@@ -1843,7 +1843,7 @@ static int mpi3mr_bsg_build_sgl(struct mpi3mr_ioc *mrioc, u8 *mpi_req,
1843
1843
*
1844
1844
* Return: Data format of the NVMe command (PRP/SGL etc)
1845
1845
*/
1846
- static unsigned int mpi3mr_get_nvme_data_fmt (
1846
+ unsigned int mpi3mr_get_nvme_data_fmt (
1847
1847
struct mpi3_nvme_encapsulated_request * nvme_encap_request )
1848
1848
{
1849
1849
u8 format = 0 ;
@@ -1866,7 +1866,7 @@ static unsigned int mpi3mr_get_nvme_data_fmt(
1866
1866
*
1867
1867
* Return: 0 on success, -1 on failure
1868
1868
*/
1869
- static int mpi3mr_build_nvme_sgl (struct mpi3mr_ioc * mrioc ,
1869
+ int mpi3mr_build_nvme_sgl (struct mpi3mr_ioc * mrioc ,
1870
1870
struct mpi3_nvme_encapsulated_request * nvme_encap_request ,
1871
1871
struct mpi3mr_buf_map * drv_bufs , u8 bufcnt )
1872
1872
{
@@ -1963,7 +1963,7 @@ static int mpi3mr_build_nvme_sgl(struct mpi3mr_ioc *mrioc,
1963
1963
*
1964
1964
* Return: 0 on success, -1 on failure
1965
1965
*/
1966
- static int mpi3mr_build_nvme_prp (struct mpi3mr_ioc * mrioc ,
1966
+ int mpi3mr_build_nvme_prp (struct mpi3mr_ioc * mrioc ,
1967
1967
struct mpi3_nvme_encapsulated_request * nvme_encap_request ,
1968
1968
struct mpi3mr_buf_map * drv_bufs , u8 bufcnt )
1969
1969
{
@@ -2237,9 +2237,9 @@ static int mpi3mr_build_nvme_prp(struct mpi3mr_ioc *mrioc,
2237
2237
*
2238
2238
* Return: 0 on success, -1 on failure
2239
2239
*/
2240
- static int mpi3mr_map_data_buffer_dma (struct mpi3mr_ioc * mrioc ,
2240
+ int mpi3mr_map_data_buffer_dma (struct mpi3mr_ioc * mrioc ,
2241
2241
struct mpi3mr_buf_map * drv_buf ,
2242
- u16 desc_count )
2242
+ u16 desc_count , void * ubuf )
2243
2243
{
2244
2244
u16 i , needed_desc = drv_buf -> kern_buf_len / MPI3MR_IOCTL_SGE_SIZE ;
2245
2245
u32 buf_len = drv_buf -> kern_buf_len , copied_len = 0 ;
@@ -2268,9 +2268,15 @@ static int mpi3mr_map_data_buffer_dma(struct mpi3mr_ioc *mrioc,
2268
2268
memset (drv_buf -> dma_desc [i ].addr , 0 ,
2269
2269
mrioc -> ioctl_sge [desc_count ].size );
2270
2270
if (drv_buf -> data_dir == DMA_TO_DEVICE ) {
2271
- memcpy (drv_buf -> dma_desc [i ].addr ,
2272
- drv_buf -> bsg_buf + copied_len ,
2273
- drv_buf -> dma_desc [i ].size );
2271
+ if (ubuf ) {
2272
+ if (copy_from_user (drv_buf -> dma_desc [i ].addr ,
2273
+ ubuf + copied_len , drv_buf -> dma_desc [i ].size ))
2274
+ return (- EFAULT );
2275
+ } else {
2276
+ memcpy (drv_buf -> dma_desc [i ].addr ,
2277
+ drv_buf -> bsg_buf + copied_len ,
2278
+ drv_buf -> dma_desc [i ].size );
2279
+ }
2274
2280
copied_len += drv_buf -> dma_desc [i ].size ;
2275
2281
}
2276
2282
}
@@ -2564,7 +2570,8 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job)
2564
2570
} else {
2565
2571
if (!drv_buf_iter -> kern_buf_len )
2566
2572
continue ;
2567
- if (mpi3mr_map_data_buffer_dma (mrioc , drv_buf_iter , desc_count )) {
2573
+ if (mpi3mr_map_data_buffer_dma (mrioc , drv_buf_iter ,
2574
+ desc_count , NULL )) {
2568
2575
rval = - ENOMEM ;
2569
2576
mutex_unlock (& mrioc -> bsg_cmds .mutex );
2570
2577
dprint_bsg_err (mrioc , "%s:%d: mapping data buffers failed\n" ,
0 commit comments