[linux.git] / drivers / scsi / scsi_ioctl.c

/*
 * Changes:
 * Arnaldo Carvalho de Melo <[email protected]> 08/23/2000
 * - get rid of some verify_areas and use __copy*user and __get/put_user
 *   for the ones that remain
 */
#include <linux/module.h>
#include <linux/blkdev.h>
#include <linux/interrupt.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/sched.h>
#include <linux/mm.h>
#include <linux/string.h>
#include <asm/uaccess.h>

#include <scsi/scsi.h>
#include <scsi/scsi_device.h>
#include <scsi/scsi_eh.h>
#include <scsi/scsi_host.h>
#include <scsi/scsi_ioctl.h>
#include <scsi/scsi_request.h>
#include <scsi/sg.h>
#include <scsi/scsi_dbg.h>

#include "scsi_logging.h"

#define NORMAL_RETRIES			5
#define IOCTL_NORMAL_TIMEOUT			(10 * HZ)

#define MAX_BUF PAGE_SIZE

/**
 * ioctl_probe  --  return host identification
 * @host:	host to identify
 * @buffer:	userspace buffer for identification
 *
 * Return an identifying string at @buffer, if @buffer is non-NULL, filling
 * to the length stored at * (int *) @buffer.
 */
static int ioctl_probe(struct Scsi_Host *host, void __user *buffer)
{
	unsigned int len, slen;
	const char *string;

	if (buffer) {
		if (get_user(len, (unsigned int __user *) buffer))
			return -EFAULT;

		if (host->hostt->info)
			string = host->hostt->info(host);
		else
			string = host->hostt->name;
		if (string) {
			slen = strlen(string);
			if (len > slen)
				len = slen + 1;
			if (copy_to_user(buffer, string, len))
				return -EFAULT;
		}
	}
	return 1;
}

/*

 * The SCSI_IOCTL_SEND_COMMAND ioctl sends a command out to the SCSI host.
 * The IOCTL_NORMAL_TIMEOUT and NORMAL_RETRIES  variables are used.  
 * 
 * dev is the SCSI device struct ptr, *(int *) arg is the length of the
 * input data, if any, not including the command string & counts, 
 * *((int *)arg + 1) is the output buffer size in bytes.
 * 
 * *(char *) ((int *) arg)[2] the actual command byte.   
 * 
 * Note that if more than MAX_BUF bytes are requested to be transferred,
 * the ioctl will fail with error EINVAL.
 * 
 * This size *does not* include the initial lengths that were passed.
 * 
 * The SCSI command is read from the memory location immediately after the
 * length words, and the input data is right after the command.  The SCSI
 * routines know the command size based on the opcode decode.  
 * 
 * The output area is then filled in starting from the command byte. 
 */

static int ioctl_internal_command(struct scsi_device *sdev, char *cmd,
				  int timeout, int retries)
{
	int result;
	struct scsi_sense_hdr sshdr;

	SCSI_LOG_IOCTL(1, printk("Trying ioctl with scsi command %d\n", *cmd));

	result = scsi_execute_req(sdev, cmd, DMA_NONE, NULL, 0,
				  &sshdr, timeout, retries);

	SCSI_LOG_IOCTL(2, printk("Ioctl returned  0x%x\n", result));

	if ((driver_byte(result) & DRIVER_SENSE) &&
	    (scsi_sense_valid(&sshdr))) {
		switch (sshdr.sense_key) {
		case ILLEGAL_REQUEST:
			if (cmd[0] == ALLOW_MEDIUM_REMOVAL)
				sdev->lockable = 0;
			else
				printk(KERN_INFO "ioctl_internal_command: "
				       "ILLEGAL REQUEST asc=0x%x ascq=0x%x\n",
				       sshdr.asc, sshdr.ascq);
			break;
		case NOT_READY:	/* This happens if there is no disc in drive */
			if (sdev->removable && (cmd[0] != TEST_UNIT_READY)) {
				printk(KERN_INFO "Device not ready. Make sure"
				       " there is a disc in the drive.\n");
				break;
			}
		case UNIT_ATTENTION:
			if (sdev->removable) {
				sdev->changed = 1;
				result = 0;	/* This is no longer considered an error */
				break;
			}
		default:	/* Fall through for non-removable media */
			sdev_printk(KERN_INFO, sdev,
				    "ioctl_internal_command return code = %x\n",
				    result);
			scsi_print_sense_hdr("   ", &sshdr);
			break;
		}
	}

	SCSI_LOG_IOCTL(2, printk("IOCTL Releasing command\n"));
	return result;
}

int scsi_set_medium_removal(struct scsi_device *sdev, char state)
{
	char scsi_cmd[MAX_COMMAND_SIZE];
	int ret;

	if (!sdev->removable || !sdev->lockable)
	       return 0;

	scsi_cmd[0] = ALLOW_MEDIUM_REMOVAL;
	scsi_cmd[1] = 0;
	scsi_cmd[2] = 0;
	scsi_cmd[3] = 0;
	scsi_cmd[4] = state;
	scsi_cmd[5] = 0;

	ret = ioctl_internal_command(sdev, scsi_cmd,
			IOCTL_NORMAL_TIMEOUT, NORMAL_RETRIES);
	if (ret == 0)
		sdev->locked = (state == SCSI_REMOVAL_PREVENT);
	return ret;
}
EXPORT_SYMBOL(scsi_set_medium_removal);

/*
 * This interface is deprecated - users should use the scsi generic (sg)
 * interface instead, as this is a more flexible approach to performing
 * generic SCSI commands on a device.
 *
 * The structure that we are passed should look like:
 *
 * struct sdata {
 *  unsigned int inlen;      [i] Length of data to be written to device 
 *  unsigned int outlen;     [i] Length of data to be read from device 
 *  unsigned char cmd[x];    [i] SCSI command (6 <= x <= 12).
 *                           [o] Data read from device starts here.
 *                           [o] On error, sense buffer starts here.
 *  unsigned char wdata[y];  [i] Data written to device starts here.
 * };
 * Notes:
 *   -  The SCSI command length is determined by examining the 1st byte
 *      of the given command. There is no way to override this.
 *   -  Data transfers are limited to PAGE_SIZE (4K on i386, 8K on alpha).
 *   -  The length (x + y) must be at least OMAX_SB_LEN bytes long to
 *      accommodate the sense buffer when an error occurs.
 *      The sense buffer is truncated to OMAX_SB_LEN (16) bytes so that
 *      old code will not be surprised.
 *   -  If a Unix error occurs (e.g. ENOMEM) then the user will receive
 *      a negative return and the Unix error code in 'errno'. 
 *      If the SCSI command succeeds then 0 is returned.
 *      Positive numbers returned are the compacted SCSI error codes (4 
 *      bytes in one int) where the lowest byte is the SCSI status.
 *      See the drivers/scsi/scsi.h file for more information on this.
 *
 */
#define OMAX_SB_LEN 16		/* Old sense buffer length */

int scsi_ioctl_send_command(struct scsi_device *sdev,
			    struct scsi_ioctl_command __user *sic)
{
	char *buf;
	unsigned char cmd[MAX_COMMAND_SIZE];
	unsigned char sense[SCSI_SENSE_BUFFERSIZE];
	char __user *cmd_in;
	unsigned char opcode;
	unsigned int inlen, outlen, cmdlen;
	unsigned int needed, buf_needed;
	int timeout, retries, result;
	int data_direction;
	gfp_t gfp_mask = GFP_KERNEL;

	if (!sic)
		return -EINVAL;

	if (sdev->host->unchecked_isa_dma)
		gfp_mask |= GFP_DMA;

	/*
	 * Verify that we can read at least this much.
	 */
	if (!access_ok(VERIFY_READ, sic, sizeof(Scsi_Ioctl_Command)))
		return -EFAULT;

	if(__get_user(inlen, &sic->inlen))
		return -EFAULT;
		
	if(__get_user(outlen, &sic->outlen))
		return -EFAULT;

	/*
	 * We do not transfer more than MAX_BUF with this interface.
	 * If the user needs to transfer more data than this, they
	 * should use scsi_generics (sg) instead.
	 */
	if (inlen > MAX_BUF)
		return -EINVAL;
	if (outlen > MAX_BUF)
		return -EINVAL;

	cmd_in = sic->data;
	if(get_user(opcode, cmd_in))
		return -EFAULT;

	needed = buf_needed = (inlen > outlen ? inlen : outlen);
	if (buf_needed) {
		buf_needed = (buf_needed + 511) & ~511;
		if (buf_needed > MAX_BUF)
			buf_needed = MAX_BUF;
		buf = kmalloc(buf_needed, gfp_mask);
		if (!buf)
			return -ENOMEM;
		memset(buf, 0, buf_needed);
		if (inlen == 0) {
			data_direction = DMA_FROM_DEVICE;
		} else if (outlen == 0 ) {
			data_direction = DMA_TO_DEVICE;
		} else {
			/*
			 * Can this ever happen?
			 */
			data_direction = DMA_BIDIRECTIONAL;
		}

	} else {
		buf = NULL;
		data_direction = DMA_NONE;
	}

	/*
	 * Obtain the command from the user's address space.
	 */
	cmdlen = COMMAND_SIZE(opcode);
	
	result = -EFAULT;

	if (!access_ok(VERIFY_READ, cmd_in, cmdlen + inlen))
		goto error;

	if(__copy_from_user(cmd, cmd_in, cmdlen))
		goto error;

	/*
	 * Obtain the data to be sent to the device (if any).
	 */

	if(inlen && copy_from_user(buf, cmd_in + cmdlen, inlen))
		goto error;

	switch (opcode) {
	case SEND_DIAGNOSTIC:
	case FORMAT_UNIT:
		timeout = FORMAT_UNIT_TIMEOUT;
		retries = 1;
		break;
	case START_STOP:
		timeout = START_STOP_TIMEOUT;
		retries = NORMAL_RETRIES;
		break;
	case MOVE_MEDIUM:
		timeout = MOVE_MEDIUM_TIMEOUT;
		retries = NORMAL_RETRIES;
		break;
	case READ_ELEMENT_STATUS:
		timeout = READ_ELEMENT_STATUS_TIMEOUT;
		retries = NORMAL_RETRIES;
		break;
	case READ_DEFECT_DATA:
		timeout = READ_DEFECT_DATA_TIMEOUT;
		retries = 1;
		break;
	default:
		timeout = IOCTL_NORMAL_TIMEOUT;
		retries = NORMAL_RETRIES;
		break;
	}

	result = scsi_execute(sdev, cmd, data_direction, buf, needed,
			      sense, timeout, retries, 0);

	/* 
	 * If there was an error condition, pass the info back to the user. 
	 */
	if (result) {
		int sb_len = sizeof(*sense);

		sb_len = (sb_len > OMAX_SB_LEN) ? OMAX_SB_LEN : sb_len;
		if (copy_to_user(cmd_in, sense, sb_len))
			result = -EFAULT;
	} else {
		if (outlen && copy_to_user(cmd_in, buf, outlen))
			result = -EFAULT;
	}	

error:
	kfree(buf);
	return result;
}
EXPORT_SYMBOL(scsi_ioctl_send_command);

/*
 * The scsi_ioctl_get_pci() function places into arg the value
 * pci_dev::slot_name (8 characters) for the PCI device (if any).
 * Returns: 0 on success
 *          -ENXIO if there isn't a PCI device pointer
 *                 (could be because the SCSI driver hasn't been
 *                  updated yet, or because it isn't a SCSI
 *                  device)
 *          any copy_to_user() error on failure there
 */
static int scsi_ioctl_get_pci(struct scsi_device *sdev, void __user *arg)
{
	struct device *dev = scsi_get_device(sdev->host);

        if (!dev)
		return -ENXIO;
        return copy_to_user(arg, dev->bus_id, sizeof(dev->bus_id))? -EFAULT: 0;
}


/*
 * the scsi_ioctl() function differs from most ioctls in that it does
 * not take a major/minor number as the dev field.  Rather, it takes
 * a pointer to a scsi_devices[] element, a structure. 
 */
int scsi_ioctl(struct scsi_device *sdev, int cmd, void __user *arg)
{
	char scsi_cmd[MAX_COMMAND_SIZE];

	/* No idea how this happens.... */
	if (!sdev)
		return -ENXIO;

	/*
	 * If we are in the middle of error recovery, don't let anyone
	 * else try and use this device.  Also, if error recovery fails, it
	 * may try and take the device offline, in which case all further
	 * access to the device is prohibited.
	 */
	if (!scsi_block_when_processing_errors(sdev))
		return -ENODEV;

	/* Check for deprecated ioctls ... all the ioctls which don't
	 * follow the new unique numbering scheme are deprecated */
	switch (cmd) {
	case SCSI_IOCTL_SEND_COMMAND:
	case SCSI_IOCTL_TEST_UNIT_READY:
	case SCSI_IOCTL_BENCHMARK_COMMAND:
	case SCSI_IOCTL_SYNC:
	case SCSI_IOCTL_START_UNIT:
	case SCSI_IOCTL_STOP_UNIT:
		printk(KERN_WARNING "program %s is using a deprecated SCSI "
		       "ioctl, please convert it to SG_IO\n", current->comm);
		break;
	default:
		break;
	}

	switch (cmd) {
	case SCSI_IOCTL_GET_IDLUN:
		if (!access_ok(VERIFY_WRITE, arg, sizeof(struct scsi_idlun)))
			return -EFAULT;

		__put_user((sdev->id & 0xff)
			 + ((sdev->lun & 0xff) << 8)
			 + ((sdev->channel & 0xff) << 16)
			 + ((sdev->host->host_no & 0xff) << 24),
			 &((struct scsi_idlun __user *)arg)->dev_id);
		__put_user(sdev->host->unique_id,
			 &((struct scsi_idlun __user *)arg)->host_unique_id);
		return 0;
	case SCSI_IOCTL_GET_BUS_NUMBER:
		return put_user(sdev->host->host_no, (int __user *)arg);
	case SCSI_IOCTL_PROBE_HOST:
		return ioctl_probe(sdev->host, arg);
	case SCSI_IOCTL_SEND_COMMAND:
		if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
			return -EACCES;
		return scsi_ioctl_send_command(sdev, arg);
	case SCSI_IOCTL_DOORLOCK:
		return scsi_set_medium_removal(sdev, SCSI_REMOVAL_PREVENT);
	case SCSI_IOCTL_DOORUNLOCK:
		return scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW);
	case SCSI_IOCTL_TEST_UNIT_READY:
		return scsi_test_unit_ready(sdev, IOCTL_NORMAL_TIMEOUT,
					    NORMAL_RETRIES);
	case SCSI_IOCTL_START_UNIT:
		scsi_cmd[0] = START_STOP;
		scsi_cmd[1] = 0;
		scsi_cmd[2] = scsi_cmd[3] = scsi_cmd[5] = 0;
		scsi_cmd[4] = 1;
		return ioctl_internal_command(sdev, scsi_cmd,
				     START_STOP_TIMEOUT, NORMAL_RETRIES);
	case SCSI_IOCTL_STOP_UNIT:
		scsi_cmd[0] = START_STOP;
		scsi_cmd[1] = 0;
		scsi_cmd[2] = scsi_cmd[3] = scsi_cmd[5] = 0;
		scsi_cmd[4] = 0;
		return ioctl_internal_command(sdev, scsi_cmd,
				     START_STOP_TIMEOUT, NORMAL_RETRIES);
        case SCSI_IOCTL_GET_PCI:
                return scsi_ioctl_get_pci(sdev, arg);
	default:
		if (sdev->host->hostt->ioctl)
			return sdev->host->hostt->ioctl(sdev, cmd, arg);
	}
	return -EINVAL;
}
EXPORT_SYMBOL(scsi_ioctl);

/*
 * the scsi_nonblock_ioctl() function is designed for ioctls which may
 * be executed even if the device is in recovery.
 */
int scsi_nonblockable_ioctl(struct scsi_device *sdev, int cmd,
			    void __user *arg, struct file *filp)
{
	int val, result;

	/* The first set of iocts may be executed even if we're doing
	 * error processing, as long as the device was opened
	 * non-blocking */
	if (filp && filp->f_flags & O_NONBLOCK) {
		if (scsi_host_in_recovery(sdev->host))
			return -ENODEV;
	} else if (!scsi_block_when_processing_errors(sdev))
		return -ENODEV;

	switch (cmd) {
	case SG_SCSI_RESET:
		result = get_user(val, (int __user *)arg);
		if (result)
			return result;
		if (val == SG_SCSI_RESET_NOTHING)
			return 0;
		switch (val) {
		case SG_SCSI_RESET_DEVICE:
			val = SCSI_TRY_RESET_DEVICE;
			break;
		case SG_SCSI_RESET_BUS:
			val = SCSI_TRY_RESET_BUS;
			break;
		case SG_SCSI_RESET_HOST:
			val = SCSI_TRY_RESET_HOST;
			break;
		default:
			return -EINVAL;
		}
		if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
			return -EACCES;
		return (scsi_reset_provider(sdev, val) ==
			SUCCESS) ? 0 : -EIO;
	}
	return -ENODEV;
}
EXPORT_SYMBOL(scsi_nonblockable_ioctl);
Commit	Line	Data
1da177e4 LT	1	/*
	2	* Changes:
	3	* Arnaldo Carvalho de Melo <[email protected]> 08/23/2000
	4	* - get rid of some verify_areas and use __copy*user and __get/put_user
	5	* for the ones that remain
	6	*/
	7	#include <linux/module.h>
	8	#include <linux/blkdev.h>
	9	#include <linux/interrupt.h>
	10	#include <linux/errno.h>
	11	#include <linux/kernel.h>
	12	#include <linux/sched.h>
	13	#include <linux/mm.h>
	14	#include <linux/string.h>
	15	#include <asm/uaccess.h>
	16
	17	#include <scsi/scsi.h>
	18	#include <scsi/scsi_device.h>
	19	#include <scsi/scsi_eh.h>
	20	#include <scsi/scsi_host.h>
	21	#include <scsi/scsi_ioctl.h>
	22	#include <scsi/scsi_request.h>
	23	#include <scsi/sg.h>
	24	#include <scsi/scsi_dbg.h>
	25
	26	#include "scsi_logging.h"
	27
	28	#define NORMAL_RETRIES 5
	29	#define IOCTL_NORMAL_TIMEOUT (10 * HZ)
1da177e4 LT	30
	31	#define MAX_BUF PAGE_SIZE
	32
32993523 CH	33	/**
	34	* ioctl_probe -- return host identification
	35	* @host: host to identify
	36	* @buffer: userspace buffer for identification
	37	*
	38	* Return an identifying string at @buffer, if @buffer is non-NULL, filling
	39	* to the length stored at * (int *) @buffer.
1da177e4	40	*/
1da177e4 LT	41	static int ioctl_probe(struct Scsi_Host host, void __user buffer)
	42	{
	43	unsigned int len, slen;
	44	const char *string;
1da177e4	45
32993523	46	if (buffer) {
1da177e4 LT	47	if (get_user(len, (unsigned int __user *) buffer))
	48	return -EFAULT;
	49
	50	if (host->hostt->info)
	51	string = host->hostt->info(host);
	52	else
	53	string = host->hostt->name;
	54	if (string) {
	55	slen = strlen(string);
	56	if (len > slen)
	57	len = slen + 1;
	58	if (copy_to_user(buffer, string, len))
	59	return -EFAULT;
	60	}
	61	}
32993523	62	return 1;
1da177e4 LT	63	}
	64
	65	/*
	66
	67	* The SCSI_IOCTL_SEND_COMMAND ioctl sends a command out to the SCSI host.
	68	* The IOCTL_NORMAL_TIMEOUT and NORMAL_RETRIES variables are used.
	69	*
	70	* dev is the SCSI device struct ptr, (int ) arg is the length of the
	71	* input data, if any, not including the command string & counts,
	72	* ((int )arg + 1) is the output buffer size in bytes.
	73	*
	74	* (char ) ((int *) arg)[2] the actual command byte.
	75	*
	76	* Note that if more than MAX_BUF bytes are requested to be transferred,
	77	* the ioctl will fail with error EINVAL.
	78	*
	79	* This size does not include the initial lengths that were passed.
	80	*
	81	* The SCSI command is read from the memory location immediately after the
	82	* length words, and the input data is right after the command. The SCSI
	83	* routines know the command size based on the opcode decode.
	84	*
	85	* The output area is then filled in starting from the command byte.
	86	*/
	87
	88	static int ioctl_internal_command(struct scsi_device sdev, char cmd,
	89	int timeout, int retries)
	90	{
1da177e4 LT	91	int result;
	92	struct scsi_sense_hdr sshdr;
	93
	94	SCSI_LOG_IOCTL(1, printk("Trying ioctl with scsi command %d\n", *cmd));
	95
1cf72699	96	result = scsi_execute_req(sdev, cmd, DMA_NONE, NULL, 0,
ea73a9f2	97	&sshdr, timeout, retries);
1da177e4	98
1cf72699	99	SCSI_LOG_IOCTL(2, printk("Ioctl returned 0x%x\n", result));
1da177e4	100
1cf72699	101	if ((driver_byte(result) & DRIVER_SENSE) &&
ea73a9f2	102	(scsi_sense_valid(&sshdr))) {
1da177e4 LT	103	switch (sshdr.sense_key) {
	104	case ILLEGAL_REQUEST:
	105	if (cmd[0] == ALLOW_MEDIUM_REMOVAL)
	106	sdev->lockable = 0;
	107	else
	108	printk(KERN_INFO "ioctl_internal_command: "
	109	"ILLEGAL REQUEST asc=0x%x ascq=0x%x\n",
	110	sshdr.asc, sshdr.ascq);
	111	break;
	112	case NOT_READY: /* This happens if there is no disc in drive */
	113	if (sdev->removable && (cmd[0] != TEST_UNIT_READY)) {
	114	printk(KERN_INFO "Device not ready. Make sure"
	115	" there is a disc in the drive.\n");
	116	break;
	117	}
	118	case UNIT_ATTENTION:
	119	if (sdev->removable) {
	120	sdev->changed = 1;
1cf72699	121	result = 0; /* This is no longer considered an error */
1da177e4 LT	122	break;
	123	}
	124	default: /* Fall through for non-removable media */
9ccfc756 JB	125	sdev_printk(KERN_INFO, sdev,
	126	"ioctl_internal_command return code = %x\n",
	127	result);
ea73a9f2	128	scsi_print_sense_hdr(" ", &sshdr);
1da177e4 LT	129	break;
	130	}
	131	}
	132
1da177e4	133	SCSI_LOG_IOCTL(2, printk("IOCTL Releasing command\n"));
1da177e4 LT	134	return result;
	135	}
	136
	137	int scsi_set_medium_removal(struct scsi_device *sdev, char state)
	138	{
	139	char scsi_cmd[MAX_COMMAND_SIZE];
	140	int ret;
	141
	142	if (!sdev->removable \|\| !sdev->lockable)
	143	return 0;
	144
	145	scsi_cmd[0] = ALLOW_MEDIUM_REMOVAL;
	146	scsi_cmd[1] = 0;
	147	scsi_cmd[2] = 0;
	148	scsi_cmd[3] = 0;
	149	scsi_cmd[4] = state;
	150	scsi_cmd[5] = 0;
	151
	152	ret = ioctl_internal_command(sdev, scsi_cmd,
	153	IOCTL_NORMAL_TIMEOUT, NORMAL_RETRIES);
	154	if (ret == 0)
	155	sdev->locked = (state == SCSI_REMOVAL_PREVENT);
	156	return ret;
	157	}
	158	EXPORT_SYMBOL(scsi_set_medium_removal);
	159
	160	/*
	161	* This interface is deprecated - users should use the scsi generic (sg)
	162	* interface instead, as this is a more flexible approach to performing
	163	* generic SCSI commands on a device.
	164	*
	165	* The structure that we are passed should look like:
	166	*
	167	* struct sdata {
	168	* unsigned int inlen; [i] Length of data to be written to device
	169	* unsigned int outlen; [i] Length of data to be read from device
	170	* unsigned char cmd[x]; [i] SCSI command (6 <= x <= 12).
	171	* [o] Data read from device starts here.
	172	* [o] On error, sense buffer starts here.
	173	* unsigned char wdata[y]; [i] Data written to device starts here.
	174	* };
	175	* Notes:
	176	* - The SCSI command length is determined by examining the 1st byte
	177	* of the given command. There is no way to override this.
	178	* - Data transfers are limited to PAGE_SIZE (4K on i386, 8K on alpha).
	179	* - The length (x + y) must be at least OMAX_SB_LEN bytes long to
	180	* accommodate the sense buffer when an error occurs.
	181	* The sense buffer is truncated to OMAX_SB_LEN (16) bytes so that
	182	* old code will not be surprised.
	183	* - If a Unix error occurs (e.g. ENOMEM) then the user will receive
	184	* a negative return and the Unix error code in 'errno'.
	185	* If the SCSI command succeeds then 0 is returned.
	186	* Positive numbers returned are the compacted SCSI error codes (4
	187	* bytes in one int) where the lowest byte is the SCSI status.
	188	* See the drivers/scsi/scsi.h file for more information on this.
	189	*
	190	*/
	191	#define OMAX_SB_LEN 16 /* Old sense buffer length */
	192
	193	int scsi_ioctl_send_command(struct scsi_device *sdev,
	194	struct scsi_ioctl_command __user *sic)
	195	{
	196	char *buf;
	197	unsigned char cmd[MAX_COMMAND_SIZE];
1cf72699	198	unsigned char sense[SCSI_SENSE_BUFFERSIZE];
1da177e4	199	char __user *cmd_in;
1da177e4 LT	200	unsigned char opcode;
	201	unsigned int inlen, outlen, cmdlen;
	202	unsigned int needed, buf_needed;
	203	int timeout, retries, result;
c53033f6 AV	204	int data_direction;
c53033f6 AV	205	gfp_t gfp_mask = GFP_KERNEL;
1da177e4 LT	206
	207	if (!sic)
	208	return -EINVAL;
	209
	210	if (sdev->host->unchecked_isa_dma)
	211	gfp_mask \|= GFP_DMA;
	212
	213	/*
	214	* Verify that we can read at least this much.
	215	*/
	216	if (!access_ok(VERIFY_READ, sic, sizeof(Scsi_Ioctl_Command)))
	217	return -EFAULT;
	218
	219	if(__get_user(inlen, &sic->inlen))
	220	return -EFAULT;
	221
	222	if(__get_user(outlen, &sic->outlen))
	223	return -EFAULT;
	224
	225	/*
	226	* We do not transfer more than MAX_BUF with this interface.
	227	* If the user needs to transfer more data than this, they
	228	* should use scsi_generics (sg) instead.
	229	*/
	230	if (inlen > MAX_BUF)
	231	return -EINVAL;
	232	if (outlen > MAX_BUF)
	233	return -EINVAL;
	234
	235	cmd_in = sic->data;
	236	if(get_user(opcode, cmd_in))
	237	return -EFAULT;
	238
	239	needed = buf_needed = (inlen > outlen ? inlen : outlen);
	240	if (buf_needed) {
	241	buf_needed = (buf_needed + 511) & ~511;
	242	if (buf_needed > MAX_BUF)
	243	buf_needed = MAX_BUF;
	244	buf = kmalloc(buf_needed, gfp_mask);
	245	if (!buf)
	246	return -ENOMEM;
	247	memset(buf, 0, buf_needed);
	248	if (inlen == 0) {
	249	data_direction = DMA_FROM_DEVICE;
	250	} else if (outlen == 0 ) {
	251	data_direction = DMA_TO_DEVICE;
	252	} else {
	253	/*
	254	* Can this ever happen?
	255	*/
	256	data_direction = DMA_BIDIRECTIONAL;
	257	}
	258
	259	} else {
	260	buf = NULL;
	261	data_direction = DMA_NONE;
	262	}
	263
	264	/*
	265	* Obtain the command from the user's address space.
	266	*/
	267	cmdlen = COMMAND_SIZE(opcode);
	268
	269	result = -EFAULT;
270
271	if (!access_ok(VERIFY_READ, cmd_in, cmdlen + inlen))
272	goto error;
273
274	if(__copy_from_user(cmd, cmd_in, cmdlen))
275	goto error;
276
277	/*
278	* Obtain the data to be sent to the device (if any).
279	*/
280
46477226	281	if(inlen && copy_from_user(buf, cmd_in + cmdlen, inlen))
1da177e4 LT	282	goto error;
	283
	284	switch (opcode) {
	285	case SEND_DIAGNOSTIC:
	286	case FORMAT_UNIT:
	287	timeout = FORMAT_UNIT_TIMEOUT;
	288	retries = 1;
	289	break;
	290	case START_STOP:
	291	timeout = START_STOP_TIMEOUT;
	292	retries = NORMAL_RETRIES;
	293	break;
	294	case MOVE_MEDIUM:
	295	timeout = MOVE_MEDIUM_TIMEOUT;
	296	retries = NORMAL_RETRIES;
	297	break;
	298	case READ_ELEMENT_STATUS:
	299	timeout = READ_ELEMENT_STATUS_TIMEOUT;
	300	retries = NORMAL_RETRIES;
	301	break;
	302	case READ_DEFECT_DATA:
	303	timeout = READ_DEFECT_DATA_TIMEOUT;
	304	retries = 1;
	305	break;
	306	default:
	307	timeout = IOCTL_NORMAL_TIMEOUT;
	308	retries = NORMAL_RETRIES;
	309	break;
	310	}
	311
ea73a9f2 JB	312	result = scsi_execute(sdev, cmd, data_direction, buf, needed,
	313	sense, timeout, retries, 0);
	314
1da177e4 LT	315	/*
	316	* If there was an error condition, pass the info back to the user.
	317	*/
1da177e4	318	if (result) {
1cf72699	319	int sb_len = sizeof(*sense);
1da177e4 LT	320
1da177e4 LT	321	sb_len = (sb_len > OMAX_SB_LEN) ? OMAX_SB_LEN : sb_len;
1cf72699	322	if (copy_to_user(cmd_in, sense, sb_len))
1da177e4 LT	323	result = -EFAULT;
1da177e4 LT	324	} else {
46477226	325	if (outlen && copy_to_user(cmd_in, buf, outlen))
1da177e4 LT	326	result = -EFAULT;
	327	}
	328
1da177e4 LT	329	error:
	330	kfree(buf);
	331	return result;
	332	}
	333	EXPORT_SYMBOL(scsi_ioctl_send_command);
	334
	335	/*
	336	* The scsi_ioctl_get_pci() function places into arg the value
	337	* pci_dev::slot_name (8 characters) for the PCI device (if any).
	338	* Returns: 0 on success
	339	* -ENXIO if there isn't a PCI device pointer
	340	* (could be because the SCSI driver hasn't been
	341	* updated yet, or because it isn't a SCSI
	342	* device)
	343	* any copy_to_user() error on failure there
	344	*/
	345	static int scsi_ioctl_get_pci(struct scsi_device sdev, void __user arg)
	346	{
	347	struct device *dev = scsi_get_device(sdev->host);
	348
	349	if (!dev)
	350	return -ENXIO;
	351	return copy_to_user(arg, dev->bus_id, sizeof(dev->bus_id))? -EFAULT: 0;
	352	}
	353
	354
	355	/*
	356	* the scsi_ioctl() function differs from most ioctls in that it does
	357	* not take a major/minor number as the dev field. Rather, it takes
	358	* a pointer to a scsi_devices[] element, a structure.
	359	*/
	360	int scsi_ioctl(struct scsi_device sdev, int cmd, void __user arg)
	361	{
	362	char scsi_cmd[MAX_COMMAND_SIZE];
	363
	364	/* No idea how this happens.... */
	365	if (!sdev)
	366	return -ENXIO;
	367
	368	/*
	369	* If we are in the middle of error recovery, don't let anyone
	370	* else try and use this device. Also, if error recovery fails, it
	371	* may try and take the device offline, in which case all further
	372	* access to the device is prohibited.
	373	*/
	374	if (!scsi_block_when_processing_errors(sdev))
	375	return -ENODEV;
	376
	377	/* Check for deprecated ioctls ... all the ioctls which don't
	378	* follow the new unique numbering scheme are deprecated */
	379	switch (cmd) {
	380	case SCSI_IOCTL_SEND_COMMAND:
	381	case SCSI_IOCTL_TEST_UNIT_READY:
	382	case SCSI_IOCTL_BENCHMARK_COMMAND:
	383	case SCSI_IOCTL_SYNC:
	384	case SCSI_IOCTL_START_UNIT:
	385	case SCSI_IOCTL_STOP_UNIT:
	386	printk(KERN_WARNING "program %s is using a deprecated SCSI "
	387	"ioctl, please convert it to SG_IO\n", current->comm);
	388	break;
	389	default:
	390	break;
	391	}
	392
393	switch (cmd) {
394	case SCSI_IOCTL_GET_IDLUN:
395	if (!access_ok(VERIFY_WRITE, arg, sizeof(struct scsi_idlun)))
396	return -EFAULT;
397
398	__put_user((sdev->id & 0xff)
399	+ ((sdev->lun & 0xff) << 8)
400	+ ((sdev->channel & 0xff) << 16)
401	+ ((sdev->host->host_no & 0xff) << 24),
402	&((struct scsi_idlun __user *)arg)->dev_id);
403	__put_user(sdev->host->unique_id,
404	&((struct scsi_idlun __user *)arg)->host_unique_id);
405	return 0;
406	case SCSI_IOCTL_GET_BUS_NUMBER:
407	return put_user(sdev->host->host_no, (int __user *)arg);
408	case SCSI_IOCTL_PROBE_HOST:
409	return ioctl_probe(sdev->host, arg);
410	case SCSI_IOCTL_SEND_COMMAND:
411	if (!capable(CAP_SYS_ADMIN) \|\| !capable(CAP_SYS_RAWIO))
412	return -EACCES;
413	return scsi_ioctl_send_command(sdev, arg);
414	case SCSI_IOCTL_DOORLOCK:
415	return scsi_set_medium_removal(sdev, SCSI_REMOVAL_PREVENT);
416	case SCSI_IOCTL_DOORUNLOCK:
417	return scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW);
418	case SCSI_IOCTL_TEST_UNIT_READY:
419	return scsi_test_unit_ready(sdev, IOCTL_NORMAL_TIMEOUT,
420	NORMAL_RETRIES);
421	case SCSI_IOCTL_START_UNIT:
422	scsi_cmd[0] = START_STOP;
423	scsi_cmd[1] = 0;
424	scsi_cmd[2] = scsi_cmd[3] = scsi_cmd[5] = 0;
425	scsi_cmd[4] = 1;
426	return ioctl_internal_command(sdev, scsi_cmd,
427	START_STOP_TIMEOUT, NORMAL_RETRIES);
428	case SCSI_IOCTL_STOP_UNIT:
429	scsi_cmd[0] = START_STOP;
430	scsi_cmd[1] = 0;
431	scsi_cmd[2] = scsi_cmd[3] = scsi_cmd[5] = 0;
432	scsi_cmd[4] = 0;
433	return ioctl_internal_command(sdev, scsi_cmd,
434	START_STOP_TIMEOUT, NORMAL_RETRIES);
435	case SCSI_IOCTL_GET_PCI:
436	return scsi_ioctl_get_pci(sdev, arg);
437	default:
438	if (sdev->host->hostt->ioctl)
439	return sdev->host->hostt->ioctl(sdev, cmd, arg);
440	}
441	return -EINVAL;
442	}
443	EXPORT_SYMBOL(scsi_ioctl);
444
445	/*
446	* the scsi_nonblock_ioctl() function is designed for ioctls which may
447	* be executed even if the device is in recovery.
448	*/
449	int scsi_nonblockable_ioctl(struct scsi_device *sdev, int cmd,
450	void __user arg, struct file filp)
451	{
452	int val, result;
453
454	/* The first set of iocts may be executed even if we're doing
455	* error processing, as long as the device was opened
456	* non-blocking */
457	if (filp && filp->f_flags & O_NONBLOCK) {
939647ee	458	if (scsi_host_in_recovery(sdev->host))
1da177e4 LT	459	return -ENODEV;
	460	} else if (!scsi_block_when_processing_errors(sdev))
	461	return -ENODEV;
	462
	463	switch (cmd) {
	464	case SG_SCSI_RESET:
	465	result = get_user(val, (int __user *)arg);
	466	if (result)
	467	return result;
	468	if (val == SG_SCSI_RESET_NOTHING)
	469	return 0;
	470	switch (val) {
	471	case SG_SCSI_RESET_DEVICE:
	472	val = SCSI_TRY_RESET_DEVICE;
	473	break;
	474	case SG_SCSI_RESET_BUS:
	475	val = SCSI_TRY_RESET_BUS;
	476	break;
	477	case SG_SCSI_RESET_HOST:
	478	val = SCSI_TRY_RESET_HOST;
	479	break;
	480	default:
	481	return -EINVAL;
	482	}
	483	if (!capable(CAP_SYS_ADMIN) \|\| !capable(CAP_SYS_RAWIO))
	484	return -EACCES;
	485	return (scsi_reset_provider(sdev, val) ==
	486	SUCCESS) ? 0 : -EIO;
	487	}
	488	return -ENODEV;
	489	}
	490	EXPORT_SYMBOL(scsi_nonblockable_ioctl);