printk(KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n", upsg->sg[i].count,i,upsg->count); 
kfree (usg); dprintk((KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n", usg->sg[i].count,i,usg->count)); 
static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg){	struct fib* srbfib;	int status;	struct aac_srb *srbcmd = NULL;	struct user_aac_srb *user_srbcmd = NULL;	struct user_aac_srb __user *user_srb = arg;	struct aac_srb_reply __user *user_reply;	struct aac_srb_reply* reply;	u32 fibsize = 0;	u32 flags = 0;	s32 rcode = 0;	u32 data_dir;	void __user *sg_user[32];	void *sg_list[32];	u32   sg_indx = 0;	u32 byte_count = 0;	u32 actual_fibsize = 0;	int i;	if (!capable(CAP_SYS_ADMIN)){		printk(KERN_DEBUG"aacraid: No permission to send raw srb\n"); 		return -EPERM;	}	/*	 *	Allocate and initialize a Fib then setup a BlockWrite command	 */	if (!(srbfib = fib_alloc(dev))) {		return -1;	}	fib_init(srbfib);	srbcmd = (struct aac_srb*) fib_data(srbfib);	if(copy_from_user(&fibsize, &user_srb->count,sizeof(u32))){		printk(KERN_DEBUG"aacraid: Could not copy data size from user\n"); 		rcode = -EFAULT;		goto cleanup;	}	if (fibsize > FIB_DATA_SIZE_IN_BYTES) {		rcode = -EINVAL;		goto cleanup;	}	user_srbcmd = kmalloc(GFP_KERNEL, fibsize);	if(copy_from_user(user_srbcmd, user_srb,fibsize)){		printk(KERN_DEBUG"aacraid: Could not copy srb from user\n"); 		rcode = -EFAULT;		goto cleanup;	}	user_reply = arg+fibsize;	flags = user_srbcmd->flags; /* from user in cpu order */	// Fix up srb for endian and force some values	srbcmd->function = cpu_to_le32(SRBF_ExecuteScsi);	// Force this	srbcmd->channel = cpu_to_le32(user_srbcmd->channel);	srbcmd->id = cpu_to_le32(user_srbcmd->id);	srbcmd->lun = cpu_to_le32(user_srbcmd->lun);	srbcmd->flags = cpu_to_le32(user_srbcmd->flags);	srbcmd->timeout = cpu_to_le32(user_srbcmd->timeout);	srbcmd->retry_limit = 0; 	srbcmd->cdb_size = cpu_to_le32(user_srbcmd->cdb_size);		switch (flags & (SRB_DataIn | SRB_DataOut)) {	case SRB_DataOut:		data_dir = DMA_TO_DEVICE;		break;	case (SRB_DataIn | SRB_DataOut):		data_dir = DMA_BIDIRECTIONAL;		break;	case SRB_DataIn:		data_dir = DMA_FROM_DEVICE;		break;	default:		data_dir = DMA_NONE;	}	if (dev->dac_support == 1) {		struct user_sgmap64* upsg = (struct user_sgmap64*)&user_srbcmd->sg;		struct sgmap64* psg = (struct sgmap64*)&user_srbcmd->sg;		byte_count = 0;		/*		 * This should also catch if user used the 32 bit sgmap		 */		actual_fibsize = sizeof(struct aac_srb) - 			sizeof(struct sgentry) + 			((user_srbcmd->sg.count & 0xff) * 		 	sizeof(struct sgentry64));		if(actual_fibsize != fibsize){ // User made a mistake - should not continue			printk(KERN_DEBUG"aacraid: Bad Size specified in Raw SRB command\n");			rcode = -EINVAL;			goto cleanup;		}		if ((data_dir == DMA_NONE) && upsg->count) { 			printk(KERN_DEBUG"aacraid: SG with no direction specified in Raw SRB command\n");			rcode = -EINVAL;			goto cleanup;		}		for (i = 0; i < upsg->count; i++) {			u64 addr; 			void* p;			p = kmalloc(upsg->sg[i].count, GFP_KERNEL|__GFP_DMA);			if(p == 0) {				printk(KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",				upsg->sg[i].count,i,upsg->count);				rcode = -ENOMEM;				goto cleanup;			}			sg_user[i] = (void __user *)upsg->sg[i].addr;			sg_list[i] = p; // save so we can clean up later			sg_indx = i;			if( flags & SRB_DataOut ){				if(copy_from_user(p,sg_user[i],upsg->sg[i].count)){					printk(KERN_DEBUG"aacraid: Could not copy sg data from user\n"); 					rcode = -EFAULT;					goto cleanup;				}			}			addr = pci_map_single(dev->pdev, p, upsg->sg[i].count, data_dir);			psg->sg[i].addr[0] = cpu_to_le32(addr & 0xffffffff);			psg->sg[i].addr[1] = cpu_to_le32(addr >> 32);			psg->sg[i].count = cpu_to_le32(upsg->sg[i].count);  			byte_count += upsg->sg[i].count;		}		srbcmd->count = cpu_to_le32(byte_count);		status = fib_send(ScsiPortCommand64, srbfib, actual_fibsize, FsaNormal, 1, 1,NULL,NULL);	} else {		struct user_sgmap* upsg = &user_srbcmd->sg;		struct sgmap* psg = &srbcmd->sg;		byte_count = 0;		actual_fibsize = sizeof (struct aac_srb) + 			(((le32_to_cpu(srbcmd->sg.count) & 0xff) - 1) * 			 sizeof (struct sgentry));		if(actual_fibsize != fibsize){ // User made a mistake - should not continue			printk(KERN_DEBUG"aacraid: Bad Size specified in Raw SRB command\n");			rcode = -EINVAL;			goto cleanup;		}		if ((data_dir == DMA_NONE) && upsg->count) {			printk(KERN_DEBUG"aacraid: SG with no direction specified in Raw SRB command\n");			rcode = -EINVAL;			goto cleanup;		}		for (i = 0; i < upsg->count; i++) {			dma_addr_t addr; 			void* p;			p = kmalloc(upsg->sg[i].count, GFP_KERNEL);			if(p == 0) {				printk(KERN_DEBUG"aacraid: Could not allocate SG buffer - size = %d buffer number %d of %d\n",				upsg->sg[i].count, i, upsg->count);				rcode = -ENOMEM;				goto cleanup;			}			sg_user[i] = (void __user *)upsg->sg[i].addr; 			sg_list[i] = p; // save so we can clean up later			sg_indx = i;			if( flags & SRB_DataOut ){				if(copy_from_user(p, sg_user[i], 							upsg->sg[i].count)) {					printk(KERN_DEBUG"aacraid: Could not copy sg data from user\n"); 					rcode = -EFAULT;					goto cleanup;				}			}			addr = pci_map_single(dev->pdev, p, 					upsg->sg[i].count, data_dir);			psg->sg[i].addr = cpu_to_le32(addr);			psg->sg[i].count = cpu_to_le32(upsg->sg[i].count);  			byte_count += upsg->sg[i].count;		}		srbcmd->count = cpu_to_le32(byte_count);		status = fib_send(ScsiPortCommand, srbfib, actual_fibsize, FsaNormal, 1, 1, NULL, NULL);	}	if (status != 0){		printk(KERN_DEBUG"aacraid: Could not send raw srb fib to hba\n"); 		rcode = -1;		goto cleanup;	}	if( flags & SRB_DataIn ) {		for(i = 0 ; i <= sg_indx; i++){			if(copy_to_user(sg_user[i],sg_list[i],le32_to_cpu(srbcmd->sg.sg[i].count))){				printk(KERN_DEBUG"aacraid: Could not copy sg data to user\n"); 				rcode = -EFAULT;				goto cleanup;			}		}	}	reply = (struct aac_srb_reply *) fib_data(srbfib);	if(copy_to_user(user_reply,reply,sizeof(struct aac_srb_reply))){		printk(KERN_DEBUG"aacraid: Could not copy reply to user\n"); 		rcode = -EFAULT;		goto cleanup;	}cleanup:	kfree(user_srbcmd);	for(i=0; i <= sg_indx; i++){		kfree(sg_list[i]);	}	fib_complete(srbfib);	fib_free(srbfib);	return rcode;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/7c00ffa314bf0fb0e23858bbebad33b48b6abbb9/commctrl.c/clean/drivers/scsi/aacraid/commctrl.c