3 * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 08/23/2000
4 * - get rid of some verify_areas and use __copy*user and __get/put_user
5 * for the ones that remain
7 #include <linux/module.h>
8 #include <linux/blkdev.h>
9 #include <linux/interrupt.h>
10 #include <linux/errno.h>
11 #include <linux/kernel.h>
12 #include <linux/sched.h>
14 #include <linux/string.h>
15 #include <asm/uaccess.h>
17 #include <scsi/scsi.h>
18 #include <scsi/scsi_device.h>
19 #include <scsi/scsi_eh.h>
20 #include <scsi/scsi_host.h>
21 #include <scsi/scsi_ioctl.h>
22 #include <scsi/scsi_request.h>
24 #include "scsi_logging.h"
26 #define NORMAL_RETRIES 5
27 #define IOCTL_NORMAL_TIMEOUT (10 * HZ)
28 #define FORMAT_UNIT_TIMEOUT (2 * 60 * 60 * HZ)
29 #define START_STOP_TIMEOUT (60 * HZ)
30 #define MOVE_MEDIUM_TIMEOUT (5 * 60 * HZ)
31 #define READ_ELEMENT_STATUS_TIMEOUT (5 * 60 * HZ)
32 #define READ_DEFECT_DATA_TIMEOUT (60 * HZ ) /* ZIP-250 on parallel port takes as long! */
34 #define MAX_BUF PAGE_SIZE
37 * If we are told to probe a host, we will return 0 if the host is not
38 * present, 1 if the host is present, and will return an identifying
39 * string at *arg, if arg is non null, filling to the length stored at
43 static int ioctl_probe(struct Scsi_Host *host, void __user *buffer)
45 unsigned int len, slen;
47 int temp = host->hostt->present;
50 if (get_user(len, (unsigned int __user *) buffer))
53 if (host->hostt->info)
54 string = host->hostt->info(host);
56 string = host->hostt->name;
58 slen = strlen(string);
61 if (copy_to_user(buffer, string, len))
70 * The SCSI_IOCTL_SEND_COMMAND ioctl sends a command out to the SCSI host.
71 * The IOCTL_NORMAL_TIMEOUT and NORMAL_RETRIES variables are used.
73 * dev is the SCSI device struct ptr, *(int *) arg is the length of the
74 * input data, if any, not including the command string & counts,
75 * *((int *)arg + 1) is the output buffer size in bytes.
77 * *(char *) ((int *) arg)[2] the actual command byte.
79 * Note that if more than MAX_BUF bytes are requested to be transferred,
80 * the ioctl will fail with error EINVAL.
82 * This size *does not* include the initial lengths that were passed.
84 * The SCSI command is read from the memory location immediately after the
85 * length words, and the input data is right after the command. The SCSI
86 * routines know the command size based on the opcode decode.
88 * The output area is then filled in starting from the command byte.
91 static int ioctl_internal_command(struct scsi_device *sdev, char *cmd,
92 int timeout, int retries)
94 struct scsi_request *sreq;
97 SCSI_LOG_IOCTL(1, printk("Trying ioctl with scsi command %d\n", *cmd));
99 sreq = scsi_allocate_request(sdev, GFP_KERNEL);
101 printk("SCSI internal ioctl failed, no memory\n");
105 sreq->sr_data_direction = DMA_NONE;
106 scsi_wait_req(sreq, cmd, NULL, 0, timeout, retries);
108 SCSI_LOG_IOCTL(2, printk("Ioctl returned 0x%x\n", sreq->sr_result));
110 if (driver_byte(sreq->sr_result)) {
111 switch (sreq->sr_sense_buffer[2] & 0xf) {
112 case ILLEGAL_REQUEST:
113 if (cmd[0] == ALLOW_MEDIUM_REMOVAL)
116 printk("SCSI device (ioctl) reports ILLEGAL REQUEST.\n");
118 case NOT_READY: /* This happens if there is no disc in drive */
119 if (sdev->removable && (cmd[0] != TEST_UNIT_READY)) {
120 printk(KERN_INFO "Device not ready. Make sure there is a disc in the drive.\n");
124 if (sdev->removable) {
126 sreq->sr_result = 0; /* This is no longer considered an error */
129 default: /* Fall through for non-removable media */
130 printk("SCSI error: host %d id %d lun %d return code = %x\n",
135 printk("\tSense class %x, sense error %x, extended sense %x\n",
136 sense_class(sreq->sr_sense_buffer[0]),
137 sense_error(sreq->sr_sense_buffer[0]),
138 sreq->sr_sense_buffer[2] & 0xf);
143 result = sreq->sr_result;
144 SCSI_LOG_IOCTL(2, printk("IOCTL Releasing command\n"));
145 scsi_release_request(sreq);
149 int scsi_set_medium_removal(struct scsi_device *sdev, char state)
151 char scsi_cmd[MAX_COMMAND_SIZE];
154 if (!sdev->removable || !sdev->lockable)
157 scsi_cmd[0] = ALLOW_MEDIUM_REMOVAL;
164 ret = ioctl_internal_command(sdev, scsi_cmd,
165 IOCTL_NORMAL_TIMEOUT, NORMAL_RETRIES);
167 sdev->locked = (state == SCSI_REMOVAL_PREVENT);
172 * This interface is deprecated - users should use the scsi generic (sg)
173 * interface instead, as this is a more flexible approach to performing
174 * generic SCSI commands on a device.
176 * The structure that we are passed should look like:
179 * unsigned int inlen; [i] Length of data to be written to device
180 * unsigned int outlen; [i] Length of data to be read from device
181 * unsigned char cmd[x]; [i] SCSI command (6 <= x <= 12).
182 * [o] Data read from device starts here.
183 * [o] On error, sense buffer starts here.
184 * unsigned char wdata[y]; [i] Data written to device starts here.
187 * - The SCSI command length is determined by examining the 1st byte
188 * of the given command. There is no way to override this.
189 * - Data transfers are limited to PAGE_SIZE (4K on i386, 8K on alpha).
190 * - The length (x + y) must be at least OMAX_SB_LEN bytes long to
191 * accommodate the sense buffer when an error occurs.
192 * The sense buffer is truncated to OMAX_SB_LEN (16) bytes so that
193 * old code will not be surprised.
194 * - If a Unix error occurs (e.g. ENOMEM) then the user will receive
195 * a negative return and the Unix error code in 'errno'.
196 * If the SCSI command succeeds then 0 is returned.
197 * Positive numbers returned are the compacted SCSI error codes (4
198 * bytes in one int) where the lowest byte is the SCSI status.
199 * See the drivers/scsi/scsi.h file for more information on this.
202 #define OMAX_SB_LEN 16 /* Old sense buffer length */
204 int scsi_ioctl_send_command(struct scsi_device *sdev,
205 struct scsi_ioctl_command __user *sic)
208 unsigned char cmd[MAX_COMMAND_SIZE];
210 struct scsi_request *sreq;
211 unsigned char opcode;
212 unsigned int inlen, outlen, cmdlen;
213 unsigned int needed, buf_needed;
214 int timeout, retries, result;
215 int data_direction, gfp_mask = GFP_KERNEL;
220 if (sdev->host->unchecked_isa_dma)
224 * Verify that we can read at least this much.
226 if (verify_area(VERIFY_READ, sic, sizeof(Scsi_Ioctl_Command)))
229 if(__get_user(inlen, &sic->inlen))
232 if(__get_user(outlen, &sic->outlen))
236 * We do not transfer more than MAX_BUF with this interface.
237 * If the user needs to transfer more data than this, they
238 * should use scsi_generics (sg) instead.
242 if (outlen > MAX_BUF)
246 if(get_user(opcode, cmd_in))
249 needed = buf_needed = (inlen > outlen ? inlen : outlen);
251 buf_needed = (buf_needed + 511) & ~511;
252 if (buf_needed > MAX_BUF)
253 buf_needed = MAX_BUF;
254 buf = kmalloc(buf_needed, gfp_mask);
257 memset(buf, 0, buf_needed);
259 data_direction = DMA_FROM_DEVICE;
260 } else if (outlen == 0 ) {
261 data_direction = DMA_TO_DEVICE;
264 * Can this ever happen?
266 data_direction = DMA_BIDIRECTIONAL;
271 data_direction = DMA_NONE;
275 * Obtain the command from the user's address space.
277 cmdlen = COMMAND_SIZE(opcode);
281 if (verify_area(VERIFY_READ, cmd_in, cmdlen + inlen))
284 if(__copy_from_user(cmd, cmd_in, cmdlen))
288 * Obtain the data to be sent to the device (if any).
291 if(copy_from_user(buf, cmd_in + cmdlen, inlen))
295 case SEND_DIAGNOSTIC:
297 timeout = FORMAT_UNIT_TIMEOUT;
301 timeout = START_STOP_TIMEOUT;
302 retries = NORMAL_RETRIES;
305 timeout = MOVE_MEDIUM_TIMEOUT;
306 retries = NORMAL_RETRIES;
308 case READ_ELEMENT_STATUS:
309 timeout = READ_ELEMENT_STATUS_TIMEOUT;
310 retries = NORMAL_RETRIES;
312 case READ_DEFECT_DATA:
313 timeout = READ_DEFECT_DATA_TIMEOUT;
317 timeout = IOCTL_NORMAL_TIMEOUT;
318 retries = NORMAL_RETRIES;
322 sreq = scsi_allocate_request(sdev, GFP_KERNEL);
328 sreq->sr_data_direction = data_direction;
329 scsi_wait_req(sreq, cmd, buf, needed, timeout, retries);
332 * If there was an error condition, pass the info back to the user.
334 result = sreq->sr_result;
336 int sb_len = sizeof(sreq->sr_sense_buffer);
338 sb_len = (sb_len > OMAX_SB_LEN) ? OMAX_SB_LEN : sb_len;
339 if (copy_to_user(cmd_in, sreq->sr_sense_buffer, sb_len))
342 if (copy_to_user(cmd_in, buf, outlen))
346 scsi_release_request(sreq);
353 * The scsi_ioctl_get_pci() function places into arg the value
354 * pci_dev::slot_name (8 characters) for the PCI device (if any).
355 * Returns: 0 on success
356 * -ENXIO if there isn't a PCI device pointer
357 * (could be because the SCSI driver hasn't been
358 * updated yet, or because it isn't a SCSI
360 * any copy_to_user() error on failure there
362 static int scsi_ioctl_get_pci(struct scsi_device *sdev, void __user *arg)
364 struct device *dev = scsi_get_device(sdev->host);
368 return copy_to_user(arg, dev->bus_id, sizeof(dev->bus_id))? -EFAULT: 0;
373 * the scsi_ioctl() function differs from most ioctls in that it does
374 * not take a major/minor number as the dev field. Rather, it takes
375 * a pointer to a scsi_devices[] element, a structure.
377 int scsi_ioctl(struct scsi_device *sdev, int cmd, void __user *arg)
379 char scsi_cmd[MAX_COMMAND_SIZE];
381 /* No idea how this happens.... */
386 * If we are in the middle of error recovery, don't let anyone
387 * else try and use this device. Also, if error recovery fails, it
388 * may try and take the device offline, in which case all further
389 * access to the device is prohibited.
391 if (!scsi_block_when_processing_errors(sdev))
394 /* Check for deprecated ioctls ... all the ioctls which don't
395 * follow the new unique numbering scheme are deprecated */
397 case SCSI_IOCTL_SEND_COMMAND:
398 case SCSI_IOCTL_TEST_UNIT_READY:
399 case SCSI_IOCTL_BENCHMARK_COMMAND:
400 case SCSI_IOCTL_SYNC:
401 case SCSI_IOCTL_START_UNIT:
402 case SCSI_IOCTL_STOP_UNIT:
403 printk(KERN_WARNING "program %s is using a deprecated SCSI ioctl, please convert it to SG_IO\n", current->comm);
410 case SCSI_IOCTL_GET_IDLUN:
411 if (verify_area(VERIFY_WRITE, arg, sizeof(struct scsi_idlun)))
414 __put_user((sdev->id & 0xff)
415 + ((sdev->lun & 0xff) << 8)
416 + ((sdev->channel & 0xff) << 16)
417 + ((sdev->host->host_no & 0xff) << 24),
418 &((struct scsi_idlun __user *)arg)->dev_id);
419 __put_user(sdev->host->unique_id,
420 &((struct scsi_idlun __user *)arg)->host_unique_id);
422 case SCSI_IOCTL_GET_BUS_NUMBER:
423 return put_user(sdev->host->host_no, (int __user *)arg);
424 case SCSI_IOCTL_PROBE_HOST:
425 return ioctl_probe(sdev->host, arg);
426 case SCSI_IOCTL_SEND_COMMAND:
427 if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
429 return scsi_ioctl_send_command(sdev, arg);
430 case SCSI_IOCTL_DOORLOCK:
431 return scsi_set_medium_removal(sdev, SCSI_REMOVAL_PREVENT);
432 case SCSI_IOCTL_DOORUNLOCK:
433 return scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW);
434 case SCSI_IOCTL_TEST_UNIT_READY:
435 return scsi_test_unit_ready(sdev, IOCTL_NORMAL_TIMEOUT,
437 case SCSI_IOCTL_START_UNIT:
438 scsi_cmd[0] = START_STOP;
440 scsi_cmd[2] = scsi_cmd[3] = scsi_cmd[5] = 0;
442 return ioctl_internal_command(sdev, scsi_cmd,
443 START_STOP_TIMEOUT, NORMAL_RETRIES);
444 case SCSI_IOCTL_STOP_UNIT:
445 scsi_cmd[0] = START_STOP;
447 scsi_cmd[2] = scsi_cmd[3] = scsi_cmd[5] = 0;
449 return ioctl_internal_command(sdev, scsi_cmd,
450 START_STOP_TIMEOUT, NORMAL_RETRIES);
451 case SCSI_IOCTL_GET_PCI:
452 return scsi_ioctl_get_pci(sdev, arg);
454 if (sdev->host->hostt->ioctl)
455 return sdev->host->hostt->ioctl(sdev, cmd, arg);