drivers/scsi/sg.c

   1 /*
   2  *  History:
   3  *  Started: Aug 9 by Lawrence Foard (entropy@world.std.com),
   4  *           to allow user process control of SCSI devices.
   5  *  Development Sponsored by Killy Corp. NY NY
   6  *
   7  * Original driver (sg.c):
   8  *        Copyright (C) 1992 Lawrence Foard
   9  * Version 2 and 3 extensions to driver:
  10  *        Copyright (C) 1998 - 2002 Douglas Gilbert
  11  *
  12  *  Modified  19-JAN-1998  Richard Gooch <rgooch@atnf.csiro.au>  Devfs support
  13  *
  14  * This program is free software; you can redistribute it and/or modify
  15  * it under the terms of the GNU General Public License as published by
  16  * the Free Software Foundation; either version 2, or (at your option)
  17  * any later version.
  18  *
  19  */
  20 #include <linux/config.h>
  21 static int sg_version_num = 30530;      /* 2 digits for each component */
  22 /*
  23  *  D. P. Gilbert (dgilbert@interlog.com, dougg@triode.net.au), notes:
  24  *      - scsi logging is available via SCSI_LOG_TIMEOUT macros. First
  25  *        the kernel/module needs to be built with CONFIG_SCSI_LOGGING
  26  *        (otherwise the macros compile to empty statements).
  27  *        Then before running the program to be debugged enter:
  28  *          # echo "scsi log timeout 7" > /proc/scsi/scsi
  29  *        This will send copious output to the console and the log which
  30  *        is usually /var/log/messages. To turn off debugging enter:
  31  *          # echo "scsi log timeout 0" > /proc/scsi/scsi
  32  *        The 'timeout' token was chosen because it is relatively unused.
  33  *        The token 'hlcomplete' should be used but that triggers too
  34  *        much output from the sd device driver. To dump the current
  35  *        state of the SCSI mid level data structures enter:
  36  *          # echo "scsi dump 1" > /proc/scsi/scsi
  37  *        To dump the state of sg's data structures use:
  38  *          # cat /proc/scsi/sg/debug
  39  *
  40  */
  41 #include <linux/module.h>
  42
  43 #include <linux/fs.h>
  44 #include <linux/kernel.h>
  45 #include <linux/sched.h>
  46 #include <linux/string.h>
  47 #include <linux/mm.h>
  48 #include <linux/errno.h>
  49 #include <linux/mtio.h>
  50 #include <linux/ioctl.h>
  51 #include <linux/fcntl.h>
  52 #include <linux/init.h>
  53 #include <linux/poll.h>
  54 #include <linux/vmalloc.h>
  55 #include <linux/smp_lock.h>
  56 #include <linux/moduleparam.h>
  57 #include <linux/devfs_fs_kernel.h>
  58 #include <linux/cdev.h>
  59 #include <linux/seq_file.h>
  60
  61 #include <linux/blkdev.h>
  62 #include "scsi.h"
  63 #include "hosts.h"
  64 #include <scsi/scsi_driver.h>
  65 #include <scsi/scsi_ioctl.h>
  66 #include <scsi/sg.h>
  67
  68 #include "scsi_logging.h"
  69
  70 #ifdef CONFIG_SCSI_PROC_FS
  71 #include <linux/proc_fs.h>
  72 static char *sg_version_str = "3.5.30 [20040124]";
  73
  74 static int sg_proc_init(void);
  75 static void sg_proc_cleanup(void);
  76 #endif
  77
  78 #ifndef LINUX_VERSION_CODE
  79 #include <linux/version.h>
  80 #endif                          /* LINUX_VERSION_CODE */
  81
  82 #define SG_ALLOW_DIO_DEF 0
  83 #define SG_ALLOW_DIO_CODE /* compile out by commenting this define */
  84
  85 #define SG_MAX_DEVS 8192
  86
  87 /*
  88  * Suppose you want to calculate the formula muldiv(x,m,d)=int(x * m / d)
  89  * Then when using 32 bit integers x * m may overflow during the calculation.
  90  * Replacing muldiv(x) by muldiv(x)=((x % d) * m) / d + int(x / d) * m
  91  * calculates the same, but prevents the overflow when both m and d
  92  * are "small" numbers (like HZ and USER_HZ).
  93  * Of course an overflow is inavoidable if the result of muldiv doesn't fit
  94  * in 32 bits.
  95  */
  96 #define MULDIV(X,MUL,DIV) ((((X % DIV) * MUL) / DIV) + ((X / DIV) * MUL))
  97
  98 #define SG_DEFAULT_TIMEOUT MULDIV(SG_DEFAULT_TIMEOUT_USER, HZ, USER_HZ)
  99
 100 int sg_big_buff = SG_DEF_RESERVED_SIZE;
 101 /* N.B. This variable is readable and writeable via
 102    /proc/scsi/sg/def_reserved_size . Each time sg_open() is called a buffer
 103    of this size (or less if there is not enough memory) will be reserved
 104    for use by this file descriptor. [Deprecated usage: this variable is also
 105    readable via /proc/sys/kernel/sg-big-buff if the sg driver is built into
 106    the kernel (i.e. it is not a module).] */
 107 static int def_reserved_size = -1;      /* picks up init parameter */
 108 static int sg_allow_dio = SG_ALLOW_DIO_DEF;
 109
 110 #define SG_SECTOR_SZ 512
 111 #define SG_SECTOR_MSK (SG_SECTOR_SZ - 1)
 112
 113 #define SG_DEV_ARR_LUMP 6       /* amount to over allocate sg_dev_arr by */
 114
 115 static int sg_add(struct class_device *);
 116 static void sg_remove(struct class_device *);
 117
 118 static Scsi_Request *dummy_cmdp;        /* only used for sizeof */
 119
 120 static rwlock_t sg_dev_arr_lock = RW_LOCK_UNLOCKED;     /* Also used to lock
 121                                                            file descriptor list for device */
 122
 123 static struct class_interface sg_interface = {
 124         .add            = sg_add,
 125         .remove         = sg_remove,
 126 };
 127
 128 typedef struct sg_scatter_hold { /* holding area for scsi scatter gather info */
 129         unsigned short k_use_sg; /* Count of kernel scatter-gather pieces */
 130         unsigned short sglist_len; /* size of malloc'd scatter-gather list ++ */
 131         unsigned bufflen;       /* Size of (aggregate) data buffer */
 132         unsigned b_malloc_len;  /* actual len malloc'ed in buffer */
 133         void *buffer;           /* Data buffer or scatter list (k_use_sg>0) */
 134         char dio_in_use;        /* 0->indirect IO (or mmap), 1->dio */
 135         unsigned char cmd_opcode; /* first byte of command */
 136 } Sg_scatter_hold;
 137
 138 struct sg_device;               /* forward declarations */
 139 struct sg_fd;
 140
 141 typedef struct sg_request {     /* SG_MAX_QUEUE requests outstanding per file */
 142         Scsi_Request *my_cmdp;  /* != 0  when request with lower levels */
 143         struct sg_request *nextrp;      /* NULL -> tail request (slist) */
 144         struct sg_fd *parentfp; /* NULL -> not in use */
 145         Sg_scatter_hold data;   /* hold buffer, perhaps scatter list */
 146         sg_io_hdr_t header;     /* scsi command+info, see <scsi/sg.h> */
 147         unsigned char sense_b[sizeof (dummy_cmdp->sr_sense_buffer)];
 148         char res_used;          /* 1 -> using reserve buffer, 0 -> not ... */
 149         char orphan;            /* 1 -> drop on sight, 0 -> normal */
 150         char sg_io_owned;       /* 1 -> packet belongs to SG_IO */
 151         volatile char done;     /* 0->before bh, 1->before read, 2->read */
 152 } Sg_request;
 153
 154 typedef struct sg_fd {          /* holds the state of a file descriptor */
 155         struct sg_fd *nextfp;   /* NULL when last opened fd on this device */
 156         struct sg_device *parentdp;     /* owning device */
 157         wait_queue_head_t read_wait;    /* queue read until command done */
 158         rwlock_t rq_list_lock;  /* protect access to list in req_arr */
 159         int timeout;            /* defaults to SG_DEFAULT_TIMEOUT      */
 160         int timeout_user;       /* defaults to SG_DEFAULT_TIMEOUT_USER */
 161         Sg_scatter_hold reserve;        /* buffer held for this file descriptor */
 162         unsigned save_scat_len; /* original length of trunc. scat. element */
 163         Sg_request *headrp;     /* head of request slist, NULL->empty */
 164         struct fasync_struct *async_qp; /* used by asynchronous notification */
 165         Sg_request req_arr[SG_MAX_QUEUE];       /* used as singly-linked list */
 166         char low_dma;           /* as in parent but possibly overridden to 1 */
 167         char force_packid;      /* 1 -> pack_id input to read(), 0 -> ignored */
 168         volatile char closed;   /* 1 -> fd closed but request(s) outstanding */
 169         char cmd_q;             /* 1 -> allow command queuing, 0 -> don't */
 170         char next_cmd_len;      /* 0 -> automatic (def), >0 -> use on next write() */
 171         char keep_orphan;       /* 0 -> drop orphan (def), 1 -> keep for read() */
 172         char mmap_called;       /* 0 -> mmap() never called on this fd */
 173 } Sg_fd;
 174
 175 typedef struct sg_device { /* holds the state of each scsi generic device */
 176         struct scsi_device *device;
 177         wait_queue_head_t o_excl_wait;  /* queue open() when O_EXCL in use */
 178         int sg_tablesize;       /* adapter's max scatter-gather table size */
 179         Sg_fd *headfp;          /* first open fd belonging to this device */
 180         volatile char detached; /* 0->attached, 1->detached pending removal */
 181         volatile char exclude;  /* opened for exclusive access */
 182         char sgdebug;           /* 0->off, 1->sense, 9->dump dev, 10-> all devs */
 183         struct gendisk *disk;
 184         struct cdev * cdev;     /* char_dev [sysfs: /sys/cdev/major/sg<n>] */
 185 } Sg_device;
 186
 187 static int sg_fasync(int fd, struct file *filp, int mode);
 188 static void sg_cmd_done(Scsi_Cmnd * SCpnt);     /* tasklet or soft irq callback */
 189 static int sg_start_req(Sg_request * srp);
 190 static void sg_finish_rem_req(Sg_request * srp);
 191 static int sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size);
 192 static int sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp,
 193                          int tablesize);
 194 static ssize_t sg_new_read(Sg_fd * sfp, char *buf, size_t count,
 195                            Sg_request * srp);
 196 static ssize_t sg_new_write(Sg_fd * sfp, const char *buf, size_t count,
 197                             int blocking, int read_only, Sg_request ** o_srp);
 198 static int sg_common_write(Sg_fd * sfp, Sg_request * srp,
 199                            unsigned char *cmnd, int timeout, int blocking);
 200 static int sg_u_iovec(sg_io_hdr_t * hp, int sg_num, int ind,
 201                       int wr_xf, int *countp, unsigned char **up);
 202 static int sg_write_xfer(Sg_request * srp);
 203 static int sg_read_xfer(Sg_request * srp);
 204 static int sg_read_oxfer(Sg_request * srp, char *outp, int num_read_xfer);
 205 static void sg_remove_scat(Sg_scatter_hold * schp);
 206 static void sg_build_reserve(Sg_fd * sfp, int req_size);
 207 static void sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size);
 208 static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp);
 209 static char *sg_page_malloc(int rqSz, int lowDma, int *retSzp);
 210 static void sg_page_free(char *buff, int size);
 211 static Sg_fd *sg_add_sfp(Sg_device * sdp, int dev);
 212 static int sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp);
 213 static void __sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp);
 214 static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id);
 215 static Sg_request *sg_add_request(Sg_fd * sfp);
 216 static int sg_remove_request(Sg_fd * sfp, Sg_request * srp);
 217 static int sg_res_in_use(Sg_fd * sfp);
 218 static int sg_ms_to_jif(unsigned int msecs);
 219 static inline unsigned sg_jif_to_ms(int jifs);
 220 static int sg_allow_access(unsigned char opcode, char dev_type);
 221 static int sg_build_direct(Sg_request * srp, Sg_fd * sfp, int dxfer_len);
 222 static Sg_device *sg_get_dev(int dev);
 223 static inline unsigned char *sg_scatg2virt(const struct scatterlist *sclp);
 224 #ifdef CONFIG_SCSI_PROC_FS
 225 static int sg_last_dev(void);
 226 #endif
 227
 228 static Sg_device **sg_dev_arr = NULL;
 229 static int sg_dev_max;
 230 static int sg_nr_dev;
 231
 232 #define SZ_SG_HEADER sizeof(struct sg_header)
 233 #define SZ_SG_IO_HDR sizeof(sg_io_hdr_t)
 234 #define SZ_SG_IOVEC sizeof(sg_iovec_t)
 235 #define SZ_SG_REQ_INFO sizeof(sg_req_info_t)
 236
 237 static int
 238 sg_open(struct inode *inode, struct file *filp)
 239 {
 240         int dev = iminor(inode);
 241         int flags = filp->f_flags;
 242         Sg_device *sdp;
 243         Sg_fd *sfp;
 244         int res;
 245         int retval;
 246
 247         SCSI_LOG_TIMEOUT(3, printk("sg_open: dev=%d, flags=0x%x\n", dev, flags));
 248         sdp = sg_get_dev(dev);
 249         if ((!sdp) || (!sdp->device))
 250                 return -ENXIO;
 251         if (sdp->detached)
 252                 return -ENODEV;
 253
 254         /* This driver's module count bumped by fops_get in <linux/fs.h> */
 255         /* Prevent the device driver from vanishing while we sleep */
 256         retval = scsi_device_get(sdp->device);
 257         if (retval)
 258                 return retval;
 259
 260         if (!((flags & O_NONBLOCK) ||
 261               scsi_block_when_processing_errors(sdp->device))) {
 262                 retval = -ENXIO;
 263                 /* we are in error recovery for this device */
 264                 goto error_out;
 265         }
 266
 267         if (flags & O_EXCL) {
 268                 if (O_RDONLY == (flags & O_ACCMODE)) {
 269                         retval = -EPERM; /* Can't lock it with read only access */
 270                         goto error_out;
 271                 }
 272                 if (sdp->headfp && (flags & O_NONBLOCK)) {
 273                         retval = -EBUSY;
 274                         goto error_out;
 275                 }
 276                 res = 0;
 277                 __wait_event_interruptible(sdp->o_excl_wait,
 278                         ((sdp->headfp || sdp->exclude) ? 0 : (sdp->exclude = 1)), res);
 279                 if (res) {
 280                         retval = res;   /* -ERESTARTSYS because signal hit process */
 281                         goto error_out;
 282                 }
 283         } else if (sdp->exclude) {      /* some other fd has an exclusive lock on dev */
 284                 if (flags & O_NONBLOCK) {
 285                         retval = -EBUSY;
 286                         goto error_out;
 287                 }
 288                 res = 0;
 289                 __wait_event_interruptible(sdp->o_excl_wait, (!sdp->exclude),
 290                                            res);
 291                 if (res) {
 292                         retval = res;   /* -ERESTARTSYS because signal hit process */
 293                         goto error_out;
 294                 }
 295         }
 296         if (sdp->detached) {
 297                 retval = -ENODEV;
 298                 goto error_out;
 299         }
 300         if (!sdp->headfp) {     /* no existing opens on this device */
 301                 sdp->sgdebug = 0;
 302                 sdp->sg_tablesize = sdp->device->host->sg_tablesize;
 303         }
 304         if ((sfp = sg_add_sfp(sdp, dev)))
 305                 filp->private_data = sfp;
 306         else {
 307                 if (flags & O_EXCL)
 308                         sdp->exclude = 0;       /* undo if error */
 309                 retval = -ENOMEM;
 310                 goto error_out;
 311         }
 312         return 0;
 313
 314       error_out:
 315         scsi_device_put(sdp->device);
 316         return retval;
 317 }
 318
 319 /* Following function was formerly called 'sg_close' */
 320 static int
 321 sg_release(struct inode *inode, struct file *filp)
 322 {
 323         Sg_device *sdp;
 324         Sg_fd *sfp;
 325
 326         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
 327                 return -ENXIO;
 328         SCSI_LOG_TIMEOUT(3, printk("sg_release: %s\n", sdp->disk->disk_name));
 329         sg_fasync(-1, filp, 0); /* remove filp from async notification list */
 330         if (0 == sg_remove_sfp(sdp, sfp)) {     /* Returns 1 when sdp gone */
 331                 if (!sdp->detached) {
 332                         scsi_device_put(sdp->device);
 333                 }
 334                 sdp->exclude = 0;
 335                 wake_up_interruptible(&sdp->o_excl_wait);
 336         }
 337         return 0;
 338 }
 339
 340 static ssize_t
 341 sg_read(struct file *filp, char *buf, size_t count, loff_t * ppos)
 342 {
 343         int k, res;
 344         Sg_device *sdp;
 345         Sg_fd *sfp;
 346         Sg_request *srp;
 347         int req_pack_id = -1;
 348         struct sg_header old_hdr;
 349         sg_io_hdr_t new_hdr;
 350         sg_io_hdr_t *hp;
 351
 352         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
 353                 return -ENXIO;
 354         SCSI_LOG_TIMEOUT(3, printk("sg_read: %s, count=%d\n",
 355                                    sdp->disk->disk_name, (int) count));
 356         if (ppos != &filp->f_pos) ;     /* FIXME: Hmm.  Seek to the right place, or fail?  */
 357         if ((k = verify_area(VERIFY_WRITE, buf, count)))
 358                 return k;
 359         if (sfp->force_packid && (count >= SZ_SG_HEADER)) {
 360                 if (__copy_from_user(&old_hdr, buf, SZ_SG_HEADER))
 361                         return -EFAULT;
 362                 if (old_hdr.reply_len < 0) {
 363                         if (count >= SZ_SG_IO_HDR) {
 364                                 if (__copy_from_user
 365                                     (&new_hdr, buf, SZ_SG_IO_HDR))
 366                                         return -EFAULT;
 367                                 req_pack_id = new_hdr.pack_id;
 368                         }
 369                 } else
 370                         req_pack_id = old_hdr.pack_id;
 371         }
 372         srp = sg_get_rq_mark(sfp, req_pack_id);
 373         if (!srp) {             /* now wait on packet to arrive */
 374                 if (sdp->detached)
 375                         return -ENODEV;
 376                 if (filp->f_flags & O_NONBLOCK)
 377                         return -EAGAIN;
 378                 while (1) {
 379                         res = 0;        /* following is a macro that beats race condition */
 380                         __wait_event_interruptible(sfp->read_wait,
 381                                 (sdp->detached || (srp = sg_get_rq_mark(sfp, req_pack_id))),
 382                                                    res);
 383                         if (sdp->detached)
 384                                 return -ENODEV;
 385                         if (0 == res)
 386                                 break;
 387                         return res;     /* -ERESTARTSYS because signal hit process */
 388                 }
 389         }
 390         if (srp->header.interface_id != '\0')
 391                 return sg_new_read(sfp, buf, count, srp);
 392
 393         hp = &srp->header;
 394         memset(&old_hdr, 0, SZ_SG_HEADER);
 395         old_hdr.reply_len = (int) hp->timeout;
 396         old_hdr.pack_len = old_hdr.reply_len; /* very old, strange behaviour */
 397         old_hdr.pack_id = hp->pack_id;
 398         old_hdr.twelve_byte =
 399             ((srp->data.cmd_opcode >= 0xc0) && (12 == hp->cmd_len)) ? 1 : 0;
 400         old_hdr.target_status = hp->masked_status;
 401         old_hdr.host_status = hp->host_status;
 402         old_hdr.driver_status = hp->driver_status;
 403         if ((CHECK_CONDITION & hp->masked_status) ||
 404             (DRIVER_SENSE & hp->driver_status))
 405                 memcpy(old_hdr.sense_buffer, srp->sense_b,
 406                        sizeof (old_hdr.sense_buffer));
 407         switch (hp->host_status) {
 408         /* This setup of 'result' is for backward compatibility and is best
 409            ignored by the user who should use target, host + driver status */
 410         case DID_OK:
 411         case DID_PASSTHROUGH:
 412         case DID_SOFT_ERROR:
 413                 old_hdr.result = 0;
 414                 break;
 415         case DID_NO_CONNECT:
 416         case DID_BUS_BUSY:
 417         case DID_TIME_OUT:
 418                 old_hdr.result = EBUSY;
 419                 break;
 420         case DID_BAD_TARGET:
 421         case DID_ABORT:
 422         case DID_PARITY:
 423         case DID_RESET:
 424         case DID_BAD_INTR:
 425                 old_hdr.result = EIO;
 426                 break;
 427         case DID_ERROR:
 428                 old_hdr.result = (srp->sense_b[0] == 0 &&
 429                                   hp->masked_status == GOOD) ? 0 : EIO;
 430                 break;
 431         default:
 432                 old_hdr.result = EIO;
 433                 break;
 434         }
 435
 436         /* Now copy the result back to the user buffer.  */
 437         if (count >= SZ_SG_HEADER) {
 438                 if (__copy_to_user(buf, &old_hdr, SZ_SG_HEADER))
 439                         return -EFAULT;
 440                 buf += SZ_SG_HEADER;
 441                 if (count > old_hdr.reply_len)
 442                         count = old_hdr.reply_len;
 443                 if (count > SZ_SG_HEADER) {
 444                         if ((res =
 445                              sg_read_oxfer(srp, buf, count - SZ_SG_HEADER)))
 446                                 return -EFAULT;
 447                 }
 448         } else
 449                 count = (old_hdr.result == 0) ? 0 : -EIO;
 450         sg_finish_rem_req(srp);
 451         return count;
 452 }
 453
 454 static ssize_t
 455 sg_new_read(Sg_fd * sfp, char *buf, size_t count, Sg_request * srp)
 456 {
 457         sg_io_hdr_t *hp = &srp->header;
 458         int err = 0;
 459         int len;
 460
 461         if (count < SZ_SG_IO_HDR) {
 462                 err = -EINVAL;
 463                 goto err_out;
 464         }
 465         hp->sb_len_wr = 0;
 466         if ((hp->mx_sb_len > 0) && hp->sbp) {
 467                 if ((CHECK_CONDITION & hp->masked_status) ||
 468                     (DRIVER_SENSE & hp->driver_status)) {
 469                         int sb_len = sizeof (dummy_cmdp->sr_sense_buffer);
 470                         sb_len = (hp->mx_sb_len > sb_len) ? sb_len : hp->mx_sb_len;
 471                         len = 8 + (int) srp->sense_b[7];        /* Additional sense length field */
 472                         len = (len > sb_len) ? sb_len : len;
 473                         if (copy_to_user(hp->sbp, srp->sense_b, len)) {
 474                                 err = -EFAULT;
 475                                 goto err_out;
 476                         }
 477                         hp->sb_len_wr = len;
 478                 }
 479         }
 480         if (hp->masked_status || hp->host_status || hp->driver_status)
 481                 hp->info |= SG_INFO_CHECK;
 482         if (copy_to_user(buf, hp, SZ_SG_IO_HDR)) {
 483                 err = -EFAULT;
 484                 goto err_out;
 485         }
 486         err = sg_read_xfer(srp);
 487       err_out:
 488         sg_finish_rem_req(srp);
 489         return (0 == err) ? count : err;
 490 }
 491
 492 static ssize_t
 493 sg_write(struct file *filp, const char *buf, size_t count, loff_t * ppos)
 494 {
 495         int mxsize, cmd_size, k;
 496         int input_size, blocking;
 497         unsigned char opcode;
 498         Sg_device *sdp;
 499         Sg_fd *sfp;
 500         Sg_request *srp;
 501         struct sg_header old_hdr;
 502         sg_io_hdr_t *hp;
 503         unsigned char cmnd[sizeof (dummy_cmdp->sr_cmnd)];
 504
 505         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
 506                 return -ENXIO;
 507         SCSI_LOG_TIMEOUT(3, printk("sg_write: %s, count=%d\n",
 508                                    sdp->disk->disk_name, (int) count));
 509         if (sdp->detached)
 510                 return -ENODEV;
 511         if (!((filp->f_flags & O_NONBLOCK) ||
 512               scsi_block_when_processing_errors(sdp->device)))
 513                 return -ENXIO;
 514         if (ppos != &filp->f_pos) ;     /* FIXME: Hmm.  Seek to the right place, or fail?  */
 515
 516         if ((k = verify_area(VERIFY_READ, buf, count)))
 517                 return k;       /* protects following copy_from_user()s + get_user()s */
 518         if (count < SZ_SG_HEADER)
 519                 return -EIO;
 520         if (__copy_from_user(&old_hdr, buf, SZ_SG_HEADER))
 521                 return -EFAULT;
 522         blocking = !(filp->f_flags & O_NONBLOCK);
 523         if (old_hdr.reply_len < 0)
 524                 return sg_new_write(sfp, buf, count, blocking, 0, NULL);
 525         if (count < (SZ_SG_HEADER + 6))
 526                 return -EIO;    /* The minimum scsi command length is 6 bytes. */
 527
 528         if (!(srp = sg_add_request(sfp))) {
 529                 SCSI_LOG_TIMEOUT(1, printk("sg_write: queue full\n"));
 530                 return -EDOM;
 531         }
 532         buf += SZ_SG_HEADER;
 533         __get_user(opcode, buf);
 534         if (sfp->next_cmd_len > 0) {
 535                 if (sfp->next_cmd_len > MAX_COMMAND_SIZE) {
 536                         SCSI_LOG_TIMEOUT(1, printk("sg_write: command length too long\n"));
 537                         sfp->next_cmd_len = 0;
 538                         sg_remove_request(sfp, srp);
 539                         return -EIO;
 540                 }
 541                 cmd_size = sfp->next_cmd_len;
 542                 sfp->next_cmd_len = 0;  /* reset so only this write() effected */
 543         } else {
 544                 cmd_size = COMMAND_SIZE(opcode);        /* based on SCSI command group */
 545                 if ((opcode >= 0xc0) && old_hdr.twelve_byte)
 546                         cmd_size = 12;
 547         }
 548         SCSI_LOG_TIMEOUT(4, printk(
 549                 "sg_write:   scsi opcode=0x%02x, cmd_size=%d\n", (int) opcode, cmd_size));
 550 /* Determine buffer size.  */
 551         input_size = count - cmd_size;
 552         mxsize = (input_size > old_hdr.reply_len) ? input_size : old_hdr.reply_len;
 553         mxsize -= SZ_SG_HEADER;
 554         input_size -= SZ_SG_HEADER;
 555         if (input_size < 0) {
 556                 sg_remove_request(sfp, srp);
 557                 return -EIO;    /* User did not pass enough bytes for this command. */
 558         }
 559         hp = &srp->header;
 560         hp->interface_id = '\0';        /* indicator of old interface tunnelled */
 561         hp->cmd_len = (unsigned char) cmd_size;
 562         hp->iovec_count = 0;
 563         hp->mx_sb_len = 0;
 564         if (input_size > 0)
 565                 hp->dxfer_direction = (old_hdr.reply_len > SZ_SG_HEADER) ?
 566                     SG_DXFER_TO_FROM_DEV : SG_DXFER_TO_DEV;
 567         else
 568                 hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE;
 569         hp->dxfer_len = mxsize;
 570         hp->dxferp = (unsigned char *) buf + cmd_size;
 571         hp->sbp = NULL;
 572         hp->timeout = old_hdr.reply_len;        /* structure abuse ... */
 573         hp->flags = input_size; /* structure abuse ... */
 574         hp->pack_id = old_hdr.pack_id;
 575         hp->usr_ptr = NULL;
 576         if (__copy_from_user(cmnd, buf, cmd_size))
 577                 return -EFAULT;
 578         k = sg_common_write(sfp, srp, cmnd, sfp->timeout, blocking);
 579         return (k < 0) ? k : count;
 580 }
 581
 582 static ssize_t
 583 sg_new_write(Sg_fd * sfp, const char *buf, size_t count,
 584              int blocking, int read_only, Sg_request ** o_srp)
 585 {
 586         int k;
 587         Sg_request *srp;
 588         sg_io_hdr_t *hp;
 589         unsigned char cmnd[sizeof (dummy_cmdp->sr_cmnd)];
 590         int timeout;
 591
 592         if (count < SZ_SG_IO_HDR)
 593                 return -EINVAL;
 594         if ((k = verify_area(VERIFY_READ, buf, count)))
 595                 return k; /* protects following copy_from_user()s + get_user()s */
 596
 597         sfp->cmd_q = 1; /* when sg_io_hdr seen, set command queuing on */
 598         if (!(srp = sg_add_request(sfp))) {
 599                 SCSI_LOG_TIMEOUT(1, printk("sg_new_write: queue full\n"));
 600                 return -EDOM;
 601         }
 602         hp = &srp->header;
 603         if (__copy_from_user(hp, buf, SZ_SG_IO_HDR)) {
 604                 sg_remove_request(sfp, srp);
 605                 return -EFAULT;
 606         }
 607         if (hp->interface_id != 'S') {
 608                 sg_remove_request(sfp, srp);
 609                 return -ENOSYS;
 610         }
 611         if (hp->flags & SG_FLAG_MMAP_IO) {
 612                 if (hp->dxfer_len > sfp->reserve.bufflen) {
 613                         sg_remove_request(sfp, srp);
 614                         return -ENOMEM; /* MMAP_IO size must fit in reserve buffer */
 615                 }
 616                 if (hp->flags & SG_FLAG_DIRECT_IO) {
 617                         sg_remove_request(sfp, srp);
 618                         return -EINVAL; /* either MMAP_IO or DIRECT_IO (not both) */
 619                 }
 620                 if (sg_res_in_use(sfp)) {
 621                         sg_remove_request(sfp, srp);
 622                         return -EBUSY;  /* reserve buffer already being used */
 623                 }
 624         }
 625         timeout = sg_ms_to_jif(srp->header.timeout);
 626         if ((!hp->cmdp) || (hp->cmd_len < 6) || (hp->cmd_len > sizeof (cmnd))) {
 627                 sg_remove_request(sfp, srp);
 628                 return -EMSGSIZE;
 629         }
 630         if ((k = verify_area(VERIFY_READ, hp->cmdp, hp->cmd_len))) {
 631                 sg_remove_request(sfp, srp);
 632                 return k;       /* protects following copy_from_user()s + get_user()s */
 633         }
 634         if (__copy_from_user(cmnd, hp->cmdp, hp->cmd_len)) {
 635                 sg_remove_request(sfp, srp);
 636                 return -EFAULT;
 637         }
 638         if (read_only &&
 639             (!sg_allow_access(cmnd[0], sfp->parentdp->device->type))) {
 640                 sg_remove_request(sfp, srp);
 641                 return -EPERM;
 642         }
 643         k = sg_common_write(sfp, srp, cmnd, timeout, blocking);
 644         if (k < 0)
 645                 return k;
 646         if (o_srp)
 647                 *o_srp = srp;
 648         return count;
 649 }
 650
 651 static int
 652 sg_common_write(Sg_fd * sfp, Sg_request * srp,
 653                 unsigned char *cmnd, int timeout, int blocking)
 654 {
 655         int k;
 656         Scsi_Request *SRpnt;
 657         Sg_device *sdp = sfp->parentdp;
 658         sg_io_hdr_t *hp = &srp->header;
 659         request_queue_t *q;
 660
 661         srp->data.cmd_opcode = cmnd[0]; /* hold opcode of command */
 662         hp->status = 0;
 663         hp->masked_status = 0;
 664         hp->msg_status = 0;
 665         hp->info = 0;
 666         hp->host_status = 0;
 667         hp->driver_status = 0;
 668         hp->resid = 0;
 669         SCSI_LOG_TIMEOUT(4, printk("sg_common_write:  scsi opcode=0x%02x, cmd_size=%d\n",
 670                           (int) cmnd[0], (int) hp->cmd_len));
 671
 672         if ((k = sg_start_req(srp))) {
 673                 SCSI_LOG_TIMEOUT(1, printk("sg_write: start_req err=%d\n", k));
 674                 sg_finish_rem_req(srp);
 675                 return k;       /* probably out of space --> ENOMEM */
 676         }
 677         if ((k = sg_write_xfer(srp))) {
 678                 SCSI_LOG_TIMEOUT(1, printk("sg_write: write_xfer, bad address\n"));
 679                 sg_finish_rem_req(srp);
 680                 return k;
 681         }
 682         if (sdp->detached) {
 683                 sg_finish_rem_req(srp);
 684                 return -ENODEV;
 685         }
 686         SRpnt = scsi_allocate_request(sdp->device, GFP_ATOMIC);
 687         if (SRpnt == NULL) {
 688                 SCSI_LOG_TIMEOUT(1, printk("sg_write: no mem\n"));
 689                 sg_finish_rem_req(srp);
 690                 return -ENOMEM;
 691         }
 692
 693         srp->my_cmdp = SRpnt;
 694         q = SRpnt->sr_device->request_queue;
 695         SRpnt->sr_request->rq_disk = sdp->disk;
 696         SRpnt->sr_sense_buffer[0] = 0;
 697         SRpnt->sr_cmd_len = hp->cmd_len;
 698         SRpnt->sr_use_sg = srp->data.k_use_sg;
 699         SRpnt->sr_sglist_len = srp->data.sglist_len;
 700         SRpnt->sr_bufflen = srp->data.bufflen;
 701         SRpnt->sr_underflow = 0;
 702         SRpnt->sr_buffer = srp->data.buffer;
 703         switch (hp->dxfer_direction) {
 704         case SG_DXFER_TO_FROM_DEV:
 705         case SG_DXFER_FROM_DEV:
 706                 SRpnt->sr_data_direction = SCSI_DATA_READ;
 707                 break;
 708         case SG_DXFER_TO_DEV:
 709                 SRpnt->sr_data_direction = SCSI_DATA_WRITE;
 710                 break;
 711         case SG_DXFER_UNKNOWN:
 712                 SRpnt->sr_data_direction = SCSI_DATA_UNKNOWN;
 713                 break;
 714         default:
 715                 SRpnt->sr_data_direction = SCSI_DATA_NONE;
 716                 break;
 717         }
 718         SRpnt->upper_private_data = srp;
 719         srp->data.k_use_sg = 0;
 720         srp->data.sglist_len = 0;
 721         srp->data.bufflen = 0;
 722         srp->data.buffer = NULL;
 723         hp->duration = jiffies; /* unit jiffies now, millisecs after done */
 724 /* Now send everything of to mid-level. The next time we hear about this
 725    packet is when sg_cmd_done() is called (i.e. a callback). */
 726         scsi_do_req(SRpnt, (void *) cmnd,
 727                     (void *) SRpnt->sr_buffer, hp->dxfer_len,
 728                     sg_cmd_done, timeout, SG_DEFAULT_RETRIES);
 729         /* dxfer_len overwrites SRpnt->sr_bufflen, hence need for b_malloc_len */
 730         generic_unplug_device(q);
 731         return 0;
 732 }
 733
 734 static int
 735 sg_ioctl(struct inode *inode, struct file *filp,
 736          unsigned int cmd_in, unsigned long arg)
 737 {
 738         int result, val, read_only;
 739         Sg_device *sdp;
 740         Sg_fd *sfp;
 741         Sg_request *srp;
 742         unsigned long iflags;
 743
 744         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
 745                 return -ENXIO;
 746         SCSI_LOG_TIMEOUT(3, printk("sg_ioctl: %s, cmd=0x%x\n",
 747                                    sdp->disk->disk_name, (int) cmd_in));
 748         read_only = (O_RDWR != (filp->f_flags & O_ACCMODE));
 749
 750         switch (cmd_in) {
 751         case SG_IO:
 752                 {
 753                         int blocking = 1;       /* ignore O_NONBLOCK flag */
 754
 755                         if (sdp->detached)
 756                                 return -ENODEV;
 757                         if (!scsi_block_when_processing_errors(sdp->device))
 758                                 return -ENXIO;
 759                         result = verify_area(VERIFY_WRITE, (void *) arg,
 760                                         SZ_SG_IO_HDR);
 761                         if (result)
 762                                 return result;
 763                         result =
 764                             sg_new_write(sfp, (const char *) arg, SZ_SG_IO_HDR,
 765                                          blocking, read_only, &srp);
 766                         if (result < 0)
 767                                 return result;
 768                         srp->sg_io_owned = 1;
 769                         while (1) {
 770                                 result = 0;     /* following macro to beat race condition */
 771                                 __wait_event_interruptible(sfp->read_wait,
 772                                         (sdp->detached || sfp->closed || srp->done),
 773                                                            result);
 774                                 if (sdp->detached)
 775                                         return -ENODEV;
 776                                 if (sfp->closed)
 777                                         return 0;       /* request packet dropped already */
 778                                 if (0 == result)
 779                                         break;
 780                                 srp->orphan = 1;
 781                                 return result;  /* -ERESTARTSYS because signal hit process */
 782                         }
 783                         srp->done = 2;
 784                         result = sg_new_read(sfp, (char *) arg, SZ_SG_IO_HDR, srp);
 785                         return (result < 0) ? result : 0;
 786                 }
 787         case SG_SET_TIMEOUT:
 788                 result = get_user(val, (int *) arg);
 789                 if (result)
 790                         return result;
 791                 if (val < 0)
 792                         return -EIO;
 793                 if (val >= MULDIV (INT_MAX, USER_HZ, HZ))
 794                     val = MULDIV (INT_MAX, USER_HZ, HZ);
 795                 sfp->timeout_user = val;
 796                 sfp->timeout = MULDIV (val, HZ, USER_HZ);
 797
 798                 return 0;
 799         case SG_GET_TIMEOUT:    /* N.B. User receives timeout as return value */
 800                                 /* strange ..., for backward compatibility */
 801                 return sfp->timeout_user;
 802         case SG_SET_FORCE_LOW_DMA:
 803                 result = get_user(val, (int *) arg);
 804                 if (result)
 805                         return result;
 806                 if (val) {
 807                         sfp->low_dma = 1;
 808                         if ((0 == sfp->low_dma) && (0 == sg_res_in_use(sfp))) {
 809                                 val = (int) sfp->reserve.bufflen;
 810                                 sg_remove_scat(&sfp->reserve);
 811                                 sg_build_reserve(sfp, val);
 812                         }
 813                 } else {
 814                         if (sdp->detached)
 815                                 return -ENODEV;
 816                         sfp->low_dma = sdp->device->host->unchecked_isa_dma;
 817                 }
 818                 return 0;
 819         case SG_GET_LOW_DMA:
 820                 return put_user((int) sfp->low_dma, (int *) arg);
 821         case SG_GET_SCSI_ID:
 822                 result =
 823                     verify_area(VERIFY_WRITE, (void *) arg,
 824                                 sizeof (sg_scsi_id_t));
 825                 if (result)
 826                         return result;
 827                 else {
 828                         sg_scsi_id_t *sg_idp = (sg_scsi_id_t *) arg;
 829
 830                         if (sdp->detached)
 831                                 return -ENODEV;
 832                         __put_user((int) sdp->device->host->host_no,
 833                                    &sg_idp->host_no);
 834                         __put_user((int) sdp->device->channel,
 835                                    &sg_idp->channel);
 836                         __put_user((int) sdp->device->id, &sg_idp->scsi_id);
 837                         __put_user((int) sdp->device->lun, &sg_idp->lun);
 838                         __put_user((int) sdp->device->type, &sg_idp->scsi_type);
 839                         __put_user((short) sdp->device->host->cmd_per_lun,
 840                                    &sg_idp->h_cmd_per_lun);
 841                         __put_user((short) sdp->device->queue_depth,
 842                                    &sg_idp->d_queue_depth);
 843                         __put_user(0, &sg_idp->unused[0]);
 844                         __put_user(0, &sg_idp->unused[1]);
 845                         return 0;
 846                 }
 847         case SG_SET_FORCE_PACK_ID:
 848                 result = get_user(val, (int *) arg);
 849                 if (result)
 850                         return result;
 851                 sfp->force_packid = val ? 1 : 0;
 852                 return 0;
 853         case SG_GET_PACK_ID:
 854                 result = verify_area(VERIFY_WRITE, (void *) arg, sizeof (int));
 855                 if (result)
 856                         return result;
 857                 read_lock_irqsave(&sfp->rq_list_lock, iflags);
 858                 for (srp = sfp->headrp; srp; srp = srp->nextrp) {
 859                         if ((1 == srp->done) && (!srp->sg_io_owned)) {
 860                                 read_unlock_irqrestore(&sfp->rq_list_lock,
 861                                                        iflags);
 862                                 __put_user(srp->header.pack_id, (int *) arg);
 863                                 return 0;
 864                         }
 865                 }
 866                 read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
 867                 __put_user(-1, (int *) arg);
 868                 return 0;
 869         case SG_GET_NUM_WAITING:
 870                 read_lock_irqsave(&sfp->rq_list_lock, iflags);
 871                 for (val = 0, srp = sfp->headrp; srp; srp = srp->nextrp) {
 872                         if ((1 == srp->done) && (!srp->sg_io_owned))
 873                                 ++val;
 874                 }
 875                 read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
 876                 return put_user(val, (int *) arg);
 877         case SG_GET_SG_TABLESIZE:
 878                 return put_user(sdp->sg_tablesize, (int *) arg);
 879         case SG_SET_RESERVED_SIZE:
 880                 result = get_user(val, (int *) arg);
 881                 if (result)
 882                         return result;
 883                 if (val < 0)
 884                         return -EINVAL;
 885                 if (val != sfp->reserve.bufflen) {
 886                         if (sg_res_in_use(sfp) || sfp->mmap_called)
 887                                 return -EBUSY;
 888                         sg_remove_scat(&sfp->reserve);
 889                         sg_build_reserve(sfp, val);
 890                 }
 891                 return 0;
 892         case SG_GET_RESERVED_SIZE:
 893                 val = (int) sfp->reserve.bufflen;
 894                 return put_user(val, (int *) arg);
 895         case SG_SET_COMMAND_Q:
 896                 result = get_user(val, (int *) arg);
 897                 if (result)
 898                         return result;
 899                 sfp->cmd_q = val ? 1 : 0;
 900                 return 0;
 901         case SG_GET_COMMAND_Q:
 902                 return put_user((int) sfp->cmd_q, (int *) arg);
 903         case SG_SET_KEEP_ORPHAN:
 904                 result = get_user(val, (int *) arg);
 905                 if (result)
 906                         return result;
 907                 sfp->keep_orphan = val;
 908                 return 0;
 909         case SG_GET_KEEP_ORPHAN:
 910                 return put_user((int) sfp->keep_orphan, (int *) arg);
 911         case SG_NEXT_CMD_LEN:
 912                 result = get_user(val, (int *) arg);
 913                 if (result)
 914                         return result;
 915                 sfp->next_cmd_len = (val > 0) ? val : 0;
 916                 return 0;
 917         case SG_GET_VERSION_NUM:
 918                 return put_user(sg_version_num, (int *) arg);
 919         case SG_GET_ACCESS_COUNT:
 920                 /* faked - we don't have a real access count anymore */
 921                 val = (sdp->device ? 1 : 0);
 922                 return put_user(val, (int *) arg);
 923         case SG_GET_REQUEST_TABLE:
 924                 result = verify_area(VERIFY_WRITE, (void *) arg,
 925                                      SZ_SG_REQ_INFO * SG_MAX_QUEUE);
 926                 if (result)
 927                         return result;
 928                 else {
 929                         sg_req_info_t rinfo[SG_MAX_QUEUE];
 930                         Sg_request *srp;
 931                         read_lock_irqsave(&sfp->rq_list_lock, iflags);
 932                         for (srp = sfp->headrp, val = 0; val < SG_MAX_QUEUE;
 933                              ++val, srp = srp ? srp->nextrp : srp) {
 934                                 memset(&rinfo[val], 0, SZ_SG_REQ_INFO);
 935                                 if (srp) {
 936                                         rinfo[val].req_state = srp->done + 1;
 937                                         rinfo[val].problem =
 938                                             srp->header.masked_status &
 939                                             srp->header.host_status &
 940                                             srp->header.driver_status;
 941                                         rinfo[val].duration =
 942                                             srp->done ? srp->header.duration :
 943                                             sg_jif_to_ms(
 944                                                 jiffies - srp->header.duration);
 945                                         rinfo[val].orphan = srp->orphan;
 946                                         rinfo[val].sg_io_owned = srp->sg_io_owned;
 947                                         rinfo[val].pack_id = srp->header.pack_id;
 948                                         rinfo[val].usr_ptr = srp->header.usr_ptr;
 949                                 }
 950                         }
 951                         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
 952                         return (__copy_to_user((void *) arg, rinfo,
 953                                 SZ_SG_REQ_INFO * SG_MAX_QUEUE) ? -EFAULT : 0);
 954                 }
 955         case SG_EMULATED_HOST:
 956                 if (sdp->detached)
 957                         return -ENODEV;
 958                 return put_user(sdp->device->host->hostt->emulated, (int *) arg);
 959         case SG_SCSI_RESET:
 960                 if (sdp->detached)
 961                         return -ENODEV;
 962                 if (filp->f_flags & O_NONBLOCK) {
 963                         if (test_bit(SHOST_RECOVERY,
 964                                      &sdp->device->host->shost_state))
 965                                 return -EBUSY;
 966                 } else if (!scsi_block_when_processing_errors(sdp->device))
 967                         return -EBUSY;
 968                 result = get_user(val, (int *) arg);
 969                 if (result)
 970                         return result;
 971                 if (SG_SCSI_RESET_NOTHING == val)
 972                         return 0;
 973                 switch (val) {
 974                 case SG_SCSI_RESET_DEVICE:
 975                         val = SCSI_TRY_RESET_DEVICE;
 976                         break;
 977                 case SG_SCSI_RESET_BUS:
 978                         val = SCSI_TRY_RESET_BUS;
 979                         break;
 980                 case SG_SCSI_RESET_HOST:
 981                         val = SCSI_TRY_RESET_HOST;
 982                         break;
 983                 default:
 984                         return -EINVAL;
 985                 }
 986                 if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
 987                         return -EACCES;
 988                 return (scsi_reset_provider(sdp->device, val) ==
 989                         SUCCESS) ? 0 : -EIO;
 990         case SCSI_IOCTL_SEND_COMMAND:
 991                 if (sdp->detached)
 992                         return -ENODEV;
 993                 if (read_only) {
 994                         unsigned char opcode = WRITE_6;
 995                         Scsi_Ioctl_Command *siocp = (void *) arg;
 996
 997                         if (copy_from_user(&opcode, siocp->data, 1))
 998                                 return -EFAULT;
 999                         if (!sg_allow_access(opcode, sdp->device->type))
1000                                 return -EPERM;
1001                 }
1002                 return scsi_ioctl_send_command(sdp->device, (void *) arg);
1003         case SG_SET_DEBUG:
1004                 result = get_user(val, (int *) arg);
1005                 if (result)
1006                         return result;
1007                 sdp->sgdebug = (char) val;
1008                 return 0;
1009         case SCSI_IOCTL_GET_IDLUN:
1010         case SCSI_IOCTL_GET_BUS_NUMBER:
1011         case SCSI_IOCTL_PROBE_HOST:
1012         case SG_GET_TRANSFORM:
1013                 if (sdp->detached)
1014                         return -ENODEV;
1015                 return scsi_ioctl(sdp->device, cmd_in, (void *) arg);
1016         default:
1017                 if (read_only)
1018                         return -EPERM;  /* don't know so take safe approach */
1019                 return scsi_ioctl(sdp->device, cmd_in, (void *) arg);
1020         }
1021 }
1022
1023 static unsigned int
1024 sg_poll(struct file *filp, poll_table * wait)
1025 {
1026         unsigned int res = 0;
1027         Sg_device *sdp;
1028         Sg_fd *sfp;
1029         Sg_request *srp;
1030         int count = 0;
1031         unsigned long iflags;
1032
1033         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp))
1034             || sfp->closed)
1035                 return POLLERR;
1036         poll_wait(filp, &sfp->read_wait, wait);
1037         read_lock_irqsave(&sfp->rq_list_lock, iflags);
1038         for (srp = sfp->headrp; srp; srp = srp->nextrp) {
1039                 /* if any read waiting, flag it */
1040                 if ((0 == res) && (1 == srp->done) && (!srp->sg_io_owned))
1041                         res = POLLIN | POLLRDNORM;
1042                 ++count;
1043         }
1044         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
1045
1046         if (sdp->detached)
1047                 res |= POLLHUP;
1048         else if (!sfp->cmd_q) {
1049                 if (0 == count)
1050                         res |= POLLOUT | POLLWRNORM;
1051         } else if (count < SG_MAX_QUEUE)
1052                 res |= POLLOUT | POLLWRNORM;
1053         SCSI_LOG_TIMEOUT(3, printk("sg_poll: %s, res=0x%x\n",
1054                                    sdp->disk->disk_name, (int) res));
1055         return res;
1056 }
1057
1058 static int
1059 sg_fasync(int fd, struct file *filp, int mode)
1060 {
1061         int retval;
1062         Sg_device *sdp;
1063         Sg_fd *sfp;
1064
1065         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
1066                 return -ENXIO;
1067         SCSI_LOG_TIMEOUT(3, printk("sg_fasync: %s, mode=%d\n",
1068                                    sdp->disk->disk_name, mode));
1069
1070         retval = fasync_helper(fd, filp, mode, &sfp->async_qp);
1071         return (retval < 0) ? retval : 0;
1072 }
1073
1074 static inline unsigned char *
1075 sg_scatg2virt(const struct scatterlist *sclp)
1076 {
1077         return (sclp && sclp->page) ?
1078             (unsigned char *) page_address(sclp->page) + sclp->offset : NULL;
1079 }
1080
1081 /* When startFinish==1 increments page counts for pages other than the
1082    first of scatter gather elements obtained from __get_free_pages().
1083    When startFinish==0 decrements ... */
1084 static void
1085 sg_rb_correct4mmap(Sg_scatter_hold * rsv_schp, int startFinish)
1086 {
1087         void *page_ptr;
1088         struct page *page;
1089         int k, m;
1090
1091         SCSI_LOG_TIMEOUT(3, printk("sg_rb_correct4mmap: startFinish=%d, scatg=%d\n",
1092                                    startFinish, rsv_schp->k_use_sg));
1093         /* N.B. correction _not_ applied to base page of each allocation */
1094         if (rsv_schp->k_use_sg) {       /* reserve buffer is a scatter gather list */
1095                 struct scatterlist *sclp = rsv_schp->buffer;
1096
1097                 for (k = 0; k < rsv_schp->k_use_sg; ++k, ++sclp) {
1098                         for (m = PAGE_SIZE; m < sclp->length; m += PAGE_SIZE) {
1099                                 page_ptr = sg_scatg2virt(sclp) + m;
1100                                 page = virt_to_page(page_ptr);
1101                                 if (startFinish)
1102                                         atomic_inc(&page->count);
1103                                 else {
1104                                         if (page_count(page) > 0)
1105                                                 atomic_dec(&page->count);
1106                                 }
1107                         }
1108                 }
1109         } else {                /* reserve buffer is just a single allocation */
1110                 for (m = PAGE_SIZE; m < rsv_schp->bufflen; m += PAGE_SIZE) {
1111                         page_ptr = (unsigned char *) rsv_schp->buffer + m;
1112                         page = virt_to_page(page_ptr);
1113                         if (startFinish)
1114                                 atomic_inc(&page->count);
1115                         else {
1116                                 if (page_count(page) > 0)
1117                                         atomic_dec(&page->count);
1118                         }
1119                 }
1120         }
1121 }
1122
1123 static struct page *
1124 sg_vma_nopage(struct vm_area_struct *vma, unsigned long addr, int *type)
1125 {
1126         Sg_fd *sfp;
1127         struct page *page = NOPAGE_SIGBUS;
1128         void *page_ptr = NULL;
1129         unsigned long offset;
1130         Sg_scatter_hold *rsv_schp;
1131
1132         if ((NULL == vma) || (!(sfp = (Sg_fd *) vma->vm_private_data)))
1133                 return page;
1134         rsv_schp = &sfp->reserve;
1135         offset = addr - vma->vm_start;
1136         if (offset >= rsv_schp->bufflen)
1137                 return page;
1138         SCSI_LOG_TIMEOUT(3, printk("sg_vma_nopage: offset=%lu, scatg=%d\n",
1139                                    offset, rsv_schp->k_use_sg));
1140         if (rsv_schp->k_use_sg) {       /* reserve buffer is a scatter gather list */
1141                 int k;
1142                 unsigned long sa = vma->vm_start;
1143                 unsigned long len;
1144                 struct scatterlist *sclp = rsv_schp->buffer;
1145
1146                 for (k = 0; (k < rsv_schp->k_use_sg) && (sa < vma->vm_end);
1147                      ++k, ++sclp) {
1148                         len = vma->vm_end - sa;
1149                         len = (len < sclp->length) ? len : sclp->length;
1150                         if (offset < len) {
1151                                 page_ptr = sg_scatg2virt(sclp) + offset;
1152                                 page = virt_to_page(page_ptr);
1153                                 get_page(page); /* increment page count */
1154                                 break;
1155                         }
1156                         sa += len;
1157                         offset -= len;
1158                 }
1159         } else {                /* reserve buffer is just a single allocation */
1160                 page_ptr = (unsigned char *) rsv_schp->buffer + offset;
1161                 page = virt_to_page(page_ptr);
1162                 get_page(page); /* increment page count */
1163         }
1164         if (type)
1165                 *type = VM_FAULT_MINOR;
1166         return page;
1167 }
1168
1169 static struct vm_operations_struct sg_mmap_vm_ops = {
1170         .nopage = sg_vma_nopage,
1171 };
1172
1173 static int
1174 sg_mmap(struct file *filp, struct vm_area_struct *vma)
1175 {
1176         Sg_fd *sfp;
1177         unsigned long req_sz = vma->vm_end - vma->vm_start;
1178         Sg_scatter_hold *rsv_schp;
1179
1180         if ((!filp) || (!vma) || (!(sfp = (Sg_fd *) filp->private_data)))
1181                 return -ENXIO;
1182         SCSI_LOG_TIMEOUT(3, printk("sg_mmap starting, vm_start=%p, len=%d\n",
1183                                    (void *) vma->vm_start, (int) req_sz));
1184         if (vma->vm_pgoff)
1185                 return -EINVAL; /* want no offset */
1186         rsv_schp = &sfp->reserve;
1187         if (req_sz > rsv_schp->bufflen)
1188                 return -ENOMEM; /* cannot map more than reserved buffer */
1189
1190         if (rsv_schp->k_use_sg) { /* reserve buffer is a scatter gather list */
1191                 int k;
1192                 unsigned long sa = vma->vm_start;
1193                 unsigned long len;
1194                 struct scatterlist *sclp = rsv_schp->buffer;
1195
1196                 for (k = 0; (k < rsv_schp->k_use_sg) && (sa < vma->vm_end);
1197                      ++k, ++sclp) {
1198                         if (0 != sclp->offset)
1199                                 return -EFAULT; /* non page aligned memory ?? */
1200                         len = vma->vm_end - sa;
1201                         len = (len < sclp->length) ? len : sclp->length;
1202                         sa += len;
1203                 }
1204         } else {        /* reserve buffer is just a single allocation */
1205                 if ((unsigned long) rsv_schp->buffer & (PAGE_SIZE - 1))
1206                         return -EFAULT; /* non page aligned memory ?? */
1207         }
1208         if (0 == sfp->mmap_called) {
1209                 sg_rb_correct4mmap(rsv_schp, 1);        /* do only once per fd lifetime */
1210                 sfp->mmap_called = 1;
1211         }
1212         vma->vm_flags |= (VM_RESERVED | VM_IO);
1213         vma->vm_private_data = sfp;
1214         vma->vm_ops = &sg_mmap_vm_ops;
1215         return 0;
1216 }
1217
1218 /* This function is a "bottom half" handler that is called by the
1219  * mid level when a command is completed (or has failed). */
1220 static void
1221 sg_cmd_done(Scsi_Cmnd * SCpnt)
1222 {
1223         Scsi_Request *SRpnt = NULL;
1224         Sg_device *sdp = NULL;
1225         Sg_fd *sfp;
1226         Sg_request *srp = NULL;
1227
1228         if (SCpnt && (SRpnt = SCpnt->sc_request))
1229                 srp = (Sg_request *) SRpnt->upper_private_data;
1230         if (NULL == srp) {
1231                 printk(KERN_ERR "sg_cmd_done: NULL request\n");
1232                 if (SRpnt)
1233                         scsi_release_request(SRpnt);
1234                 return;
1235         }
1236         sfp = srp->parentfp;
1237         if (sfp)
1238                 sdp = sfp->parentdp;
1239         if ((NULL == sdp) || sdp->detached) {
1240                 printk(KERN_INFO "sg_cmd_done: device detached\n");
1241                 scsi_release_request(SRpnt);
1242                 return;
1243         }
1244
1245         /* First transfer ownership of data buffers to sg_device object. */
1246         srp->data.k_use_sg = SRpnt->sr_use_sg;
1247         srp->data.sglist_len = SRpnt->sr_sglist_len;
1248         srp->data.bufflen = SRpnt->sr_bufflen;
1249         srp->data.buffer = SRpnt->sr_buffer;
1250         /* now clear out request structure */
1251         SRpnt->sr_use_sg = 0;
1252         SRpnt->sr_sglist_len = 0;
1253         SRpnt->sr_bufflen = 0;
1254         SRpnt->sr_buffer = NULL;
1255         SRpnt->sr_underflow = 0;
1256         SRpnt->sr_request->rq_disk = NULL; /* "sg" _disowns_ request blk */
1257
1258         srp->my_cmdp = NULL;
1259
1260         SCSI_LOG_TIMEOUT(4, printk("sg_cmd_done: %s, pack_id=%d, res=0x%x\n",
1261                 sdp->disk->disk_name, srp->header.pack_id, (int) SRpnt->sr_result));
1262         srp->header.resid = SCpnt->resid;
1263         /* N.B. unit of duration changes here from jiffies to millisecs */
1264         srp->header.duration =
1265             sg_jif_to_ms(jiffies - (int) srp->header.duration);
1266         if (0 != SRpnt->sr_result) {
1267                 memcpy(srp->sense_b, SRpnt->sr_sense_buffer,
1268                        sizeof (srp->sense_b));
1269                 srp->header.status = 0xff & SRpnt->sr_result;
1270                 srp->header.masked_status = status_byte(SRpnt->sr_result);
1271                 srp->header.msg_status = msg_byte(SRpnt->sr_result);
1272                 srp->header.host_status = host_byte(SRpnt->sr_result);
1273                 srp->header.driver_status = driver_byte(SRpnt->sr_result);
1274                 if ((sdp->sgdebug > 0) &&
1275                     ((CHECK_CONDITION == srp->header.masked_status) ||
1276                      (COMMAND_TERMINATED == srp->header.masked_status)))
1277                         print_req_sense("sg_cmd_done", SRpnt);
1278
1279                 /* Following if statement is a patch supplied by Eric Youngdale */
1280                 if (driver_byte(SRpnt->sr_result) != 0
1281                     && (SRpnt->sr_sense_buffer[0] & 0x7f) == 0x70
1282                     && (SRpnt->sr_sense_buffer[2] & 0xf) == UNIT_ATTENTION
1283                     && sdp->device->removable) {
1284                         /* Detected disc change. Set the bit - this may be used if */
1285                         /* there are filesystems using this device. */
1286                         sdp->device->changed = 1;
1287                 }
1288         }
1289         /* Rely on write phase to clean out srp status values, so no "else" */
1290
1291         scsi_release_request(SRpnt);
1292         SRpnt = NULL;
1293         if (sfp->closed) {      /* whoops this fd already released, cleanup */
1294                 SCSI_LOG_TIMEOUT(1, printk("sg_cmd_done: already closed, freeing ...\n"));
1295                 sg_finish_rem_req(srp);
1296                 srp = NULL;
1297                 if (NULL == sfp->headrp) {
1298                         SCSI_LOG_TIMEOUT(1, printk("sg...bh: already closed, final cleanup\n"));
1299                         if (0 == sg_remove_sfp(sdp, sfp)) {     /* device still present */
1300                                 scsi_device_put(sdp->device);
1301                         }
1302                         sfp = NULL;
1303                 }
1304         } else if (srp && srp->orphan) {
1305                 if (sfp->keep_orphan)
1306                         srp->sg_io_owned = 0;
1307                 else {
1308                         sg_finish_rem_req(srp);
1309                         srp = NULL;
1310                 }
1311         }
1312         if (sfp && srp) {
1313                 /* Now wake up any sg_read() that is waiting for this packet. */
1314                 kill_fasync(&sfp->async_qp, SIGPOLL, POLL_IN);
1315                 srp->done = 1;
1316                 wake_up_interruptible(&sfp->read_wait);
1317         }
1318 }
1319
1320 static struct file_operations sg_fops = {
1321         .owner = THIS_MODULE,
1322         .read = sg_read,
1323         .write = sg_write,
1324         .poll = sg_poll,
1325         .ioctl = sg_ioctl,
1326         .open = sg_open,
1327         .mmap = sg_mmap,
1328         .release = sg_release,
1329         .fasync = sg_fasync,
1330 };
1331
1332 static struct class_simple * sg_sysfs_class;
1333
1334 static int sg_sysfs_valid = 0;
1335
1336 static int
1337 sg_add(struct class_device *cl_dev)
1338 {
1339         struct scsi_device *scsidp = to_scsi_device(cl_dev->dev);
1340         struct gendisk *disk;
1341         Sg_device *sdp = NULL;
1342         unsigned long iflags;
1343         struct cdev * cdev = NULL;
1344         int k, error;
1345
1346         disk = alloc_disk(1);
1347         if (!disk)
1348                 return -ENOMEM;
1349
1350         cdev = cdev_alloc();
1351         if (! cdev)
1352                 return -ENOMEM;
1353         write_lock_irqsave(&sg_dev_arr_lock, iflags);
1354         if (sg_nr_dev >= sg_dev_max) {  /* try to resize */
1355                 Sg_device **tmp_da;
1356                 int tmp_dev_max = sg_nr_dev + SG_DEV_ARR_LUMP;
1357
1358                 write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
1359                 tmp_da = (Sg_device **)vmalloc(
1360                                 tmp_dev_max * sizeof(Sg_device *));
1361                 if (NULL == tmp_da) {
1362                         printk(KERN_ERR
1363                                "sg_add: device array cannot be resized\n");
1364                         error = -ENOMEM;
1365                         goto out;
1366                 }
1367                 write_lock_irqsave(&sg_dev_arr_lock, iflags);
1368                 memset(tmp_da, 0, tmp_dev_max * sizeof (Sg_device *));
1369                 memcpy(tmp_da, sg_dev_arr,
1370                        sg_dev_max * sizeof (Sg_device *));
1371                 vfree((char *) sg_dev_arr);
1372                 sg_dev_arr = tmp_da;
1373                 sg_dev_max = tmp_dev_max;
1374         }
1375
1376 find_empty_slot:
1377         for (k = 0; k < sg_dev_max; k++)
1378                 if (!sg_dev_arr[k])
1379                         break;
1380         if (k >= SG_MAX_DEVS) {
1381                 write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
1382                 printk(KERN_WARNING
1383                        "Unable to attach sg device <%d, %d, %d, %d>"
1384                        " type=%d, minor number exceeds %d\n",
1385                        scsidp->host->host_no, scsidp->channel, scsidp->id,
1386                        scsidp->lun, scsidp->type, SG_MAX_DEVS - 1);
1387                 if (NULL != sdp)
1388                         vfree((char *) sdp);
1389                 error = -ENODEV;
1390                 goto out;
1391         }
1392         if (k < sg_dev_max) {
1393                 if (NULL == sdp) {
1394                         write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
1395                         sdp = (Sg_device *)vmalloc(sizeof(Sg_device));
1396                         write_lock_irqsave(&sg_dev_arr_lock, iflags);
1397                         if (!sg_dev_arr[k])
1398                                 goto find_empty_slot;
1399                 }
1400         } else
1401                 sdp = NULL;
1402         if (NULL == sdp) {
1403                 write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
1404                 printk(KERN_ERR "sg_add: Sg_device cannot be allocated\n");
1405                 error = -ENOMEM;
1406                 goto out;
1407         }
1408
1409         SCSI_LOG_TIMEOUT(3, printk("sg_add: dev=%d \n", k));
1410         memset(sdp, 0, sizeof(*sdp));
1411         sprintf(disk->disk_name, "sg%d", k);
1412         cdev->owner = THIS_MODULE;
1413         cdev->ops = &sg_fops;
1414         disk->major = SCSI_GENERIC_MAJOR;
1415         disk->first_minor = k;
1416         sdp->disk = disk;
1417         sdp->device = scsidp;
1418         init_waitqueue_head(&sdp->o_excl_wait);
1419         sdp->sg_tablesize = scsidp->host ? scsidp->host->sg_tablesize : 0;
1420
1421         sg_nr_dev++;
1422         sg_dev_arr[k] = sdp;
1423         write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
1424
1425         devfs_mk_cdev(MKDEV(SCSI_GENERIC_MAJOR, k),
1426                         S_IFCHR | S_IRUSR | S_IWUSR | S_IRGRP,
1427                         "%s/generic", scsidp->devfs_name);
1428         error = cdev_add(cdev, MKDEV(SCSI_GENERIC_MAJOR, k), 1);
1429         if (error) {
1430                 devfs_remove("%s/generic", scsidp->devfs_name);
1431                 goto out;
1432         }
1433         sdp->cdev = cdev;
1434         if (sg_sysfs_valid) {
1435                 struct class_device * sg_class_member;
1436
1437                 sg_class_member = class_simple_device_add(sg_sysfs_class,
1438                                 MKDEV(SCSI_GENERIC_MAJOR, k),
1439                                 cl_dev->dev, "%s",
1440                                 disk->disk_name);
1441                 if (IS_ERR(sg_class_member))
1442                         printk(KERN_WARNING "sg_add: "
1443                                 "class_simple_device_add failed\n");
1444                 class_set_devdata(sg_class_member, sdp);
1445                 error = sysfs_create_link(&scsidp->sdev_gendev.kobj,
1446                                           &sg_class_member->kobj, "generic");
1447                 if (error)
1448                         printk(KERN_ERR "sg_add: unable to make symlink "
1449                                         "'generic' back to sg%d\n", k);
1450         } else
1451                 printk(KERN_WARNING "sg_add: sg_sys INvalid\n");
1452
1453         printk(KERN_NOTICE
1454                "Attached scsi generic sg%d at scsi%d, channel"
1455                " %d, id %d, lun %d,  type %d\n", k,
1456                scsidp->host->host_no, scsidp->channel, scsidp->id,
1457                scsidp->lun, scsidp->type);
1458
1459         return 0;
1460
1461 out:
1462         put_disk(disk);
1463         if (cdev)
1464                 cdev_del(cdev);
1465         return error;
1466 }
1467
1468 static void
1469 sg_remove(struct class_device *cl_dev)
1470 {
1471         struct scsi_device *scsidp = to_scsi_device(cl_dev->dev);
1472         Sg_device *sdp = NULL;
1473         unsigned long iflags;
1474         Sg_fd *sfp;
1475         Sg_fd *tsfp;
1476         Sg_request *srp;
1477         Sg_request *tsrp;
1478         int k, delay;
1479
1480         if (NULL == sg_dev_arr)
1481                 return;
1482         delay = 0;
1483         write_lock_irqsave(&sg_dev_arr_lock, iflags);
1484         for (k = 0; k < sg_dev_max; k++) {
1485                 sdp = sg_dev_arr[k];
1486                 if ((NULL == sdp) || (sdp->device != scsidp))
1487                         continue;       /* dirty but lowers nesting */
1488                 if (sdp->headfp) {
1489                         sdp->detached = 1;
1490                         for (sfp = sdp->headfp; sfp; sfp = tsfp) {
1491                                 tsfp = sfp->nextfp;
1492                                 for (srp = sfp->headrp; srp; srp = tsrp) {
1493                                         tsrp = srp->nextrp;
1494                                         if (sfp->closed || (0 == srp->done))
1495                                                 sg_finish_rem_req(srp);
1496                                 }
1497                                 if (sfp->closed) {
1498                                         scsi_device_put(sdp->device);
1499                                         __sg_remove_sfp(sdp, sfp);
1500                                 } else {
1501                                         delay = 1;
1502                                         wake_up_interruptible(&sfp->read_wait);
1503                                         kill_fasync(&sfp->async_qp, SIGPOLL,
1504                                                     POLL_HUP);
1505                                 }
1506                         }
1507                         SCSI_LOG_TIMEOUT(3, printk("sg_detach: dev=%d, dirty\n", k));
1508                         if (NULL == sdp->headfp) {
1509                                 sg_dev_arr[k] = NULL;
1510                         }
1511                 } else {        /* nothing active, simple case */
1512                         SCSI_LOG_TIMEOUT(3, printk("sg_detach: dev=%d\n", k));
1513                         sg_dev_arr[k] = NULL;
1514                 }
1515                 sg_nr_dev--;
1516                 break;
1517         }
1518         write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
1519
1520         if (sdp) {
1521                 sysfs_remove_link(&scsidp->sdev_gendev.kobj, "generic");
1522                 class_simple_device_remove(MKDEV(SCSI_GENERIC_MAJOR, k));
1523                 cdev_del(sdp->cdev);
1524                 sdp->cdev = NULL;
1525                 devfs_remove("%s/generic", scsidp->devfs_name);
1526                 put_disk(sdp->disk);
1527                 sdp->disk = NULL;
1528                 if (NULL == sdp->headfp)
1529                         vfree((char *) sdp);
1530         }
1531
1532         if (delay)
1533                 scsi_sleep(2);  /* dirty detach so delay device destruction */
1534 }
1535
1536 /* Set 'perm' (4th argument) to 0 to disable module_param's definition
1537  * of sysfs parameters (which module_param doesn't yet support).
1538  * Sysfs parameters defined explicitly below.
1539  */
1540 module_param_named(def_reserved_size, def_reserved_size, int, 0);
1541 module_param_named(allow_dio, sg_allow_dio, int, 0);
1542
1543 MODULE_AUTHOR("Douglas Gilbert");
1544 MODULE_DESCRIPTION("SCSI generic (sg) driver");
1545 MODULE_LICENSE("GPL");
1546
1547 MODULE_PARM_DESC(def_reserved_size, "size of buffer reserved for each fd");
1548 MODULE_PARM_DESC(allow_dio, "allow direct I/O (default: 0 (disallow))");
1549
1550 static int __init
1551 init_sg(void)
1552 {
1553         int rc;
1554
1555         if (def_reserved_size >= 0)
1556                 sg_big_buff = def_reserved_size;
1557
1558         rc = register_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0),
1559                                     SG_MAX_DEVS, "sg");
1560         if (rc)
1561                 return rc;
1562         sg_sysfs_class = class_simple_create(THIS_MODULE, "scsi_generic");
1563         if ( IS_ERR(sg_sysfs_class) ) {
1564                 rc = PTR_ERR(sg_sysfs_class);
1565                 goto err_out;
1566         }
1567         sg_sysfs_valid = 1;
1568         rc = scsi_register_interface(&sg_interface);
1569         if (0 == rc) {
1570 #ifdef CONFIG_SCSI_PROC_FS
1571                 sg_proc_init();
1572 #endif                          /* CONFIG_SCSI_PROC_FS */
1573                 return 0;
1574         }
1575         class_simple_destroy(sg_sysfs_class);
1576 err_out:
1577         unregister_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0), SG_MAX_DEVS);
1578         return rc;
1579 }
1580
1581 static void __exit
1582 exit_sg(void)
1583 {
1584 #ifdef CONFIG_SCSI_PROC_FS
1585         sg_proc_cleanup();
1586 #endif                          /* CONFIG_SCSI_PROC_FS */
1587         scsi_unregister_interface(&sg_interface);
1588         class_simple_destroy(sg_sysfs_class);
1589         sg_sysfs_valid = 0;
1590         unregister_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0),
1591                                  SG_MAX_DEVS);
1592         if (sg_dev_arr != NULL) {
1593                 vfree((char *) sg_dev_arr);
1594                 sg_dev_arr = NULL;
1595         }
1596         sg_dev_max = 0;
1597 }
1598
1599 static int
1600 sg_start_req(Sg_request * srp)
1601 {
1602         int res;
1603         Sg_fd *sfp = srp->parentfp;
1604         sg_io_hdr_t *hp = &srp->header;
1605         int dxfer_len = (int) hp->dxfer_len;
1606         int dxfer_dir = hp->dxfer_direction;
1607         Sg_scatter_hold *req_schp = &srp->data;
1608         Sg_scatter_hold *rsv_schp = &sfp->reserve;
1609
1610         SCSI_LOG_TIMEOUT(4, printk("sg_start_req: dxfer_len=%d\n", dxfer_len));
1611         if ((dxfer_len <= 0) || (dxfer_dir == SG_DXFER_NONE))
1612                 return 0;
1613         if (sg_allow_dio && (hp->flags & SG_FLAG_DIRECT_IO) &&
1614             (dxfer_dir != SG_DXFER_UNKNOWN) && (0 == hp->iovec_count) &&
1615             (!sfp->parentdp->device->host->unchecked_isa_dma)) {
1616                 res = sg_build_direct(srp, sfp, dxfer_len);
1617                 if (res <= 0)   /* -ve -> error, 0 -> done, 1 -> try indirect */
1618                         return res;
1619         }
1620         if ((!sg_res_in_use(sfp)) && (dxfer_len <= rsv_schp->bufflen))
1621                 sg_link_reserve(sfp, srp, dxfer_len);
1622         else {
1623                 res = sg_build_indirect(req_schp, sfp, dxfer_len);
1624                 if (res) {
1625                         sg_remove_scat(req_schp);
1626                         return res;
1627                 }
1628         }
1629         return 0;
1630 }
1631
1632 static void
1633 sg_finish_rem_req(Sg_request * srp)
1634 {
1635         Sg_fd *sfp = srp->parentfp;
1636         Sg_scatter_hold *req_schp = &srp->data;
1637
1638         SCSI_LOG_TIMEOUT(4, printk("sg_finish_rem_req: res_used=%d\n", (int) srp->res_used));
1639         if (srp->res_used)
1640                 sg_unlink_reserve(sfp, srp);
1641         else
1642                 sg_remove_scat(req_schp);
1643         sg_remove_request(sfp, srp);
1644 }
1645
1646 static int
1647 sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp, int tablesize)
1648 {
1649         int ret_sz;
1650         int elem_sz = sizeof (struct scatterlist);
1651         int sg_bufflen = tablesize * elem_sz;
1652         int mx_sc_elems = tablesize;
1653
1654         schp->buffer = sg_page_malloc(sg_bufflen, sfp->low_dma, &ret_sz);
1655         if (!schp->buffer)
1656                 return -ENOMEM;
1657         else if (ret_sz != sg_bufflen) {
1658                 sg_bufflen = ret_sz;
1659                 mx_sc_elems = sg_bufflen / elem_sz;
1660         }
1661         schp->sglist_len = sg_bufflen;
1662         memset(schp->buffer, 0, sg_bufflen);
1663         return mx_sc_elems;     /* number of scat_gath elements allocated */
1664 }
1665
1666 #ifdef SG_ALLOW_DIO_CODE
1667 /* vvvvvvvv  following code borrowed from st driver's direct IO vvvvvvvvv */
1668         /* hopefully this generic code will moved to a library */
1669
1670 /* Pin down user pages and put them into a scatter gather list. Returns <= 0 if
1671    - mapping of all pages not successful
1672    - any page is above max_pfn
1673    (i.e., either completely successful or fails)
1674 */
1675 static int
1676 st_map_user_pages(struct scatterlist *sgl, const unsigned int max_pages,
1677                   unsigned long uaddr, size_t count, int rw,
1678                   unsigned long max_pfn)
1679 {
1680         int res, i, j;
1681         unsigned int nr_pages;
1682         struct page **pages;
1683
1684         nr_pages = ((uaddr & ~PAGE_MASK) + count + ~PAGE_MASK) >> PAGE_SHIFT;
1685
1686         /* User attempted Overflow! */
1687         if ((uaddr + count) < uaddr)
1688                 return -EINVAL;
1689
1690         /* Too big */
1691         if (nr_pages > max_pages)
1692                 return -ENOMEM;
1693
1694         /* Hmm? */
1695         if (count == 0)
1696                 return 0;
1697
1698         if ((pages = kmalloc(max_pages * sizeof(*pages), GFP_ATOMIC)) == NULL)
1699                 return -ENOMEM;
1700
1701         /* Try to fault in all of the necessary pages */
1702         down_read(&current->mm->mmap_sem);
1703         /* rw==READ means read from drive, write into memory area */
1704         res = get_user_pages(
1705                 current,
1706                 current->mm,
1707                 uaddr,
1708                 nr_pages,
1709                 rw == READ,
1710                 0, /* don't force */
1711                 pages,
1712                 NULL);
1713         up_read(&current->mm->mmap_sem);
1714
1715         /* Errors and no page mapped should return here */
1716         if (res < nr_pages)
1717                 goto out_unmap;
1718
1719         for (i=0; i < nr_pages; i++) {
1720                 /* FIXME: flush superflous for rw==READ,
1721                  * probably wrong function for rw==WRITE
1722                  */
1723                 flush_dcache_page(pages[i]);
1724                 if (page_to_pfn(pages[i]) > max_pfn)
1725                         goto out_unlock;
1726                 /* ?? Is locking needed? I don't think so */
1727                 /* if (TestSetPageLocked(pages[i]))
1728                    goto out_unlock; */
1729         }
1730
1731         /* Populate the scatter/gather list */
1732         sgl[0].page = pages[0];
1733         sgl[0].offset = uaddr & ~PAGE_MASK;
1734         if (nr_pages > 1) {
1735                 sgl[0].length = PAGE_SIZE - sgl[0].offset;
1736                 count -= sgl[0].length;
1737                 for (i=1; i < nr_pages ; i++) {
1738                         sgl[i].offset = 0;
1739                         sgl[i].page = pages[i];
1740                         sgl[i].length = count < PAGE_SIZE ? count : PAGE_SIZE;
1741                         count -= PAGE_SIZE;
1742                 }
1743         }
1744         else {
1745                 sgl[0].length = count;
1746         }
1747
1748         kfree(pages);
1749         return nr_pages;
1750
1751  out_unlock:
1752         /* for (j=0; j < i; j++)
1753            unlock_page(pages[j]); */
1754         res = 0;
1755  out_unmap:
1756         if (res > 0)
1757                 for (j=0; j < res; j++)
1758                         page_cache_release(pages[j]);
1759         kfree(pages);
1760         return res;
1761 }
1762
1763
1764 /* And unmap them... */
1765 static int
1766 st_unmap_user_pages(struct scatterlist *sgl, const unsigned int nr_pages,
1767                     int dirtied)
1768 {
1769         int i;
1770
1771         for (i=0; i < nr_pages; i++) {
1772                 if (dirtied && !PageReserved(sgl[i].page))
1773                         SetPageDirty(sgl[i].page);
1774                 /* unlock_page(sgl[i].page); */
1775                 /* FIXME: cache flush missing for rw==READ
1776                  * FIXME: call the correct reference counting function
1777                  */
1778                 page_cache_release(sgl[i].page);
1779         }
1780
1781         return 0;
1782 }
1783
1784 /* ^^^^^^^^  above code borrowed from st driver's direct IO ^^^^^^^^^ */
1785 #endif
1786
1787
1788 /* Returns: -ve -> error, 0 -> done, 1 -> try indirect */
1789 static int
1790 sg_build_direct(Sg_request * srp, Sg_fd * sfp, int dxfer_len)
1791 {
1792 #ifdef SG_ALLOW_DIO_CODE
1793         sg_io_hdr_t *hp = &srp->header;
1794         Sg_scatter_hold *schp = &srp->data;
1795         int sg_tablesize = sfp->parentdp->sg_tablesize;
1796         struct scatterlist *sgl;
1797         int mx_sc_elems, res;
1798         struct scsi_device *sdev = sfp->parentdp->device;
1799
1800         if (((unsigned long)hp->dxferp &
1801                         queue_dma_alignment(sdev->request_queue)) != 0)
1802                 return 1;
1803         mx_sc_elems = sg_build_sgat(schp, sfp, sg_tablesize);
1804         if (mx_sc_elems <= 0) {
1805                 return 1;
1806         }
1807         sgl = (struct scatterlist *)schp->buffer;
1808         res = st_map_user_pages(sgl, mx_sc_elems, (unsigned long)hp->dxferp, dxfer_len,
1809                                 (SG_DXFER_TO_DEV == hp->dxfer_direction) ? 1 : 0, ULONG_MAX);
1810         if (res <= 0)
1811                 return 1;
1812         schp->k_use_sg = res;
1813         schp->dio_in_use = 1;
1814         hp->info |= SG_INFO_DIRECT_IO;
1815         return 0;
1816 #else
1817         return 1;
1818 #endif
1819 }
1820
1821 static int
1822 sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
1823 {
1824         int ret_sz;
1825         int blk_size = buff_size;
1826         unsigned char *p = NULL;
1827
1828         if ((blk_size < 0) || (!sfp))
1829                 return -EFAULT;
1830         if (0 == blk_size)
1831                 ++blk_size;     /* don't know why */
1832 /* round request up to next highest SG_SECTOR_SZ byte boundary */
1833         blk_size = (blk_size + SG_SECTOR_MSK) & (~SG_SECTOR_MSK);
1834         SCSI_LOG_TIMEOUT(4, printk("sg_build_indirect: buff_size=%d, blk_size=%d\n",
1835                                    buff_size, blk_size));
1836         if (blk_size <= SG_SCATTER_SZ) {
1837                 p = sg_page_malloc(blk_size, sfp->low_dma, &ret_sz);
1838                 if (!p)
1839                         return -ENOMEM;
1840                 if (blk_size == ret_sz) {       /* got it on the first attempt */
1841                         schp->k_use_sg = 0;
1842                         schp->buffer = p;
1843                         schp->bufflen = blk_size;
1844                         schp->b_malloc_len = blk_size;
1845                         return 0;
1846                 }
1847         } else {
1848                 p = sg_page_malloc(SG_SCATTER_SZ, sfp->low_dma, &ret_sz);
1849                 if (!p)
1850                         return -ENOMEM;
1851         }
1852 /* Want some local declarations, so start new block ... */
1853         {                       /* lets try and build a scatter gather list */
1854                 struct scatterlist *sclp;
1855                 int k, rem_sz, num;
1856                 int mx_sc_elems;
1857                 int sg_tablesize = sfp->parentdp->sg_tablesize;
1858                 int first = 1;
1859
1860                 /* N.B. ret_sz carried into this block ... */
1861                 mx_sc_elems = sg_build_sgat(schp, sfp, sg_tablesize);
1862                 if (mx_sc_elems < 0)
1863                         return mx_sc_elems;     /* most likely -ENOMEM */
1864
1865                 for (k = 0, sclp = schp->buffer, rem_sz = blk_size;
1866                      (rem_sz > 0) && (k < mx_sc_elems);
1867                      ++k, rem_sz -= ret_sz, ++sclp) {
1868                         if (first)
1869                                 first = 0;
1870                         else {
1871                                 num =
1872                                     (rem_sz >
1873                                      SG_SCATTER_SZ) ? SG_SCATTER_SZ : rem_sz;
1874                                 p = sg_page_malloc(num, sfp->low_dma, &ret_sz);
1875                                 if (!p)
1876                                         break;
1877                         }
1878                         sclp->page = virt_to_page(p);
1879                         sclp->offset = offset_in_page(p);
1880                         sclp->length = ret_sz;
1881
1882                         SCSI_LOG_TIMEOUT(5, printk("sg_build_build: k=%d, a=0x%p, len=%d\n",
1883                                           k, sg_scatg2virt(sclp), ret_sz));
1884                 }               /* end of for loop */
1885                 schp->k_use_sg = k;
1886                 SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k_use_sg=%d, rem_sz=%d\n", k, rem_sz));
1887                 schp->bufflen = blk_size;
1888                 if (rem_sz > 0) /* must have failed */
1889                         return -ENOMEM;
1890         }
1891         return 0;
1892 }
1893
1894 static int
1895 sg_write_xfer(Sg_request * srp)
1896 {
1897         sg_io_hdr_t *hp = &srp->header;
1898         Sg_scatter_hold *schp = &srp->data;
1899         int num_xfer = 0;
1900         int j, k, onum, usglen, ksglen, res;
1901         int iovec_count = (int) hp->iovec_count;
1902         int dxfer_dir = hp->dxfer_direction;
1903         unsigned char *p;
1904         unsigned char *up;
1905         int new_interface = ('\0' == hp->interface_id) ? 0 : 1;
1906
1907         if ((SG_DXFER_UNKNOWN == dxfer_dir) || (SG_DXFER_TO_DEV == dxfer_dir) ||
1908             (SG_DXFER_TO_FROM_DEV == dxfer_dir)) {
1909                 num_xfer = (int) (new_interface ? hp->dxfer_len : hp->flags);
1910                 if (schp->bufflen < num_xfer)
1911                         num_xfer = schp->bufflen;
1912         }
1913         if ((num_xfer <= 0) || (schp->dio_in_use) ||
1914             (new_interface
1915              && ((SG_FLAG_NO_DXFER | SG_FLAG_MMAP_IO) & hp->flags)))
1916                 return 0;
1917
1918         SCSI_LOG_TIMEOUT(4, printk("sg_write_xfer: num_xfer=%d, iovec_count=%d, k_use_sg=%d\n",
1919                           num_xfer, iovec_count, schp->k_use_sg));
1920         if (iovec_count) {
1921                 onum = iovec_count;
1922                 if ((k = verify_area(VERIFY_READ, hp->dxferp,
1923                                      SZ_SG_IOVEC * onum)))
1924                         return k;
1925         } else
1926                 onum = 1;
1927
1928         if (0 == schp->k_use_sg) {      /* kernel has single buffer */
1929                 for (j = 0, p = schp->buffer; j < onum; ++j) {
1930                         res = sg_u_iovec(hp, iovec_count, j, 1, &usglen, &up);
1931                         if (res)
1932                                 return res;
1933                         usglen = (num_xfer > usglen) ? usglen : num_xfer;
1934                         if (__copy_from_user(p, up, usglen))
1935                                 return -EFAULT;
1936                         p += usglen;
1937                         num_xfer -= usglen;
1938                         if (num_xfer <= 0)
1939                                 return 0;
1940                 }
1941         } else {                /* kernel using scatter gather list */
1942                 struct scatterlist *sclp = (struct scatterlist *) schp->buffer;
1943
1944                 ksglen = (int) sclp->length;
1945                 p = sg_scatg2virt(sclp);
1946                 for (j = 0, k = 0; j < onum; ++j) {
1947                         res = sg_u_iovec(hp, iovec_count, j, 1, &usglen, &up);
1948                         if (res)
1949                                 return res;
1950
1951                         for (; p; ++sclp, ksglen = (int) sclp->length,
1952                                   p = sg_scatg2virt(sclp)) {
1953                                 if (usglen <= 0)
1954                                         break;
1955                                 if (ksglen > usglen) {
1956                                         if (usglen >= num_xfer) {
1957                                                 if (__copy_from_user
1958                                                     (p, up, num_xfer))
1959                                                         return -EFAULT;
1960                                                 return 0;
1961                                         }
1962                                         if (__copy_from_user(p, up, usglen))
1963                                                 return -EFAULT;
1964                                         p += usglen;
1965                                         ksglen -= usglen;
1966                                         break;
1967                                 } else {
1968                                         if (ksglen >= num_xfer) {
1969                                                 if (__copy_from_user
1970                                                     (p, up, num_xfer))
1971                                                         return -EFAULT;
1972                                                 return 0;
1973                                         }
1974                                         if (__copy_from_user(p, up, ksglen))
1975                                                 return -EFAULT;
1976                                         up += ksglen;
1977                                         usglen -= ksglen;
1978                                 }
1979                                 ++k;
1980                                 if (k >= schp->k_use_sg)
1981                                         return 0;
1982                         }
1983                 }
1984         }
1985         return 0;
1986 }
1987
1988 static int
1989 sg_u_iovec(sg_io_hdr_t * hp, int sg_num, int ind,
1990            int wr_xf, int *countp, unsigned char **up)
1991 {
1992         int num_xfer = (int) hp->dxfer_len;
1993         unsigned char *p;
1994         int count, k;
1995         sg_iovec_t u_iovec;
1996
1997         if (0 == sg_num) {
1998                 p = (unsigned char *) hp->dxferp;
1999                 if (wr_xf && ('\0' == hp->interface_id))
2000                         count = (int) hp->flags;        /* holds "old" input_size */
2001                 else
2002                         count = num_xfer;
2003         } else {
2004                 if (__copy_from_user(&u_iovec,
2005                                      (unsigned char *) hp->dxferp +
2006                                      (ind * SZ_SG_IOVEC), SZ_SG_IOVEC))
2007                         return -EFAULT;
2008                 p = (unsigned char *) u_iovec.iov_base;
2009                 count = (int) u_iovec.iov_len;
2010         }
2011         if ((k = verify_area(wr_xf ? VERIFY_READ : VERIFY_WRITE, p, count)))
2012                 return k;
2013         if (up)
2014                 *up = p;
2015         if (countp)
2016                 *countp = count;
2017         return 0;
2018 }
2019
2020 static void
2021 sg_remove_scat(Sg_scatter_hold * schp)
2022 {
2023         SCSI_LOG_TIMEOUT(4, printk("sg_remove_scat: k_use_sg=%d\n", schp->k_use_sg));
2024         if (schp->buffer && (schp->sglist_len > 0)) {
2025                 struct scatterlist *sclp = (struct scatterlist *) schp->buffer;
2026
2027                 if (schp->dio_in_use) {
2028 #ifdef SG_ALLOW_DIO_CODE
2029                         st_unmap_user_pages(sclp, schp->k_use_sg, TRUE);
2030 #endif
2031                 } else {
2032                         int k;
2033
2034                         for (k = 0; (k < schp->k_use_sg) && sg_scatg2virt(sclp);
2035                              ++k, ++sclp) {
2036                                 SCSI_LOG_TIMEOUT(5, printk(
2037                                     "sg_remove_scat: k=%d, a=0x%p, len=%d\n",
2038                                     k, sg_scatg2virt(sclp), sclp->length));
2039                                 sg_page_free(sg_scatg2virt(sclp), sclp->length);
2040                                 sclp->page = NULL;
2041                                 sclp->offset = 0;
2042                                 sclp->length = 0;
2043                         }
2044                 }
2045                 sg_page_free(schp->buffer, schp->sglist_len);
2046         } else if (schp->buffer)
2047                 sg_page_free(schp->buffer, schp->b_malloc_len);
2048         memset(schp, 0, sizeof (*schp));
2049 }
2050
2051 static int
2052 sg_read_xfer(Sg_request * srp)
2053 {
2054         sg_io_hdr_t *hp = &srp->header;
2055         Sg_scatter_hold *schp = &srp->data;
2056         int num_xfer = 0;
2057         int j, k, onum, usglen, ksglen, res;
2058         int iovec_count = (int) hp->iovec_count;
2059         int dxfer_dir = hp->dxfer_direction;
2060         unsigned char *p;
2061         unsigned char *up;
2062         int new_interface = ('\0' == hp->interface_id) ? 0 : 1;
2063
2064         if ((SG_DXFER_UNKNOWN == dxfer_dir) || (SG_DXFER_FROM_DEV == dxfer_dir)
2065             || (SG_DXFER_TO_FROM_DEV == dxfer_dir)) {
2066                 num_xfer = hp->dxfer_len;
2067                 if (schp->bufflen < num_xfer)
2068                         num_xfer = schp->bufflen;
2069         }
2070         if ((num_xfer <= 0) || (schp->dio_in_use) ||
2071             (new_interface
2072              && ((SG_FLAG_NO_DXFER | SG_FLAG_MMAP_IO) & hp->flags)))
2073                 return 0;
2074
2075         SCSI_LOG_TIMEOUT(4, printk("sg_read_xfer: num_xfer=%d, iovec_count=%d, k_use_sg=%d\n",
2076                           num_xfer, iovec_count, schp->k_use_sg));
2077         if (iovec_count) {
2078                 onum = iovec_count;
2079                 if ((k = verify_area(VERIFY_READ, hp->dxferp,
2080                                      SZ_SG_IOVEC * onum)))
2081                         return k;
2082         } else
2083                 onum = 1;
2084
2085         if (0 == schp->k_use_sg) {      /* kernel has single buffer */
2086                 for (j = 0, p = schp->buffer; j < onum; ++j) {
2087                         res = sg_u_iovec(hp, iovec_count, j, 0, &usglen, &up);
2088                         if (res)
2089                                 return res;
2090                         usglen = (num_xfer > usglen) ? usglen : num_xfer;
2091                         if (__copy_to_user(up, p, usglen))
2092                                 return -EFAULT;
2093                         p += usglen;
2094                         num_xfer -= usglen;
2095                         if (num_xfer <= 0)
2096                                 return 0;
2097                 }
2098         } else {                /* kernel using scatter gather list */
2099                 struct scatterlist *sclp = (struct scatterlist *) schp->buffer;
2100
2101                 ksglen = (int) sclp->length;
2102                 p = sg_scatg2virt(sclp);
2103                 for (j = 0, k = 0; j < onum; ++j) {
2104                         res = sg_u_iovec(hp, iovec_count, j, 0, &usglen, &up);
2105                         if (res)
2106                                 return res;
2107
2108                         for (; p; ++sclp, ksglen = (int) sclp->length,
2109                                   p = sg_scatg2virt(sclp)) {
2110                                 if (usglen <= 0)
2111                                         break;
2112                                 if (ksglen > usglen) {
2113                                         if (usglen >= num_xfer) {
2114                                                 if (__copy_to_user
2115                                                     (up, p, num_xfer))
2116                                                         return -EFAULT;
2117                                                 return 0;
2118                                         }
2119                                         if (__copy_to_user(up, p, usglen))
2120                                                 return -EFAULT;
2121                                         p += usglen;
2122                                         ksglen -= usglen;
2123                                         break;
2124                                 } else {
2125                                         if (ksglen >= num_xfer) {
2126                                                 if (__copy_to_user
2127                                                     (up, p, num_xfer))
2128                                                         return -EFAULT;
2129                                                 return 0;
2130                                         }
2131                                         if (__copy_to_user(up, p, ksglen))
2132                                                 return -EFAULT;
2133                                         up += ksglen;
2134                                         usglen -= ksglen;
2135                                 }
2136                                 ++k;
2137                                 if (k >= schp->k_use_sg)
2138                                         return 0;
2139                         }
2140                 }
2141         }
2142         return 0;
2143 }
2144
2145 static int
2146 sg_read_oxfer(Sg_request * srp, char *outp, int num_read_xfer)
2147 {
2148         Sg_scatter_hold *schp = &srp->data;
2149
2150         SCSI_LOG_TIMEOUT(4, printk("sg_read_oxfer: num_read_xfer=%d\n",
2151                                    num_read_xfer));
2152         if ((!outp) || (num_read_xfer <= 0))
2153                 return 0;
2154         if (schp->k_use_sg > 0) {
2155                 int k, num;
2156                 struct scatterlist *sclp = (struct scatterlist *) schp->buffer;
2157
2158                 for (k = 0; (k < schp->k_use_sg) && sg_scatg2virt(sclp);
2159                      ++k, ++sclp) {
2160                         num = (int) sclp->length;
2161                         if (num > num_read_xfer) {
2162                                 if (__copy_to_user
2163                                     (outp, sg_scatg2virt(sclp), num_read_xfer))
2164                                         return -EFAULT;
2165                                 break;
2166                         } else {
2167                                 if (__copy_to_user
2168                                     (outp, sg_scatg2virt(sclp), num))
2169                                         return -EFAULT;
2170                                 num_read_xfer -= num;
2171                                 if (num_read_xfer <= 0)
2172                                         break;
2173                                 outp += num;
2174                         }
2175                 }
2176         } else {
2177                 if (__copy_to_user(outp, schp->buffer, num_read_xfer))
2178                         return -EFAULT;
2179         }
2180         return 0;
2181 }
2182
2183 static void
2184 sg_build_reserve(Sg_fd * sfp, int req_size)
2185 {
2186         Sg_scatter_hold *schp = &sfp->reserve;
2187
2188         SCSI_LOG_TIMEOUT(4, printk("sg_build_reserve: req_size=%d\n", req_size));
2189         do {
2190                 if (req_size < PAGE_SIZE)
2191                         req_size = PAGE_SIZE;
2192                 if (0 == sg_build_indirect(schp, sfp, req_size))
2193                         return;
2194                 else
2195                         sg_remove_scat(schp);
2196                 req_size >>= 1; /* divide by 2 */
2197         } while (req_size > (PAGE_SIZE / 2));
2198 }
2199
2200 static void
2201 sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size)
2202 {
2203         Sg_scatter_hold *req_schp = &srp->data;
2204         Sg_scatter_hold *rsv_schp = &sfp->reserve;
2205
2206         srp->res_used = 1;
2207         SCSI_LOG_TIMEOUT(4, printk("sg_link_reserve: size=%d\n", size));
2208         size = (size + 1) & (~1);       /* round to even for aha1542 */
2209         if (rsv_schp->k_use_sg > 0) {
2210                 int k, num;
2211                 int rem = size;
2212                 struct scatterlist *sclp =
2213                     (struct scatterlist *) rsv_schp->buffer;
2214
2215                 for (k = 0; k < rsv_schp->k_use_sg; ++k, ++sclp) {
2216                         num = (int) sclp->length;
2217                         if (rem <= num) {
2218                                 if (0 == k) {
2219                                         req_schp->k_use_sg = 0;
2220                                         req_schp->buffer = sg_scatg2virt(sclp);
2221                                 } else {
2222                                         sfp->save_scat_len = num;
2223                                         sclp->length = (unsigned) rem;
2224                                         req_schp->k_use_sg = k + 1;
2225                                         req_schp->sglist_len =
2226                                             rsv_schp->sglist_len;
2227                                         req_schp->buffer = rsv_schp->buffer;
2228                                 }
2229                                 req_schp->bufflen = size;
2230                                 req_schp->b_malloc_len = rsv_schp->b_malloc_len;
2231                                 break;
2232                         } else
2233                                 rem -= num;
2234                 }
2235                 if (k >= rsv_schp->k_use_sg)
2236                         SCSI_LOG_TIMEOUT(1, printk("sg_link_reserve: BAD size\n"));
2237         } else {
2238                 req_schp->k_use_sg = 0;
2239                 req_schp->bufflen = size;
2240                 req_schp->buffer = rsv_schp->buffer;
2241                 req_schp->b_malloc_len = rsv_schp->b_malloc_len;
2242         }
2243 }
2244
2245 static void
2246 sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp)
2247 {
2248         Sg_scatter_hold *req_schp = &srp->data;
2249         Sg_scatter_hold *rsv_schp = &sfp->reserve;
2250
2251         SCSI_LOG_TIMEOUT(4, printk("sg_unlink_reserve: req->k_use_sg=%d\n",
2252                                    (int) req_schp->k_use_sg));
2253         if ((rsv_schp->k_use_sg > 0) && (req_schp->k_use_sg > 0)) {
2254                 struct scatterlist *sclp =
2255                     (struct scatterlist *) rsv_schp->buffer;
2256
2257                 if (sfp->save_scat_len > 0)
2258                         (sclp + (req_schp->k_use_sg - 1))->length =
2259                             (unsigned) sfp->save_scat_len;
2260                 else
2261                         SCSI_LOG_TIMEOUT(1, printk ("sg_unlink_reserve: BAD save_scat_len\n"));
2262         }
2263         req_schp->k_use_sg = 0;
2264         req_schp->bufflen = 0;
2265         req_schp->buffer = NULL;
2266         req_schp->sglist_len = 0;
2267         sfp->save_scat_len = 0;
2268         srp->res_used = 0;
2269 }
2270
2271 static Sg_request *
2272 sg_get_rq_mark(Sg_fd * sfp, int pack_id)
2273 {
2274         Sg_request *resp;
2275         unsigned long iflags;
2276
2277         write_lock_irqsave(&sfp->rq_list_lock, iflags);
2278         for (resp = sfp->headrp; resp; resp = resp->nextrp) {
2279                 /* look for requests that are ready + not SG_IO owned */
2280                 if ((1 == resp->done) && (!resp->sg_io_owned) &&
2281                     ((-1 == pack_id) || (resp->header.pack_id == pack_id))) {
2282                         resp->done = 2; /* guard against other readers */
2283                         break;
2284                 }
2285         }
2286         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2287         return resp;
2288 }
2289
2290 #ifdef CONFIG_SCSI_PROC_FS
2291 static Sg_request *
2292 sg_get_nth_request(Sg_fd * sfp, int nth)
2293 {
2294         Sg_request *resp;
2295         unsigned long iflags;
2296         int k;
2297
2298         read_lock_irqsave(&sfp->rq_list_lock, iflags);
2299         for (k = 0, resp = sfp->headrp; resp && (k < nth);
2300              ++k, resp = resp->nextrp) ;
2301         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2302         return resp;
2303 }
2304 #endif
2305
2306 /* always adds to end of list */
2307 static Sg_request *
2308 sg_add_request(Sg_fd * sfp)
2309 {
2310         int k;
2311         unsigned long iflags;
2312         Sg_request *resp;
2313         Sg_request *rp = sfp->req_arr;
2314
2315         write_lock_irqsave(&sfp->rq_list_lock, iflags);
2316         resp = sfp->headrp;
2317         if (!resp) {
2318                 memset(rp, 0, sizeof (Sg_request));
2319                 rp->parentfp = sfp;
2320                 resp = rp;
2321                 sfp->headrp = resp;
2322         } else {
2323                 if (0 == sfp->cmd_q)
2324                         resp = NULL;    /* command queuing disallowed */
2325                 else {
2326                         for (k = 0; k < SG_MAX_QUEUE; ++k, ++rp) {
2327                                 if (!rp->parentfp)
2328                                         break;
2329                         }
2330                         if (k < SG_MAX_QUEUE) {
2331                                 memset(rp, 0, sizeof (Sg_request));
2332                                 rp->parentfp = sfp;
2333                                 while (resp->nextrp)
2334                                         resp = resp->nextrp;
2335                                 resp->nextrp = rp;
2336                                 resp = rp;
2337                         } else
2338                                 resp = NULL;
2339                 }
2340         }
2341         if (resp) {
2342                 resp->nextrp = NULL;
2343                 resp->header.duration = jiffies;
2344                 resp->my_cmdp = NULL;
2345         }
2346         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2347         return resp;
2348 }
2349
2350 /* Return of 1 for found; 0 for not found */
2351 static int
2352 sg_remove_request(Sg_fd * sfp, Sg_request * srp)
2353 {
2354         Sg_request *prev_rp;
2355         Sg_request *rp;
2356         unsigned long iflags;
2357         int res = 0;
2358
2359         if ((!sfp) || (!srp) || (!sfp->headrp))
2360                 return res;
2361         write_lock_irqsave(&sfp->rq_list_lock, iflags);
2362         prev_rp = sfp->headrp;
2363         if (srp == prev_rp) {
2364                 sfp->headrp = prev_rp->nextrp;
2365                 prev_rp->parentfp = NULL;
2366                 res = 1;
2367         } else {
2368                 while ((rp = prev_rp->nextrp)) {
2369                         if (srp == rp) {
2370                                 prev_rp->nextrp = rp->nextrp;
2371                                 rp->parentfp = NULL;
2372                                 res = 1;
2373                                 break;
2374                         }
2375                         prev_rp = rp;
2376                 }
2377         }
2378         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2379         return res;
2380 }
2381
2382 #ifdef CONFIG_SCSI_PROC_FS
2383 static Sg_fd *
2384 sg_get_nth_sfp(Sg_device * sdp, int nth)
2385 {
2386         Sg_fd *resp;
2387         unsigned long iflags;
2388         int k;
2389
2390         read_lock_irqsave(&sg_dev_arr_lock, iflags);
2391         for (k = 0, resp = sdp->headfp; resp && (k < nth);
2392              ++k, resp = resp->nextfp) ;
2393         read_unlock_irqrestore(&sg_dev_arr_lock, iflags);
2394         return resp;
2395 }
2396 #endif
2397
2398 static Sg_fd *
2399 sg_add_sfp(Sg_device * sdp, int dev)
2400 {
2401         Sg_fd *sfp;
2402         unsigned long iflags;
2403
2404         sfp = (Sg_fd *) sg_page_malloc(sizeof (Sg_fd), 0, 0);
2405         if (!sfp)
2406                 return NULL;
2407         memset(sfp, 0, sizeof (Sg_fd));
2408         init_waitqueue_head(&sfp->read_wait);
2409         sfp->rq_list_lock = RW_LOCK_UNLOCKED;
2410
2411         sfp->timeout = SG_DEFAULT_TIMEOUT;
2412         sfp->timeout_user = SG_DEFAULT_TIMEOUT_USER;
2413         sfp->force_packid = SG_DEF_FORCE_PACK_ID;
2414         sfp->low_dma = (SG_DEF_FORCE_LOW_DMA == 0) ?
2415             sdp->device->host->unchecked_isa_dma : 1;
2416         sfp->cmd_q = SG_DEF_COMMAND_Q;
2417         sfp->keep_orphan = SG_DEF_KEEP_ORPHAN;
2418         sfp->parentdp = sdp;
2419         write_lock_irqsave(&sg_dev_arr_lock, iflags);
2420         if (!sdp->headfp)
2421                 sdp->headfp = sfp;
2422         else {                  /* add to tail of existing list */
2423                 Sg_fd *pfp = sdp->headfp;
2424                 while (pfp->nextfp)
2425                         pfp = pfp->nextfp;
2426                 pfp->nextfp = sfp;
2427         }
2428         write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
2429         SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp: sfp=0x%p\n", sfp));
2430         sg_build_reserve(sfp, sg_big_buff);
2431         SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp:   bufflen=%d, k_use_sg=%d\n",
2432                            sfp->reserve.bufflen, sfp->reserve.k_use_sg));
2433         return sfp;
2434 }
2435
2436 static void
2437 __sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp)
2438 {
2439         Sg_fd *fp;
2440         Sg_fd *prev_fp;
2441
2442         prev_fp = sdp->headfp;
2443         if (sfp == prev_fp)
2444                 sdp->headfp = prev_fp->nextfp;
2445         else {
2446                 while ((fp = prev_fp->nextfp)) {
2447                         if (sfp == fp) {
2448                                 prev_fp->nextfp = fp->nextfp;
2449                                 break;
2450                         }
2451                         prev_fp = fp;
2452                 }
2453         }
2454         if (sfp->reserve.bufflen > 0) {
2455                 SCSI_LOG_TIMEOUT(6,
2456                         printk("__sg_remove_sfp:    bufflen=%d, k_use_sg=%d\n",
2457                         (int) sfp->reserve.bufflen, (int) sfp->reserve.k_use_sg));
2458                 if (sfp->mmap_called)
2459                         sg_rb_correct4mmap(&sfp->reserve, 0);   /* undo correction */
2460                 sg_remove_scat(&sfp->reserve);
2461         }
2462         sfp->parentdp = NULL;
2463         SCSI_LOG_TIMEOUT(6, printk("__sg_remove_sfp:    sfp=0x%p\n", sfp));
2464         sg_page_free((char *) sfp, sizeof (Sg_fd));
2465 }
2466
2467 /* Returns 0 in normal case, 1 when detached and sdp object removed */
2468 static int
2469 sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp)
2470 {
2471         Sg_request *srp;
2472         Sg_request *tsrp;
2473         int dirty = 0;
2474         int res = 0;
2475
2476         for (srp = sfp->headrp; srp; srp = tsrp) {
2477                 tsrp = srp->nextrp;
2478                 if (srp->done)
2479                         sg_finish_rem_req(srp);
2480                 else
2481                         ++dirty;
2482         }
2483         if (0 == dirty) {
2484                 unsigned long iflags;
2485
2486                 write_lock_irqsave(&sg_dev_arr_lock, iflags);
2487                 __sg_remove_sfp(sdp, sfp);
2488                 if (sdp->detached && (NULL == sdp->headfp)) {
2489                         int k, maxd;
2490
2491                         maxd = sg_dev_max;
2492                         for (k = 0; k < maxd; ++k) {
2493                                 if (sdp == sg_dev_arr[k])
2494                                         break;
2495                         }
2496                         if (k < maxd)
2497                                 sg_dev_arr[k] = NULL;
2498                         vfree((char *) sdp);
2499                         res = 1;
2500                 }
2501                 write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
2502         } else {
2503                 /* MOD_INC's to inhibit unloading sg and associated adapter driver */
2504                 /* only bump the access_count if we actually succeeded in
2505                  * throwing another counter on the host module */
2506                 scsi_device_get(sdp->device);   /* XXX: retval ignored? */
2507                 sfp->closed = 1;        /* flag dirty state on this fd */
2508                 SCSI_LOG_TIMEOUT(1, printk("sg_remove_sfp: worrisome, %d writes pending\n",
2509                                   dirty));
2510         }
2511         return res;
2512 }
2513
2514 static int
2515 sg_res_in_use(Sg_fd * sfp)
2516 {
2517         const Sg_request *srp;
2518         unsigned long iflags;
2519
2520         read_lock_irqsave(&sfp->rq_list_lock, iflags);
2521         for (srp = sfp->headrp; srp; srp = srp->nextrp)
2522                 if (srp->res_used)
2523                         break;
2524         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2525         return srp ? 1 : 0;
2526 }
2527
2528 /* If retSzp==NULL want exact size or fail */
2529 static char *
2530 sg_page_malloc(int rqSz, int lowDma, int *retSzp)
2531 {
2532         char *resp = NULL;
2533         int page_mask;
2534         int order, a_size;
2535         int resSz = rqSz;
2536
2537         if (rqSz <= 0)
2538                 return resp;
2539
2540         if (lowDma)
2541                 page_mask = GFP_ATOMIC | GFP_DMA | __GFP_NOWARN;
2542         else
2543                 page_mask = GFP_ATOMIC | __GFP_NOWARN;
2544
2545         for (order = 0, a_size = PAGE_SIZE; a_size < rqSz;
2546              order++, a_size <<= 1) ;
2547         resp = (char *) __get_free_pages(page_mask, order);
2548         while ((!resp) && order && retSzp) {
2549                 --order;
2550                 a_size >>= 1;   /* divide by 2, until PAGE_SIZE */
2551                 resp = (char *) __get_free_pages(page_mask, order);     /* try half */
2552                 resSz = a_size;
2553         }
2554         if (resp) {
2555                 if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
2556                         memset(resp, 0, resSz);
2557                 if (retSzp)
2558                         *retSzp = resSz;
2559         }
2560         return resp;
2561 }
2562
2563 static void
2564 sg_page_free(char *buff, int size)
2565 {
2566         int order, a_size;
2567
2568         if (!buff)
2569                 return;
2570         for (order = 0, a_size = PAGE_SIZE; a_size < size;
2571              order++, a_size <<= 1) ;
2572         free_pages((unsigned long) buff, order);
2573 }
2574
2575 static int
2576 sg_ms_to_jif(unsigned int msecs)
2577 {
2578         if ((UINT_MAX / 2U) < msecs)
2579                 return INT_MAX; /* special case, set largest possible */
2580         else
2581                 return ((int) msecs <
2582                         (INT_MAX / 1000)) ? (((int) msecs * HZ) / 1000)
2583                     : (((int) msecs / 1000) * HZ);
2584 }
2585
2586 static inline unsigned
2587 sg_jif_to_ms(int jifs)
2588 {
2589         if (jifs <= 0)
2590                 return 0U;
2591         else {
2592                 unsigned int j = (unsigned int) jifs;
2593                 return (j <
2594                         (UINT_MAX / 1000)) ? ((j * 1000) / HZ) : ((j / HZ) *
2595                                                                   1000);
2596         }
2597 }
2598
2599 static unsigned char allow_ops[] = { TEST_UNIT_READY, REQUEST_SENSE,
2600         INQUIRY, READ_CAPACITY, READ_BUFFER, READ_6, READ_10, READ_12,
2601         MODE_SENSE, MODE_SENSE_10, LOG_SENSE
2602 };
2603
2604 static int
2605 sg_allow_access(unsigned char opcode, char dev_type)
2606 {
2607         int k;
2608
2609         if (TYPE_SCANNER == dev_type)   /* TYPE_ROM maybe burner */
2610                 return 1;
2611         for (k = 0; k < sizeof (allow_ops); ++k) {
2612                 if (opcode == allow_ops[k])
2613                         return 1;
2614         }
2615         return 0;
2616 }
2617
2618 #ifdef CONFIG_SCSI_PROC_FS
2619 static int
2620 sg_last_dev(void)
2621 {
2622         int k;
2623         unsigned long iflags;
2624
2625         read_lock_irqsave(&sg_dev_arr_lock, iflags);
2626         for (k = sg_dev_max - 1; k >= 0; --k)
2627                 if (sg_dev_arr[k] && sg_dev_arr[k]->device)
2628                         break;
2629         read_unlock_irqrestore(&sg_dev_arr_lock, iflags);
2630         return k + 1;           /* origin 1 */
2631 }
2632 #endif
2633
2634 static Sg_device *
2635 sg_get_dev(int dev)
2636 {
2637         Sg_device *sdp = NULL;
2638         unsigned long iflags;
2639
2640         if (sg_dev_arr && (dev >= 0)) {
2641                 read_lock_irqsave(&sg_dev_arr_lock, iflags);
2642                 if (dev < sg_dev_max)
2643                         sdp = sg_dev_arr[dev];
2644                 read_unlock_irqrestore(&sg_dev_arr_lock, iflags);
2645         }
2646         return sdp;
2647 }
2648
2649 #ifdef CONFIG_SCSI_PROC_FS
2650
2651 static struct proc_dir_entry *sg_proc_sgp = NULL;
2652
2653 static char sg_proc_sg_dirname[] = "scsi/sg";
2654
2655 static int sg_proc_seq_show_int(struct seq_file *s, void *v);
2656
2657 static int sg_proc_single_open_adio(struct inode *inode, struct file *file);
2658 static ssize_t sg_proc_write_adio(struct file *filp, const char __user *buffer,
2659                                   size_t count, loff_t *off);
2660 static struct file_operations adio_fops = {
2661         /* .owner, .read and .llseek added in sg_proc_init() */
2662         .open = sg_proc_single_open_adio,
2663         .write = sg_proc_write_adio,
2664         .release = single_release,
2665 };
2666
2667 static int sg_proc_single_open_dressz(struct inode *inode, struct file *file);
2668 static ssize_t sg_proc_write_dressz(struct file *filp,
2669                 const char __user *buffer, size_t count, loff_t *off);
2670 static struct file_operations dressz_fops = {
2671         .open = sg_proc_single_open_dressz,
2672         .write = sg_proc_write_dressz,
2673         .release = single_release,
2674 };
2675
2676 static int sg_proc_seq_show_version(struct seq_file *s, void *v);
2677 static int sg_proc_single_open_version(struct inode *inode, struct file *file);
2678 static struct file_operations version_fops = {
2679         .open = sg_proc_single_open_version,
2680         .release = single_release,
2681 };
2682
2683 static int sg_proc_seq_show_devhdr(struct seq_file *s, void *v);
2684 static int sg_proc_single_open_devhdr(struct inode *inode, struct file *file);
2685 static struct file_operations devhdr_fops = {
2686         .open = sg_proc_single_open_devhdr,
2687         .release = single_release,
2688 };
2689
2690 static int sg_proc_seq_show_dev(struct seq_file *s, void *v);
2691 static int sg_proc_open_dev(struct inode *inode, struct file *file);
2692 static void * dev_seq_start(struct seq_file *s, loff_t *pos);
2693 static void * dev_seq_next(struct seq_file *s, void *v, loff_t *pos);
2694 static void dev_seq_stop(struct seq_file *s, void *v);
2695 static struct file_operations dev_fops = {
2696         .open = sg_proc_open_dev,
2697         .release = seq_release,
2698 };
2699 static struct seq_operations dev_seq_ops = {
2700         .start = dev_seq_start,
2701         .next  = dev_seq_next,
2702         .stop  = dev_seq_stop,
2703         .show  = sg_proc_seq_show_dev,
2704 };
2705
2706 static int sg_proc_seq_show_devstrs(struct seq_file *s, void *v);
2707 static int sg_proc_open_devstrs(struct inode *inode, struct file *file);
2708 static struct file_operations devstrs_fops = {
2709         .open = sg_proc_open_devstrs,
2710         .release = seq_release,
2711 };
2712 static struct seq_operations devstrs_seq_ops = {
2713         .start = dev_seq_start,
2714         .next  = dev_seq_next,
2715         .stop  = dev_seq_stop,
2716         .show  = sg_proc_seq_show_devstrs,
2717 };
2718
2719 static int sg_proc_seq_show_debug(struct seq_file *s, void *v);
2720 static int sg_proc_open_debug(struct inode *inode, struct file *file);
2721 static struct file_operations debug_fops = {
2722         .open = sg_proc_open_debug,
2723         .release = seq_release,
2724 };
2725 static struct seq_operations debug_seq_ops = {
2726         .start = dev_seq_start,
2727         .next  = dev_seq_next,
2728         .stop  = dev_seq_stop,
2729         .show  = sg_proc_seq_show_debug,
2730 };
2731
2732
2733 struct sg_proc_leaf {
2734         const char * name;
2735         struct file_operations * fops;
2736 };
2737
2738 static struct sg_proc_leaf sg_proc_leaf_arr[] = {
2739         {"allow_dio", &adio_fops},
2740         {"debug", &debug_fops},
2741         {"def_reserved_size", &dressz_fops},
2742         {"device_hdr", &devhdr_fops},
2743         {"devices", &dev_fops},
2744         {"device_strs", &devstrs_fops},
2745         {"version", &version_fops}
2746 };
2747
2748 static int
2749 sg_proc_init(void)
2750 {
2751         int k, mask;
2752         int num_leaves =
2753             sizeof (sg_proc_leaf_arr) / sizeof (sg_proc_leaf_arr[0]);
2754         struct proc_dir_entry *pdep;
2755         struct sg_proc_leaf * leaf;
2756
2757         sg_proc_sgp = create_proc_entry(sg_proc_sg_dirname,
2758                                         S_IFDIR | S_IRUGO | S_IXUGO, NULL);
2759         if (!sg_proc_sgp)
2760                 return 1;
2761         for (k = 0; k < num_leaves; ++k) {
2762                 leaf = &sg_proc_leaf_arr[k];
2763                 mask = leaf->fops->write ? S_IRUGO | S_IWUSR : S_IRUGO;
2764                 pdep = create_proc_entry(leaf->name, mask, sg_proc_sgp);
2765                 if (pdep) {
2766                         leaf->fops->owner = THIS_MODULE,
2767                         leaf->fops->read = seq_read,
2768                         leaf->fops->llseek = seq_lseek,
2769                         pdep->proc_fops = leaf->fops;
2770                 }
2771         }
2772         return 0;
2773 }
2774
2775 static void
2776 sg_proc_cleanup(void)
2777 {
2778         int k;
2779         int num_leaves =
2780             sizeof (sg_proc_leaf_arr) / sizeof (sg_proc_leaf_arr[0]);
2781
2782         if (!sg_proc_sgp)
2783                 return;
2784         for (k = 0; k < num_leaves; ++k)
2785                 remove_proc_entry(sg_proc_leaf_arr[k].name, sg_proc_sgp);
2786         remove_proc_entry(sg_proc_sg_dirname, NULL);
2787 }
2788
2789
2790 static int sg_proc_seq_show_int(struct seq_file *s, void *v)
2791 {
2792         seq_printf(s, "%d\n", *((int *)s->private));
2793         return 0;
2794 }
2795
2796 static int sg_proc_single_open_adio(struct inode *inode, struct file *file)
2797 {
2798         return single_open(file, sg_proc_seq_show_int, &sg_allow_dio);
2799 }
2800
2801 static ssize_t
2802 sg_proc_write_adio(struct file *filp, const char __user *buffer,
2803                    size_t count, loff_t *off)
2804 {
2805         int num;
2806         char buff[11];
2807
2808         if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
2809                 return -EACCES;
2810         num = (count < 10) ? count : 10;
2811         if (copy_from_user(buff, buffer, num))
2812                 return -EFAULT;
2813         buff[num] = '\0';
2814         sg_allow_dio = simple_strtoul(buff, 0, 10) ? 1 : 0;
2815         return count;
2816 }
2817
2818 static int sg_proc_single_open_dressz(struct inode *inode, struct file *file)
2819 {
2820         return single_open(file, sg_proc_seq_show_int, &sg_big_buff);
2821 }
2822
2823 static ssize_t
2824 sg_proc_write_dressz(struct file *filp, const char __user *buffer,
2825                      size_t count, loff_t *off)
2826 {
2827         int num;
2828         unsigned long k = ULONG_MAX;
2829         char buff[11];
2830
2831         if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
2832                 return -EACCES;
2833         num = (count < 10) ? count : 10;
2834         if (copy_from_user(buff, buffer, num))
2835                 return -EFAULT;
2836         buff[num] = '\0';
2837         k = simple_strtoul(buff, 0, 10);
2838         if (k <= 1048576) {     /* limit "big buff" to 1 MB */
2839                 sg_big_buff = k;
2840                 return count;
2841         }
2842         return -ERANGE;
2843 }
2844
2845 static int sg_proc_seq_show_version(struct seq_file *s, void *v)
2846 {
2847         seq_printf(s, "%d\t%s\n", sg_version_num, sg_version_str);
2848         return 0;
2849 }
2850
2851 static int sg_proc_single_open_version(struct inode *inode, struct file *file)
2852 {
2853         return single_open(file, sg_proc_seq_show_version, NULL);
2854 }
2855
2856 static int sg_proc_seq_show_devhdr(struct seq_file *s, void *v)
2857 {
2858         seq_printf(s, "host\tchan\tid\tlun\ttype\topens\tqdepth\tbusy\t"
2859                    "online\n");
2860         return 0;
2861 }
2862
2863 static int sg_proc_single_open_devhdr(struct inode *inode, struct file *file)
2864 {
2865         return single_open(file, sg_proc_seq_show_devhdr, NULL);
2866 }
2867
2868 struct sg_proc_deviter {
2869         loff_t  index;
2870         size_t  max;
2871 };
2872
2873 static void * dev_seq_start(struct seq_file *s, loff_t *pos)
2874 {
2875         struct sg_proc_deviter * it = kmalloc(sizeof(*it), GFP_KERNEL);
2876
2877         if (! it)
2878                 return NULL;
2879         if (NULL == sg_dev_arr)
2880                 goto err1;
2881         it->index = *pos;
2882         it->max = sg_last_dev();
2883         if (it->index >= it->max)
2884                 goto err1;
2885         return it;
2886 err1:
2887         kfree(it);
2888         return NULL;
2889 }
2890
2891 static void * dev_seq_next(struct seq_file *s, void *v, loff_t *pos)
2892 {
2893         struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
2894
2895         *pos = ++it->index;
2896         return (it->index < it->max) ? it : NULL;
2897 }
2898
2899 static void dev_seq_stop(struct seq_file *s, void *v)
2900 {
2901         kfree (v);
2902 }
2903
2904 static int sg_proc_open_dev(struct inode *inode, struct file *file)
2905 {
2906         return seq_open(file, &dev_seq_ops);
2907 }
2908
2909 static int sg_proc_seq_show_dev(struct seq_file *s, void *v)
2910 {
2911         struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
2912         Sg_device *sdp;
2913         struct scsi_device *scsidp;
2914
2915         sdp = it ? sg_get_dev(it->index) : NULL;
2916         if (sdp && (scsidp = sdp->device) && (!sdp->detached))
2917                 seq_printf(s, "%d\t%d\t%d\t%d\t%d\t%d\t%d\t%d\t%d\n",
2918                               scsidp->host->host_no, scsidp->channel,
2919                               scsidp->id, scsidp->lun, (int) scsidp->type,
2920                               1,
2921                               (int) scsidp->queue_depth,
2922                               (int) scsidp->device_busy,
2923                               (int) scsi_device_online(scsidp));
2924         else
2925                 seq_printf(s, "-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\n");
2926         return 0;
2927 }
2928
2929 static int sg_proc_open_devstrs(struct inode *inode, struct file *file)
2930 {
2931         return seq_open(file, &devstrs_seq_ops);
2932 }
2933
2934 static int sg_proc_seq_show_devstrs(struct seq_file *s, void *v)
2935 {
2936         struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
2937         Sg_device *sdp;
2938         struct scsi_device *scsidp;
2939
2940         sdp = it ? sg_get_dev(it->index) : NULL;
2941         if (sdp && (scsidp = sdp->device) && (!sdp->detached))
2942                 seq_printf(s, "%8.8s\t%16.16s\t%4.4s\n",
2943                            scsidp->vendor, scsidp->model, scsidp->rev);
2944         else
2945                 seq_printf(s, "<no active device>\n");
2946         return 0;
2947 }
2948
2949 static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp)
2950 {
2951         int k, m, new_interface, blen, usg;
2952         Sg_request *srp;
2953         Sg_fd *fp;
2954         const sg_io_hdr_t *hp;
2955         const char * cp;
2956
2957         for (k = 0; (fp = sg_get_nth_sfp(sdp, k)); ++k) {
2958                 seq_printf(s, "   FD(%d): timeout=%dms bufflen=%d "
2959                            "(res)sgat=%d low_dma=%d\n", k + 1,
2960                            sg_jif_to_ms(fp->timeout),
2961                            fp->reserve.bufflen,
2962                            (int) fp->reserve.k_use_sg,
2963                            (int) fp->low_dma);
2964                 seq_printf(s, "   cmd_q=%d f_packid=%d k_orphan=%d closed=%d\n",
2965                            (int) fp->cmd_q, (int) fp->force_packid,
2966                            (int) fp->keep_orphan, (int) fp->closed);
2967                 for (m = 0; (srp = sg_get_nth_request(fp, m)); ++m) {
2968                         hp = &srp->header;
2969                         new_interface = (hp->interface_id == '\0') ? 0 : 1;
2970                         if (srp->res_used) {
2971                                 if (new_interface &&
2972                                     (SG_FLAG_MMAP_IO & hp->flags))
2973                                         cp = "     mmap>> ";
2974                                 else
2975                                         cp = "     rb>> ";
2976                         } else {
2977                                 if (SG_INFO_DIRECT_IO_MASK & hp->info)
2978                                         cp = "     dio>> ";
2979                                 else
2980                                         cp = "     ";
2981                         }
2982                         seq_printf(s, cp);
2983                         blen = srp->my_cmdp ?
2984                                 srp->my_cmdp->sr_bufflen : srp->data.bufflen;
2985                         usg = srp->my_cmdp ?
2986                                 srp->my_cmdp->sr_use_sg : srp->data.k_use_sg;
2987                         seq_printf(s, srp->done ?
2988                                    ((1 == srp->done) ?  "rcv:" : "fin:")
2989                                    : (srp->my_cmdp ? "act:" : "prior:"));
2990                         seq_printf(s, " id=%d blen=%d",
2991                                    srp->header.pack_id, blen);
2992                         if (srp->done)
2993                                 seq_printf(s, " dur=%d", hp->duration);
2994                         else
2995                                 seq_printf(s, " t_o/elap=%d/%d",
2996                                   new_interface ? hp->timeout : sg_jif_to_ms(fp->timeout),
2997                                   sg_jif_to_ms(hp->duration ? (jiffies - hp->duration) : 0));
2998                         seq_printf(s, "ms sgat=%d op=0x%02x\n", usg,
2999                                    (int) srp->data.cmd_opcode);
3000                 }
3001                 if (0 == m)
3002                         seq_printf(s, "     No requests active\n");
3003         }
3004 }
3005
3006 static int sg_proc_open_debug(struct inode *inode, struct file *file)
3007 {
3008         return seq_open(file, &debug_seq_ops);
3009 }
3010
3011 static int sg_proc_seq_show_debug(struct seq_file *s, void *v)
3012 {
3013         struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
3014         Sg_device *sdp;
3015
3016         if (it && (0 == it->index)) {
3017                 seq_printf(s, "dev_max(currently)=%d max_active_device=%d "
3018                            "(origin 1)\n", sg_dev_max, (int)it->max);
3019                 seq_printf(s, " def_reserved_size=%d\n", sg_big_buff);
3020         }
3021         sdp = it ? sg_get_dev(it->index) : NULL;
3022         if (sdp) {
3023                 struct scsi_device *scsidp = sdp->device;
3024
3025                 if (NULL == scsidp) {
3026                         seq_printf(s, "device %d detached ??\n",
3027                                    (int)it->index);
3028                         return 0;
3029                 }
3030
3031                 if (sg_get_nth_sfp(sdp, 0)) {
3032                         seq_printf(s, " >>> device=%s ",
3033                                 sdp->disk->disk_name);
3034                         if (sdp->detached)
3035                                 seq_printf(s, "detached pending close ");
3036                         else
3037                                 seq_printf
3038                                     (s, "scsi%d chan=%d id=%d lun=%d   em=%d",
3039                                      scsidp->host->host_no,
3040                                      scsidp->channel, scsidp->id,
3041                                      scsidp->lun,
3042                                      scsidp->host->hostt->emulated);
3043                         seq_printf(s, " sg_tablesize=%d excl=%d\n",
3044                                    sdp->sg_tablesize, sdp->exclude);
3045                 }
3046                 sg_proc_debug_helper(s, sdp);
3047         }
3048         return 0;
3049 }
3050
3051 #endif                          /* CONFIG_SCSI_PROC_FS */
3052
3053 module_init(init_sg);
3054 module_exit(exit_sg);
3055 MODULE_ALIAS_CHARDEV_MAJOR(SCSI_GENERIC_MAJOR);