2 * Copyright (C) 2001 Jens Axboe <axboe@suse.de>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public Licens
15 * along with this program; if not, write to the Free Software
16 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-
19 #include <linux/kernel.h>
20 #include <linux/errno.h>
21 #include <linux/string.h>
22 #include <linux/module.h>
23 #include <linux/blkdev.h>
24 #include <linux/capability.h>
25 #include <linux/completion.h>
26 #include <linux/cdrom.h>
27 #include <linux/slab.h>
28 #include <linux/times.h>
29 #include <asm/uaccess.h>
31 #include <scsi/scsi.h>
32 #include <scsi/scsi_ioctl.h>
33 #include <scsi/scsi_cmnd.h>
35 /* Command group 3 is reserved and should never be used. */
36 const unsigned char scsi_command_size
[8] =
42 EXPORT_SYMBOL(scsi_command_size
);
46 static int sg_get_version(int __user
*p
)
48 static const int sg_version_num
= 30527;
49 return put_user(sg_version_num
, p
);
52 static int scsi_get_idlun(request_queue_t
*q
, int __user
*p
)
54 return put_user(0, p
);
57 static int scsi_get_bus(request_queue_t
*q
, int __user
*p
)
59 return put_user(0, p
);
62 static int sg_get_timeout(request_queue_t
*q
)
64 return q
->sg_timeout
/ (HZ
/ USER_HZ
);
67 static int sg_set_timeout(request_queue_t
*q
, int __user
*p
)
69 int timeout
, err
= get_user(timeout
, p
);
72 q
->sg_timeout
= timeout
* (HZ
/ USER_HZ
);
77 static int sg_get_reserved_size(request_queue_t
*q
, int __user
*p
)
79 unsigned val
= min(q
->sg_reserved_size
, q
->max_sectors
<< 9);
81 return put_user(val
, p
);
84 static int sg_set_reserved_size(request_queue_t
*q
, int __user
*p
)
86 int size
, err
= get_user(size
, p
);
93 if (size
> (q
->max_sectors
<< 9))
94 size
= q
->max_sectors
<< 9;
96 q
->sg_reserved_size
= size
;
101 * will always return that we are ATAPI even for a real SCSI drive, I'm not
102 * so sure this is worth doing anything about (why would you care??)
104 static int sg_emulated_host(request_queue_t
*q
, int __user
*p
)
106 return put_user(1, p
);
109 #define CMD_READ_SAFE 0x01
110 #define CMD_WRITE_SAFE 0x02
111 #define CMD_WARNED 0x04
112 #define safe_for_read(cmd) [cmd] = CMD_READ_SAFE
113 #define safe_for_write(cmd) [cmd] = CMD_WRITE_SAFE
115 int blk_verify_command(unsigned char *cmd
, int has_write_perm
)
117 static unsigned char cmd_type
[256] = {
119 /* Basic read-only commands */
120 safe_for_read(TEST_UNIT_READY
),
121 safe_for_read(REQUEST_SENSE
),
122 safe_for_read(READ_6
),
123 safe_for_read(READ_10
),
124 safe_for_read(READ_12
),
125 safe_for_read(READ_16
),
126 safe_for_read(READ_BUFFER
),
127 safe_for_read(READ_DEFECT_DATA
),
128 safe_for_read(READ_LONG
),
129 safe_for_read(INQUIRY
),
130 safe_for_read(MODE_SENSE
),
131 safe_for_read(MODE_SENSE_10
),
132 safe_for_read(LOG_SENSE
),
133 safe_for_read(START_STOP
),
134 safe_for_read(GPCMD_VERIFY_10
),
135 safe_for_read(VERIFY_16
),
137 /* Audio CD commands */
138 safe_for_read(GPCMD_PLAY_CD
),
139 safe_for_read(GPCMD_PLAY_AUDIO_10
),
140 safe_for_read(GPCMD_PLAY_AUDIO_MSF
),
141 safe_for_read(GPCMD_PLAY_AUDIO_TI
),
142 safe_for_read(GPCMD_PAUSE_RESUME
),
144 /* CD/DVD data reading */
145 safe_for_read(GPCMD_READ_BUFFER_CAPACITY
),
146 safe_for_read(GPCMD_READ_CD
),
147 safe_for_read(GPCMD_READ_CD_MSF
),
148 safe_for_read(GPCMD_READ_DISC_INFO
),
149 safe_for_read(GPCMD_READ_CDVD_CAPACITY
),
150 safe_for_read(GPCMD_READ_DVD_STRUCTURE
),
151 safe_for_read(GPCMD_READ_HEADER
),
152 safe_for_read(GPCMD_READ_TRACK_RZONE_INFO
),
153 safe_for_read(GPCMD_READ_SUBCHANNEL
),
154 safe_for_read(GPCMD_READ_TOC_PMA_ATIP
),
155 safe_for_read(GPCMD_REPORT_KEY
),
156 safe_for_read(GPCMD_SCAN
),
157 safe_for_read(GPCMD_GET_CONFIGURATION
),
158 safe_for_read(GPCMD_READ_FORMAT_CAPACITIES
),
159 safe_for_read(GPCMD_GET_EVENT_STATUS_NOTIFICATION
),
160 safe_for_read(GPCMD_GET_PERFORMANCE
),
161 safe_for_read(GPCMD_SEEK
),
162 safe_for_read(GPCMD_STOP_PLAY_SCAN
),
164 /* Basic writing commands */
165 safe_for_write(WRITE_6
),
166 safe_for_write(WRITE_10
),
167 safe_for_write(WRITE_VERIFY
),
168 safe_for_write(WRITE_12
),
169 safe_for_write(WRITE_VERIFY_12
),
170 safe_for_write(WRITE_16
),
171 safe_for_write(WRITE_LONG
),
172 safe_for_write(WRITE_LONG_2
),
173 safe_for_write(ERASE
),
174 safe_for_write(GPCMD_MODE_SELECT_10
),
175 safe_for_write(MODE_SELECT
),
176 safe_for_write(LOG_SELECT
),
177 safe_for_write(GPCMD_BLANK
),
178 safe_for_write(GPCMD_CLOSE_TRACK
),
179 safe_for_write(GPCMD_FLUSH_CACHE
),
180 safe_for_write(GPCMD_FORMAT_UNIT
),
181 safe_for_write(GPCMD_REPAIR_RZONE_TRACK
),
182 safe_for_write(GPCMD_RESERVE_RZONE_TRACK
),
183 safe_for_write(GPCMD_SEND_DVD_STRUCTURE
),
184 safe_for_write(GPCMD_SEND_EVENT
),
185 safe_for_write(GPCMD_SEND_KEY
),
186 safe_for_write(GPCMD_SEND_OPC
),
187 safe_for_write(GPCMD_SEND_CUE_SHEET
),
188 safe_for_write(GPCMD_SET_SPEED
),
189 safe_for_write(GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL
),
190 safe_for_write(GPCMD_LOAD_UNLOAD
),
191 safe_for_write(GPCMD_SET_STREAMING
),
193 unsigned char type
= cmd_type
[cmd
[0]];
195 /* Anybody who can open the device can do a read-safe command */
196 if (type
& CMD_READ_SAFE
)
199 /* Write-safe commands just require a writable open.. */
200 if ((type
& CMD_WRITE_SAFE
) && has_write_perm
)
203 /* And root can do any command.. */
204 if (capable(CAP_SYS_RAWIO
))
208 cmd_type
[cmd
[0]] = CMD_WARNED
;
209 printk(KERN_WARNING
"scsi: unknown opcode 0x%02x\n", cmd
[0]);
212 /* Otherwise fail it with an "Operation not permitted" */
215 EXPORT_SYMBOL_GPL(blk_verify_command
);
217 int blk_fill_sghdr_rq(request_queue_t
*q
, struct request
*rq
,
218 struct sg_io_hdr
*hdr
, int has_write_perm
)
220 memset(rq
->cmd
, 0, BLK_MAX_CDB
); /* ATAPI hates garbage after CDB */
222 if (copy_from_user(rq
->cmd
, hdr
->cmdp
, hdr
->cmd_len
))
224 if (blk_verify_command(rq
->cmd
, has_write_perm
))
228 * fill in request structure
230 rq
->cmd_len
= hdr
->cmd_len
;
231 rq
->cmd_type
= REQ_TYPE_BLOCK_PC
;
233 rq
->timeout
= (hdr
->timeout
* HZ
) / 1000;
235 rq
->timeout
= q
->sg_timeout
;
237 rq
->timeout
= BLK_DEFAULT_SG_TIMEOUT
;
241 EXPORT_SYMBOL_GPL(blk_fill_sghdr_rq
);
244 * unmap a request that was previously mapped to this sg_io_hdr. handles
245 * both sg and non-sg sg_io_hdr.
247 int blk_unmap_sghdr_rq(struct request
*rq
, struct sg_io_hdr
*hdr
)
249 blk_rq_unmap_user(rq
->bio
);
253 EXPORT_SYMBOL_GPL(blk_unmap_sghdr_rq
);
255 int blk_complete_sghdr_rq(struct request
*rq
, struct sg_io_hdr
*hdr
,
261 * fill in all the output members
263 hdr
->status
= rq
->errors
& 0xff;
264 hdr
->masked_status
= status_byte(rq
->errors
);
265 hdr
->msg_status
= msg_byte(rq
->errors
);
266 hdr
->host_status
= host_byte(rq
->errors
);
267 hdr
->driver_status
= driver_byte(rq
->errors
);
269 if (hdr
->masked_status
|| hdr
->host_status
|| hdr
->driver_status
)
270 hdr
->info
|= SG_INFO_CHECK
;
271 hdr
->resid
= rq
->data_len
;
274 if (rq
->sense_len
&& hdr
->sbp
) {
275 int len
= min((unsigned int) hdr
->mx_sb_len
, rq
->sense_len
);
277 if (!copy_to_user(hdr
->sbp
, rq
->sense
, len
))
278 hdr
->sb_len_wr
= len
;
284 r
= blk_unmap_sghdr_rq(rq
, hdr
);
290 EXPORT_SYMBOL_GPL(blk_complete_sghdr_rq
);
292 static int sg_io(struct file
*file
, request_queue_t
*q
,
293 struct gendisk
*bd_disk
, struct sg_io_hdr
*hdr
)
295 unsigned long start_time
;
296 int writing
= 0, ret
= 0, has_write_perm
= 0;
298 char sense
[SCSI_SENSE_BUFFERSIZE
];
301 if (hdr
->interface_id
!= 'S')
303 if (hdr
->cmd_len
> BLK_MAX_CDB
)
306 if (hdr
->dxfer_len
> (q
->max_hw_sectors
<< 9))
310 switch (hdr
->dxfer_direction
) {
313 case SG_DXFER_TO_DEV
:
316 case SG_DXFER_TO_FROM_DEV
:
317 case SG_DXFER_FROM_DEV
:
321 rq
= blk_get_request(q
, writing
? WRITE
: READ
, GFP_KERNEL
);
326 has_write_perm
= file
->f_mode
& FMODE_WRITE
;
328 if (blk_fill_sghdr_rq(q
, rq
, hdr
, has_write_perm
)) {
333 if (hdr
->iovec_count
) {
334 const int size
= sizeof(struct sg_iovec
) * hdr
->iovec_count
;
335 struct sg_iovec
*iov
;
337 iov
= kmalloc(size
, GFP_KERNEL
);
343 if (copy_from_user(iov
, hdr
->dxferp
, size
)) {
349 ret
= blk_rq_map_user_iov(q
, rq
, iov
, hdr
->iovec_count
,
352 } else if (hdr
->dxfer_len
)
353 ret
= blk_rq_map_user(q
, rq
, hdr
->dxferp
, hdr
->dxfer_len
);
359 memset(sense
, 0, sizeof(sense
));
364 start_time
= jiffies
;
366 /* ignore return value. All information is passed back to caller
367 * (if he doesn't check that is his problem).
368 * N.B. a non-zero SCSI status is _not_ necessarily an error.
370 blk_execute_rq(q
, bd_disk
, rq
, 0);
372 hdr
->duration
= ((jiffies
- start_time
) * 1000) / HZ
;
374 return blk_complete_sghdr_rq(rq
, hdr
, bio
);
381 * sg_scsi_ioctl -- handle deprecated SCSI_IOCTL_SEND_COMMAND ioctl
382 * @file: file this ioctl operates on (optional)
383 * @q: request queue to send scsi commands down
384 * @disk: gendisk to operate on (option)
385 * @sic: userspace structure describing the command to perform
387 * Send down the scsi command described by @sic to the device below
388 * the request queue @q. If @file is non-NULL it's used to perform
389 * fine-grained permission checks that allow users to send down
390 * non-destructive SCSI commands. If the caller has a struct gendisk
391 * available it should be passed in as @disk to allow the low level
392 * driver to use the information contained in it. A non-NULL @disk
393 * is only allowed if the caller knows that the low level driver doesn't
394 * need it (e.g. in the scsi subsystem).
397 * - This interface is deprecated - users should use the SG_IO
398 * interface instead, as this is a more flexible approach to
399 * performing SCSI commands on a device.
400 * - The SCSI command length is determined by examining the 1st byte
401 * of the given command. There is no way to override this.
402 * - Data transfers are limited to PAGE_SIZE
403 * - The length (x + y) must be at least OMAX_SB_LEN bytes long to
404 * accommodate the sense buffer when an error occurs.
405 * The sense buffer is truncated to OMAX_SB_LEN (16) bytes so that
406 * old code will not be surprised.
407 * - If a Unix error occurs (e.g. ENOMEM) then the user will receive
408 * a negative return and the Unix error code in 'errno'.
409 * If the SCSI command succeeds then 0 is returned.
410 * Positive numbers returned are the compacted SCSI error codes (4
411 * bytes in one int) where the lowest byte is the SCSI status.
413 #define OMAX_SB_LEN 16 /* For backward compatibility */
414 int sg_scsi_ioctl(struct file
*file
, struct request_queue
*q
,
415 struct gendisk
*disk
, struct scsi_ioctl_command __user
*sic
)
419 unsigned int in_len
, out_len
, bytes
, opcode
, cmdlen
;
420 char *buffer
= NULL
, sense
[SCSI_SENSE_BUFFERSIZE
];
426 * get in an out lengths, verify they don't exceed a page worth of data
428 if (get_user(in_len
, &sic
->inlen
))
430 if (get_user(out_len
, &sic
->outlen
))
432 if (in_len
> PAGE_SIZE
|| out_len
> PAGE_SIZE
)
434 if (get_user(opcode
, sic
->data
))
437 bytes
= max(in_len
, out_len
);
439 buffer
= kmalloc(bytes
, q
->bounce_gfp
| GFP_USER
| __GFP_NOWARN
);
443 memset(buffer
, 0, bytes
);
446 rq
= blk_get_request(q
, in_len
? WRITE
: READ
, __GFP_WAIT
);
448 cmdlen
= COMMAND_SIZE(opcode
);
451 * get command and data to send to device, if any
454 rq
->cmd_len
= cmdlen
;
455 if (copy_from_user(rq
->cmd
, sic
->data
, cmdlen
))
458 if (in_len
&& copy_from_user(buffer
, sic
->data
+ cmdlen
, in_len
))
461 err
= blk_verify_command(rq
->cmd
, file
->f_mode
& FMODE_WRITE
);
465 /* default. possible overriden later */
469 case SEND_DIAGNOSTIC
:
471 rq
->timeout
= FORMAT_UNIT_TIMEOUT
;
475 rq
->timeout
= START_STOP_TIMEOUT
;
478 rq
->timeout
= MOVE_MEDIUM_TIMEOUT
;
480 case READ_ELEMENT_STATUS
:
481 rq
->timeout
= READ_ELEMENT_STATUS_TIMEOUT
;
483 case READ_DEFECT_DATA
:
484 rq
->timeout
= READ_DEFECT_DATA_TIMEOUT
;
488 rq
->timeout
= BLK_DEFAULT_SG_TIMEOUT
;
492 if (bytes
&& blk_rq_map_kern(q
, rq
, buffer
, bytes
, __GFP_WAIT
)) {
493 err
= DRIVER_ERROR
<< 24;
497 memset(sense
, 0, sizeof(sense
));
500 rq
->cmd_type
= REQ_TYPE_BLOCK_PC
;
502 blk_execute_rq(q
, disk
, rq
, 0);
505 err
= rq
->errors
& 0xff; /* only 8 bit SCSI status */
507 if (rq
->sense_len
&& rq
->sense
) {
508 bytes
= (OMAX_SB_LEN
> rq
->sense_len
) ?
509 rq
->sense_len
: OMAX_SB_LEN
;
510 if (copy_to_user(sic
->data
, rq
->sense
, bytes
))
514 if (copy_to_user(sic
->data
, buffer
, out_len
))
523 EXPORT_SYMBOL_GPL(sg_scsi_ioctl
);
525 /* Send basic block requests */
526 static int __blk_send_generic(request_queue_t
*q
, struct gendisk
*bd_disk
, int cmd
, int data
)
531 rq
= blk_get_request(q
, WRITE
, __GFP_WAIT
);
532 rq
->cmd_type
= REQ_TYPE_BLOCK_PC
;
535 rq
->timeout
= BLK_DEFAULT_SG_TIMEOUT
;
536 memset(rq
->cmd
, 0, sizeof(rq
->cmd
));
540 err
= blk_execute_rq(q
, bd_disk
, rq
, 0);
546 static inline int blk_send_start_stop(request_queue_t
*q
, struct gendisk
*bd_disk
, int data
)
548 return __blk_send_generic(q
, bd_disk
, GPCMD_START_STOP_UNIT
, data
);
551 int scsi_cmd_ioctl(struct file
*file
, struct request_queue
*q
,
552 struct gendisk
*bd_disk
, unsigned int cmd
, void __user
*arg
)
556 if (!q
|| blk_get_queue(q
))
563 case SG_GET_VERSION_NUM
:
564 err
= sg_get_version(arg
);
566 case SCSI_IOCTL_GET_IDLUN
:
567 err
= scsi_get_idlun(q
, arg
);
569 case SCSI_IOCTL_GET_BUS_NUMBER
:
570 err
= scsi_get_bus(q
, arg
);
573 err
= sg_set_timeout(q
, arg
);
576 err
= sg_get_timeout(q
);
578 case SG_GET_RESERVED_SIZE
:
579 err
= sg_get_reserved_size(q
, arg
);
581 case SG_SET_RESERVED_SIZE
:
582 err
= sg_set_reserved_size(q
, arg
);
584 case SG_EMULATED_HOST
:
585 err
= sg_emulated_host(q
, arg
);
588 struct sg_io_hdr hdr
;
591 if (copy_from_user(&hdr
, arg
, sizeof(hdr
)))
593 err
= sg_io(file
, q
, bd_disk
, &hdr
);
597 if (copy_to_user(arg
, &hdr
, sizeof(hdr
)))
601 case CDROM_SEND_PACKET
: {
602 struct cdrom_generic_command cgc
;
603 struct sg_io_hdr hdr
;
606 if (copy_from_user(&cgc
, arg
, sizeof(cgc
)))
608 cgc
.timeout
= clock_t_to_jiffies(cgc
.timeout
);
609 memset(&hdr
, 0, sizeof(hdr
));
610 hdr
.interface_id
= 'S';
611 hdr
.cmd_len
= sizeof(cgc
.cmd
);
612 hdr
.dxfer_len
= cgc
.buflen
;
614 switch (cgc
.data_direction
) {
615 case CGC_DATA_UNKNOWN
:
616 hdr
.dxfer_direction
= SG_DXFER_UNKNOWN
;
619 hdr
.dxfer_direction
= SG_DXFER_TO_DEV
;
622 hdr
.dxfer_direction
= SG_DXFER_FROM_DEV
;
625 hdr
.dxfer_direction
= SG_DXFER_NONE
;
633 hdr
.dxferp
= cgc
.buffer
;
636 hdr
.mx_sb_len
= sizeof(struct request_sense
);
637 hdr
.timeout
= cgc
.timeout
;
638 hdr
.cmdp
= ((struct cdrom_generic_command __user
*) arg
)->cmd
;
639 hdr
.cmd_len
= sizeof(cgc
.cmd
);
641 err
= sg_io(file
, q
, bd_disk
, &hdr
);
649 cgc
.buflen
= hdr
.resid
;
650 if (copy_to_user(arg
, &cgc
, sizeof(cgc
)))
657 * old junk scsi send command ioctl
659 case SCSI_IOCTL_SEND_COMMAND
:
660 printk(KERN_WARNING
"program %s is using a deprecated SCSI ioctl, please convert it to SG_IO\n", current
->comm
);
665 err
= sg_scsi_ioctl(file
, q
, bd_disk
, arg
);
668 err
= blk_send_start_stop(q
, bd_disk
, 0x03);
671 err
= blk_send_start_stop(q
, bd_disk
, 0x02);
681 EXPORT_SYMBOL(scsi_cmd_ioctl
);