Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* |
2 | * Changes: | |
3 | * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 08/23/2000 | |
4 | * - get rid of some verify_areas and use __copy*user and __get/put_user | |
5 | * for the ones that remain | |
6 | */ | |
7 | #include <linux/module.h> | |
8 | #include <linux/blkdev.h> | |
9 | #include <linux/interrupt.h> | |
10 | #include <linux/errno.h> | |
11 | #include <linux/kernel.h> | |
12 | #include <linux/sched.h> | |
13 | #include <linux/mm.h> | |
14 | #include <linux/string.h> | |
15 | #include <asm/uaccess.h> | |
16 | ||
17 | #include <scsi/scsi.h> | |
18 | #include <scsi/scsi_device.h> | |
19 | #include <scsi/scsi_eh.h> | |
20 | #include <scsi/scsi_host.h> | |
21 | #include <scsi/scsi_ioctl.h> | |
22 | #include <scsi/scsi_request.h> | |
23 | #include <scsi/sg.h> | |
24 | #include <scsi/scsi_dbg.h> | |
25 | ||
26 | #include "scsi_logging.h" | |
27 | ||
28 | #define NORMAL_RETRIES 5 | |
29 | #define IOCTL_NORMAL_TIMEOUT (10 * HZ) | |
1da177e4 LT |
30 | |
31 | #define MAX_BUF PAGE_SIZE | |
32 | ||
33 | /* | |
34 | * If we are told to probe a host, we will return 0 if the host is not | |
35 | * present, 1 if the host is present, and will return an identifying | |
36 | * string at *arg, if arg is non null, filling to the length stored at | |
37 | * (int *) arg | |
38 | */ | |
39 | ||
40 | static int ioctl_probe(struct Scsi_Host *host, void __user *buffer) | |
41 | { | |
42 | unsigned int len, slen; | |
43 | const char *string; | |
44 | int temp = host->hostt->present; | |
45 | ||
46 | if (temp && buffer) { | |
47 | if (get_user(len, (unsigned int __user *) buffer)) | |
48 | return -EFAULT; | |
49 | ||
50 | if (host->hostt->info) | |
51 | string = host->hostt->info(host); | |
52 | else | |
53 | string = host->hostt->name; | |
54 | if (string) { | |
55 | slen = strlen(string); | |
56 | if (len > slen) | |
57 | len = slen + 1; | |
58 | if (copy_to_user(buffer, string, len)) | |
59 | return -EFAULT; | |
60 | } | |
61 | } | |
62 | return temp; | |
63 | } | |
64 | ||
65 | /* | |
66 | ||
67 | * The SCSI_IOCTL_SEND_COMMAND ioctl sends a command out to the SCSI host. | |
68 | * The IOCTL_NORMAL_TIMEOUT and NORMAL_RETRIES variables are used. | |
69 | * | |
70 | * dev is the SCSI device struct ptr, *(int *) arg is the length of the | |
71 | * input data, if any, not including the command string & counts, | |
72 | * *((int *)arg + 1) is the output buffer size in bytes. | |
73 | * | |
74 | * *(char *) ((int *) arg)[2] the actual command byte. | |
75 | * | |
76 | * Note that if more than MAX_BUF bytes are requested to be transferred, | |
77 | * the ioctl will fail with error EINVAL. | |
78 | * | |
79 | * This size *does not* include the initial lengths that were passed. | |
80 | * | |
81 | * The SCSI command is read from the memory location immediately after the | |
82 | * length words, and the input data is right after the command. The SCSI | |
83 | * routines know the command size based on the opcode decode. | |
84 | * | |
85 | * The output area is then filled in starting from the command byte. | |
86 | */ | |
87 | ||
88 | static int ioctl_internal_command(struct scsi_device *sdev, char *cmd, | |
89 | int timeout, int retries) | |
90 | { | |
91 | struct scsi_request *sreq; | |
92 | int result; | |
93 | struct scsi_sense_hdr sshdr; | |
94 | ||
95 | SCSI_LOG_IOCTL(1, printk("Trying ioctl with scsi command %d\n", *cmd)); | |
96 | ||
97 | sreq = scsi_allocate_request(sdev, GFP_KERNEL); | |
98 | if (!sreq) { | |
99 | printk(KERN_WARNING "SCSI internal ioctl failed, no memory\n"); | |
100 | return -ENOMEM; | |
101 | } | |
102 | ||
103 | sreq->sr_data_direction = DMA_NONE; | |
104 | scsi_wait_req(sreq, cmd, NULL, 0, timeout, retries); | |
105 | ||
106 | SCSI_LOG_IOCTL(2, printk("Ioctl returned 0x%x\n", sreq->sr_result)); | |
107 | ||
108 | if ((driver_byte(sreq->sr_result) & DRIVER_SENSE) && | |
109 | (scsi_request_normalize_sense(sreq, &sshdr))) { | |
110 | switch (sshdr.sense_key) { | |
111 | case ILLEGAL_REQUEST: | |
112 | if (cmd[0] == ALLOW_MEDIUM_REMOVAL) | |
113 | sdev->lockable = 0; | |
114 | else | |
115 | printk(KERN_INFO "ioctl_internal_command: " | |
116 | "ILLEGAL REQUEST asc=0x%x ascq=0x%x\n", | |
117 | sshdr.asc, sshdr.ascq); | |
118 | break; | |
119 | case NOT_READY: /* This happens if there is no disc in drive */ | |
120 | if (sdev->removable && (cmd[0] != TEST_UNIT_READY)) { | |
121 | printk(KERN_INFO "Device not ready. Make sure" | |
122 | " there is a disc in the drive.\n"); | |
123 | break; | |
124 | } | |
125 | case UNIT_ATTENTION: | |
126 | if (sdev->removable) { | |
127 | sdev->changed = 1; | |
128 | sreq->sr_result = 0; /* This is no longer considered an error */ | |
129 | break; | |
130 | } | |
131 | default: /* Fall through for non-removable media */ | |
132 | printk(KERN_INFO "ioctl_internal_command: <%d %d %d " | |
133 | "%d> return code = %x\n", | |
134 | sdev->host->host_no, | |
135 | sdev->channel, | |
136 | sdev->id, | |
137 | sdev->lun, | |
138 | sreq->sr_result); | |
139 | scsi_print_req_sense(" ", sreq); | |
140 | break; | |
141 | } | |
142 | } | |
143 | ||
144 | result = sreq->sr_result; | |
145 | SCSI_LOG_IOCTL(2, printk("IOCTL Releasing command\n")); | |
146 | scsi_release_request(sreq); | |
147 | return result; | |
148 | } | |
149 | ||
150 | int scsi_set_medium_removal(struct scsi_device *sdev, char state) | |
151 | { | |
152 | char scsi_cmd[MAX_COMMAND_SIZE]; | |
153 | int ret; | |
154 | ||
155 | if (!sdev->removable || !sdev->lockable) | |
156 | return 0; | |
157 | ||
158 | scsi_cmd[0] = ALLOW_MEDIUM_REMOVAL; | |
159 | scsi_cmd[1] = 0; | |
160 | scsi_cmd[2] = 0; | |
161 | scsi_cmd[3] = 0; | |
162 | scsi_cmd[4] = state; | |
163 | scsi_cmd[5] = 0; | |
164 | ||
165 | ret = ioctl_internal_command(sdev, scsi_cmd, | |
166 | IOCTL_NORMAL_TIMEOUT, NORMAL_RETRIES); | |
167 | if (ret == 0) | |
168 | sdev->locked = (state == SCSI_REMOVAL_PREVENT); | |
169 | return ret; | |
170 | } | |
171 | EXPORT_SYMBOL(scsi_set_medium_removal); | |
172 | ||
173 | /* | |
174 | * This interface is deprecated - users should use the scsi generic (sg) | |
175 | * interface instead, as this is a more flexible approach to performing | |
176 | * generic SCSI commands on a device. | |
177 | * | |
178 | * The structure that we are passed should look like: | |
179 | * | |
180 | * struct sdata { | |
181 | * unsigned int inlen; [i] Length of data to be written to device | |
182 | * unsigned int outlen; [i] Length of data to be read from device | |
183 | * unsigned char cmd[x]; [i] SCSI command (6 <= x <= 12). | |
184 | * [o] Data read from device starts here. | |
185 | * [o] On error, sense buffer starts here. | |
186 | * unsigned char wdata[y]; [i] Data written to device starts here. | |
187 | * }; | |
188 | * Notes: | |
189 | * - The SCSI command length is determined by examining the 1st byte | |
190 | * of the given command. There is no way to override this. | |
191 | * - Data transfers are limited to PAGE_SIZE (4K on i386, 8K on alpha). | |
192 | * - The length (x + y) must be at least OMAX_SB_LEN bytes long to | |
193 | * accommodate the sense buffer when an error occurs. | |
194 | * The sense buffer is truncated to OMAX_SB_LEN (16) bytes so that | |
195 | * old code will not be surprised. | |
196 | * - If a Unix error occurs (e.g. ENOMEM) then the user will receive | |
197 | * a negative return and the Unix error code in 'errno'. | |
198 | * If the SCSI command succeeds then 0 is returned. | |
199 | * Positive numbers returned are the compacted SCSI error codes (4 | |
200 | * bytes in one int) where the lowest byte is the SCSI status. | |
201 | * See the drivers/scsi/scsi.h file for more information on this. | |
202 | * | |
203 | */ | |
204 | #define OMAX_SB_LEN 16 /* Old sense buffer length */ | |
205 | ||
206 | int scsi_ioctl_send_command(struct scsi_device *sdev, | |
207 | struct scsi_ioctl_command __user *sic) | |
208 | { | |
209 | char *buf; | |
210 | unsigned char cmd[MAX_COMMAND_SIZE]; | |
211 | char __user *cmd_in; | |
212 | struct scsi_request *sreq; | |
213 | unsigned char opcode; | |
214 | unsigned int inlen, outlen, cmdlen; | |
215 | unsigned int needed, buf_needed; | |
216 | int timeout, retries, result; | |
217 | int data_direction, gfp_mask = GFP_KERNEL; | |
218 | ||
219 | if (!sic) | |
220 | return -EINVAL; | |
221 | ||
222 | if (sdev->host->unchecked_isa_dma) | |
223 | gfp_mask |= GFP_DMA; | |
224 | ||
225 | /* | |
226 | * Verify that we can read at least this much. | |
227 | */ | |
228 | if (!access_ok(VERIFY_READ, sic, sizeof(Scsi_Ioctl_Command))) | |
229 | return -EFAULT; | |
230 | ||
231 | if(__get_user(inlen, &sic->inlen)) | |
232 | return -EFAULT; | |
233 | ||
234 | if(__get_user(outlen, &sic->outlen)) | |
235 | return -EFAULT; | |
236 | ||
237 | /* | |
238 | * We do not transfer more than MAX_BUF with this interface. | |
239 | * If the user needs to transfer more data than this, they | |
240 | * should use scsi_generics (sg) instead. | |
241 | */ | |
242 | if (inlen > MAX_BUF) | |
243 | return -EINVAL; | |
244 | if (outlen > MAX_BUF) | |
245 | return -EINVAL; | |
246 | ||
247 | cmd_in = sic->data; | |
248 | if(get_user(opcode, cmd_in)) | |
249 | return -EFAULT; | |
250 | ||
251 | needed = buf_needed = (inlen > outlen ? inlen : outlen); | |
252 | if (buf_needed) { | |
253 | buf_needed = (buf_needed + 511) & ~511; | |
254 | if (buf_needed > MAX_BUF) | |
255 | buf_needed = MAX_BUF; | |
256 | buf = kmalloc(buf_needed, gfp_mask); | |
257 | if (!buf) | |
258 | return -ENOMEM; | |
259 | memset(buf, 0, buf_needed); | |
260 | if (inlen == 0) { | |
261 | data_direction = DMA_FROM_DEVICE; | |
262 | } else if (outlen == 0 ) { | |
263 | data_direction = DMA_TO_DEVICE; | |
264 | } else { | |
265 | /* | |
266 | * Can this ever happen? | |
267 | */ | |
268 | data_direction = DMA_BIDIRECTIONAL; | |
269 | } | |
270 | ||
271 | } else { | |
272 | buf = NULL; | |
273 | data_direction = DMA_NONE; | |
274 | } | |
275 | ||
276 | /* | |
277 | * Obtain the command from the user's address space. | |
278 | */ | |
279 | cmdlen = COMMAND_SIZE(opcode); | |
280 | ||
281 | result = -EFAULT; | |
282 | ||
283 | if (!access_ok(VERIFY_READ, cmd_in, cmdlen + inlen)) | |
284 | goto error; | |
285 | ||
286 | if(__copy_from_user(cmd, cmd_in, cmdlen)) | |
287 | goto error; | |
288 | ||
289 | /* | |
290 | * Obtain the data to be sent to the device (if any). | |
291 | */ | |
292 | ||
293 | if(copy_from_user(buf, cmd_in + cmdlen, inlen)) | |
294 | goto error; | |
295 | ||
296 | switch (opcode) { | |
297 | case SEND_DIAGNOSTIC: | |
298 | case FORMAT_UNIT: | |
299 | timeout = FORMAT_UNIT_TIMEOUT; | |
300 | retries = 1; | |
301 | break; | |
302 | case START_STOP: | |
303 | timeout = START_STOP_TIMEOUT; | |
304 | retries = NORMAL_RETRIES; | |
305 | break; | |
306 | case MOVE_MEDIUM: | |
307 | timeout = MOVE_MEDIUM_TIMEOUT; | |
308 | retries = NORMAL_RETRIES; | |
309 | break; | |
310 | case READ_ELEMENT_STATUS: | |
311 | timeout = READ_ELEMENT_STATUS_TIMEOUT; | |
312 | retries = NORMAL_RETRIES; | |
313 | break; | |
314 | case READ_DEFECT_DATA: | |
315 | timeout = READ_DEFECT_DATA_TIMEOUT; | |
316 | retries = 1; | |
317 | break; | |
318 | default: | |
319 | timeout = IOCTL_NORMAL_TIMEOUT; | |
320 | retries = NORMAL_RETRIES; | |
321 | break; | |
322 | } | |
323 | ||
324 | sreq = scsi_allocate_request(sdev, GFP_KERNEL); | |
325 | if (!sreq) { | |
326 | result = -EINTR; | |
327 | goto error; | |
328 | } | |
329 | ||
330 | sreq->sr_data_direction = data_direction; | |
331 | scsi_wait_req(sreq, cmd, buf, needed, timeout, retries); | |
332 | ||
333 | /* | |
334 | * If there was an error condition, pass the info back to the user. | |
335 | */ | |
336 | result = sreq->sr_result; | |
337 | if (result) { | |
338 | int sb_len = sizeof(sreq->sr_sense_buffer); | |
339 | ||
340 | sb_len = (sb_len > OMAX_SB_LEN) ? OMAX_SB_LEN : sb_len; | |
341 | if (copy_to_user(cmd_in, sreq->sr_sense_buffer, sb_len)) | |
342 | result = -EFAULT; | |
343 | } else { | |
344 | if (copy_to_user(cmd_in, buf, outlen)) | |
345 | result = -EFAULT; | |
346 | } | |
347 | ||
348 | scsi_release_request(sreq); | |
349 | error: | |
350 | kfree(buf); | |
351 | return result; | |
352 | } | |
353 | EXPORT_SYMBOL(scsi_ioctl_send_command); | |
354 | ||
355 | /* | |
356 | * The scsi_ioctl_get_pci() function places into arg the value | |
357 | * pci_dev::slot_name (8 characters) for the PCI device (if any). | |
358 | * Returns: 0 on success | |
359 | * -ENXIO if there isn't a PCI device pointer | |
360 | * (could be because the SCSI driver hasn't been | |
361 | * updated yet, or because it isn't a SCSI | |
362 | * device) | |
363 | * any copy_to_user() error on failure there | |
364 | */ | |
365 | static int scsi_ioctl_get_pci(struct scsi_device *sdev, void __user *arg) | |
366 | { | |
367 | struct device *dev = scsi_get_device(sdev->host); | |
368 | ||
369 | if (!dev) | |
370 | return -ENXIO; | |
371 | return copy_to_user(arg, dev->bus_id, sizeof(dev->bus_id))? -EFAULT: 0; | |
372 | } | |
373 | ||
374 | ||
375 | /* | |
376 | * the scsi_ioctl() function differs from most ioctls in that it does | |
377 | * not take a major/minor number as the dev field. Rather, it takes | |
378 | * a pointer to a scsi_devices[] element, a structure. | |
379 | */ | |
380 | int scsi_ioctl(struct scsi_device *sdev, int cmd, void __user *arg) | |
381 | { | |
382 | char scsi_cmd[MAX_COMMAND_SIZE]; | |
383 | ||
384 | /* No idea how this happens.... */ | |
385 | if (!sdev) | |
386 | return -ENXIO; | |
387 | ||
388 | /* | |
389 | * If we are in the middle of error recovery, don't let anyone | |
390 | * else try and use this device. Also, if error recovery fails, it | |
391 | * may try and take the device offline, in which case all further | |
392 | * access to the device is prohibited. | |
393 | */ | |
394 | if (!scsi_block_when_processing_errors(sdev)) | |
395 | return -ENODEV; | |
396 | ||
397 | /* Check for deprecated ioctls ... all the ioctls which don't | |
398 | * follow the new unique numbering scheme are deprecated */ | |
399 | switch (cmd) { | |
400 | case SCSI_IOCTL_SEND_COMMAND: | |
401 | case SCSI_IOCTL_TEST_UNIT_READY: | |
402 | case SCSI_IOCTL_BENCHMARK_COMMAND: | |
403 | case SCSI_IOCTL_SYNC: | |
404 | case SCSI_IOCTL_START_UNIT: | |
405 | case SCSI_IOCTL_STOP_UNIT: | |
406 | printk(KERN_WARNING "program %s is using a deprecated SCSI " | |
407 | "ioctl, please convert it to SG_IO\n", current->comm); | |
408 | break; | |
409 | default: | |
410 | break; | |
411 | } | |
412 | ||
413 | switch (cmd) { | |
414 | case SCSI_IOCTL_GET_IDLUN: | |
415 | if (!access_ok(VERIFY_WRITE, arg, sizeof(struct scsi_idlun))) | |
416 | return -EFAULT; | |
417 | ||
418 | __put_user((sdev->id & 0xff) | |
419 | + ((sdev->lun & 0xff) << 8) | |
420 | + ((sdev->channel & 0xff) << 16) | |
421 | + ((sdev->host->host_no & 0xff) << 24), | |
422 | &((struct scsi_idlun __user *)arg)->dev_id); | |
423 | __put_user(sdev->host->unique_id, | |
424 | &((struct scsi_idlun __user *)arg)->host_unique_id); | |
425 | return 0; | |
426 | case SCSI_IOCTL_GET_BUS_NUMBER: | |
427 | return put_user(sdev->host->host_no, (int __user *)arg); | |
428 | case SCSI_IOCTL_PROBE_HOST: | |
429 | return ioctl_probe(sdev->host, arg); | |
430 | case SCSI_IOCTL_SEND_COMMAND: | |
431 | if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO)) | |
432 | return -EACCES; | |
433 | return scsi_ioctl_send_command(sdev, arg); | |
434 | case SCSI_IOCTL_DOORLOCK: | |
435 | return scsi_set_medium_removal(sdev, SCSI_REMOVAL_PREVENT); | |
436 | case SCSI_IOCTL_DOORUNLOCK: | |
437 | return scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW); | |
438 | case SCSI_IOCTL_TEST_UNIT_READY: | |
439 | return scsi_test_unit_ready(sdev, IOCTL_NORMAL_TIMEOUT, | |
440 | NORMAL_RETRIES); | |
441 | case SCSI_IOCTL_START_UNIT: | |
442 | scsi_cmd[0] = START_STOP; | |
443 | scsi_cmd[1] = 0; | |
444 | scsi_cmd[2] = scsi_cmd[3] = scsi_cmd[5] = 0; | |
445 | scsi_cmd[4] = 1; | |
446 | return ioctl_internal_command(sdev, scsi_cmd, | |
447 | START_STOP_TIMEOUT, NORMAL_RETRIES); | |
448 | case SCSI_IOCTL_STOP_UNIT: | |
449 | scsi_cmd[0] = START_STOP; | |
450 | scsi_cmd[1] = 0; | |
451 | scsi_cmd[2] = scsi_cmd[3] = scsi_cmd[5] = 0; | |
452 | scsi_cmd[4] = 0; | |
453 | return ioctl_internal_command(sdev, scsi_cmd, | |
454 | START_STOP_TIMEOUT, NORMAL_RETRIES); | |
455 | case SCSI_IOCTL_GET_PCI: | |
456 | return scsi_ioctl_get_pci(sdev, arg); | |
457 | default: | |
458 | if (sdev->host->hostt->ioctl) | |
459 | return sdev->host->hostt->ioctl(sdev, cmd, arg); | |
460 | } | |
461 | return -EINVAL; | |
462 | } | |
463 | EXPORT_SYMBOL(scsi_ioctl); | |
464 | ||
465 | /* | |
466 | * the scsi_nonblock_ioctl() function is designed for ioctls which may | |
467 | * be executed even if the device is in recovery. | |
468 | */ | |
469 | int scsi_nonblockable_ioctl(struct scsi_device *sdev, int cmd, | |
470 | void __user *arg, struct file *filp) | |
471 | { | |
472 | int val, result; | |
473 | ||
474 | /* The first set of iocts may be executed even if we're doing | |
475 | * error processing, as long as the device was opened | |
476 | * non-blocking */ | |
477 | if (filp && filp->f_flags & O_NONBLOCK) { | |
d3301874 | 478 | if (sdev->host->shost_state == SHOST_RECOVERY) |
1da177e4 LT |
479 | return -ENODEV; |
480 | } else if (!scsi_block_when_processing_errors(sdev)) | |
481 | return -ENODEV; | |
482 | ||
483 | switch (cmd) { | |
484 | case SG_SCSI_RESET: | |
485 | result = get_user(val, (int __user *)arg); | |
486 | if (result) | |
487 | return result; | |
488 | if (val == SG_SCSI_RESET_NOTHING) | |
489 | return 0; | |
490 | switch (val) { | |
491 | case SG_SCSI_RESET_DEVICE: | |
492 | val = SCSI_TRY_RESET_DEVICE; | |
493 | break; | |
494 | case SG_SCSI_RESET_BUS: | |
495 | val = SCSI_TRY_RESET_BUS; | |
496 | break; | |
497 | case SG_SCSI_RESET_HOST: | |
498 | val = SCSI_TRY_RESET_HOST; | |
499 | break; | |
500 | default: | |
501 | return -EINVAL; | |
502 | } | |
503 | if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO)) | |
504 | return -EACCES; | |
505 | return (scsi_reset_provider(sdev, val) == | |
506 | SUCCESS) ? 0 : -EIO; | |
507 | } | |
508 | return -ENODEV; | |
509 | } | |
510 | EXPORT_SYMBOL(scsi_nonblockable_ioctl); |