3 * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 08/23/2000
4 * - get rid of some verify_areas and use __copy*user and __get/put_user
5 * for the ones that remain
7 #include <linux/module.h>
8 #include <linux/blkdev.h>
9 #include <linux/interrupt.h>
10 #include <linux/errno.h>
11 #include <linux/kernel.h>
12 #include <linux/sched.h>
14 #include <linux/string.h>
15 #include <asm/uaccess.h>
17 #include <scsi/scsi.h>
18 #include <scsi/scsi_device.h>
19 #include <scsi/scsi_eh.h>
20 #include <scsi/scsi_host.h>
21 #include <scsi/scsi_ioctl.h>
22 #include <scsi/scsi_request.h>
24 #include <scsi/scsi_dbg.h>
26 #include "scsi_logging.h"
28 #define NORMAL_RETRIES 5
29 #define IOCTL_NORMAL_TIMEOUT (10 * HZ)
31 #define MAX_BUF PAGE_SIZE
34 * ioctl_probe -- return host identification
35 * @host: host to identify
36 * @buffer: userspace buffer for identification
38 * Return an identifying string at @buffer, if @buffer is non-NULL, filling
39 * to the length stored at * (int *) @buffer.
41 static int ioctl_probe(struct Scsi_Host
*host
, void __user
*buffer
)
43 unsigned int len
, slen
;
47 if (get_user(len
, (unsigned int __user
*) buffer
))
50 if (host
->hostt
->info
)
51 string
= host
->hostt
->info(host
);
53 string
= host
->hostt
->name
;
55 slen
= strlen(string
);
58 if (copy_to_user(buffer
, string
, len
))
67 * The SCSI_IOCTL_SEND_COMMAND ioctl sends a command out to the SCSI host.
68 * The IOCTL_NORMAL_TIMEOUT and NORMAL_RETRIES variables are used.
70 * dev is the SCSI device struct ptr, *(int *) arg is the length of the
71 * input data, if any, not including the command string & counts,
72 * *((int *)arg + 1) is the output buffer size in bytes.
74 * *(char *) ((int *) arg)[2] the actual command byte.
76 * Note that if more than MAX_BUF bytes are requested to be transferred,
77 * the ioctl will fail with error EINVAL.
79 * This size *does not* include the initial lengths that were passed.
81 * The SCSI command is read from the memory location immediately after the
82 * length words, and the input data is right after the command. The SCSI
83 * routines know the command size based on the opcode decode.
85 * The output area is then filled in starting from the command byte.
88 static int ioctl_internal_command(struct scsi_device
*sdev
, char *cmd
,
89 int timeout
, int retries
)
92 struct scsi_sense_hdr sshdr
;
94 SCSI_LOG_IOCTL(1, printk("Trying ioctl with scsi command %d\n", *cmd
));
96 result
= scsi_execute_req(sdev
, cmd
, DMA_NONE
, NULL
, 0,
97 &sshdr
, timeout
, retries
);
99 SCSI_LOG_IOCTL(2, printk("Ioctl returned 0x%x\n", result
));
101 if ((driver_byte(result
) & DRIVER_SENSE
) &&
102 (scsi_sense_valid(&sshdr
))) {
103 switch (sshdr
.sense_key
) {
104 case ILLEGAL_REQUEST
:
105 if (cmd
[0] == ALLOW_MEDIUM_REMOVAL
)
108 printk(KERN_INFO
"ioctl_internal_command: "
109 "ILLEGAL REQUEST asc=0x%x ascq=0x%x\n",
110 sshdr
.asc
, sshdr
.ascq
);
112 case NOT_READY
: /* This happens if there is no disc in drive */
113 if (sdev
->removable
&& (cmd
[0] != TEST_UNIT_READY
)) {
114 printk(KERN_INFO
"Device not ready. Make sure"
115 " there is a disc in the drive.\n");
119 if (sdev
->removable
) {
121 result
= 0; /* This is no longer considered an error */
124 default: /* Fall through for non-removable media */
125 printk(KERN_INFO
"ioctl_internal_command: <%d %d %d "
126 "%d> return code = %x\n",
132 scsi_print_sense_hdr(" ", &sshdr
);
137 SCSI_LOG_IOCTL(2, printk("IOCTL Releasing command\n"));
141 int scsi_set_medium_removal(struct scsi_device
*sdev
, char state
)
143 char scsi_cmd
[MAX_COMMAND_SIZE
];
146 if (!sdev
->removable
|| !sdev
->lockable
)
149 scsi_cmd
[0] = ALLOW_MEDIUM_REMOVAL
;
156 ret
= ioctl_internal_command(sdev
, scsi_cmd
,
157 IOCTL_NORMAL_TIMEOUT
, NORMAL_RETRIES
);
159 sdev
->locked
= (state
== SCSI_REMOVAL_PREVENT
);
162 EXPORT_SYMBOL(scsi_set_medium_removal
);
165 * This interface is deprecated - users should use the scsi generic (sg)
166 * interface instead, as this is a more flexible approach to performing
167 * generic SCSI commands on a device.
169 * The structure that we are passed should look like:
172 * unsigned int inlen; [i] Length of data to be written to device
173 * unsigned int outlen; [i] Length of data to be read from device
174 * unsigned char cmd[x]; [i] SCSI command (6 <= x <= 12).
175 * [o] Data read from device starts here.
176 * [o] On error, sense buffer starts here.
177 * unsigned char wdata[y]; [i] Data written to device starts here.
180 * - The SCSI command length is determined by examining the 1st byte
181 * of the given command. There is no way to override this.
182 * - Data transfers are limited to PAGE_SIZE (4K on i386, 8K on alpha).
183 * - The length (x + y) must be at least OMAX_SB_LEN bytes long to
184 * accommodate the sense buffer when an error occurs.
185 * The sense buffer is truncated to OMAX_SB_LEN (16) bytes so that
186 * old code will not be surprised.
187 * - If a Unix error occurs (e.g. ENOMEM) then the user will receive
188 * a negative return and the Unix error code in 'errno'.
189 * If the SCSI command succeeds then 0 is returned.
190 * Positive numbers returned are the compacted SCSI error codes (4
191 * bytes in one int) where the lowest byte is the SCSI status.
192 * See the drivers/scsi/scsi.h file for more information on this.
195 #define OMAX_SB_LEN 16 /* Old sense buffer length */
197 int scsi_ioctl_send_command(struct scsi_device
*sdev
,
198 struct scsi_ioctl_command __user
*sic
)
201 unsigned char cmd
[MAX_COMMAND_SIZE
];
202 unsigned char sense
[SCSI_SENSE_BUFFERSIZE
];
204 unsigned char opcode
;
205 unsigned int inlen
, outlen
, cmdlen
;
206 unsigned int needed
, buf_needed
;
207 int timeout
, retries
, result
;
209 gfp_t gfp_mask
= GFP_KERNEL
;
214 if (sdev
->host
->unchecked_isa_dma
)
218 * Verify that we can read at least this much.
220 if (!access_ok(VERIFY_READ
, sic
, sizeof(Scsi_Ioctl_Command
)))
223 if(__get_user(inlen
, &sic
->inlen
))
226 if(__get_user(outlen
, &sic
->outlen
))
230 * We do not transfer more than MAX_BUF with this interface.
231 * If the user needs to transfer more data than this, they
232 * should use scsi_generics (sg) instead.
236 if (outlen
> MAX_BUF
)
240 if(get_user(opcode
, cmd_in
))
243 needed
= buf_needed
= (inlen
> outlen
? inlen
: outlen
);
245 buf_needed
= (buf_needed
+ 511) & ~511;
246 if (buf_needed
> MAX_BUF
)
247 buf_needed
= MAX_BUF
;
248 buf
= kmalloc(buf_needed
, gfp_mask
);
251 memset(buf
, 0, buf_needed
);
253 data_direction
= DMA_FROM_DEVICE
;
254 } else if (outlen
== 0 ) {
255 data_direction
= DMA_TO_DEVICE
;
258 * Can this ever happen?
260 data_direction
= DMA_BIDIRECTIONAL
;
265 data_direction
= DMA_NONE
;
269 * Obtain the command from the user's address space.
271 cmdlen
= COMMAND_SIZE(opcode
);
275 if (!access_ok(VERIFY_READ
, cmd_in
, cmdlen
+ inlen
))
278 if(__copy_from_user(cmd
, cmd_in
, cmdlen
))
282 * Obtain the data to be sent to the device (if any).
285 if(copy_from_user(buf
, cmd_in
+ cmdlen
, inlen
))
289 case SEND_DIAGNOSTIC
:
291 timeout
= FORMAT_UNIT_TIMEOUT
;
295 timeout
= START_STOP_TIMEOUT
;
296 retries
= NORMAL_RETRIES
;
299 timeout
= MOVE_MEDIUM_TIMEOUT
;
300 retries
= NORMAL_RETRIES
;
302 case READ_ELEMENT_STATUS
:
303 timeout
= READ_ELEMENT_STATUS_TIMEOUT
;
304 retries
= NORMAL_RETRIES
;
306 case READ_DEFECT_DATA
:
307 timeout
= READ_DEFECT_DATA_TIMEOUT
;
311 timeout
= IOCTL_NORMAL_TIMEOUT
;
312 retries
= NORMAL_RETRIES
;
316 result
= scsi_execute(sdev
, cmd
, data_direction
, buf
, needed
,
317 sense
, timeout
, retries
, 0);
320 * If there was an error condition, pass the info back to the user.
323 int sb_len
= sizeof(*sense
);
325 sb_len
= (sb_len
> OMAX_SB_LEN
) ? OMAX_SB_LEN
: sb_len
;
326 if (copy_to_user(cmd_in
, sense
, sb_len
))
329 if (copy_to_user(cmd_in
, buf
, outlen
))
337 EXPORT_SYMBOL(scsi_ioctl_send_command
);
340 * The scsi_ioctl_get_pci() function places into arg the value
341 * pci_dev::slot_name (8 characters) for the PCI device (if any).
342 * Returns: 0 on success
343 * -ENXIO if there isn't a PCI device pointer
344 * (could be because the SCSI driver hasn't been
345 * updated yet, or because it isn't a SCSI
347 * any copy_to_user() error on failure there
349 static int scsi_ioctl_get_pci(struct scsi_device
*sdev
, void __user
*arg
)
351 struct device
*dev
= scsi_get_device(sdev
->host
);
355 return copy_to_user(arg
, dev
->bus_id
, sizeof(dev
->bus_id
))? -EFAULT
: 0;
360 * the scsi_ioctl() function differs from most ioctls in that it does
361 * not take a major/minor number as the dev field. Rather, it takes
362 * a pointer to a scsi_devices[] element, a structure.
364 int scsi_ioctl(struct scsi_device
*sdev
, int cmd
, void __user
*arg
)
366 char scsi_cmd
[MAX_COMMAND_SIZE
];
368 /* No idea how this happens.... */
373 * If we are in the middle of error recovery, don't let anyone
374 * else try and use this device. Also, if error recovery fails, it
375 * may try and take the device offline, in which case all further
376 * access to the device is prohibited.
378 if (!scsi_block_when_processing_errors(sdev
))
381 /* Check for deprecated ioctls ... all the ioctls which don't
382 * follow the new unique numbering scheme are deprecated */
384 case SCSI_IOCTL_SEND_COMMAND
:
385 case SCSI_IOCTL_TEST_UNIT_READY
:
386 case SCSI_IOCTL_BENCHMARK_COMMAND
:
387 case SCSI_IOCTL_SYNC
:
388 case SCSI_IOCTL_START_UNIT
:
389 case SCSI_IOCTL_STOP_UNIT
:
390 printk(KERN_WARNING
"program %s is using a deprecated SCSI "
391 "ioctl, please convert it to SG_IO\n", current
->comm
);
398 case SCSI_IOCTL_GET_IDLUN
:
399 if (!access_ok(VERIFY_WRITE
, arg
, sizeof(struct scsi_idlun
)))
402 __put_user((sdev
->id
& 0xff)
403 + ((sdev
->lun
& 0xff) << 8)
404 + ((sdev
->channel
& 0xff) << 16)
405 + ((sdev
->host
->host_no
& 0xff) << 24),
406 &((struct scsi_idlun __user
*)arg
)->dev_id
);
407 __put_user(sdev
->host
->unique_id
,
408 &((struct scsi_idlun __user
*)arg
)->host_unique_id
);
410 case SCSI_IOCTL_GET_BUS_NUMBER
:
411 return put_user(sdev
->host
->host_no
, (int __user
*)arg
);
412 case SCSI_IOCTL_PROBE_HOST
:
413 return ioctl_probe(sdev
->host
, arg
);
414 case SCSI_IOCTL_SEND_COMMAND
:
415 if (!capable(CAP_SYS_ADMIN
) || !capable(CAP_SYS_RAWIO
))
417 return scsi_ioctl_send_command(sdev
, arg
);
418 case SCSI_IOCTL_DOORLOCK
:
419 return scsi_set_medium_removal(sdev
, SCSI_REMOVAL_PREVENT
);
420 case SCSI_IOCTL_DOORUNLOCK
:
421 return scsi_set_medium_removal(sdev
, SCSI_REMOVAL_ALLOW
);
422 case SCSI_IOCTL_TEST_UNIT_READY
:
423 return scsi_test_unit_ready(sdev
, IOCTL_NORMAL_TIMEOUT
,
425 case SCSI_IOCTL_START_UNIT
:
426 scsi_cmd
[0] = START_STOP
;
428 scsi_cmd
[2] = scsi_cmd
[3] = scsi_cmd
[5] = 0;
430 return ioctl_internal_command(sdev
, scsi_cmd
,
431 START_STOP_TIMEOUT
, NORMAL_RETRIES
);
432 case SCSI_IOCTL_STOP_UNIT
:
433 scsi_cmd
[0] = START_STOP
;
435 scsi_cmd
[2] = scsi_cmd
[3] = scsi_cmd
[5] = 0;
437 return ioctl_internal_command(sdev
, scsi_cmd
,
438 START_STOP_TIMEOUT
, NORMAL_RETRIES
);
439 case SCSI_IOCTL_GET_PCI
:
440 return scsi_ioctl_get_pci(sdev
, arg
);
442 if (sdev
->host
->hostt
->ioctl
)
443 return sdev
->host
->hostt
->ioctl(sdev
, cmd
, arg
);
447 EXPORT_SYMBOL(scsi_ioctl
);
450 * the scsi_nonblock_ioctl() function is designed for ioctls which may
451 * be executed even if the device is in recovery.
453 int scsi_nonblockable_ioctl(struct scsi_device
*sdev
, int cmd
,
454 void __user
*arg
, struct file
*filp
)
458 /* The first set of iocts may be executed even if we're doing
459 * error processing, as long as the device was opened
461 if (filp
&& filp
->f_flags
& O_NONBLOCK
) {
462 if (scsi_host_in_recovery(sdev
->host
))
464 } else if (!scsi_block_when_processing_errors(sdev
))
469 result
= get_user(val
, (int __user
*)arg
);
472 if (val
== SG_SCSI_RESET_NOTHING
)
475 case SG_SCSI_RESET_DEVICE
:
476 val
= SCSI_TRY_RESET_DEVICE
;
478 case SG_SCSI_RESET_BUS
:
479 val
= SCSI_TRY_RESET_BUS
;
481 case SG_SCSI_RESET_HOST
:
482 val
= SCSI_TRY_RESET_HOST
;
487 if (!capable(CAP_SYS_ADMIN
) || !capable(CAP_SYS_RAWIO
))
489 return (scsi_reset_provider(sdev
, val
) ==
494 EXPORT_SYMBOL(scsi_nonblockable_ioctl
);