projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[SCSI] sg: completely protect sfds
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / scsi / sg.c
CommitLineData
1da177e4
LT		 1/*
2 * History:
3 * Started: Aug 9 by Lawrence Foard (entropy@world.std.com),
4 * to allow user process control of SCSI devices.
5 * Development Sponsored by Killy Corp. NY NY
6 *
7 * Original driver (sg.c):
8 * Copyright (C) 1992 Lawrence Foard
9 * Version 2 and 3 extensions to driver:
10 * Copyright (C) 1998 - 2005 Douglas Gilbert
11 *
12 * Modified 19-JAN-1998 Richard Gooch <rgooch@atnf.csiro.au> Devfs support
13 *
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 2, or (at your option)
17 * any later version.
18 *
19 */
20
b2155d04
DG		 21static int sg_version_num = 30534; /* 2 digits for each component */
22#define SG_VERSION_STR "3.5.34"
1da177e4
LT		 23
24/*
25 * D. P. Gilbert (dgilbert@interlog.com, dougg@triode.net.au), notes:
26 * - scsi logging is available via SCSI_LOG_TIMEOUT macros. First
27 * the kernel/module needs to be built with CONFIG_SCSI_LOGGING
28 * (otherwise the macros compile to empty statements).
29 *
30 */
1da177e4
LT		 31#include <linux/module.h>
32
33#include <linux/fs.h>
34#include <linux/kernel.h>
35#include <linux/sched.h>
36#include <linux/string.h>
37#include <linux/mm.h>
38#include <linux/errno.h>
39#include <linux/mtio.h>
40#include <linux/ioctl.h>
5a0e3ad6 41#include <linux/slab.h>
1da177e4
LT		 42#include <linux/fcntl.h>
43#include <linux/init.h>
44#include <linux/poll.h>
1da177e4 45#include <linux/moduleparam.h>
1da177e4 46#include <linux/cdev.h>
7c07d613 47#include <linux/idr.h>
1da177e4
LT		 48#include <linux/seq_file.h>
49#include <linux/blkdev.h>
50#include <linux/delay.h>
6da127ad 51#include <linux/blktrace_api.h>
c45d15d2 52#include <linux/mutex.h>
2fe038e3 53#include <linux/ratelimit.h>
1da177e4
LT		 54
55#include "scsi.h"
db9dff36 56#include <scsi/scsi_dbg.h>
1da177e4
LT		 57#include <scsi/scsi_host.h>
58#include <scsi/scsi_driver.h>
59#include <scsi/scsi_ioctl.h>
60#include <scsi/sg.h>
61
62#include "scsi_logging.h"
63
64#ifdef CONFIG_SCSI_PROC_FS
65#include <linux/proc_fs.h>
7ca63cb4 66static char *sg_version_date = "20061027";
1da177e4
LT		 67
68static int sg_proc_init(void);
69static void sg_proc_cleanup(void);
70#endif
71
1da177e4 72#define SG_ALLOW_DIO_DEF 0
1da177e4
LT		 73
74#define SG_MAX_DEVS 32768
75
76/*
77 * Suppose you want to calculate the formula muldiv(x,m,d)=int(x * m / d)
78 * Then when using 32 bit integers x * m may overflow during the calculation.
79 * Replacing muldiv(x) by muldiv(x)=((x % d) * m) / d + int(x / d) * m
80 * calculates the same, but prevents the overflow when both m and d
81 * are "small" numbers (like HZ and USER_HZ).
82 * Of course an overflow is inavoidable if the result of muldiv doesn't fit
83 * in 32 bits.
84 */
85#define MULDIV(X,MUL,DIV) ((((X % DIV) * MUL) / DIV) + ((X / DIV) * MUL))
86
87#define SG_DEFAULT_TIMEOUT MULDIV(SG_DEFAULT_TIMEOUT_USER, HZ, USER_HZ)
88
89int sg_big_buff = SG_DEF_RESERVED_SIZE;
90/* N.B. This variable is readable and writeable via
91 /proc/scsi/sg/def_reserved_size . Each time sg_open() is called a buffer
92 of this size (or less if there is not enough memory) will be reserved
93 for use by this file descriptor. [Deprecated usage: this variable is also
94 readable via /proc/sys/kernel/sg-big-buff if the sg driver is built into
95 the kernel (i.e. it is not a module).] */
96static int def_reserved_size = -1; /* picks up init parameter */
97static int sg_allow_dio = SG_ALLOW_DIO_DEF;
98
6460e75a
DG		 99static int scatter_elem_sz = SG_SCATTER_SZ;
100static int scatter_elem_sz_prev = SG_SCATTER_SZ;
101
1da177e4 102#define SG_SECTOR_SZ 512
1da177e4 103
ee959b00
TJ		 104static int sg_add(struct device *, struct class_interface *);
105static void sg_remove(struct device *, struct class_interface *);
1da177e4 106
c45d15d2 107static DEFINE_MUTEX(sg_mutex);
b499e524 108static DEFINE_SPINLOCK(sg_open_exclusive_lock);
c45d15d2 109
7c07d613
JB		 110static DEFINE_IDR(sg_index_idr);
111static DEFINE_RWLOCK(sg_index_lock); /* Also used to lock
1da177e4
LT		 112 file descriptor list for device */
113
114static struct class_interface sg_interface = {
ee959b00
TJ		 115 .add_dev = sg_add,
116 .remove_dev = sg_remove,
1da177e4
LT		 117};
118
119typedef struct sg_scatter_hold { /* holding area for scsi scatter gather info */
120 unsigned short k_use_sg; /* Count of kernel scatter-gather pieces */
ea312552 121 unsigned sglist_len; /* size of malloc'd scatter-gather list ++ */
1da177e4 122 unsigned bufflen; /* Size of (aggregate) data buffer */
10db10d1
FT		 123 struct page **pages;
124 int page_order;
1da177e4
LT		 125 char dio_in_use; /* 0->indirect IO (or mmap), 1->dio */
126 unsigned char cmd_opcode; /* first byte of command */
127} Sg_scatter_hold;
128
129struct sg_device; /* forward declarations */
130struct sg_fd;
131
132typedef struct sg_request { /* SG_MAX_QUEUE requests outstanding per file */
1da177e4
LT		 133 struct sg_request *nextrp; /* NULL -> tail request (slist) */
134 struct sg_fd *parentfp; /* NULL -> not in use */
135 Sg_scatter_hold data; /* hold buffer, perhaps scatter list */
136 sg_io_hdr_t header; /* scsi command+info, see <scsi/sg.h> */
d6b10348 137 unsigned char sense_b[SCSI_SENSE_BUFFERSIZE];
1da177e4
LT		 138 char res_used; /* 1 -> using reserve buffer, 0 -> not ... */
139 char orphan; /* 1 -> drop on sight, 0 -> normal */
140 char sg_io_owned; /* 1 -> packet belongs to SG_IO */
6acddc5e
JE		 141 /* done protected by rq_list_lock */
142 char done; /* 0->before bh, 1->before read, 2->read */
10865dfa 143 struct request *rq;
6e5a30cb 144 struct bio *bio;
c96952ed 145 struct execute_work ew;
1da177e4
LT		 146} Sg_request;
147
148typedef struct sg_fd { /* holds the state of a file descriptor */
035d12e6 149 /* sfd_siblings is protected by sg_index_lock */
3442f802 150 struct list_head sfd_siblings;
1da177e4
LT		 151 struct sg_device *parentdp; /* owning device */
152 wait_queue_head_t read_wait; /* queue read until command done */
153 rwlock_t rq_list_lock; /* protect access to list in req_arr */
154 int timeout; /* defaults to SG_DEFAULT_TIMEOUT */
155 int timeout_user; /* defaults to SG_DEFAULT_TIMEOUT_USER */
156 Sg_scatter_hold reserve; /* buffer held for this file descriptor */
157 unsigned save_scat_len; /* original length of trunc. scat. element */
158 Sg_request *headrp; /* head of request slist, NULL->empty */
159 struct fasync_struct *async_qp; /* used by asynchronous notification */
160 Sg_request req_arr[SG_MAX_QUEUE]; /* used as singly-linked list */
161 char low_dma; /* as in parent but possibly overridden to 1 */
162 char force_packid; /* 1 -> pack_id input to read(), 0 -> ignored */
1da177e4
LT		 163 char cmd_q; /* 1 -> allow command queuing, 0 -> don't */
164 char next_cmd_len; /* 0 -> automatic (def), >0 -> use on next write() */
165 char keep_orphan; /* 0 -> drop orphan (def), 1 -> keep for read() */
166 char mmap_called; /* 0 -> mmap() never called on this fd */
c6517b79
TB		 167 struct kref f_ref;
168 struct execute_work ew;
1da177e4
LT		 169} Sg_fd;
170
171typedef struct sg_device { /* holds the state of each scsi generic device */
172 struct scsi_device *device;
173 wait_queue_head_t o_excl_wait; /* queue open() when O_EXCL in use */
174 int sg_tablesize; /* adapter's max scatter-gather table size */
7c07d613 175 u32 index; /* device index number */
035d12e6 176 /* sfds is protected by sg_index_lock */
3442f802 177 struct list_head sfds;
1da177e4 178 volatile char detached; /* 0->attached, 1->detached pending removal */
b499e524
JE		 179 /* exclude protected by sg_open_exclusive_lock */
180 char exclude; /* opened for exclusive access */
1da177e4
LT		 181 char sgdebug; /* 0->off, 1->sense, 9->dump dev, 10-> all devs */
182 struct gendisk *disk;
183 struct cdev * cdev; /* char_dev [sysfs: /sys/cdev/major/sg<n>] */
c6517b79 184 struct kref d_ref;
1da177e4
LT		 185} Sg_device;
186
d6b10348 187/* tasklet or soft irq callback */
a91a3a20 188static void sg_rq_end_io(struct request *rq, int uptodate);
10865dfa 189static int sg_start_req(Sg_request *srp, unsigned char *cmd);
e7ee4cc0 190static int sg_finish_rem_req(Sg_request * srp);
1da177e4 191static int sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size);
1da177e4
LT		 192static ssize_t sg_new_read(Sg_fd * sfp, char __user *buf, size_t count,
193 Sg_request * srp);
0b07de85
AG		 194static ssize_t sg_new_write(Sg_fd *sfp, struct file *file,
195 const char __user *buf, size_t count, int blocking,
a2dd3b4c 196 int read_only, int sg_io_owned, Sg_request **o_srp);
1da177e4
LT		 197static int sg_common_write(Sg_fd * sfp, Sg_request * srp,
198 unsigned char *cmnd, int timeout, int blocking);
1da177e4
LT		 199static int sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer);
200static void sg_remove_scat(Sg_scatter_hold * schp);
201static void sg_build_reserve(Sg_fd * sfp, int req_size);
202static void sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size);
203static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp);
1da177e4 204static Sg_fd *sg_add_sfp(Sg_device * sdp, int dev);
c6517b79 205static void sg_remove_sfp(struct kref *);
1da177e4
LT		 206static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id);
207static Sg_request *sg_add_request(Sg_fd * sfp);
208static int sg_remove_request(Sg_fd * sfp, Sg_request * srp);
209static int sg_res_in_use(Sg_fd * sfp);
1da177e4 210static Sg_device *sg_get_dev(int dev);
c6517b79 211static void sg_put_dev(Sg_device *sdp);
1da177e4 212
1da177e4
LT		 213#define SZ_SG_HEADER sizeof(struct sg_header)
214#define SZ_SG_IO_HDR sizeof(sg_io_hdr_t)
215#define SZ_SG_IOVEC sizeof(sg_iovec_t)
216#define SZ_SG_REQ_INFO sizeof(sg_req_info_t)
217
14e507b8
FT		 218static int sg_allow_access(struct file *filp, unsigned char *cmd)
219{
35df8397 220 struct sg_fd *sfp = filp->private_data;
14e507b8
FT		 221
222 if (sfp->parentdp->device->type == TYPE_SCANNER)
223 return 0;
224
018e0446 225 return blk_verify_command(cmd, filp->f_mode & FMODE_WRITE);
14e507b8
FT		 226}
227
b499e524
JE		 228static int get_exclude(Sg_device *sdp)
229{
230 unsigned long flags;
231 int ret;
232
233 spin_lock_irqsave(&sg_open_exclusive_lock, flags);
234 ret = sdp->exclude;
235 spin_unlock_irqrestore(&sg_open_exclusive_lock, flags);
236 return ret;
237}
238
239static int set_exclude(Sg_device *sdp, char val)
240{
241 unsigned long flags;
242
243 spin_lock_irqsave(&sg_open_exclusive_lock, flags);
244 sdp->exclude = val;
245 spin_unlock_irqrestore(&sg_open_exclusive_lock, flags);
246 return val;
247}
248
035d12e6
JE		 249static int sfds_list_empty(Sg_device *sdp)
250{
251 unsigned long flags;
252 int ret;
253
254 read_lock_irqsave(&sg_index_lock, flags);
255 ret = list_empty(&sdp->sfds);
256 read_unlock_irqrestore(&sg_index_lock, flags);
257 return ret;
258}
259
1da177e4
LT		 260static int
261sg_open(struct inode *inode, struct file *filp)
262{
263 int dev = iminor(inode);
264 int flags = filp->f_flags;
d6b10348 265 struct request_queue *q;
1da177e4
LT		 266 Sg_device *sdp;
267 Sg_fd *sfp;
268 int res;
269 int retval;
270
c45d15d2 271 mutex_lock(&sg_mutex);
1da177e4
LT		 272 nonseekable_open(inode, filp);
273 SCSI_LOG_TIMEOUT(3, printk("sg_open: dev=%d, flags=0x%x\n", dev, flags));
274 sdp = sg_get_dev(dev);
c6517b79
TB		 275 if (IS_ERR(sdp)) {
276 retval = PTR_ERR(sdp);
277 sdp = NULL;
278 goto sg_put;
eb09d3d4 279 }
1da177e4
LT		 280
281 /* This driver's module count bumped by fops_get in <linux/fs.h> */
282 /* Prevent the device driver from vanishing while we sleep */
283 retval = scsi_device_get(sdp->device);
c6517b79
TB		 284 if (retval)
285 goto sg_put;
1da177e4 286
bc4f2401
AS		 287 retval = scsi_autopm_get_device(sdp->device);
288 if (retval)
289 goto sdp_put;
290
1da177e4
LT		 291 if (!((flags & O_NONBLOCK) ||
292 scsi_block_when_processing_errors(sdp->device))) {
293 retval = -ENXIO;
294 /* we are in error recovery for this device */
295 goto error_out;
296 }
297
298 if (flags & O_EXCL) {
299 if (O_RDONLY == (flags & O_ACCMODE)) {
300 retval = -EPERM; /* Can't lock it with read only access */
301 goto error_out;
302 }
035d12e6 303 if (!sfds_list_empty(sdp) && (flags & O_NONBLOCK)) {
1da177e4
LT		 304 retval = -EBUSY;
305 goto error_out;
306 }
3f0c6aba 307 res = wait_event_interruptible(sdp->o_excl_wait,
035d12e6 308 ((!sfds_list_empty(sdp) || get_exclude(sdp)) ? 0 : set_exclude(sdp, 1)));
1da177e4
LT		 309 if (res) {
310 retval = res; /* -ERESTARTSYS because signal hit process */
311 goto error_out;
312 }
b499e524 313 } else if (get_exclude(sdp)) { /* some other fd has an exclusive lock on dev */
1da177e4
LT		 314 if (flags & O_NONBLOCK) {
315 retval = -EBUSY;
316 goto error_out;
317 }
b499e524 318 res = wait_event_interruptible(sdp->o_excl_wait, !get_exclude(sdp));
1da177e4
LT		 319 if (res) {
320 retval = res; /* -ERESTARTSYS because signal hit process */
321 goto error_out;
322 }
323 }
324 if (sdp->detached) {
325 retval = -ENODEV;
326 goto error_out;
327 }
035d12e6 328 if (sfds_list_empty(sdp)) { /* no existing opens on this device */
1da177e4 329 sdp->sgdebug = 0;
d6b10348 330 q = sdp->device->request_queue;
8a78362c 331 sdp->sg_tablesize = queue_max_segments(q);
1da177e4
LT		 332 }
333 if ((sfp = sg_add_sfp(sdp, dev)))
334 filp->private_data = sfp;
335 else {
c6517b79 336 if (flags & O_EXCL) {
b499e524 337 set_exclude(sdp, 0); /* undo if error */
c6517b79
TB		 338 wake_up_interruptible(&sdp->o_excl_wait);
339 }
1da177e4
LT		 340 retval = -ENOMEM;
341 goto error_out;
342 }
c6517b79
TB		 343 retval = 0;
344error_out:
bc4f2401
AS		 345 if (retval) {
346 scsi_autopm_put_device(sdp->device);
347sdp_put:
c6517b79 348 scsi_device_put(sdp->device);
bc4f2401 349 }
c6517b79
TB		 350sg_put:
351 if (sdp)
352 sg_put_dev(sdp);
c45d15d2 353 mutex_unlock(&sg_mutex);
1da177e4
LT		 354 return retval;
355}
356
357/* Following function was formerly called 'sg_close' */
358static int
359sg_release(struct inode *inode, struct file *filp)
360{
361 Sg_device *sdp;
362 Sg_fd *sfp;
363
364 if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
365 return -ENXIO;
366 SCSI_LOG_TIMEOUT(3, printk("sg_release: %s\n", sdp->disk->disk_name));
c6517b79 367
b499e524 368 set_exclude(sdp, 0);
c6517b79
TB		 369 wake_up_interruptible(&sdp->o_excl_wait);
370
bc4f2401 371 scsi_autopm_put_device(sdp->device);
c6517b79 372 kref_put(&sfp->f_ref, sg_remove_sfp);
1da177e4
LT		 373 return 0;
374}
375
376static ssize_t
377sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
378{
1da177e4
LT		 379 Sg_device *sdp;
380 Sg_fd *sfp;
381 Sg_request *srp;
382 int req_pack_id = -1;
1da177e4 383 sg_io_hdr_t *hp;
cb59e840
DG		 384 struct sg_header *old_hdr = NULL;
385 int retval = 0;
1da177e4
LT		 386
387 if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
388 return -ENXIO;
389 SCSI_LOG_TIMEOUT(3, printk("sg_read: %s, count=%d\n",
390 sdp->disk->disk_name, (int) count));
d6b10348 391
1da177e4
LT		 392 if (!access_ok(VERIFY_WRITE, buf, count))
393 return -EFAULT;
394 if (sfp->force_packid && (count >= SZ_SG_HEADER)) {
cb59e840
DG		 395 old_hdr = kmalloc(SZ_SG_HEADER, GFP_KERNEL);
396 if (!old_hdr)
397 return -ENOMEM;
398 if (__copy_from_user(old_hdr, buf, SZ_SG_HEADER)) {
399 retval = -EFAULT;
400 goto free_old_hdr;
401 }
402 if (old_hdr->reply_len < 0) {
1da177e4 403 if (count >= SZ_SG_IO_HDR) {
cb59e840
DG		 404 sg_io_hdr_t *new_hdr;
405 new_hdr = kmalloc(SZ_SG_IO_HDR, GFP_KERNEL);
406 if (!new_hdr) {
407 retval = -ENOMEM;
408 goto free_old_hdr;
409 }
410 retval =__copy_from_user
411 (new_hdr, buf, SZ_SG_IO_HDR);
412 req_pack_id = new_hdr->pack_id;
413 kfree(new_hdr);
414 if (retval) {
415 retval = -EFAULT;
416 goto free_old_hdr;
417 }
1da177e4
LT		 418 }
419 } else
cb59e840 420 req_pack_id = old_hdr->pack_id;
1da177e4
LT		 421 }
422 srp = sg_get_rq_mark(sfp, req_pack_id);
423 if (!srp) { /* now wait on packet to arrive */
cb59e840
DG		 424 if (sdp->detached) {
425 retval = -ENODEV;
426 goto free_old_hdr;
427 }
428 if (filp->f_flags & O_NONBLOCK) {
429 retval = -EAGAIN;
430 goto free_old_hdr;
431 }
3f0c6aba 432 retval = wait_event_interruptible(sfp->read_wait,
794c10fa 433 (sdp->detached ||
3f0c6aba 434 (srp = sg_get_rq_mark(sfp, req_pack_id))));
794c10fa
JE		 435 if (sdp->detached) {
436 retval = -ENODEV;
437 goto free_old_hdr;
438 }
439 if (retval) {
cb59e840
DG		 440 /* -ERESTARTSYS as signal hit process */
441 goto free_old_hdr;
1da177e4
LT		 442 }
443 }
cb59e840
DG		 444 if (srp->header.interface_id != '\0') {
445 retval = sg_new_read(sfp, buf, count, srp);
446 goto free_old_hdr;
447 }
1da177e4
LT		 448
449 hp = &srp->header;
cb59e840
DG		 450 if (old_hdr == NULL) {
451 old_hdr = kmalloc(SZ_SG_HEADER, GFP_KERNEL);
452 if (! old_hdr) {
453 retval = -ENOMEM;
454 goto free_old_hdr;
455 }
456 }
457 memset(old_hdr, 0, SZ_SG_HEADER);
458 old_hdr->reply_len = (int) hp->timeout;
459 old_hdr->pack_len = old_hdr->reply_len; /* old, strange behaviour */
460 old_hdr->pack_id = hp->pack_id;
461 old_hdr->twelve_byte =
1da177e4 462 ((srp->data.cmd_opcode >= 0xc0) && (12 == hp->cmd_len)) ? 1 : 0;
cb59e840
DG		 463 old_hdr->target_status = hp->masked_status;
464 old_hdr->host_status = hp->host_status;
465 old_hdr->driver_status = hp->driver_status;
1da177e4
LT		 466 if ((CHECK_CONDITION & hp->masked_status) ||
467 (DRIVER_SENSE & hp->driver_status))
cb59e840
DG		 468 memcpy(old_hdr->sense_buffer, srp->sense_b,
469 sizeof (old_hdr->sense_buffer));
1da177e4
LT		 470 switch (hp->host_status) {
471 /* This setup of 'result' is for backward compatibility and is best
472 ignored by the user who should use target, host + driver status */
473 case DID_OK:
474 case DID_PASSTHROUGH:
475 case DID_SOFT_ERROR:
cb59e840 476 old_hdr->result = 0;
1da177e4
LT		 477 break;
478 case DID_NO_CONNECT:
479 case DID_BUS_BUSY:
480 case DID_TIME_OUT:
cb59e840 481 old_hdr->result = EBUSY;
1da177e4
LT		 482 break;
483 case DID_BAD_TARGET:
484 case DID_ABORT:
485 case DID_PARITY:
486 case DID_RESET:
487 case DID_BAD_INTR:
cb59e840 488 old_hdr->result = EIO;
1da177e4
LT		 489 break;
490 case DID_ERROR:
cb59e840 491 old_hdr->result = (srp->sense_b[0] == 0 &&
1da177e4
LT		 492 hp->masked_status == GOOD) ? 0 : EIO;
493 break;
494 default:
cb59e840 495 old_hdr->result = EIO;
1da177e4
LT		 496 break;
497 }
498
499 /* Now copy the result back to the user buffer. */
500 if (count >= SZ_SG_HEADER) {
cb59e840
DG		 501 if (__copy_to_user(buf, old_hdr, SZ_SG_HEADER)) {
502 retval = -EFAULT;
503 goto free_old_hdr;
504 }
1da177e4 505 buf += SZ_SG_HEADER;
cb59e840
DG		 506 if (count > old_hdr->reply_len)
507 count = old_hdr->reply_len;
1da177e4 508 if (count > SZ_SG_HEADER) {
cb59e840
DG		 509 if (sg_read_oxfer(srp, buf, count - SZ_SG_HEADER)) {
510 retval = -EFAULT;
511 goto free_old_hdr;
512 }
1da177e4
LT		 513 }
514 } else
cb59e840 515 count = (old_hdr->result == 0) ? 0 : -EIO;
1da177e4 516 sg_finish_rem_req(srp);
cb59e840
DG		 517 retval = count;
518free_old_hdr:
c9475cb0 519 kfree(old_hdr);
cb59e840 520 return retval;
1da177e4
LT		 521}
522
523static ssize_t
524sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
525{
526 sg_io_hdr_t *hp = &srp->header;
527 int err = 0;
528 int len;
529
530 if (count < SZ_SG_IO_HDR) {
531 err = -EINVAL;
532 goto err_out;
533 }
534 hp->sb_len_wr = 0;
535 if ((hp->mx_sb_len > 0) && hp->sbp) {
536 if ((CHECK_CONDITION & hp->masked_status) ||
537 (DRIVER_SENSE & hp->driver_status)) {
d6b10348 538 int sb_len = SCSI_SENSE_BUFFERSIZE;
1da177e4
LT		 539 sb_len = (hp->mx_sb_len > sb_len) ? sb_len : hp->mx_sb_len;
540 len = 8 + (int) srp->sense_b[7]; /* Additional sense length field */
541 len = (len > sb_len) ? sb_len : len;
542 if (copy_to_user(hp->sbp, srp->sense_b, len)) {
543 err = -EFAULT;
544 goto err_out;
545 }
546 hp->sb_len_wr = len;
547 }
548 }
549 if (hp->masked_status || hp->host_status || hp->driver_status)
550 hp->info |= SG_INFO_CHECK;
551 if (copy_to_user(buf, hp, SZ_SG_IO_HDR)) {
552 err = -EFAULT;
553 goto err_out;
554 }
0b6cb26c 555err_out:
e7ee4cc0 556 err = sg_finish_rem_req(srp);
1da177e4
LT		 557 return (0 == err) ? count : err;
558}
559
560static ssize_t
561sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
562{
563 int mxsize, cmd_size, k;
564 int input_size, blocking;
565 unsigned char opcode;
566 Sg_device *sdp;
567 Sg_fd *sfp;
568 Sg_request *srp;
569 struct sg_header old_hdr;
570 sg_io_hdr_t *hp;
d6b10348 571 unsigned char cmnd[MAX_COMMAND_SIZE];
1da177e4
LT		 572
573 if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
574 return -ENXIO;
575 SCSI_LOG_TIMEOUT(3, printk("sg_write: %s, count=%d\n",
576 sdp->disk->disk_name, (int) count));
577 if (sdp->detached)
578 return -ENODEV;
579 if (!((filp->f_flags & O_NONBLOCK) ||
580 scsi_block_when_processing_errors(sdp->device)))
581 return -ENXIO;
582
583 if (!access_ok(VERIFY_READ, buf, count))
584 return -EFAULT; /* protects following copy_from_user()s + get_user()s */
585 if (count < SZ_SG_HEADER)
586 return -EIO;
587 if (__copy_from_user(&old_hdr, buf, SZ_SG_HEADER))
588 return -EFAULT;
589 blocking = !(filp->f_flags & O_NONBLOCK);
590 if (old_hdr.reply_len < 0)
a2dd3b4c
TB		 591 return sg_new_write(sfp, filp, buf, count,
592 blocking, 0, 0, NULL);
1da177e4
LT		 593 if (count < (SZ_SG_HEADER + 6))
594 return -EIO; /* The minimum scsi command length is 6 bytes. */
595
596 if (!(srp = sg_add_request(sfp))) {
597 SCSI_LOG_TIMEOUT(1, printk("sg_write: queue full\n"));
598 return -EDOM;
599 }
600 buf += SZ_SG_HEADER;
601 __get_user(opcode, buf);
602 if (sfp->next_cmd_len > 0) {
603 if (sfp->next_cmd_len > MAX_COMMAND_SIZE) {
604 SCSI_LOG_TIMEOUT(1, printk("sg_write: command length too long\n"));
605 sfp->next_cmd_len = 0;
606 sg_remove_request(sfp, srp);
607 return -EIO;
608 }
609 cmd_size = sfp->next_cmd_len;
610 sfp->next_cmd_len = 0; /* reset so only this write() effected */
611 } else {
612 cmd_size = COMMAND_SIZE(opcode); /* based on SCSI command group */
613 if ((opcode >= 0xc0) && old_hdr.twelve_byte)
614 cmd_size = 12;
615 }
616 SCSI_LOG_TIMEOUT(4, printk(
617 "sg_write: scsi opcode=0x%02x, cmd_size=%d\n", (int) opcode, cmd_size));
618/* Determine buffer size. */
619 input_size = count - cmd_size;
620 mxsize = (input_size > old_hdr.reply_len) ? input_size : old_hdr.reply_len;
621 mxsize -= SZ_SG_HEADER;
622 input_size -= SZ_SG_HEADER;
623 if (input_size < 0) {
624 sg_remove_request(sfp, srp);
625 return -EIO; /* User did not pass enough bytes for this command. */
626 }
627 hp = &srp->header;
628 hp->interface_id = '\0'; /* indicator of old interface tunnelled */
629 hp->cmd_len = (unsigned char) cmd_size;
630 hp->iovec_count = 0;
631 hp->mx_sb_len = 0;
632 if (input_size > 0)
633 hp->dxfer_direction = (old_hdr.reply_len > SZ_SG_HEADER) ?
634 SG_DXFER_TO_FROM_DEV : SG_DXFER_TO_DEV;
635 else
636 hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE;
637 hp->dxfer_len = mxsize;
fad7f01e
FT		 638 if (hp->dxfer_direction == SG_DXFER_TO_DEV)
639 hp->dxferp = (char __user *)buf + cmd_size;
640 else
641 hp->dxferp = NULL;
1da177e4
LT		 642 hp->sbp = NULL;
643 hp->timeout = old_hdr.reply_len; /* structure abuse ... */
644 hp->flags = input_size; /* structure abuse ... */
645 hp->pack_id = old_hdr.pack_id;
646 hp->usr_ptr = NULL;
647 if (__copy_from_user(cmnd, buf, cmd_size))
648 return -EFAULT;
649 /*
650 * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV,
651 * but is is possible that the app intended SG_DXFER_TO_DEV, because there
652 * is a non-zero input_size, so emit a warning.
653 */
eaa3e22e
AK		 654 if (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV) {
655 static char cmd[TASK_COMM_LEN];
2fe038e3
CD		 656 if (strcmp(current->comm, cmd)) {
657 printk_ratelimited(KERN_WARNING
658 "sg_write: data in/out %d/%d bytes "
659 "for SCSI command 0x%x-- guessing "
660 "data in;\n program %s not setting "
661 "count and/or reply_len properly\n",
662 old_hdr.reply_len - (int)SZ_SG_HEADER,
663 input_size, (unsigned int) cmnd[0],
664 current->comm);
eaa3e22e
AK		 665 strcpy(cmd, current->comm);
666 }
667 }
1da177e4
LT		 668 k = sg_common_write(sfp, srp, cmnd, sfp->timeout, blocking);
669 return (k < 0) ? k : count;
670}
671
672static ssize_t
0b07de85 673sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
a2dd3b4c 674 size_t count, int blocking, int read_only, int sg_io_owned,
0b07de85 675 Sg_request **o_srp)
1da177e4
LT		 676{
677 int k;
678 Sg_request *srp;
679 sg_io_hdr_t *hp;
d6b10348 680 unsigned char cmnd[MAX_COMMAND_SIZE];
1da177e4
LT		 681 int timeout;
682 unsigned long ul_timeout;
683
684 if (count < SZ_SG_IO_HDR)
685 return -EINVAL;
686 if (!access_ok(VERIFY_READ, buf, count))
687 return -EFAULT; /* protects following copy_from_user()s + get_user()s */
688
689 sfp->cmd_q = 1; /* when sg_io_hdr seen, set command queuing on */
690 if (!(srp = sg_add_request(sfp))) {
691 SCSI_LOG_TIMEOUT(1, printk("sg_new_write: queue full\n"));
692 return -EDOM;
693 }
a2dd3b4c 694 srp->sg_io_owned = sg_io_owned;
1da177e4
LT		 695 hp = &srp->header;
696 if (__copy_from_user(hp, buf, SZ_SG_IO_HDR)) {
697 sg_remove_request(sfp, srp);
698 return -EFAULT;
699 }
700 if (hp->interface_id != 'S') {
701 sg_remove_request(sfp, srp);
702 return -ENOSYS;
703 }
704 if (hp->flags & SG_FLAG_MMAP_IO) {
705 if (hp->dxfer_len > sfp->reserve.bufflen) {
706 sg_remove_request(sfp, srp);
707 return -ENOMEM; /* MMAP_IO size must fit in reserve buffer */
708 }
709 if (hp->flags & SG_FLAG_DIRECT_IO) {
710 sg_remove_request(sfp, srp);
711 return -EINVAL; /* either MMAP_IO or DIRECT_IO (not both) */
712 }
713 if (sg_res_in_use(sfp)) {
714 sg_remove_request(sfp, srp);
715 return -EBUSY; /* reserve buffer already being used */
716 }
717 }
718 ul_timeout = msecs_to_jiffies(srp->header.timeout);
719 timeout = (ul_timeout < INT_MAX) ? ul_timeout : INT_MAX;
720 if ((!hp->cmdp) || (hp->cmd_len < 6) || (hp->cmd_len > sizeof (cmnd))) {
721 sg_remove_request(sfp, srp);
722 return -EMSGSIZE;
723 }
724 if (!access_ok(VERIFY_READ, hp->cmdp, hp->cmd_len)) {
725 sg_remove_request(sfp, srp);
726 return -EFAULT; /* protects following copy_from_user()s + get_user()s */
727 }
728 if (__copy_from_user(cmnd, hp->cmdp, hp->cmd_len)) {
729 sg_remove_request(sfp, srp);
730 return -EFAULT;
731 }
14e507b8 732 if (read_only && sg_allow_access(file, cmnd)) {
1da177e4
LT		 733 sg_remove_request(sfp, srp);
734 return -EPERM;
735 }
736 k = sg_common_write(sfp, srp, cmnd, timeout, blocking);
737 if (k < 0)
738 return k;
739 if (o_srp)
740 *o_srp = srp;
741 return count;
742}
743
744static int
745sg_common_write(Sg_fd * sfp, Sg_request * srp,
746 unsigned char *cmnd, int timeout, int blocking)
747{
d6b10348 748 int k, data_dir;
1da177e4
LT		 749 Sg_device *sdp = sfp->parentdp;
750 sg_io_hdr_t *hp = &srp->header;
1da177e4
LT		 751
752 srp->data.cmd_opcode = cmnd[0]; /* hold opcode of command */
753 hp->status = 0;
754 hp->masked_status = 0;
755 hp->msg_status = 0;
756 hp->info = 0;
757 hp->host_status = 0;
758 hp->driver_status = 0;
759 hp->resid = 0;
760 SCSI_LOG_TIMEOUT(4, printk("sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n",
761 (int) cmnd[0], (int) hp->cmd_len));
762
10865dfa
FT		 763 k = sg_start_req(srp, cmnd);
764 if (k) {
7ca63cb4 765 SCSI_LOG_TIMEOUT(1, printk("sg_common_write: start_req err=%d\n", k));
1da177e4
LT		 766 sg_finish_rem_req(srp);
767 return k; /* probably out of space --> ENOMEM */
768 }
1da177e4 769 if (sdp->detached) {
caf19d38
FT		 770 if (srp->bio)
771 blk_end_request_all(srp->rq, -EIO);
1da177e4
LT		 772 sg_finish_rem_req(srp);
773 return -ENODEV;
774 }
1da177e4 775
1da177e4
LT		 776 switch (hp->dxfer_direction) {
777 case SG_DXFER_TO_FROM_DEV:
778 case SG_DXFER_FROM_DEV:
d6b10348 779 data_dir = DMA_FROM_DEVICE;
1da177e4
LT		 780 break;
781 case SG_DXFER_TO_DEV:
d6b10348 782 data_dir = DMA_TO_DEVICE;
1da177e4
LT		 783 break;
784 case SG_DXFER_UNKNOWN:
d6b10348 785 data_dir = DMA_BIDIRECTIONAL;
1da177e4
LT		 786 break;
787 default:
d6b10348 788 data_dir = DMA_NONE;
1da177e4
LT		 789 break;
790 }
cb59e840 791 hp->duration = jiffies_to_msecs(jiffies);
10db10d1
FT		 792
793 srp->rq->timeout = timeout;
c6517b79 794 kref_get(&sfp->f_ref); /* sg_rq_end_io() does kref_put(). */
10db10d1
FT		 795 blk_execute_rq_nowait(sdp->device->request_queue, sdp->disk,
796 srp->rq, 1, sg_rq_end_io);
797 return 0;
1da177e4
LT		 798}
799
6acddc5e
JE		 800static int srp_done(Sg_fd *sfp, Sg_request *srp)
801{
802 unsigned long flags;
803 int ret;
804
805 read_lock_irqsave(&sfp->rq_list_lock, flags);
806 ret = srp->done;
807 read_unlock_irqrestore(&sfp->rq_list_lock, flags);
808 return ret;
809}
810
1da177e4 811static int
f4927c45 812sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
1da177e4
LT		 813{
814 void __user *p = (void __user *)arg;
815 int __user *ip = p;
816 int result, val, read_only;
817 Sg_device *sdp;
818 Sg_fd *sfp;
819 Sg_request *srp;
820 unsigned long iflags;
821
822 if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
823 return -ENXIO;
abf54393 824
1da177e4
LT		 825 SCSI_LOG_TIMEOUT(3, printk("sg_ioctl: %s, cmd=0x%x\n",
826 sdp->disk->disk_name, (int) cmd_in));
827 read_only = (O_RDWR != (filp->f_flags & O_ACCMODE));
828
829 switch (cmd_in) {
830 case SG_IO:
dddbf8d9
JE		 831 if (sdp->detached)
832 return -ENODEV;
833 if (!scsi_block_when_processing_errors(sdp->device))
834 return -ENXIO;
835 if (!access_ok(VERIFY_WRITE, p, SZ_SG_IO_HDR))
836 return -EFAULT;
837 result = sg_new_write(sfp, filp, p, SZ_SG_IO_HDR,
838 1, read_only, 1, &srp);
839 if (result < 0)
840 return result;
3f0c6aba 841 result = wait_event_interruptible(sfp->read_wait,
6acddc5e 842 (srp_done(sfp, srp) || sdp->detached));
794c10fa
JE		 843 if (sdp->detached)
844 return -ENODEV;
845 write_lock_irq(&sfp->rq_list_lock);
846 if (srp->done) {
847 srp->done = 2;
dddbf8d9 848 write_unlock_irq(&sfp->rq_list_lock);
794c10fa
JE		 849 result = sg_new_read(sfp, p, SZ_SG_IO_HDR, srp);
850 return (result < 0) ? result : 0;
1da177e4 851 }
794c10fa
JE		 852 srp->orphan = 1;
853 write_unlock_irq(&sfp->rq_list_lock);
854 return result; /* -ERESTARTSYS because signal hit process */
1da177e4
LT		 855 case SG_SET_TIMEOUT:
856 result = get_user(val, ip);
857 if (result)
858 return result;
859 if (val < 0)
860 return -EIO;
861 if (val >= MULDIV (INT_MAX, USER_HZ, HZ))
862 val = MULDIV (INT_MAX, USER_HZ, HZ);
863 sfp->timeout_user = val;
864 sfp->timeout = MULDIV (val, HZ, USER_HZ);
865
866 return 0;
867 case SG_GET_TIMEOUT: /* N.B. User receives timeout as return value */
868 /* strange ..., for backward compatibility */
869 return sfp->timeout_user;
870 case SG_SET_FORCE_LOW_DMA:
871 result = get_user(val, ip);
872 if (result)
873 return result;
874 if (val) {
875 sfp->low_dma = 1;
876 if ((0 == sfp->low_dma) && (0 == sg_res_in_use(sfp))) {
877 val = (int) sfp->reserve.bufflen;
878 sg_remove_scat(&sfp->reserve);
879 sg_build_reserve(sfp, val);
880 }
881 } else {
882 if (sdp->detached)
883 return -ENODEV;
884 sfp->low_dma = sdp->device->host->unchecked_isa_dma;
885 }
886 return 0;
887 case SG_GET_LOW_DMA:
888 return put_user((int) sfp->low_dma, ip);
889 case SG_GET_SCSI_ID:
890 if (!access_ok(VERIFY_WRITE, p, sizeof (sg_scsi_id_t)))
891 return -EFAULT;
892 else {
893 sg_scsi_id_t __user *sg_idp = p;
894
895 if (sdp->detached)
896 return -ENODEV;
897 __put_user((int) sdp->device->host->host_no,
898 &sg_idp->host_no);
899 __put_user((int) sdp->device->channel,
900 &sg_idp->channel);
901 __put_user((int) sdp->device->id, &sg_idp->scsi_id);
902 __put_user((int) sdp->device->lun, &sg_idp->lun);
903 __put_user((int) sdp->device->type, &sg_idp->scsi_type);
904 __put_user((short) sdp->device->host->cmd_per_lun,
905 &sg_idp->h_cmd_per_lun);
906 __put_user((short) sdp->device->queue_depth,
907 &sg_idp->d_queue_depth);
908 __put_user(0, &sg_idp->unused[0]);
909 __put_user(0, &sg_idp->unused[1]);
910 return 0;
911 }
912 case SG_SET_FORCE_PACK_ID:
913 result = get_user(val, ip);
914 if (result)
915 return result;
916 sfp->force_packid = val ? 1 : 0;
917 return 0;
918 case SG_GET_PACK_ID:
919 if (!access_ok(VERIFY_WRITE, ip, sizeof (int)))
920 return -EFAULT;
921 read_lock_irqsave(&sfp->rq_list_lock, iflags);
922 for (srp = sfp->headrp; srp; srp = srp->nextrp) {
923 if ((1 == srp->done) && (!srp->sg_io_owned)) {
924 read_unlock_irqrestore(&sfp->rq_list_lock,
925 iflags);
926 __put_user(srp->header.pack_id, ip);
927 return 0;
928 }
929 }
930 read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
931 __put_user(-1, ip);
932 return 0;
933 case SG_GET_NUM_WAITING:
934 read_lock_irqsave(&sfp->rq_list_lock, iflags);
935 for (val = 0, srp = sfp->headrp; srp; srp = srp->nextrp) {
936 if ((1 == srp->done) && (!srp->sg_io_owned))
937 ++val;
938 }
939 read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
940 return put_user(val, ip);
941 case SG_GET_SG_TABLESIZE:
942 return put_user(sdp->sg_tablesize, ip);
943 case SG_SET_RESERVED_SIZE:
944 result = get_user(val, ip);
945 if (result)
946 return result;
947 if (val < 0)
948 return -EINVAL;
44ec9542 949 val = min_t(int, val,
ae03bf63 950 queue_max_sectors(sdp->device->request_queue) * 512);
1da177e4
LT		 951 if (val != sfp->reserve.bufflen) {
952 if (sg_res_in_use(sfp) || sfp->mmap_called)
953 return -EBUSY;
954 sg_remove_scat(&sfp->reserve);
955 sg_build_reserve(sfp, val);
956 }
957 return 0;
958 case SG_GET_RESERVED_SIZE:
44ec9542 959 val = min_t(int, sfp->reserve.bufflen,
ae03bf63 960 queue_max_sectors(sdp->device->request_queue) * 512);
1da177e4
LT		 961 return put_user(val, ip);
962 case SG_SET_COMMAND_Q:
963 result = get_user(val, ip);
964 if (result)
965 return result;
966 sfp->cmd_q = val ? 1 : 0;
967 return 0;
968 case SG_GET_COMMAND_Q:
969 return put_user((int) sfp->cmd_q, ip);
970 case SG_SET_KEEP_ORPHAN:
971 result = get_user(val, ip);
972 if (result)
973 return result;
974 sfp->keep_orphan = val;
975 return 0;
976 case SG_GET_KEEP_ORPHAN:
977 return put_user((int) sfp->keep_orphan, ip);
978 case SG_NEXT_CMD_LEN:
979 result = get_user(val, ip);
980 if (result)
981 return result;
982 sfp->next_cmd_len = (val > 0) ? val : 0;
983 return 0;
984 case SG_GET_VERSION_NUM:
985 return put_user(sg_version_num, ip);
986 case SG_GET_ACCESS_COUNT:
987 /* faked - we don't have a real access count anymore */
988 val = (sdp->device ? 1 : 0);
989 return put_user(val, ip);
990 case SG_GET_REQUEST_TABLE:
991 if (!access_ok(VERIFY_WRITE, p, SZ_SG_REQ_INFO * SG_MAX_QUEUE))
992 return -EFAULT;
993 else {
cb59e840
DG		 994 sg_req_info_t *rinfo;
995 unsigned int ms;
996
997 rinfo = kmalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
998 GFP_KERNEL);
999 if (!rinfo)
1000 return -ENOMEM;
1da177e4
LT		 1001 read_lock_irqsave(&sfp->rq_list_lock, iflags);
1002 for (srp = sfp->headrp, val = 0; val < SG_MAX_QUEUE;
1003 ++val, srp = srp ? srp->nextrp : srp) {
1004 memset(&rinfo[val], 0, SZ_SG_REQ_INFO);
1005 if (srp) {
1006 rinfo[val].req_state = srp->done + 1;
1007 rinfo[val].problem =
1008 srp->header.masked_status &
1009 srp->header.host_status &
1010 srp->header.driver_status;
cb59e840
DG		 1011 if (srp->done)
1012 rinfo[val].duration =
1013 srp->header.duration;
1014 else {
1015 ms = jiffies_to_msecs(jiffies);
1016 rinfo[val].duration =
1017 (ms > srp->header.duration) ?
1018 (ms - srp->header.duration) : 0;
1019 }
1da177e4 1020 rinfo[val].orphan = srp->orphan;
cb59e840
DG		 1021 rinfo[val].sg_io_owned =
1022 srp->sg_io_owned;
1023 rinfo[val].pack_id =
1024 srp->header.pack_id;
1025 rinfo[val].usr_ptr =
1026 srp->header.usr_ptr;
1da177e4
LT		 1027 }
1028 }
1029 read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
cb59e840
DG		 1030 result = __copy_to_user(p, rinfo,
1031 SZ_SG_REQ_INFO * SG_MAX_QUEUE);
1032 result = result ? -EFAULT : 0;
1033 kfree(rinfo);
1034 return result;
1da177e4
LT		 1035 }
1036 case SG_EMULATED_HOST:
1037 if (sdp->detached)
1038 return -ENODEV;
1039 return put_user(sdp->device->host->hostt->emulated, ip);
1040 case SG_SCSI_RESET:
1041 if (sdp->detached)
1042 return -ENODEV;
1043 if (filp->f_flags & O_NONBLOCK) {
939647ee 1044 if (scsi_host_in_recovery(sdp->device->host))
1da177e4
LT		 1045 return -EBUSY;
1046 } else if (!scsi_block_when_processing_errors(sdp->device))
1047 return -EBUSY;
1048 result = get_user(val, ip);
1049 if (result)
1050 return result;
1051 if (SG_SCSI_RESET_NOTHING == val)
1052 return 0;
1053 switch (val) {
1054 case SG_SCSI_RESET_DEVICE:
1055 val = SCSI_TRY_RESET_DEVICE;
1056 break;
39120e11
BK		 1057 case SG_SCSI_RESET_TARGET:
1058 val = SCSI_TRY_RESET_TARGET;
1059 break;
1da177e4
LT		 1060 case SG_SCSI_RESET_BUS:
1061 val = SCSI_TRY_RESET_BUS;
1062 break;
1063 case SG_SCSI_RESET_HOST:
1064 val = SCSI_TRY_RESET_HOST;
1065 break;
1066 default:
1067 return -EINVAL;
1068 }
1069 if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
1070 return -EACCES;
1071 return (scsi_reset_provider(sdp->device, val) ==
1072 SUCCESS) ? 0 : -EIO;
1073 case SCSI_IOCTL_SEND_COMMAND:
1074 if (sdp->detached)
1075 return -ENODEV;
1076 if (read_only) {
1077 unsigned char opcode = WRITE_6;
1078 Scsi_Ioctl_Command __user *siocp = p;
1079
1080 if (copy_from_user(&opcode, siocp->data, 1))
1081 return -EFAULT;
14e507b8 1082 if (sg_allow_access(filp, &opcode))
1da177e4
LT		 1083 return -EPERM;
1084 }
e915e872 1085 return sg_scsi_ioctl(sdp->device->request_queue, NULL, filp->f_mode, p);
1da177e4
LT		 1086 case SG_SET_DEBUG:
1087 result = get_user(val, ip);
1088 if (result)
1089 return result;
1090 sdp->sgdebug = (char) val;
1091 return 0;
1092 case SCSI_IOCTL_GET_IDLUN:
1093 case SCSI_IOCTL_GET_BUS_NUMBER:
1094 case SCSI_IOCTL_PROBE_HOST:
1095 case SG_GET_TRANSFORM:
1096 if (sdp->detached)
1097 return -ENODEV;
1098 return scsi_ioctl(sdp->device, cmd_in, p);
44ec9542 1099 case BLKSECTGET:
ae03bf63 1100 return put_user(queue_max_sectors(sdp->device->request_queue) * 512,
44ec9542 1101 ip);
6da127ad
CS		 1102 case BLKTRACESETUP:
1103 return blk_trace_setup(sdp->device->request_queue,
1104 sdp->disk->disk_name,
76e3a19d 1105 MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
d0deef5b 1106 NULL,
6da127ad
CS		 1107 (char *)arg);
1108 case BLKTRACESTART:
1109 return blk_trace_startstop(sdp->device->request_queue, 1);
1110 case BLKTRACESTOP:
1111 return blk_trace_startstop(sdp->device->request_queue, 0);
1112 case BLKTRACETEARDOWN:
1113 return blk_trace_remove(sdp->device->request_queue);
1da177e4
LT		 1114 default:
1115 if (read_only)
1116 return -EPERM; /* don't know so take safe approach */
1117 return scsi_ioctl(sdp->device, cmd_in, p);
1118 }
1119}
1120
f4927c45
AB		 1121static long
1122sg_unlocked_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
1123{
1124 int ret;
1125
c45d15d2 1126 mutex_lock(&sg_mutex);
f4927c45 1127 ret = sg_ioctl(filp, cmd_in, arg);
c45d15d2 1128 mutex_unlock(&sg_mutex);
f4927c45
AB		 1129
1130 return ret;
1131}
1132
1da177e4
LT		 1133#ifdef CONFIG_COMPAT
1134static long sg_compat_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
1135{
1136 Sg_device *sdp;
1137 Sg_fd *sfp;
1138 struct scsi_device *sdev;
1139
1140 if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
1141 return -ENXIO;
1142
1143 sdev = sdp->device;
1144 if (sdev->host->hostt->compat_ioctl) {
1145 int ret;
1146
1147 ret = sdev->host->hostt->compat_ioctl(sdev, cmd_in, (void __user *)arg);
1148
1149 return ret;
1150 }
1151
1152 return -ENOIOCTLCMD;
1153}
1154#endif
1155
1156static unsigned int
1157sg_poll(struct file *filp, poll_table * wait)
1158{
1159 unsigned int res = 0;
1160 Sg_device *sdp;
1161 Sg_fd *sfp;
1162 Sg_request *srp;
1163 int count = 0;
1164 unsigned long iflags;
1165
ebaf466b
JE		 1166 sfp = filp->private_data;
1167 if (!sfp)
1168 return POLLERR;
1169 sdp = sfp->parentdp;
1170 if (!sdp)
1da177e4
LT		 1171 return POLLERR;
1172 poll_wait(filp, &sfp->read_wait, wait);
1173 read_lock_irqsave(&sfp->rq_list_lock, iflags);
1174 for (srp = sfp->headrp; srp; srp = srp->nextrp) {
1175 /* if any read waiting, flag it */
1176 if ((0 == res) && (1 == srp->done) && (!srp->sg_io_owned))
1177 res = POLLIN | POLLRDNORM;
1178 ++count;
1179 }
1180 read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
1181
1182 if (sdp->detached)
1183 res |= POLLHUP;
1184 else if (!sfp->cmd_q) {
1185 if (0 == count)
1186 res |= POLLOUT | POLLWRNORM;
1187 } else if (count < SG_MAX_QUEUE)
1188 res |= POLLOUT | POLLWRNORM;
1189 SCSI_LOG_TIMEOUT(3, printk("sg_poll: %s, res=0x%x\n",
1190 sdp->disk->disk_name, (int) res));
1191 return res;
1192}
1193
1194static int
1195sg_fasync(int fd, struct file *filp, int mode)
1196{
1da177e4
LT		 1197 Sg_device *sdp;
1198 Sg_fd *sfp;
1199
1200 if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
1201 return -ENXIO;
1202 SCSI_LOG_TIMEOUT(3, printk("sg_fasync: %s, mode=%d\n",
1203 sdp->disk->disk_name, mode));
1204
60aa4924 1205 return fasync_helper(fd, filp, mode, &sfp->async_qp);
1da177e4
LT		 1206}
1207
a13ff0bb
NP		 1208static int
1209sg_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
1da177e4
LT		 1210{
1211 Sg_fd *sfp;
d6b10348 1212 unsigned long offset, len, sa;
1da177e4 1213 Sg_scatter_hold *rsv_schp;
10db10d1 1214 int k, length;
1da177e4
LT		 1215
1216 if ((NULL == vma) || (!(sfp = (Sg_fd *) vma->vm_private_data)))
a13ff0bb 1217 return VM_FAULT_SIGBUS;
1da177e4 1218 rsv_schp = &sfp->reserve;
a13ff0bb 1219 offset = vmf->pgoff << PAGE_SHIFT;
1da177e4 1220 if (offset >= rsv_schp->bufflen)
a13ff0bb
NP		 1221 return VM_FAULT_SIGBUS;
1222 SCSI_LOG_TIMEOUT(3, printk("sg_vma_fault: offset=%lu, scatg=%d\n",
1da177e4 1223 offset, rsv_schp->k_use_sg));
d6b10348 1224 sa = vma->vm_start;
10db10d1
FT		 1225 length = 1 << (PAGE_SHIFT + rsv_schp->page_order);
1226 for (k = 0; k < rsv_schp->k_use_sg && sa < vma->vm_end; k++) {
d6b10348 1227 len = vma->vm_end - sa;
10db10d1 1228 len = (len < length) ? len : length;
d6b10348 1229 if (offset < len) {
10db10d1
FT		 1230 struct page *page = nth_page(rsv_schp->pages[k],
1231 offset >> PAGE_SHIFT);
d6b10348 1232 get_page(page); /* increment page count */
a13ff0bb
NP		 1233 vmf->page = page;
1234 return 0; /* success */
1da177e4 1235 }
d6b10348
MC		 1236 sa += len;
1237 offset -= len;
1da177e4 1238 }
d6b10348 1239
a13ff0bb 1240 return VM_FAULT_SIGBUS;
1da177e4
LT		 1241}
1242
f0f37e2f 1243static const struct vm_operations_struct sg_mmap_vm_ops = {
a13ff0bb 1244 .fault = sg_vma_fault,
1da177e4
LT		 1245};
1246
1247static int
1248sg_mmap(struct file *filp, struct vm_area_struct *vma)
1249{
1250 Sg_fd *sfp;
d6b10348 1251 unsigned long req_sz, len, sa;
1da177e4 1252 Sg_scatter_hold *rsv_schp;
10db10d1 1253 int k, length;
1da177e4
LT		 1254
1255 if ((!filp) || (!vma) || (!(sfp = (Sg_fd *) filp->private_data)))
1256 return -ENXIO;
cb59e840 1257 req_sz = vma->vm_end - vma->vm_start;
1da177e4
LT		 1258 SCSI_LOG_TIMEOUT(3, printk("sg_mmap starting, vm_start=%p, len=%d\n",
1259 (void *) vma->vm_start, (int) req_sz));
1260 if (vma->vm_pgoff)
1261 return -EINVAL; /* want no offset */
1262 rsv_schp = &sfp->reserve;
1263 if (req_sz > rsv_schp->bufflen)
1264 return -ENOMEM; /* cannot map more than reserved buffer */
1265
d6b10348 1266 sa = vma->vm_start;
10db10d1
FT		 1267 length = 1 << (PAGE_SHIFT + rsv_schp->page_order);
1268 for (k = 0; k < rsv_schp->k_use_sg && sa < vma->vm_end; k++) {
d6b10348 1269 len = vma->vm_end - sa;
10db10d1 1270 len = (len < length) ? len : length;
d6b10348 1271 sa += len;
1da177e4 1272 }
d6b10348 1273
f9aed0e2 1274 sfp->mmap_called = 1;
1c8e71d7 1275 vma->vm_flags |= VM_RESERVED;
1da177e4
LT		 1276 vma->vm_private_data = sfp;
1277 vma->vm_ops = &sg_mmap_vm_ops;
1278 return 0;
1279}
1280
c96952ed
FT		 1281static void sg_rq_end_io_usercontext(struct work_struct *work)
1282{
1283 struct sg_request *srp = container_of(work, struct sg_request, ew.work);
1284 struct sg_fd *sfp = srp->parentfp;
1285
1286 sg_finish_rem_req(srp);
1287 kref_put(&sfp->f_ref, sg_remove_sfp);
1288}
1289
a91a3a20
FT		 1290/*
1291 * This function is a "bottom half" handler that is called by the mid
1292 * level when a command is completed (or has failed).
1293 */
1294static void sg_rq_end_io(struct request *rq, int uptodate)
1da177e4 1295{
a91a3a20 1296 struct sg_request *srp = rq->end_io_data;
c6517b79 1297 Sg_device *sdp;
1da177e4 1298 Sg_fd *sfp;
1da177e4 1299 unsigned long iflags;
cb59e840 1300 unsigned int ms;
a91a3a20 1301 char *sense;
c6517b79 1302 int result, resid, done = 1;
1da177e4 1303
c6517b79 1304 if (WARN_ON(srp->done != 0))
1da177e4 1305 return;
c6517b79 1306
1da177e4 1307 sfp = srp->parentfp;
c6517b79 1308 if (WARN_ON(sfp == NULL))
1da177e4 1309 return;
c6517b79
TB		 1310
1311 sdp = sfp->parentdp;
1312 if (unlikely(sdp->detached))
1313 printk(KERN_INFO "sg_rq_end_io: device detached\n");
1da177e4 1314
a91a3a20
FT		 1315 sense = rq->sense;
1316 result = rq->errors;
c3a4d78c 1317 resid = rq->resid_len;
1da177e4
LT		 1318
1319 SCSI_LOG_TIMEOUT(4, printk("sg_cmd_done: %s, pack_id=%d, res=0x%x\n",
d6b10348
MC		 1320 sdp->disk->disk_name, srp->header.pack_id, result));
1321 srp->header.resid = resid;
cb59e840
DG		 1322 ms = jiffies_to_msecs(jiffies);
1323 srp->header.duration = (ms > srp->header.duration) ?
1324 (ms - srp->header.duration) : 0;
d6b10348 1325 if (0 != result) {
1da177e4
LT		 1326 struct scsi_sense_hdr sshdr;
1327
d6b10348
MC		 1328 srp->header.status = 0xff & result;
1329 srp->header.masked_status = status_byte(result);
1330 srp->header.msg_status = msg_byte(result);
1331 srp->header.host_status = host_byte(result);
1332 srp->header.driver_status = driver_byte(result);
1da177e4
LT		 1333 if ((sdp->sgdebug > 0) &&
1334 ((CHECK_CONDITION == srp->header.masked_status) ||
1335 (COMMAND_TERMINATED == srp->header.masked_status)))
d6b10348
MC		 1336 __scsi_print_sense("sg_cmd_done", sense,
1337 SCSI_SENSE_BUFFERSIZE);
1da177e4
LT		 1338
1339 /* Following if statement is a patch supplied by Eric Youngdale */
d6b10348
MC		 1340 if (driver_byte(result) != 0
1341 && scsi_normalize_sense(sense, SCSI_SENSE_BUFFERSIZE, &sshdr)
1da177e4
LT		 1342 && !scsi_sense_is_deferred(&sshdr)
1343 && sshdr.sense_key == UNIT_ATTENTION
1344 && sdp->device->removable) {
1345 /* Detected possible disc change. Set the bit - this */
1346 /* may be used if there are filesystems using this device */
1347 sdp->device->changed = 1;
1348 }
1349 }
1350 /* Rely on write phase to clean out srp status values, so no "else" */
1351
c6517b79
TB		 1352 write_lock_irqsave(&sfp->rq_list_lock, iflags);
1353 if (unlikely(srp->orphan)) {
1da177e4
LT		 1354 if (sfp->keep_orphan)
1355 srp->sg_io_owned = 0;
c6517b79
TB		 1356 else
1357 done = 0;
1da177e4 1358 }
c6517b79
TB		 1359 srp->done = done;
1360 write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
1361
1362 if (likely(done)) {
1363 /* Now wake up any sg_read() that is waiting for this
1364 * packet.
1365 */
1da177e4 1366 wake_up_interruptible(&sfp->read_wait);
c6517b79 1367 kill_fasync(&sfp->async_qp, SIGPOLL, POLL_IN);
c96952ed 1368 kref_put(&sfp->f_ref, sg_remove_sfp);
015640ed
FT		 1369 } else {
1370 INIT_WORK(&srp->ew.work, sg_rq_end_io_usercontext);
1371 schedule_work(&srp->ew.work);
1372 }
1da177e4
LT		 1373}
1374
828c0950 1375static const struct file_operations sg_fops = {
1da177e4
LT		 1376 .owner = THIS_MODULE,
1377 .read = sg_read,
1378 .write = sg_write,
1379 .poll = sg_poll,
f4927c45 1380 .unlocked_ioctl = sg_unlocked_ioctl,
1da177e4
LT		 1381#ifdef CONFIG_COMPAT
1382 .compat_ioctl = sg_compat_ioctl,
1383#endif
1384 .open = sg_open,
1385 .mmap = sg_mmap,
1386 .release = sg_release,
1387 .fasync = sg_fasync,
6038f373 1388 .llseek = no_llseek,
1da177e4
LT		 1389};
1390
d253878b 1391static struct class *sg_sysfs_class;
1da177e4
LT		 1392
1393static int sg_sysfs_valid = 0;
1394
7c07d613 1395static Sg_device *sg_alloc(struct gendisk *disk, struct scsi_device *scsidp)
1da177e4 1396{
d6b10348 1397 struct request_queue *q = scsidp->request_queue;
1da177e4
LT		 1398 Sg_device *sdp;
1399 unsigned long iflags;
7c07d613
JB		 1400 int error;
1401 u32 k;
1da177e4 1402
24669f75 1403 sdp = kzalloc(sizeof(Sg_device), GFP_KERNEL);
1da177e4
LT		 1404 if (!sdp) {
1405 printk(KERN_WARNING "kmalloc Sg_device failure\n");
7c07d613
JB		 1406 return ERR_PTR(-ENOMEM);
1407 }
c6517b79 1408
7c07d613
JB		 1409 if (!idr_pre_get(&sg_index_idr, GFP_KERNEL)) {
1410 printk(KERN_WARNING "idr expansion Sg_device failure\n");
c6517b79 1411 error = -ENOMEM;
7c07d613 1412 goto out;
1da177e4
LT		 1413 }
1414
7c07d613 1415 write_lock_irqsave(&sg_index_lock, iflags);
1da177e4 1416
c6517b79 1417 error = idr_get_new(&sg_index_idr, sdp, &k);
7c07d613 1418 if (error) {
c6517b79 1419 write_unlock_irqrestore(&sg_index_lock, iflags);
7c07d613
JB		 1420 printk(KERN_WARNING "idr allocation Sg_device failure: %d\n",
1421 error);
1422 goto out;
1da177e4
LT		 1423 }
1424
1da177e4
LT		 1425 if (unlikely(k >= SG_MAX_DEVS))
1426 goto overflow;
1427
1da177e4
LT		 1428 SCSI_LOG_TIMEOUT(3, printk("sg_alloc: dev=%d \n", k));
1429 sprintf(disk->disk_name, "sg%d", k);
1430 disk->first_minor = k;
1431 sdp->disk = disk;
1432 sdp->device = scsidp;
3442f802 1433 INIT_LIST_HEAD(&sdp->sfds);
1da177e4 1434 init_waitqueue_head(&sdp->o_excl_wait);
8a78362c 1435 sdp->sg_tablesize = queue_max_segments(q);
7c07d613 1436 sdp->index = k;
c6517b79
TB		 1437 kref_init(&sdp->d_ref);
1438
1439 write_unlock_irqrestore(&sg_index_lock, iflags);
1da177e4 1440
7c07d613 1441 error = 0;
1da177e4 1442 out:
7c07d613 1443 if (error) {
1da177e4 1444 kfree(sdp);
7c07d613
JB		 1445 return ERR_PTR(error);
1446 }
1447 return sdp;
1da177e4
LT		 1448
1449 overflow:
c6517b79
TB		 1450 idr_remove(&sg_index_idr, k);
1451 write_unlock_irqrestore(&sg_index_lock, iflags);
9ccfc756
JB		 1452 sdev_printk(KERN_WARNING, scsidp,
1453 "Unable to attach sg device type=%d, minor "
1454 "number exceeds %d\n", scsidp->type, SG_MAX_DEVS - 1);
1da177e4
LT		 1455 error = -ENODEV;
1456 goto out;
1457}
1458
1459static int
ee959b00 1460sg_add(struct device *cl_dev, struct class_interface *cl_intf)
1da177e4 1461{
ee959b00 1462 struct scsi_device *scsidp = to_scsi_device(cl_dev->parent);
1da177e4
LT		 1463 struct gendisk *disk;
1464 Sg_device *sdp = NULL;
1465 struct cdev * cdev = NULL;
7c07d613 1466 int error;
454e8957 1467 unsigned long iflags;
1da177e4
LT		 1468
1469 disk = alloc_disk(1);
1470 if (!disk) {
1471 printk(KERN_WARNING "alloc_disk failed\n");
1472 return -ENOMEM;
1473 }
1474 disk->major = SCSI_GENERIC_MAJOR;
1475
1476 error = -ENOMEM;
1477 cdev = cdev_alloc();
1478 if (!cdev) {
1479 printk(KERN_WARNING "cdev_alloc failed\n");
1480 goto out;
1481 }
1482 cdev->owner = THIS_MODULE;
1483 cdev->ops = &sg_fops;
1484
7c07d613
JB		 1485 sdp = sg_alloc(disk, scsidp);
1486 if (IS_ERR(sdp)) {
1da177e4 1487 printk(KERN_WARNING "sg_alloc failed\n");
7c07d613 1488 error = PTR_ERR(sdp);
1da177e4
LT		 1489 goto out;
1490 }
1da177e4 1491
7c07d613 1492 error = cdev_add(cdev, MKDEV(SCSI_GENERIC_MAJOR, sdp->index), 1);
5e3c34c1 1493 if (error)
454e8957 1494 goto cdev_add_err;
5e3c34c1 1495
1da177e4
LT		 1496 sdp->cdev = cdev;
1497 if (sg_sysfs_valid) {
ee959b00 1498 struct device *sg_class_member;
1da177e4 1499
d73a1a67
GKH		 1500 sg_class_member = device_create(sg_sysfs_class, cl_dev->parent,
1501 MKDEV(SCSI_GENERIC_MAJOR,
1502 sdp->index),
1503 sdp, "%s", disk->disk_name);
d07e0361
FT		 1504 if (IS_ERR(sg_class_member)) {
1505 printk(KERN_ERR "sg_add: "
ee959b00 1506 "device_create failed\n");
d07e0361
FT		 1507 error = PTR_ERR(sg_class_member);
1508 goto cdev_add_err;
1509 }
d07e0361 1510 error = sysfs_create_link(&scsidp->sdev_gendev.kobj,
1da177e4
LT		 1511 &sg_class_member->kobj, "generic");
1512 if (error)
1513 printk(KERN_ERR "sg_add: unable to make symlink "
7c07d613 1514 "'generic' back to sg%d\n", sdp->index);
1da177e4 1515 } else
7c07d613 1516 printk(KERN_WARNING "sg_add: sg_sys Invalid\n");
1da177e4 1517
9ccfc756 1518 sdev_printk(KERN_NOTICE, scsidp,
7c07d613
JB		 1519 "Attached scsi generic sg%d type %d\n", sdp->index,
1520 scsidp->type);
1da177e4 1521
ee959b00 1522 dev_set_drvdata(cl_dev, sdp);
a24484f2 1523
1da177e4
LT		 1524 return 0;
1525
454e8957 1526cdev_add_err:
7c07d613
JB		 1527 write_lock_irqsave(&sg_index_lock, iflags);
1528 idr_remove(&sg_index_idr, sdp->index);
1529 write_unlock_irqrestore(&sg_index_lock, iflags);
1530 kfree(sdp);
454e8957 1531
1da177e4
LT		 1532out:
1533 put_disk(disk);
1534 if (cdev)
1535 cdev_del(cdev);
1536 return error;
1537}
1538
c6517b79
TB		 1539static void sg_device_destroy(struct kref *kref)
1540{
1541 struct sg_device *sdp = container_of(kref, struct sg_device, d_ref);
1542 unsigned long flags;
1543
1544 /* CAUTION! Note that the device can still be found via idr_find()
1545 * even though the refcount is 0. Therefore, do idr_remove() BEFORE
1546 * any other cleanup.
1547 */
1548
1549 write_lock_irqsave(&sg_index_lock, flags);
1550 idr_remove(&sg_index_idr, sdp->index);
1551 write_unlock_irqrestore(&sg_index_lock, flags);
1552
1553 SCSI_LOG_TIMEOUT(3,
1554 printk("sg_device_destroy: %s\n",
1555 sdp->disk->disk_name));
1556
1557 put_disk(sdp->disk);
1558 kfree(sdp);
1559}
1560
1561static void sg_remove(struct device *cl_dev, struct class_interface *cl_intf)
1da177e4 1562{
ee959b00
TJ		 1563 struct scsi_device *scsidp = to_scsi_device(cl_dev->parent);
1564 Sg_device *sdp = dev_get_drvdata(cl_dev);
1da177e4
LT		 1565 unsigned long iflags;
1566 Sg_fd *sfp;
1da177e4 1567
c6517b79 1568 if (!sdp || sdp->detached)
1da177e4 1569 return;
7c07d613 1570
c6517b79
TB		 1571 SCSI_LOG_TIMEOUT(3, printk("sg_remove: %s\n", sdp->disk->disk_name));
1572
1573 /* Need a write lock to set sdp->detached. */
7c07d613 1574 write_lock_irqsave(&sg_index_lock, iflags);
c6517b79 1575 sdp->detached = 1;
3442f802 1576 list_for_each_entry(sfp, &sdp->sfds, sfd_siblings) {
c6517b79
TB		 1577 wake_up_interruptible(&sfp->read_wait);
1578 kill_fasync(&sfp->async_qp, SIGPOLL, POLL_HUP);
7c07d613
JB		 1579 }
1580 write_unlock_irqrestore(&sg_index_lock, iflags);
1581
1582 sysfs_remove_link(&scsidp->sdev_gendev.kobj, "generic");
ee959b00 1583 device_destroy(sg_sysfs_class, MKDEV(SCSI_GENERIC_MAJOR, sdp->index));
7c07d613
JB		 1584 cdev_del(sdp->cdev);
1585 sdp->cdev = NULL;
1da177e4 1586
c6517b79 1587 sg_put_dev(sdp);
1da177e4
LT		 1588}
1589
6460e75a
DG		 1590module_param_named(scatter_elem_sz, scatter_elem_sz, int, S_IRUGO | S_IWUSR);
1591module_param_named(def_reserved_size, def_reserved_size, int,
1592 S_IRUGO | S_IWUSR);
1da177e4
LT		 1593module_param_named(allow_dio, sg_allow_dio, int, S_IRUGO | S_IWUSR);
1594
1595MODULE_AUTHOR("Douglas Gilbert");
1596MODULE_DESCRIPTION("SCSI generic (sg) driver");
1597MODULE_LICENSE("GPL");
1598MODULE_VERSION(SG_VERSION_STR);
f018fa55 1599MODULE_ALIAS_CHARDEV_MAJOR(SCSI_GENERIC_MAJOR);
1da177e4 1600
6460e75a
DG		 1601MODULE_PARM_DESC(scatter_elem_sz, "scatter gather element "
1602 "size (default: max(SG_SCATTER_SZ, PAGE_SIZE))");
1da177e4
LT		 1603MODULE_PARM_DESC(def_reserved_size, "size of buffer reserved for each fd");
1604MODULE_PARM_DESC(allow_dio, "allow direct I/O (default: 0 (disallow))");
1605
1606static int __init
1607init_sg(void)
1608{
1609 int rc;
1610
6460e75a
DG		 1611 if (scatter_elem_sz < PAGE_SIZE) {
1612 scatter_elem_sz = PAGE_SIZE;
1613 scatter_elem_sz_prev = scatter_elem_sz;
1614 }
1da177e4
LT		 1615 if (def_reserved_size >= 0)
1616 sg_big_buff = def_reserved_size;
6460e75a
DG		 1617 else
1618 def_reserved_size = sg_big_buff;
1da177e4
LT		 1619
1620 rc = register_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0),
1621 SG_MAX_DEVS, "sg");
1622 if (rc)
1623 return rc;
d253878b 1624 sg_sysfs_class = class_create(THIS_MODULE, "scsi_generic");
1da177e4
LT		 1625 if ( IS_ERR(sg_sysfs_class) ) {
1626 rc = PTR_ERR(sg_sysfs_class);
1627 goto err_out;
1628 }
1629 sg_sysfs_valid = 1;
1630 rc = scsi_register_interface(&sg_interface);
1631 if (0 == rc) {
1632#ifdef CONFIG_SCSI_PROC_FS
1633 sg_proc_init();
1634#endif /* CONFIG_SCSI_PROC_FS */
1635 return 0;
1636 }
d253878b 1637 class_destroy(sg_sysfs_class);
1da177e4
LT		 1638err_out:
1639 unregister_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0), SG_MAX_DEVS);
1640 return rc;
1641}
1642
1643static void __exit
1644exit_sg(void)
1645{
1646#ifdef CONFIG_SCSI_PROC_FS
1647 sg_proc_cleanup();
1648#endif /* CONFIG_SCSI_PROC_FS */
1649 scsi_unregister_interface(&sg_interface);
d253878b 1650 class_destroy(sg_sysfs_class);
1da177e4
LT		 1651 sg_sysfs_valid = 0;
1652 unregister_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0),
1653 SG_MAX_DEVS);
7c07d613 1654 idr_destroy(&sg_index_idr);
1da177e4
LT		 1655}
1656
44c7b0ea 1657static int sg_start_req(Sg_request *srp, unsigned char *cmd)
10865dfa 1658{
626710c9 1659 int res;
10865dfa 1660 struct request *rq;
44c7b0ea
FT		 1661 Sg_fd *sfp = srp->parentfp;
1662 sg_io_hdr_t *hp = &srp->header;
1663 int dxfer_len = (int) hp->dxfer_len;
1664 int dxfer_dir = hp->dxfer_direction;
626710c9 1665 unsigned int iov_count = hp->iovec_count;
44c7b0ea
FT		 1666 Sg_scatter_hold *req_schp = &srp->data;
1667 Sg_scatter_hold *rsv_schp = &sfp->reserve;
1668 struct request_queue *q = sfp->parentdp->device->request_queue;
626710c9 1669 struct rq_map_data *md, map_data;
10865dfa
FT		 1670 int rw = hp->dxfer_direction == SG_DXFER_TO_DEV ? WRITE : READ;
1671
44c7b0ea
FT		 1672 SCSI_LOG_TIMEOUT(4, printk(KERN_INFO "sg_start_req: dxfer_len=%d\n",
1673 dxfer_len));
1674
10865dfa
FT		 1675 rq = blk_get_request(q, rw, GFP_ATOMIC);
1676 if (!rq)
1677 return -ENOMEM;
1678
1679 memcpy(rq->cmd, cmd, hp->cmd_len);
1680
1681 rq->cmd_len = hp->cmd_len;
1682 rq->cmd_type = REQ_TYPE_BLOCK_PC;
1683
1684 srp->rq = rq;
1685 rq->end_io_data = srp;
1686 rq->sense = srp->sense_b;
1687 rq->retries = SG_DEFAULT_RETRIES;
1688
1da177e4 1689 if ((dxfer_len <= 0) || (dxfer_dir == SG_DXFER_NONE))
10db10d1 1690 return 0;
10865dfa 1691
626710c9
FT		 1692 if (sg_allow_dio && hp->flags & SG_FLAG_DIRECT_IO &&
1693 dxfer_dir != SG_DXFER_UNKNOWN && !iov_count &&
1694 !sfp->parentdp->device->host->unchecked_isa_dma &&
2610a254 1695 blk_rq_aligned(q, (unsigned long)hp->dxferp, dxfer_len))
626710c9
FT		 1696 md = NULL;
1697 else
1698 md = &map_data;
1699
1700 if (md) {
1701 if (!sg_res_in_use(sfp) && dxfer_len <= rsv_schp->bufflen)
1702 sg_link_reserve(sfp, srp, dxfer_len);
1703 else {
1704 res = sg_build_indirect(req_schp, sfp, dxfer_len);
1705 if (res)
1706 return res;
1707 }
7e56cb0f 1708
626710c9
FT		 1709 md->pages = req_schp->pages;
1710 md->page_order = req_schp->page_order;
1711 md->nr_entries = req_schp->k_use_sg;
56c451f4 1712 md->offset = 0;
97ae77a1 1713 md->null_mapped = hp->dxferp ? 0 : 1;
ecb554a8
FT		 1714 if (dxfer_dir == SG_DXFER_TO_FROM_DEV)
1715 md->from_user = 1;
1716 else
1717 md->from_user = 0;
626710c9
FT		 1718 }
1719
0fdf96b6
FT		 1720 if (iov_count) {
1721 int len, size = sizeof(struct sg_iovec) * iov_count;
1722 struct iovec *iov;
1723
3094141c
JL		 1724 iov = memdup_user(hp->dxferp, size);
1725 if (IS_ERR(iov))
1726 return PTR_ERR(iov);
0fdf96b6
FT		 1727
1728 len = iov_length(iov, iov_count);
1729 if (hp->dxfer_len < len) {
1730 iov_count = iov_shorten(iov, iov_count, hp->dxfer_len);
1731 len = hp->dxfer_len;
1732 }
1733
1734 res = blk_rq_map_user_iov(q, rq, md, (struct sg_iovec *)iov,
1735 iov_count,
1736 len, GFP_ATOMIC);
1737 kfree(iov);
1738 } else
626710c9
FT		 1739 res = blk_rq_map_user(q, rq, md, hp->dxferp,
1740 hp->dxfer_len, GFP_ATOMIC);
10db10d1
FT		 1741
1742 if (!res) {
626710c9 1743 srp->bio = rq->bio;
10db10d1 1744
626710c9
FT		 1745 if (!md) {
1746 req_schp->dio_in_use = 1;
1747 hp->info |= SG_INFO_DIRECT_IO;
1748 }
1749 }
10db10d1 1750 return res;
1da177e4
LT		 1751}
1752
e7ee4cc0 1753static int sg_finish_rem_req(Sg_request * srp)
1da177e4 1754{
e7ee4cc0
FT		 1755 int ret = 0;
1756
1da177e4
LT		 1757 Sg_fd *sfp = srp->parentfp;
1758 Sg_scatter_hold *req_schp = &srp->data;
1759
1760 SCSI_LOG_TIMEOUT(4, printk("sg_finish_rem_req: res_used=%d\n", (int) srp->res_used));
6e5a30cb
FT		 1761 if (srp->rq) {
1762 if (srp->bio)
e7ee4cc0 1763 ret = blk_rq_unmap_user(srp->bio);
10db10d1 1764
10865dfa 1765 blk_put_request(srp->rq);
6e5a30cb 1766 }
10865dfa 1767
e27168f8
CS		 1768 if (srp->res_used)
1769 sg_unlink_reserve(sfp, srp);
1770 else
1771 sg_remove_scat(req_schp);
1772
1da177e4 1773 sg_remove_request(sfp, srp);
e7ee4cc0
FT		 1774
1775 return ret;
1da177e4
LT		 1776}
1777
1778static int
1779sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp, int tablesize)
1780{
10db10d1 1781 int sg_bufflen = tablesize * sizeof(struct page *);
2d20eaf9 1782 gfp_t gfp_flags = GFP_ATOMIC | __GFP_NOWARN;
1da177e4 1783
10db10d1
FT		 1784 schp->pages = kzalloc(sg_bufflen, gfp_flags);
1785 if (!schp->pages)
1da177e4 1786 return -ENOMEM;
1da177e4 1787 schp->sglist_len = sg_bufflen;
d6b10348 1788 return tablesize; /* number of scat_gath elements allocated */
1da177e4
LT		 1789}
1790
1da177e4
LT		 1791static int
1792sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
1793{
10db10d1 1794 int ret_sz = 0, i, k, rem_sz, num, mx_sc_elems;
d6b10348 1795 int sg_tablesize = sfp->parentdp->sg_tablesize;
10db10d1
FT		 1796 int blk_size = buff_size, order;
1797 gfp_t gfp_mask = GFP_ATOMIC | __GFP_COMP | __GFP_NOWARN;
1da177e4 1798
fb119935 1799 if (blk_size < 0)
1da177e4
LT		 1800 return -EFAULT;
1801 if (0 == blk_size)
1802 ++blk_size; /* don't know why */
b2ed6c69
FT		 1803 /* round request up to next highest SG_SECTOR_SZ byte boundary */
1804 blk_size = ALIGN(blk_size, SG_SECTOR_SZ);
1da177e4
LT		 1805 SCSI_LOG_TIMEOUT(4, printk("sg_build_indirect: buff_size=%d, blk_size=%d\n",
1806 buff_size, blk_size));
d6b10348
MC		 1807
1808 /* N.B. ret_sz carried into this block ... */
1809 mx_sc_elems = sg_build_sgat(schp, sfp, sg_tablesize);
1810 if (mx_sc_elems < 0)
1811 return mx_sc_elems; /* most likely -ENOMEM */
1812
6460e75a
DG		 1813 num = scatter_elem_sz;
1814 if (unlikely(num != scatter_elem_sz_prev)) {
1815 if (num < PAGE_SIZE) {
1816 scatter_elem_sz = PAGE_SIZE;
1817 scatter_elem_sz_prev = PAGE_SIZE;
1818 } else
1819 scatter_elem_sz_prev = num;
1820 }
10db10d1
FT		 1821
1822 if (sfp->low_dma)
1823 gfp_mask |= GFP_DMA;
1824
1825 if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
1826 gfp_mask |= __GFP_ZERO;
1827
1828 order = get_order(num);
1829retry:
1830 ret_sz = 1 << (PAGE_SHIFT + order);
1831
1832 for (k = 0, rem_sz = blk_size; rem_sz > 0 && k < mx_sc_elems;
1833 k++, rem_sz -= ret_sz) {
1834
6460e75a 1835 num = (rem_sz > scatter_elem_sz_prev) ?
10db10d1
FT		 1836 scatter_elem_sz_prev : rem_sz;
1837
1838 schp->pages[k] = alloc_pages(gfp_mask, order);
1839 if (!schp->pages[k])
1840 goto out;
d6b10348 1841
6460e75a
DG		 1842 if (num == scatter_elem_sz_prev) {
1843 if (unlikely(ret_sz > scatter_elem_sz_prev)) {
1844 scatter_elem_sz = ret_sz;
1845 scatter_elem_sz_prev = ret_sz;
1846 }
1847 }
d6b10348 1848
7ca63cb4
DG		 1849 SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k=%d, num=%d, "
1850 "ret_sz=%d\n", k, num, ret_sz));
d6b10348
MC		 1851 } /* end of for loop */
1852
10db10d1 1853 schp->page_order = order;
d6b10348 1854 schp->k_use_sg = k;
7ca63cb4
DG		 1855 SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k_use_sg=%d, "
1856 "rem_sz=%d\n", k, rem_sz));
d6b10348
MC		 1857
1858 schp->bufflen = blk_size;
1859 if (rem_sz > 0) /* must have failed */
1860 return -ENOMEM;
1da177e4 1861 return 0;
10db10d1
FT		 1862out:
1863 for (i = 0; i < k; i++)
e71044ee 1864 __free_pages(schp->pages[i], order);
10db10d1
FT		 1865
1866 if (--order >= 0)
1867 goto retry;
1868
1869 return -ENOMEM;
1da177e4
LT		 1870}
1871
1da177e4
LT		 1872static void
1873sg_remove_scat(Sg_scatter_hold * schp)
1874{
1875 SCSI_LOG_TIMEOUT(4, printk("sg_remove_scat: k_use_sg=%d\n", schp->k_use_sg));
10db10d1 1876 if (schp->pages && schp->sglist_len > 0) {
6e5a30cb 1877 if (!schp->dio_in_use) {
1da177e4
LT		 1878 int k;
1879
10db10d1 1880 for (k = 0; k < schp->k_use_sg && schp->pages[k]; k++) {
1da177e4 1881 SCSI_LOG_TIMEOUT(5, printk(
10db10d1
FT		 1882 "sg_remove_scat: k=%d, pg=0x%p\n",
1883 k, schp->pages[k]));
1884 __free_pages(schp->pages[k], schp->page_order);
1da177e4 1885 }
6e5a30cb 1886
10db10d1 1887 kfree(schp->pages);
1da177e4 1888 }
d6b10348 1889 }
1da177e4
LT		 1890 memset(schp, 0, sizeof (*schp));
1891}
1892
1da177e4
LT		 1893static int
1894sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer)
1895{
1896 Sg_scatter_hold *schp = &srp->data;
d6b10348 1897 int k, num;
1da177e4
LT		 1898
1899 SCSI_LOG_TIMEOUT(4, printk("sg_read_oxfer: num_read_xfer=%d\n",
1900 num_read_xfer));
1901 if ((!outp) || (num_read_xfer <= 0))
1902 return 0;
d6b10348 1903
10db10d1
FT		 1904 num = 1 << (PAGE_SHIFT + schp->page_order);
1905 for (k = 0; k < schp->k_use_sg && schp->pages[k]; k++) {
d6b10348 1906 if (num > num_read_xfer) {
10db10d1 1907 if (__copy_to_user(outp, page_address(schp->pages[k]),
d6b10348
MC		 1908 num_read_xfer))
1909 return -EFAULT;
1910 break;
1911 } else {
10db10d1 1912 if (__copy_to_user(outp, page_address(schp->pages[k]),
d6b10348
MC		 1913 num))
1914 return -EFAULT;
1915 num_read_xfer -= num;
1916 if (num_read_xfer <= 0)
1da177e4 1917 break;
d6b10348 1918 outp += num;
1da177e4 1919 }
1da177e4 1920 }
d6b10348 1921
1da177e4
LT		 1922 return 0;
1923}
1924
1925static void
1926sg_build_reserve(Sg_fd * sfp, int req_size)
1927{
1928 Sg_scatter_hold *schp = &sfp->reserve;
1929
1930 SCSI_LOG_TIMEOUT(4, printk("sg_build_reserve: req_size=%d\n", req_size));
1931 do {
1932 if (req_size < PAGE_SIZE)
1933 req_size = PAGE_SIZE;
1934 if (0 == sg_build_indirect(schp, sfp, req_size))
1935 return;
1936 else
1937 sg_remove_scat(schp);
1938 req_size >>= 1; /* divide by 2 */
1939 } while (req_size > (PAGE_SIZE / 2));
1940}
1941
1942static void
1943sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size)
1944{
1945 Sg_scatter_hold *req_schp = &srp->data;
1946 Sg_scatter_hold *rsv_schp = &sfp->reserve;
d6b10348 1947 int k, num, rem;
1da177e4
LT		 1948
1949 srp->res_used = 1;
1950 SCSI_LOG_TIMEOUT(4, printk("sg_link_reserve: size=%d\n", size));
eca7be5e 1951 rem = size;
d6b10348 1952
10db10d1
FT		 1953 num = 1 << (PAGE_SHIFT + rsv_schp->page_order);
1954 for (k = 0; k < rsv_schp->k_use_sg; k++) {
d6b10348 1955 if (rem <= num) {
d6b10348
MC		 1956 req_schp->k_use_sg = k + 1;
1957 req_schp->sglist_len = rsv_schp->sglist_len;
10db10d1 1958 req_schp->pages = rsv_schp->pages;
d6b10348
MC		 1959
1960 req_schp->bufflen = size;
10db10d1 1961 req_schp->page_order = rsv_schp->page_order;
d6b10348
MC		 1962 break;
1963 } else
1964 rem -= num;
1da177e4 1965 }
d6b10348
MC		 1966
1967 if (k >= rsv_schp->k_use_sg)
1968 SCSI_LOG_TIMEOUT(1, printk("sg_link_reserve: BAD size\n"));
1da177e4
LT		 1969}
1970
1971static void
1972sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp)
1973{
1974 Sg_scatter_hold *req_schp = &srp->data;
1da177e4
LT		 1975
1976 SCSI_LOG_TIMEOUT(4, printk("sg_unlink_reserve: req->k_use_sg=%d\n",
1977 (int) req_schp->k_use_sg));
1da177e4
LT		 1978 req_schp->k_use_sg = 0;
1979 req_schp->bufflen = 0;
10db10d1
FT		 1980 req_schp->pages = NULL;
1981 req_schp->page_order = 0;
1da177e4
LT		 1982 req_schp->sglist_len = 0;
1983 sfp->save_scat_len = 0;
1984 srp->res_used = 0;
1985}
1986
1987static Sg_request *
1988sg_get_rq_mark(Sg_fd * sfp, int pack_id)
1989{
1990 Sg_request *resp;
1991 unsigned long iflags;
1992
1993 write_lock_irqsave(&sfp->rq_list_lock, iflags);
1994 for (resp = sfp->headrp; resp; resp = resp->nextrp) {
1995 /* look for requests that are ready + not SG_IO owned */
1996 if ((1 == resp->done) && (!resp->sg_io_owned) &&
1997 ((-1 == pack_id) || (resp->header.pack_id == pack_id))) {
1998 resp->done = 2; /* guard against other readers */
1999 break;
2000 }
2001 }
2002 write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2003 return resp;
2004}
2005
1da177e4
LT		 2006/* always adds to end of list */
2007static Sg_request *
2008sg_add_request(Sg_fd * sfp)
2009{
2010 int k;
2011 unsigned long iflags;
2012 Sg_request *resp;
2013 Sg_request *rp = sfp->req_arr;
2014
2015 write_lock_irqsave(&sfp->rq_list_lock, iflags);
2016 resp = sfp->headrp;
2017 if (!resp) {
2018 memset(rp, 0, sizeof (Sg_request));
2019 rp->parentfp = sfp;
2020 resp = rp;
2021 sfp->headrp = resp;
2022 } else {
2023 if (0 == sfp->cmd_q)
2024 resp = NULL; /* command queuing disallowed */
2025 else {
2026 for (k = 0; k < SG_MAX_QUEUE; ++k, ++rp) {
2027 if (!rp->parentfp)
2028 break;
2029 }
2030 if (k < SG_MAX_QUEUE) {
2031 memset(rp, 0, sizeof (Sg_request));
2032 rp->parentfp = sfp;
2033 while (resp->nextrp)
2034 resp = resp->nextrp;
2035 resp->nextrp = rp;
2036 resp = rp;
2037 } else
2038 resp = NULL;
2039 }
2040 }
2041 if (resp) {
2042 resp->nextrp = NULL;
cb59e840 2043 resp->header.duration = jiffies_to_msecs(jiffies);
1da177e4
LT		 2044 }
2045 write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2046 return resp;
2047}
2048
2049/* Return of 1 for found; 0 for not found */
2050static int
2051sg_remove_request(Sg_fd * sfp, Sg_request * srp)
2052{
2053 Sg_request *prev_rp;
2054 Sg_request *rp;
2055 unsigned long iflags;
2056 int res = 0;
2057
2058 if ((!sfp) || (!srp) || (!sfp->headrp))
2059 return res;
2060 write_lock_irqsave(&sfp->rq_list_lock, iflags);
2061 prev_rp = sfp->headrp;
2062 if (srp == prev_rp) {
2063 sfp->headrp = prev_rp->nextrp;
2064 prev_rp->parentfp = NULL;
2065 res = 1;
2066 } else {
2067 while ((rp = prev_rp->nextrp)) {
2068 if (srp == rp) {
2069 prev_rp->nextrp = rp->nextrp;
2070 rp->parentfp = NULL;
2071 res = 1;
2072 break;
2073 }
2074 prev_rp = rp;
2075 }
2076 }
2077 write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2078 return res;
2079}
2080
1da177e4
LT		 2081static Sg_fd *
2082sg_add_sfp(Sg_device * sdp, int dev)
2083{
2084 Sg_fd *sfp;
2085 unsigned long iflags;
44ec9542 2086 int bufflen;
1da177e4 2087
d6b10348 2088 sfp = kzalloc(sizeof(*sfp), GFP_ATOMIC | __GFP_NOWARN);
1da177e4
LT		 2089 if (!sfp)
2090 return NULL;
d6b10348 2091
1da177e4
LT		 2092 init_waitqueue_head(&sfp->read_wait);
2093 rwlock_init(&sfp->rq_list_lock);
2094
c6517b79 2095 kref_init(&sfp->f_ref);
1da177e4
LT		 2096 sfp->timeout = SG_DEFAULT_TIMEOUT;
2097 sfp->timeout_user = SG_DEFAULT_TIMEOUT_USER;
2098 sfp->force_packid = SG_DEF_FORCE_PACK_ID;
2099 sfp->low_dma = (SG_DEF_FORCE_LOW_DMA == 0) ?
2100 sdp->device->host->unchecked_isa_dma : 1;
2101 sfp->cmd_q = SG_DEF_COMMAND_Q;
2102 sfp->keep_orphan = SG_DEF_KEEP_ORPHAN;
2103 sfp->parentdp = sdp;
7c07d613 2104 write_lock_irqsave(&sg_index_lock, iflags);
3442f802 2105 list_add_tail(&sfp->sfd_siblings, &sdp->sfds);
7c07d613 2106 write_unlock_irqrestore(&sg_index_lock, iflags);
1da177e4 2107 SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp: sfp=0x%p\n", sfp));
6460e75a
DG		 2108 if (unlikely(sg_big_buff != def_reserved_size))
2109 sg_big_buff = def_reserved_size;
2110
44ec9542 2111 bufflen = min_t(int, sg_big_buff,
ae03bf63 2112 queue_max_sectors(sdp->device->request_queue) * 512);
44ec9542 2113 sg_build_reserve(sfp, bufflen);
1da177e4
LT		 2114 SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp: bufflen=%d, k_use_sg=%d\n",
2115 sfp->reserve.bufflen, sfp->reserve.k_use_sg));
c6517b79
TB		 2116
2117 kref_get(&sdp->d_ref);
2118 __module_get(THIS_MODULE);
1da177e4
LT		 2119 return sfp;
2120}
2121
c6517b79 2122static void sg_remove_sfp_usercontext(struct work_struct *work)
1da177e4 2123{
c6517b79
TB		 2124 struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work);
2125 struct sg_device *sdp = sfp->parentdp;
2126
2127 /* Cleanup any responses which were never read(). */
2128 while (sfp->headrp)
2129 sg_finish_rem_req(sfp->headrp);
1da177e4 2130
1da177e4 2131 if (sfp->reserve.bufflen > 0) {
c6517b79
TB		 2132 SCSI_LOG_TIMEOUT(6,
2133 printk("sg_remove_sfp: bufflen=%d, k_use_sg=%d\n",
2134 (int) sfp->reserve.bufflen,
2135 (int) sfp->reserve.k_use_sg));
1da177e4
LT		 2136 sg_remove_scat(&sfp->reserve);
2137 }
c6517b79
TB		 2138
2139 SCSI_LOG_TIMEOUT(6,
2140 printk("sg_remove_sfp: %s, sfp=0x%p\n",
2141 sdp->disk->disk_name,
2142 sfp));
d6b10348 2143 kfree(sfp);
c6517b79
TB		 2144
2145 scsi_device_put(sdp->device);
2146 sg_put_dev(sdp);
2147 module_put(THIS_MODULE);
1da177e4
LT		 2148}
2149
c6517b79 2150static void sg_remove_sfp(struct kref *kref)
1da177e4 2151{
c6517b79
TB		 2152 struct sg_fd *sfp = container_of(kref, struct sg_fd, f_ref);
2153 struct sg_device *sdp = sfp->parentdp;
c6517b79 2154 unsigned long iflags;
1da177e4 2155
c6517b79 2156 write_lock_irqsave(&sg_index_lock, iflags);
3442f802 2157 list_del(&sfp->sfd_siblings);
c6517b79
TB		 2158 write_unlock_irqrestore(&sg_index_lock, iflags);
2159 wake_up_interruptible(&sdp->o_excl_wait);
1da177e4 2160
015640ed
FT		 2161 INIT_WORK(&sfp->ew.work, sg_remove_sfp_usercontext);
2162 schedule_work(&sfp->ew.work);
1da177e4
LT		 2163}
2164
2165static int
2166sg_res_in_use(Sg_fd * sfp)
2167{
2168 const Sg_request *srp;
2169 unsigned long iflags;
2170
2171 read_lock_irqsave(&sfp->rq_list_lock, iflags);
2172 for (srp = sfp->headrp; srp; srp = srp->nextrp)
2173 if (srp->res_used)
2174 break;
2175 read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2176 return srp ? 1 : 0;
2177}
2178
1da177e4 2179#ifdef CONFIG_SCSI_PROC_FS
7c07d613
JB		 2180static int
2181sg_idr_max_id(int id, void *p, void *data)
2182{
2183 int *k = data;
2184
2185 if (*k < id)
2186 *k = id;
2187
2188 return 0;
2189}
2190
1da177e4
LT		 2191static int
2192sg_last_dev(void)
2193{
53474c04 2194 int k = -1;
1da177e4
LT		 2195 unsigned long iflags;
2196
7c07d613
JB		 2197 read_lock_irqsave(&sg_index_lock, iflags);
2198 idr_for_each(&sg_index_idr, sg_idr_max_id, &k);
2199 read_unlock_irqrestore(&sg_index_lock, iflags);
1da177e4
LT		 2200 return k + 1; /* origin 1 */
2201}
2202#endif
2203
c6517b79
TB		 2204/* must be called with sg_index_lock held */
2205static Sg_device *sg_lookup_dev(int dev)
1da177e4 2206{
c6517b79
TB		 2207 return idr_find(&sg_index_idr, dev);
2208}
1da177e4 2209
c6517b79
TB		 2210static Sg_device *sg_get_dev(int dev)
2211{
2212 struct sg_device *sdp;
2213 unsigned long flags;
2214
2215 read_lock_irqsave(&sg_index_lock, flags);
2216 sdp = sg_lookup_dev(dev);
2217 if (!sdp)
2218 sdp = ERR_PTR(-ENXIO);
2219 else if (sdp->detached) {
2220 /* If sdp->detached, then the refcount may already be 0, in
2221 * which case it would be a bug to do kref_get().
2222 */
2223 sdp = ERR_PTR(-ENODEV);
2224 } else
2225 kref_get(&sdp->d_ref);
2226 read_unlock_irqrestore(&sg_index_lock, flags);
7c07d613 2227
1da177e4
LT		 2228 return sdp;
2229}
2230
c6517b79
TB		 2231static void sg_put_dev(struct sg_device *sdp)
2232{
2233 kref_put(&sdp->d_ref, sg_device_destroy);
2234}
2235
1da177e4
LT		 2236#ifdef CONFIG_SCSI_PROC_FS
2237
2238static struct proc_dir_entry *sg_proc_sgp = NULL;
2239
2240static char sg_proc_sg_dirname[] = "scsi/sg";
2241
2242static int sg_proc_seq_show_int(struct seq_file *s, void *v);
2243
2244static int sg_proc_single_open_adio(struct inode *inode, struct file *file);
2245static ssize_t sg_proc_write_adio(struct file *filp, const char __user *buffer,
2246 size_t count, loff_t *off);
828c0950
AD		 2247static const struct file_operations adio_fops = {
2248 .owner = THIS_MODULE,
1da177e4 2249 .open = sg_proc_single_open_adio,
828c0950
AD		 2250 .read = seq_read,
2251 .llseek = seq_lseek,
1da177e4
LT		 2252 .write = sg_proc_write_adio,
2253 .release = single_release,
2254};
2255
2256static int sg_proc_single_open_dressz(struct inode *inode, struct file *file);
2257static ssize_t sg_proc_write_dressz(struct file *filp,
2258 const char __user *buffer, size_t count, loff_t *off);
828c0950
AD		 2259static const struct file_operations dressz_fops = {
2260 .owner = THIS_MODULE,
1da177e4 2261 .open = sg_proc_single_open_dressz,
828c0950
AD		 2262 .read = seq_read,
2263 .llseek = seq_lseek,
1da177e4
LT		 2264 .write = sg_proc_write_dressz,
2265 .release = single_release,
2266};
2267
2268static int sg_proc_seq_show_version(struct seq_file *s, void *v);
2269static int sg_proc_single_open_version(struct inode *inode, struct file *file);
828c0950
AD		 2270static const struct file_operations version_fops = {
2271 .owner = THIS_MODULE,
1da177e4 2272 .open = sg_proc_single_open_version,
828c0950
AD		 2273 .read = seq_read,
2274 .llseek = seq_lseek,
1da177e4
LT		 2275 .release = single_release,
2276};
2277
2278static int sg_proc_seq_show_devhdr(struct seq_file *s, void *v);
2279static int sg_proc_single_open_devhdr(struct inode *inode, struct file *file);
828c0950
AD		 2280static const struct file_operations devhdr_fops = {
2281 .owner = THIS_MODULE,
1da177e4 2282 .open = sg_proc_single_open_devhdr,
828c0950
AD		 2283 .read = seq_read,
2284 .llseek = seq_lseek,
1da177e4
LT		 2285 .release = single_release,
2286};
2287
2288static int sg_proc_seq_show_dev(struct seq_file *s, void *v);
2289static int sg_proc_open_dev(struct inode *inode, struct file *file);
2290static void * dev_seq_start(struct seq_file *s, loff_t *pos);
2291static void * dev_seq_next(struct seq_file *s, void *v, loff_t *pos);
2292static void dev_seq_stop(struct seq_file *s, void *v);
828c0950
AD		 2293static const struct file_operations dev_fops = {
2294 .owner = THIS_MODULE,
1da177e4 2295 .open = sg_proc_open_dev,
828c0950
AD		 2296 .read = seq_read,
2297 .llseek = seq_lseek,
1da177e4
LT		 2298 .release = seq_release,
2299};
88e9d34c 2300static const struct seq_operations dev_seq_ops = {
1da177e4
LT		 2301 .start = dev_seq_start,
2302 .next = dev_seq_next,
2303 .stop = dev_seq_stop,
2304 .show = sg_proc_seq_show_dev,
2305};
2306
2307static int sg_proc_seq_show_devstrs(struct seq_file *s, void *v);
2308static int sg_proc_open_devstrs(struct inode *inode, struct file *file);
828c0950
AD		 2309static const struct file_operations devstrs_fops = {
2310 .owner = THIS_MODULE,
1da177e4 2311 .open = sg_proc_open_devstrs,
828c0950
AD		 2312 .read = seq_read,
2313 .llseek = seq_lseek,
1da177e4
LT		 2314 .release = seq_release,
2315};
88e9d34c 2316static const struct seq_operations devstrs_seq_ops = {
1da177e4
LT		 2317 .start = dev_seq_start,
2318 .next = dev_seq_next,
2319 .stop = dev_seq_stop,
2320 .show = sg_proc_seq_show_devstrs,
2321};
2322
2323static int sg_proc_seq_show_debug(struct seq_file *s, void *v);
2324static int sg_proc_open_debug(struct inode *inode, struct file *file);
828c0950
AD		 2325static const struct file_operations debug_fops = {
2326 .owner = THIS_MODULE,
1da177e4 2327 .open = sg_proc_open_debug,
828c0950
AD		 2328 .read = seq_read,
2329 .llseek = seq_lseek,
1da177e4
LT		 2330 .release = seq_release,
2331};
88e9d34c 2332static const struct seq_operations debug_seq_ops = {
1da177e4
LT		 2333 .start = dev_seq_start,
2334 .next = dev_seq_next,
2335 .stop = dev_seq_stop,
2336 .show = sg_proc_seq_show_debug,
2337};
2338
2339
2340struct sg_proc_leaf {
2341 const char * name;
828c0950 2342 const struct file_operations * fops;
1da177e4
LT		 2343};
2344
2345static struct sg_proc_leaf sg_proc_leaf_arr[] = {
2346 {"allow_dio", &adio_fops},
2347 {"debug", &debug_fops},
2348 {"def_reserved_size", &dressz_fops},
2349 {"device_hdr", &devhdr_fops},
2350 {"devices", &dev_fops},
2351 {"device_strs", &devstrs_fops},
2352 {"version", &version_fops}
2353};
2354
2355static int
2356sg_proc_init(void)
2357{
6391a113 2358 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
d161a13f 2359 int k;
1da177e4 2360
66600221 2361 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
1da177e4
LT		 2362 if (!sg_proc_sgp)
2363 return 1;
2364 for (k = 0; k < num_leaves; ++k) {
d161a13f
AV		 2365 struct sg_proc_leaf *leaf = &sg_proc_leaf_arr[k];
2366 umode_t mask = leaf->fops->write ? S_IRUGO | S_IWUSR : S_IRUGO;
a973909f 2367 proc_create(leaf->name, mask, sg_proc_sgp, leaf->fops);
1da177e4
LT		 2368 }
2369 return 0;
2370}
2371
2372static void
2373sg_proc_cleanup(void)
2374{
2375 int k;
6391a113 2376 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
1da177e4
LT		 2377
2378 if (!sg_proc_sgp)
2379 return;
2380 for (k = 0; k < num_leaves; ++k)
2381 remove_proc_entry(sg_proc_leaf_arr[k].name, sg_proc_sgp);
2382 remove_proc_entry(sg_proc_sg_dirname, NULL);
2383}
2384
2385
2386static int sg_proc_seq_show_int(struct seq_file *s, void *v)
2387{
2388 seq_printf(s, "%d\n", *((int *)s->private));
2389 return 0;
2390}
2391
2392static int sg_proc_single_open_adio(struct inode *inode, struct file *file)
2393{
2394 return single_open(file, sg_proc_seq_show_int, &sg_allow_dio);
2395}
2396
2397static ssize_t
2398sg_proc_write_adio(struct file *filp, const char __user *buffer,
2399 size_t count, loff_t *off)
2400{
7e95fffe
SB		 2401 int err;
2402 unsigned long num;
1da177e4
LT		 2403
2404 if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
2405 return -EACCES;
7e95fffe
SB		 2406 err = kstrtoul_from_user(buffer, count, 0, &num);
2407 if (err)
2408 return err;
2409 sg_allow_dio = num ? 1 : 0;
1da177e4
LT		 2410 return count;
2411}
2412
2413static int sg_proc_single_open_dressz(struct inode *inode, struct file *file)
2414{
2415 return single_open(file, sg_proc_seq_show_int, &sg_big_buff);
2416}
2417
2418static ssize_t
2419sg_proc_write_dressz(struct file *filp, const char __user *buffer,
2420 size_t count, loff_t *off)
2421{
7e95fffe 2422 int err;
1da177e4 2423 unsigned long k = ULONG_MAX;
1da177e4
LT		 2424
2425 if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
2426 return -EACCES;
7e95fffe
SB		 2427
2428 err = kstrtoul_from_user(buffer, count, 0, &k);
2429 if (err)
2430 return err;
1da177e4
LT		 2431 if (k <= 1048576) { /* limit "big buff" to 1 MB */
2432 sg_big_buff = k;
2433 return count;
2434 }
2435 return -ERANGE;
2436}
2437
2438static int sg_proc_seq_show_version(struct seq_file *s, void *v)
2439{
2440 seq_printf(s, "%d\t%s [%s]\n", sg_version_num, SG_VERSION_STR,
2441 sg_version_date);
2442 return 0;
2443}
2444
2445static int sg_proc_single_open_version(struct inode *inode, struct file *file)
2446{
2447 return single_open(file, sg_proc_seq_show_version, NULL);
2448}
2449
2450static int sg_proc_seq_show_devhdr(struct seq_file *s, void *v)
2451{
2452 seq_printf(s, "host\tchan\tid\tlun\ttype\topens\tqdepth\tbusy\t"
2453 "online\n");
2454 return 0;
2455}
2456
2457static int sg_proc_single_open_devhdr(struct inode *inode, struct file *file)
2458{
2459 return single_open(file, sg_proc_seq_show_devhdr, NULL);
2460}
2461
2462struct sg_proc_deviter {
2463 loff_t index;
2464 size_t max;
2465};
2466
2467static void * dev_seq_start(struct seq_file *s, loff_t *pos)
2468{
2469 struct sg_proc_deviter * it = kmalloc(sizeof(*it), GFP_KERNEL);
2470
729d70f5 2471 s->private = it;
1da177e4
LT		 2472 if (! it)
2473 return NULL;
729d70f5 2474
1da177e4
LT		 2475 it->index = *pos;
2476 it->max = sg_last_dev();
2477 if (it->index >= it->max)
729d70f5 2478 return NULL;
1da177e4 2479 return it;
1da177e4
LT		 2480}
2481
2482static void * dev_seq_next(struct seq_file *s, void *v, loff_t *pos)
2483{
729d70f5 2484 struct sg_proc_deviter * it = s->private;
1da177e4
LT		 2485
2486 *pos = ++it->index;
2487 return (it->index < it->max) ? it : NULL;
2488}
2489
2490static void dev_seq_stop(struct seq_file *s, void *v)
2491{
729d70f5 2492 kfree(s->private);
1da177e4
LT		 2493}
2494
2495static int sg_proc_open_dev(struct inode *inode, struct file *file)
2496{
2497 return seq_open(file, &dev_seq_ops);
2498}
2499
2500static int sg_proc_seq_show_dev(struct seq_file *s, void *v)
2501{
2502 struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
2503 Sg_device *sdp;
2504 struct scsi_device *scsidp;
c6517b79 2505 unsigned long iflags;
1da177e4 2506
c6517b79
TB		 2507 read_lock_irqsave(&sg_index_lock, iflags);
2508 sdp = it ? sg_lookup_dev(it->index) : NULL;
1da177e4
LT		 2509 if (sdp && (scsidp = sdp->device) && (!sdp->detached))
2510 seq_printf(s, "%d\t%d\t%d\t%d\t%d\t%d\t%d\t%d\t%d\n",
2511 scsidp->host->host_no, scsidp->channel,
2512 scsidp->id, scsidp->lun, (int) scsidp->type,
2513 1,
2514 (int) scsidp->queue_depth,
2515 (int) scsidp->device_busy,
2516 (int) scsi_device_online(scsidp));
2517 else
2518 seq_printf(s, "-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\n");
c6517b79 2519 read_unlock_irqrestore(&sg_index_lock, iflags);
1da177e4
LT		 2520 return 0;
2521}
2522
2523static int sg_proc_open_devstrs(struct inode *inode, struct file *file)
2524{
2525 return seq_open(file, &devstrs_seq_ops);
2526}
2527
2528static int sg_proc_seq_show_devstrs(struct seq_file *s, void *v)
2529{
2530 struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
2531 Sg_device *sdp;
2532 struct scsi_device *scsidp;
c6517b79 2533 unsigned long iflags;
1da177e4 2534
c6517b79
TB		 2535 read_lock_irqsave(&sg_index_lock, iflags);
2536 sdp = it ? sg_lookup_dev(it->index) : NULL;
1da177e4
LT		 2537 if (sdp && (scsidp = sdp->device) && (!sdp->detached))
2538 seq_printf(s, "%8.8s\t%16.16s\t%4.4s\n",
2539 scsidp->vendor, scsidp->model, scsidp->rev);
2540 else
2541 seq_printf(s, "<no active device>\n");
c6517b79 2542 read_unlock_irqrestore(&sg_index_lock, iflags);
1da177e4
LT		 2543 return 0;
2544}
2545
c6517b79 2546/* must be called while holding sg_index_lock */
1da177e4
LT		 2547static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp)
2548{
2549 int k, m, new_interface, blen, usg;
2550 Sg_request *srp;
2551 Sg_fd *fp;
2552 const sg_io_hdr_t *hp;
2553 const char * cp;
cb59e840 2554 unsigned int ms;
1da177e4 2555
3442f802
FT		 2556 k = 0;
2557 list_for_each_entry(fp, &sdp->sfds, sfd_siblings) {
2558 k++;
c6517b79 2559 read_lock(&fp->rq_list_lock); /* irqs already disabled */
1da177e4 2560 seq_printf(s, " FD(%d): timeout=%dms bufflen=%d "
3442f802 2561 "(res)sgat=%d low_dma=%d\n", k,
1da177e4
LT		 2562 jiffies_to_msecs(fp->timeout),
2563 fp->reserve.bufflen,
2564 (int) fp->reserve.k_use_sg,
2565 (int) fp->low_dma);
ebaf466b 2566 seq_printf(s, " cmd_q=%d f_packid=%d k_orphan=%d closed=0\n",
1da177e4 2567 (int) fp->cmd_q, (int) fp->force_packid,
ebaf466b 2568 (int) fp->keep_orphan);
c6517b79
TB		 2569 for (m = 0, srp = fp->headrp;
2570 srp != NULL;
2571 ++m, srp = srp->nextrp) {
1da177e4
LT		 2572 hp = &srp->header;
2573 new_interface = (hp->interface_id == '\0') ? 0 : 1;
2574 if (srp->res_used) {
2575 if (new_interface &&
2576 (SG_FLAG_MMAP_IO & hp->flags))
2577 cp = " mmap>> ";
2578 else
2579 cp = " rb>> ";
2580 } else {
2581 if (SG_INFO_DIRECT_IO_MASK & hp->info)
2582 cp = " dio>> ";
2583 else
2584 cp = " ";
2585 }
2586 seq_printf(s, cp);
d6b10348
MC		 2587 blen = srp->data.bufflen;
2588 usg = srp->data.k_use_sg;
1da177e4
LT		 2589 seq_printf(s, srp->done ?
2590 ((1 == srp->done) ? "rcv:" : "fin:")
d6b10348 2591 : "act:");
1da177e4
LT		 2592 seq_printf(s, " id=%d blen=%d",
2593 srp->header.pack_id, blen);
2594 if (srp->done)
2595 seq_printf(s, " dur=%d", hp->duration);
cb59e840
DG		 2596 else {
2597 ms = jiffies_to_msecs(jiffies);
1da177e4 2598 seq_printf(s, " t_o/elap=%d/%d",
cb59e840
DG		 2599 (new_interface ? hp->timeout :
2600 jiffies_to_msecs(fp->timeout)),
2601 (ms > hp->duration ? ms - hp->duration : 0));
2602 }
1da177e4
LT		 2603 seq_printf(s, "ms sgat=%d op=0x%02x\n", usg,
2604 (int) srp->data.cmd_opcode);
2605 }
2606 if (0 == m)
2607 seq_printf(s, " No requests active\n");
c6517b79 2608 read_unlock(&fp->rq_list_lock);
1da177e4
LT		 2609 }
2610}
2611
2612static int sg_proc_open_debug(struct inode *inode, struct file *file)
2613{
2614 return seq_open(file, &debug_seq_ops);
2615}
2616
2617static int sg_proc_seq_show_debug(struct seq_file *s, void *v)
2618{
2619 struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
2620 Sg_device *sdp;
c6517b79 2621 unsigned long iflags;
1da177e4
LT		 2622
2623 if (it && (0 == it->index)) {
7c07d613
JB		 2624 seq_printf(s, "max_active_device=%d(origin 1)\n",
2625 (int)it->max);
1da177e4
LT		 2626 seq_printf(s, " def_reserved_size=%d\n", sg_big_buff);
2627 }
1da177e4 2628
c6517b79
TB		 2629 read_lock_irqsave(&sg_index_lock, iflags);
2630 sdp = it ? sg_lookup_dev(it->index) : NULL;
3442f802 2631 if (sdp && !list_empty(&sdp->sfds)) {
c6517b79 2632 struct scsi_device *scsidp = sdp->device;
1da177e4 2633
c6517b79
TB		 2634 seq_printf(s, " >>> device=%s ", sdp->disk->disk_name);
2635 if (sdp->detached)
2636 seq_printf(s, "detached pending close ");
2637 else
2638 seq_printf
2639 (s, "scsi%d chan=%d id=%d lun=%d em=%d",
2640 scsidp->host->host_no,
2641 scsidp->channel, scsidp->id,
2642 scsidp->lun,
2643 scsidp->host->hostt->emulated);
2644 seq_printf(s, " sg_tablesize=%d excl=%d\n",
b499e524 2645 sdp->sg_tablesize, get_exclude(sdp));
1da177e4
LT		 2646 sg_proc_debug_helper(s, sdp);
2647 }
c6517b79 2648 read_unlock_irqrestore(&sg_index_lock, iflags);
1da177e4
LT		 2649 return 0;
2650}
2651
2652#endif /* CONFIG_SCSI_PROC_FS */
2653
2654module_init(init_sg);
2655module_exit(exit_sg);
kernel source for telekom puls (alcatel/mediatek)