aacraid: No permission to send raw srb\n")); 494 return -EPERM; 495 } 496 /* 497 * Allocate and initialize a Fib then setup a SRB command 498 */ 499 if (!(srbfib = aac_fib_alloc(dev))) { 500 return -ENOMEM; 501 } 502 503 memset(sg_list, 0, sizeof(sg_list)); /* cleanup may take issue */ 504 if(copy_from_user(&fibsize, &user_srb->count,sizeof(u32))){ 505 dprintk((KERN_DEBUG"aacraid: Could not copy data size from user\n")); 506 rcode = -EFAULT; 507 goto cleanup; 508 } 509 510 if ((fibsize < (sizeof(struct user_aac_srb) - sizeof(struct user_sgentry))) || 511 (fibsize > (dev->max_fib_size - sizeof(struct aac_fibhdr)))) { 512 rcode = -EINVAL; 513 goto cleanup; 514 } 515 516 user_srbcmd = memdup_user(user_srb, fibsize); 517 if (IS_ERR(user_srbcmd)) { 518 rcode = PTR_ERR(user_srbcmd); 519 goto cleanup; 520 } 521 522 flags = user_srbcmd->flags; /* from user in cpu order */ 523 switch (flags & (SRB_DataIn | SRB_DataOut)) { 524 case SRB_DataOut: 525 data_dir = DMA_TO_DEVICE; 526 break; 527 case (SRB_DataIn | SRB_DataOut): 528 data_dir = DMA_BIDIRECTIONAL; 529 break; 530 case SRB_DataIn: 531 data_dir = DMA_FROM_DEVICE; 532 break; 533 default: 534 data_dir = DMA_NONE; 535 } 536 if (user_srbcmd->sg.count > ARRAY_SIZE(sg_list)) { 537 dprintk((KERN_DEBUG"aacraid: too many sg entries %d\n", 538 user_srbcmd->sg.count)); 539 rcode = -EINVAL; 540 goto cleanup; 541 } 542 if ((data_dir == DMA_NONE) && user_srbcmd->sg.count) { 543 dprintk((KERN_DEBUG"aacraid:SG with no direction specified\n")); 544 rcode = -EINVAL; 545 goto cleanup; 546 } 547 actual_fibsize = sizeof(struct aac_srb) - sizeof(struct sgentry) + 548 ((user_srbcmd->sg.count & 0xff) * sizeof(struct sgentry)); 549 actual_fibsize64 = actual_fibsize + (user_srbcmd->sg.count & 0xff) * 550 (sizeof(struct sgentry64) - sizeof(struct sgentry)); 551 /* User made a mistake - should not continue */ 552 if ((actual_fibsize != fibsize) && (actual_fibsize64 != fibsize)) { 553 dprintk((KERN_DEBUG"aacraid: Bad Size specified in " 554 "Raw SRB command calculated fibsize=%lu;%lu " 555 "user_srbcmd->sg.count=%d aac_srb=%lu sgentry=%lu;%lu " 556 "issued fibsize=%d\n", 557 actual_fibsize, actual_fibsize64, user_srbcmd->sg.count, 558 sizeof(struct aac_srb), sizeof(struct sgentry), 559 sizeof(struct sgentry64), fibsize)); 560 rcode = -EINVAL; 561 goto cleanup; 562 } 563 564 chn = user_srbcmd->channel; 565 if (chn < AAC_MAX_BUSES && user_srbcmd->id < AAC_MAX_TARGETS && 566 dev->hba_map[chn][user_srbcmd->id].devtype == 567 AAC_DEVTYPE_NATIVE_RAW) { 568 is_native_device = 1; 569 hbacmd = (struct aac_hba_cmd_req *)srbfib->hw_fib_va; 570 memset(hbacmd, 0, 96); /* sizeof(*hbacmd) is not necessary */ 571 572 /* iu_type is a parameter of aac_hba_send */ 573 switch (data_dir) { 574 case DMA_TO_DEVICE: 575 hbacmd->byte1 = 2; 576 break; 577 case DMA_FROM_DEVICE: 578 case DMA_BIDIRECTIONAL: 579 hbacmd->byte1 = 1; 580 break; 581 case DMA_NONE: 582 default: 583 break; 584 } 585 hbacmd->lun[1] = cpu_to_le32(user_srbcmd->lun); 586 hbacmd->it_nexus = dev->hba_map[chn][user_srbcmd->id].rmw_nexus; 587 588 /* 589 * we fill in reply_qid later in aac_src_deliver_message 590 * we fill in iu_type, request_id later in aac_hba_send 591 * we fill in emb_data_desc_count, data_length later 592 * in sg list build 593 */ 594 595 memcpy(hbacmd->cdb, user_srbcmd->cdb, sizeof(hbacmd->cdb)); 596 597 address = (u64)srbfib->hw_error_pa; 598 hbacmd->error_ptr_hi = cpu_to_le32((u32)(address >> 32)); 599 hbacmd->error_ptr_lo = cpu_to_le32((u32)(address & 0xffffffff)); 600 hbacmd->error_length = cpu_to_le32(FW_ERROR_BUFFER_SIZE); 601 hbacmd->emb_data_desc_count = 602 cpu_to_le32(user_srbcmd->sg.count); 603 srbfib->hbacmd_size = 64 + 604 user_srbcmd->sg.count * sizeof(struct aac_hba_sgl); 605 606 } else { 607 is_native_device = 0; 608 aac_fib_init(srbfib); 609 610 /* raw_srb FIB is not FastResponseCapable */ 611 srbfib->hw_fib_va->header.XferState &= 612 ~cpu_to_le32(FastResponseCapable); 613 614 srbcmd = (struct aac_srb *) fib_data(srbfib); 615 616 // Fix up srb for endian and force some values 617 618 srbcmd->function = cpu_to_le32(SRBF_ExecuteScsi); // Force this 619 srbcmd->channel = cpu_to_le32(user_srbcmd->channel); 620 srbcmd->id = cpu_to_le32(user_srbcmd->id); 621 srbcmd->lun = cpu_to_le32(user_srbcmd->lun); 622 srbcmd->timeout = cpu_to_le32(user_srbcmd->timeout); 623 srbcmd->flags = cpu_to_le32(flags); 624 srbcmd->retry_limit = 0; // Obsolete parameter 625 srbcmd->cdb_size = cpu_to_le32(user_srbcmd->cdb_size); 626 memcpy(srbcmd->cdb, user_srbcmd->cdb, sizeof(srbcmd->cdb)); 627 } 628 629 byte_count = 0; 630 if (is_native_device) { 631 struct user_sgmap *usg32 = &user_srbcmd->sg; 632 struct user_sgmap64 *usg64 = 633 (struct user_sgmap64 *)&user_srbcmd->sg; 634 635 for (i = 0; i < usg32->count; i++) { 636 void *p; 637 u64 addr; 638 639 sg_count[i] = (actual_fibsize64 == fibsize) ? 640 usg64->sg[i].count : usg32->sg[i].count; 641 if (sg_count[i] > 642 (dev->scsi_host_ptr->max_sectors << 9)) { 643 pr_err("aacraid: upsg->sg[%d].count=%u>%u\n", 644 i, sg_count[i], 645 dev->scsi_host_ptr->max_sectors << 9); 646 rcode = -EINVAL; 647 goto cleanup; 648 } 649 650 p = kmalloc(sg_count[i], GFP_KERNEL); 651 if (!p) { 652 rcode = -ENOMEM; 653 goto cleanup; 654 } 655 656 if (actual_fibsize64 == fibsize) { 657 addr = (u64)usg64->sg[i].addr[0]; 658 addr += ((u64)usg64->sg[i].addr[1]) << 32; 659 } else { 660 addr = (u64)usg32->sg[i].addr; 661 } 662 663 sg_user[i] = (void __user *)(uintptr_t)addr; 664 sg_list[i] = p; // save so we can clean up later 665 sg_indx = i; 666 667 if (flags & SRB_DataOut) { 668 if (copy_from_user(p, sg_user[i], 669 sg_count[i])) { 670 rcode = -EFAULT; 671 goto cleanup; 672 } 673 } 674 addr = pci_map_single(dev->pdev, p, sg_count[i], 675 data_dir); 676 hbacmd->sge[i].addr_hi = cpu_to_le32((u32)(addr>>32)); 677 hbacmd->sge[i].addr_lo = cpu_to_le32( 678 (u32)(addr & 0xffffffff)); 679 hbacmd->sge[i].len = cpu_to_le32(sg_count[i]); 680 hbacmd->sge[i].flags = 0; 681 byte_count += sg_count[i]; 682 } 683 684 if (usg32->count > 0) /* embedded sglist */ 685 hbacmd->sge[usg32->count-1].flags = 686 cpu_to_le32(0x40000000); 687 hbacmd->data_length = cpu_to_le32(byte_count); 688 689 status = aac_hba_send(HBA_IU_TYPE_SCSI_CMD_REQ, srbfib, 690 NULL, NULL); 691 692 } else if (dev->adapter_info.options & AAC_OPT_SGMAP_HOST64) { 693 struct user_sgmap64* upsg = (struct user_sgmap64*)&user_srbcmd->sg; 694 struct sgmap64* psg = (struct sgmap64*)&srbcmd->sg; 695 696 /* 697 * This should also catch if user used the 32 bit sgmap 698 */ 699 if (actual_fibsize64 == fibsize) { 700 actual_fibsize = actual_fibsize64; 701 for (i = 0; i < upsg->count; i++) { 702 u64 addr; 703 void* p; 704 705 sg_count[i] = upsg->sg[i].count; 706 if (sg_count[i] > 707 ((dev->adapter_info.options & 708 AAC_OPT_NEW_COMM) ? 709 (dev->scsi_host_ptr->max_sectors << 9) : 710 65536)) { 711 rcode = -EINVAL; 712 goto cleanup; 713 } 714 715 p = kmalloc(sg_count[i], GFP_KERNEL); 716 if(!p) { 717 dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n", 718 sg_count[i], i, upsg->count)); 719 rcode = -ENOMEM; 720 goto cleanup; 721 } 722 addr = (u64)upsg->sg[i].addr[0]; 723 addr += ((u64)upsg->sg[i].addr[1]) << 32; 724 sg_user[i] = (void __user *)(uintptr_t)addr; 725 sg_list[i] = p; // save so we can clean up later 726 sg_indx = i; 727 728 if (flags & SRB_DataOut) { 729 if (copy_from_user(p, sg_user[i], 730 sg_count[i])){ 731 dprintk((KERN_DEBUG"aacraid: Could not copy sg data from user\n")); 732 rcode = -EFAULT; 733 goto cleanup; 734 } 735 } 736 addr = pci_map_single(dev->pdev, p, 737 sg_count[i], data_dir); 738 739 psg->sg[i].addr[0] = cpu_to_le32(addr & 0xffffffff); 740 psg->sg[i].addr[1] = cpu_to_le32(addr>>32); 741 byte_count += sg_count[i]; 742 psg->sg[i].count = cpu_to_le32(sg_count[i]); 743 } 744 } else { 745 struct user_sgmap* usg; 746 usg = kmemdup(upsg, 747 actual_fibsize - sizeof(struct aac_srb) 748 + sizeof(struct sgmap), GFP_KERNEL); 749 if (!usg) { 750 dprintk((KERN_DEBUG"aacraid: Allocation error in Raw SRB command\n")); 751 rcode = -ENOMEM; 752 goto cleanup; 753 } 754 actual_fibsize = actual_fibsize64; 755 756 for (i = 0; i < usg->count; i++) { 757 u64 addr; 758 void* p; 759 760 sg_count[i] = usg->sg[i].count; 761 if (sg_count[i] > 762 ((dev->adapter_info.options & 763 AAC_OPT_NEW_COMM) ? 764 (dev->scsi_host_ptr->max_sectors << 9) : 765 65536)) { 766 kfree(usg); 767 rcode = -EINVAL; 768 goto cleanup; 769 } 770 771 p = kmalloc(sg_count[i], GFP_KERNEL); 772 if(!p) { 773 dprintk((KERN_DEBUG "aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n", 774 sg_count[i], i, usg->count)); 775 kfree(usg); 776 rcode = -ENOMEM; 777 goto cleanup; 778 } 779 sg_user[i] = (void __user *)(uintptr_t)usg->sg[i].addr; 780 sg_list[i] = p; // save so we can clean up later 781 sg_indx = i; 782 783 if (flags & SRB_DataOut) { 784 if (copy_from_user(p, sg_user[i], 785 sg_count[i])) { 786 kfree (usg); 787 dprintk((KERN_DEBUG"aacraid: Could not copy sg data from user\n")); 788 rcode = -EFAULT; 789 goto cleanup; 790 } 791 } 792 addr = pci_map_single(dev->pdev, p, 793 sg_count[i], data_dir); 794 795 psg->sg[i].addr[0] = cpu_to_le32(addr & 0xffffffff); 796 psg->sg[i].addr[1] = cpu_to_le32(addr>>32); 797 byte_count += sg_count[i]; 798 psg->sg[i].count = cpu_to_le32(sg_count[i]); 799 } 800 kfree (usg); 801 } 802 srbcmd->count = cpu_to_le32(byte_count); 803 if (user_srbcmd->sg.count) 804 psg->count = cpu_to_le32(sg_indx+1); 805 else 806 psg->count = 0; 807 status = aac_fib_send(ScsiPortCommand64, srbfib, actual_fibsize, FsaNormal, 1, 1,NULL,NULL); 808 } else { 809 struct user_sgmap* upsg = &user_srbcmd->sg; 810 struct sgmap* psg = &srbcmd->sg; 811 812 if (actual_fibsize64 == fibsize) { 813 struct user_sgmap64* usg = (struct user_sgmap64 *)upsg; 814 for (i = 0; i < upsg->count; i++) { 815 uintptr_t addr; 816 void* p; 817 818 sg_count[i] = usg->sg[i].count; 819 if (sg_count[i] > 820 ((dev->adapter_info.options & 821 AAC_OPT_NEW_COMM) ? 822 (dev->scsi_host_ptr->max_sectors << 9) : 823 65536)) { 824 rcode = -EINVAL; 825 goto cleanup; 826 } 827 p = kmalloc(sg_count[i], GFP_KERNEL); 828 if (!p) { 829 dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n", 830 sg_count[i], i, usg->count)); 831 rcode = -ENOMEM; 832 goto cleanup; 833 } 834 addr = (u64)usg->sg[i].addr[0]; 835 addr += ((u64)usg->sg[i].addr[1]) << 32; 836 sg_user[i] = (void __user *)addr; 837 sg_list[i] = p; // save so we can clean up later 838 sg_indx = i; 839 840 if (flags & SRB_DataOut) { 841 if (copy_from_user(p, sg_user[i], 842 sg_count[i])){ 843 dprintk((KERN_DEBUG"aacraid: Could not copy sg data from user\n")); 844 rcode = -EFAULT; 845 goto cleanup; 846 } 847 } 848 addr = pci_map_single(dev->pdev, p, usg->sg[i].count, data_dir); 849 850 psg->sg[i].addr = cpu_to_le32(addr & 0xffffffff); 851 byte_count += usg->sg[i].count; 852 psg->sg[i].count = cpu_to_le32(sg_count[i]); 853 } 854 } else { 855 for (i = 0; i < upsg->count; i++) { 856 dma_addr_t addr; 857 void* p; 858 859 sg_count[i] = upsg->sg[i].count; 860 if (sg_count[i] > 861 ((dev->adapter_info.options & 862 AAC_OPT_NEW_COMM) ? 863 (dev->scsi_host_ptr->max_sectors << 9) : 864 65536)) { 865 rcode = -EINVAL; 866 goto cleanup; 867 } 868 p = kmalloc(sg_count[i], GFP_KERNEL); 869 if (!p) { 870 dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n", 871 sg_count[i], i, upsg->count)); 872 rcode = -ENOMEM; 873 goto cleanup; 874 } 875 sg_user[i] = (void __user *)(uintptr_t)upsg->sg[i].addr; 876 sg_list[i] = p; // save so we can clean up later 877 sg_indx = i; 878 879 if (flags & SRB_DataOut) { 880 if (copy_from_user(p, sg_user[i], 881 sg_count[i])) { 882 dprintk((KERN_DEBUG"aacraid: Could not copy sg data from user\n")); 883 rcode = -EFAULT; 884 goto cleanup; 885 } 886 } 887 addr = pci_map_single(dev->pdev, p, 888 sg_count[i], data_dir); 889 890 psg->sg[i].addr = cpu_to_le32(addr); 891 byte_count += sg_count[i]; 892 psg->sg[i].count = cpu_to_le32(sg_count[i]); 893 } 894 } 895 srbcmd->count = cpu_to_le32(byte_count); 896 if (user_srbcmd->sg.count) 897 psg->count = cpu_to_le32(sg_indx+1); 898 else 899 psg->count = 0; 900 status = aac_fib_send(ScsiPortCommand, srbfib, actual_fibsize, FsaNormal, 1, 1, NULL, NULL); 901 } 902 903 if (status == -ERESTARTSYS) { 904 rcode = -ERESTARTSYS; 905 goto cleanup; 906 } 907 908 if (status != 0) { 909 dprintk((KERN_DEBUG"aacraid: Could not send raw srb fib to hba\n")); 910 rcode = -ENXIO; 911 goto cleanup; 912 } 913 914 if (flags & SRB_DataIn) { 915 for(i = 0 ; i <= sg_indx; i++){ 916 if (copy_to_user(sg_user[i], sg_list[i], sg_count[i])) { 917 dprintk((KERN_DEBUG"aacraid: Could not copy sg data to user\n")); 918 rcode = -EFAULT; 919 goto cleanup; 920 921 } 922 } 923 } 924 925 user_reply = arg + fibsize; 926 if (is_native_device) { 927 struct aac_hba_resp *err = 928 &((struct aac_native_hba *)srbfib->hw_fib_va)->resp.err; 929 struct aac_srb_reply reply; 930 931 memset(&reply, 0, sizeof(reply)); 932 reply.status = ST_OK; 933 if (srbfib->flags & FIB_CONTEXT_FLAG_FASTRESP) { 934 /* fast response */ 935 reply.srb_status = SRB_STATUS_SUCCESS; 936 reply.scsi_status = 0; 937 reply.data_xfer_length = byte_count; 938 reply.sense_data_size = 0; 939 memset(reply.sense_data, 0, AAC_SENSE_BUFFERSIZE); 940 } else { 941 reply.srb_status = err->service_response; 942 reply.scsi_status = err->status; 943 reply.data_xfer_length = byte_count - 944 le32_to_cpu(err->residual_count); 945 reply.sense_data_size = err->sense_response_data_len; 946 memcpy(reply.sense_data, err->sense_response_buf, 947 AAC_SENSE_BUFFERSIZE); 948 } 949 if (copy_to_user(user_reply, &reply, 950 sizeof(struct aac_srb_reply))) { 951 dprintk((KERN_DEBUG"aacraid: Copy to user failed\n")); 952 rcode = -EFAULT; 953 goto cleanup; 954 } 955 } else { 956 struct aac_srb_reply *reply; 957 958 reply = (struct aac_srb_reply *) fib_data(srbfib); 959 if (copy_to_user(user_reply, reply, 960 sizeof(struct aac_srb_reply))) { 961 dprintk((KERN_DEBUG"aacraid: Copy to user failed\n")); 962 rcode = -EFAULT; 963 goto cleanup; 964 } 965 } 966 967 cleanup: 968 kfree(user_srbcmd); 969 if (rcode != -ERESTARTSYS) { 970 for (i = 0; i <= sg_indx; i++) 971 kfree(sg_list[i]); 972 aac_fib_complete(srbfib); 973 aac_fib_free(srbfib); 974 } 975 976 return rcode; 977 } 978 979 struct aac_pci_info { 980 u32 bus; 981 u32 slot; 982 }; 983 984 985 static int aac_get_pci_info(struct aac_dev* dev, void __user *arg) 986 { 987 struct aac_pci_info pci_info; 988 989 pci_info.bus = dev->pdev->bus->number; 990 pci_info.slot = PCI_SLOT(dev->pdev->devfn); 991 992 if (copy_to_user(arg, &pci_info, sizeof(struct aac_pci_info))) { 993 dprintk((KERN_DEBUG "aacraid: Could not copy pci info\n")); 994 return -EFAULT; 995 } 996 return 0; 997 } 998 999 static int aac_get_hba_info(struct aac_dev *dev, void __user *arg) 1000 { 1001 struct aac_hba_info hbainfo; 1002 1003 memset(&hbainfo, 0, sizeof(hbainfo)); 1004 hbainfo.adapter_number = (u8) dev->id; 1005 hbainfo.system_io_bus_number = dev->pdev->bus->number; 1006 hbainfo.device_number = (dev->pdev->devfn >> 3); 1007 hbainfo.function_number = (dev->pdev->devfn & 0x0007); 1008 1009 hbainfo.vendor_id = dev->pdev->vendor; 1010 hbainfo.device_id = dev->pdev->device; 1011 hbainfo.sub_vendor_id = dev->pdev->subsystem_vendor; 1012 hbainfo.sub_system_id = dev->pdev->subsystem_device; 1013 1014 if (copy_to_user(arg, &hbainfo, sizeof(struct aac_hba_info))) { 1015 dprintk((KERN_DEBUG "aacraid: Could not copy hba info\n")); 1016 return -EFAULT; 1017 } 1018 1019 return 0; 1020 } 1021 1022 struct aac_reset_iop { 1023 u8 reset_type; 1024 }; 1025 1026 static int aac_send_reset_adapter(struct aac_dev *dev, void __user *arg) 1027 { 1028 struct aac_reset_iop reset; 1029 int retval; 1030 1031 if (copy_from_user((void *)&reset, arg, sizeof(struct aac_reset_iop))) 1032 return -EFAULT; 1033 1034 dev->adapter_shutdown = 1; 1035 1036 mutex_unlock(&dev->ioctl_mutex); 1037 retval = aac_reset_adapter(dev, 0, reset.reset_type); 1038 mutex_lock(&dev->ioctl_mutex); 1039 1040 return retval; 1041 } 1042 1043 int aac_do_ioctl(struct aac_dev *dev, unsigned int cmd, void __user *arg) 1044 { 1045 int status; 1046 1047 mutex_lock(&dev->ioctl_mutex); 1048 1049 if (dev->adapter_shutdown) { 1050 status = -EACCES; 1051 goto cleanup; 1052 } 1053 1054 /* 1055 * HBA gets first crack 1056 */ 1057 1058 status = aac_dev_ioctl(dev, cmd, arg); 1059 if (status != -ENOTTY) 1060 goto cleanup; 1061 1062 switch (cmd) { 1063 case FSACTL_MINIPORT_REV_CHECK: 1064 status = check_revision(dev, arg); 1065 break; 1066 case FSACTL_SEND_LARGE_FIB: 1067 case FSACTL_SENDFIB: 1068 status = ioctl_send_fib(dev, arg); 1069 break; 1070 case FSACTL_OPEN_GET_ADAPTER_FIB: 1071 status = open_getadapter_fib(dev, arg); 1072 break; 1073 case FSACTL_GET_NEXT_ADAPTER_FIB: 1074 status = next_getadapter_fib(dev, arg); 1075 break; 1076 case FSACTL_CLOSE_GET_ADAPTER_FIB: 1077 status = close_getadapter_fib(dev, arg); 1078 break; 1079 case FSACTL_SEND_RAW_SRB: 1080 status = aac_send_raw_srb(dev,arg); 1081 break; 1082 case FSACTL_GET_PCI_INFO: 1083 status = aac_get_pci_info(dev,arg); 1084 break; 1085 case FSACTL_GET_HBA_INFO: 1086 status = aac_get_hba_info(dev, arg); 1087 break; 1088 case FSACTL_RESET_IOP: 1089 status = aac_send_reset_adapter(dev, arg); 1090 break; 1091 1092 default: 1093 status = -ENOTTY; 1094 break; 1095 } 1096 1097 cleanup: 1098 mutex_unlock(&dev->ioctl_mutex); 1099 1100 return status; 1101 } 1102 1103