1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Changes: 4 * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 08/23/2000 5 * - get rid of some verify_areas and use __copy*user and __get/put_user 6 * for the ones that remain 7 */ 8 #include <linux/module.h> 9 #include <linux/blkdev.h> 10 #include <linux/interrupt.h> 11 #include <linux/errno.h> 12 #include <linux/kernel.h> 13 #include <linux/sched.h> 14 #include <linux/mm.h> 15 #include <linux/string.h> 16 #include <linux/uaccess.h> 17 #include <linux/cdrom.h> 18 19 #include <scsi/scsi.h> 20 #include <scsi/scsi_cmnd.h> 21 #include <scsi/scsi_device.h> 22 #include <scsi/scsi_eh.h> 23 #include <scsi/scsi_host.h> 24 #include <scsi/scsi_ioctl.h> 25 #include <scsi/sg.h> 26 #include <scsi/scsi_dbg.h> 27 28 #include "scsi_logging.h" 29 30 #define NORMAL_RETRIES 5 31 #define IOCTL_NORMAL_TIMEOUT (10 * HZ) 32 33 #define MAX_BUF PAGE_SIZE 34 35 /** 36 * ioctl_probe -- return host identification 37 * @host: host to identify 38 * @buffer: userspace buffer for identification 39 * 40 * Return: 41 * * if successful, %1 and an identifying string at @buffer, if @buffer 42 * is non-NULL, filling to the length stored at * (int *) @buffer. 43 * * <0 error code on failure. 44 */ 45 static int ioctl_probe(struct Scsi_Host *host, void __user *buffer) 46 { 47 unsigned int len, slen; 48 const char *string; 49 50 if (buffer) { 51 if (get_user(len, (unsigned int __user *) buffer)) 52 return -EFAULT; 53 54 if (host->hostt->info) 55 string = host->hostt->info(host); 56 else 57 string = host->hostt->name; 58 if (string) { 59 slen = strlen(string); 60 if (len > slen) 61 len = slen + 1; 62 if (copy_to_user(buffer, string, len)) 63 return -EFAULT; 64 } 65 } 66 return 1; 67 } 68 69 static int ioctl_internal_command(struct scsi_device *sdev, char *cmd, 70 int timeout, int retries) 71 { 72 int result; 73 struct scsi_sense_hdr sshdr; 74 const struct scsi_exec_args exec_args = { 75 .sshdr = &sshdr, 76 }; 77 78 SCSI_LOG_IOCTL(1, sdev_printk(KERN_INFO, sdev, 79 "Trying ioctl with scsi command %d\n", *cmd)); 80 81 result = scsi_execute_cmd(sdev, cmd, REQ_OP_DRV_IN, NULL, 0, timeout, 82 retries, &exec_args); 83 84 SCSI_LOG_IOCTL(2, sdev_printk(KERN_INFO, sdev, 85 "Ioctl returned 0x%x\n", result)); 86 87 if (result < 0) 88 goto out; 89 if (scsi_sense_valid(&sshdr)) { 90 switch (sshdr.sense_key) { 91 case ILLEGAL_REQUEST: 92 if (cmd[0] == ALLOW_MEDIUM_REMOVAL) 93 sdev->lockable = 0; 94 else 95 sdev_printk(KERN_INFO, sdev, 96 "ioctl_internal_command: " 97 "ILLEGAL REQUEST " 98 "asc=0x%x ascq=0x%x\n", 99 sshdr.asc, sshdr.ascq); 100 break; 101 case NOT_READY: /* This happens if there is no disc in drive */ 102 if (sdev->removable) 103 break; 104 fallthrough; 105 case UNIT_ATTENTION: 106 if (sdev->removable) { 107 sdev->changed = 1; 108 result = 0; /* This is no longer considered an error */ 109 break; 110 } 111 fallthrough; /* for non-removable media */ 112 default: 113 sdev_printk(KERN_INFO, sdev, 114 "ioctl_internal_command return code = %x\n", 115 result); 116 scsi_print_sense_hdr(sdev, NULL, &sshdr); 117 break; 118 } 119 } 120 out: 121 SCSI_LOG_IOCTL(2, sdev_printk(KERN_INFO, sdev, 122 "IOCTL Releasing command\n")); 123 return result; 124 } 125 126 /** 127 * scsi_set_medium_removal() - send command to allow or prevent medium removal 128 * @sdev: target scsi device 129 * @state: removal state to set (prevent or allow) 130 * 131 * Returns: 132 * * %0 if @sdev is not removable or not lockable or successful. 133 * * non-%0 is a SCSI result code if > 0 or kernel error code if < 0. 134 * * Sets @sdev->locked to the new state on success. 135 */ 136 int scsi_set_medium_removal(struct scsi_device *sdev, char state) 137 { 138 char scsi_cmd[MAX_COMMAND_SIZE]; 139 int ret; 140 141 if (!sdev->removable || !sdev->lockable) 142 return 0; 143 144 scsi_cmd[0] = ALLOW_MEDIUM_REMOVAL; 145 scsi_cmd[1] = 0; 146 scsi_cmd[2] = 0; 147 scsi_cmd[3] = 0; 148 scsi_cmd[4] = state; 149 scsi_cmd[5] = 0; 150 151 ret = ioctl_internal_command(sdev, scsi_cmd, 152 IOCTL_NORMAL_TIMEOUT, NORMAL_RETRIES); 153 if (ret == 0) 154 sdev->locked = (state == SCSI_REMOVAL_PREVENT); 155 return ret; 156 } 157 EXPORT_SYMBOL(scsi_set_medium_removal); 158 159 /* 160 * The scsi_ioctl_get_pci() function places into arg the value 161 * pci_dev::slot_name (8 characters) for the PCI device (if any). 162 * Returns: 0 on success 163 * -ENXIO if there isn't a PCI device pointer 164 * (could be because the SCSI driver hasn't been 165 * updated yet, or because it isn't a SCSI 166 * device) 167 * any copy_to_user() error on failure there 168 */ 169 static int scsi_ioctl_get_pci(struct scsi_device *sdev, void __user *arg) 170 { 171 struct device *dev = scsi_get_device(sdev->host); 172 const char *name; 173 174 if (!dev) 175 return -ENXIO; 176 177 name = dev_name(dev); 178 179 /* compatibility with old ioctl which only returned 180 * 20 characters */ 181 return copy_to_user(arg, name, min(strlen(name), (size_t)20)) 182 ? -EFAULT: 0; 183 } 184 185 static int sg_get_version(int __user *p) 186 { 187 static const int sg_version_num = 30527; 188 return put_user(sg_version_num, p); 189 } 190 191 static int sg_set_timeout(struct scsi_device *sdev, int __user *p) 192 { 193 int timeout, err = get_user(timeout, p); 194 195 if (!err) 196 sdev->sg_timeout = clock_t_to_jiffies(timeout); 197 198 return err; 199 } 200 201 static int sg_get_reserved_size(struct scsi_device *sdev, int __user *p) 202 { 203 int val = min(sdev->sg_reserved_size, 204 queue_max_bytes(sdev->request_queue)); 205 206 return put_user(val, p); 207 } 208 209 static int sg_set_reserved_size(struct scsi_device *sdev, int __user *p) 210 { 211 int size, err = get_user(size, p); 212 213 if (err) 214 return err; 215 216 if (size < 0) 217 return -EINVAL; 218 219 sdev->sg_reserved_size = min_t(unsigned int, size, 220 queue_max_bytes(sdev->request_queue)); 221 return 0; 222 } 223 224 /* 225 * will always return that we are ATAPI even for a real SCSI drive, I'm not 226 * so sure this is worth doing anything about (why would you care??) 227 */ 228 static int sg_emulated_host(struct request_queue *q, int __user *p) 229 { 230 return put_user(1, p); 231 } 232 233 static int scsi_get_idlun(struct scsi_device *sdev, void __user *argp) 234 { 235 struct scsi_idlun v = { 236 .dev_id = (sdev->id & 0xff) + 237 ((sdev->lun & 0xff) << 8) + 238 ((sdev->channel & 0xff) << 16) + 239 ((sdev->host->host_no & 0xff) << 24), 240 .host_unique_id = sdev->host->unique_id 241 }; 242 if (copy_to_user(argp, &v, sizeof(struct scsi_idlun))) 243 return -EFAULT; 244 return 0; 245 } 246 247 static int scsi_send_start_stop(struct scsi_device *sdev, int data) 248 { 249 u8 cdb[MAX_COMMAND_SIZE] = { }; 250 251 cdb[0] = START_STOP; 252 cdb[4] = data; 253 return ioctl_internal_command(sdev, cdb, START_STOP_TIMEOUT, 254 NORMAL_RETRIES); 255 } 256 257 /** 258 * scsi_cmd_allowed() - Check if the given command is allowed. 259 * @cmd: SCSI command to check 260 * @open_for_write: is the file / block device opened for writing? 261 * 262 * Only a subset of commands are allowed for unprivileged users. Commands used 263 * to format the media, update the firmware, etc. are not permitted. 264 * 265 * Return: %true if the cmd is allowed, otherwise @false. 266 */ 267 bool scsi_cmd_allowed(unsigned char *cmd, bool open_for_write) 268 { 269 /* root can do any command. */ 270 if (capable(CAP_SYS_RAWIO)) 271 return true; 272 273 /* Anybody who can open the device can do a read-safe command */ 274 switch (cmd[0]) { 275 /* Basic read-only commands */ 276 case TEST_UNIT_READY: 277 case REQUEST_SENSE: 278 case READ_6: 279 case READ_10: 280 case READ_12: 281 case READ_16: 282 case READ_BUFFER: 283 case READ_DEFECT_DATA: 284 case READ_CAPACITY: /* also GPCMD_READ_CDVD_CAPACITY */ 285 case READ_LONG: 286 case INQUIRY: 287 case MODE_SENSE: 288 case MODE_SENSE_10: 289 case LOG_SENSE: 290 case START_STOP: 291 case GPCMD_VERIFY_10: 292 case VERIFY_16: 293 case REPORT_LUNS: 294 case SERVICE_ACTION_IN_16: 295 case RECEIVE_DIAGNOSTIC: 296 case MAINTENANCE_IN: /* also GPCMD_SEND_KEY, which is a write command */ 297 case GPCMD_READ_BUFFER_CAPACITY: 298 /* Audio CD commands */ 299 case GPCMD_PLAY_CD: 300 case GPCMD_PLAY_AUDIO_10: 301 case GPCMD_PLAY_AUDIO_MSF: 302 case GPCMD_PLAY_AUDIO_TI: 303 case GPCMD_PAUSE_RESUME: 304 /* CD/DVD data reading */ 305 case GPCMD_READ_CD: 306 case GPCMD_READ_CD_MSF: 307 case GPCMD_READ_DISC_INFO: 308 case GPCMD_READ_DVD_STRUCTURE: 309 case GPCMD_READ_HEADER: 310 case GPCMD_READ_TRACK_RZONE_INFO: 311 case GPCMD_READ_SUBCHANNEL: 312 case GPCMD_READ_TOC_PMA_ATIP: 313 case GPCMD_REPORT_KEY: 314 case GPCMD_SCAN: 315 case GPCMD_GET_CONFIGURATION: 316 case GPCMD_READ_FORMAT_CAPACITIES: 317 case GPCMD_GET_EVENT_STATUS_NOTIFICATION: 318 case GPCMD_GET_PERFORMANCE: 319 case GPCMD_SEEK: 320 case GPCMD_STOP_PLAY_SCAN: 321 /* ZBC */ 322 case ZBC_IN: 323 return true; 324 /* Basic writing commands */ 325 case WRITE_6: 326 case WRITE_10: 327 case WRITE_VERIFY: 328 case WRITE_12: 329 case WRITE_VERIFY_12: 330 case WRITE_16: 331 case WRITE_LONG: 332 case WRITE_LONG_2: 333 case WRITE_SAME: 334 case WRITE_SAME_16: 335 case WRITE_SAME_32: 336 case ERASE: 337 case GPCMD_MODE_SELECT_10: 338 case MODE_SELECT: 339 case LOG_SELECT: 340 case GPCMD_BLANK: 341 case GPCMD_CLOSE_TRACK: 342 case GPCMD_FLUSH_CACHE: 343 case GPCMD_FORMAT_UNIT: 344 case GPCMD_REPAIR_RZONE_TRACK: 345 case GPCMD_RESERVE_RZONE_TRACK: 346 case GPCMD_SEND_DVD_STRUCTURE: 347 case GPCMD_SEND_EVENT: 348 case GPCMD_SEND_OPC: 349 case GPCMD_SEND_CUE_SHEET: 350 case GPCMD_SET_SPEED: 351 case GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL: 352 case GPCMD_LOAD_UNLOAD: 353 case GPCMD_SET_STREAMING: 354 case GPCMD_SET_READ_AHEAD: 355 /* ZBC */ 356 case ZBC_OUT: 357 return open_for_write; 358 default: 359 return false; 360 } 361 } 362 EXPORT_SYMBOL(scsi_cmd_allowed); 363 364 static int scsi_fill_sghdr_rq(struct scsi_device *sdev, struct request *rq, 365 struct sg_io_hdr *hdr, bool open_for_write) 366 { 367 struct scsi_cmnd *scmd = blk_mq_rq_to_pdu(rq); 368 369 if (hdr->cmd_len < 6) 370 return -EMSGSIZE; 371 if (copy_from_user(scmd->cmnd, hdr->cmdp, hdr->cmd_len)) 372 return -EFAULT; 373 if (!scsi_cmd_allowed(scmd->cmnd, open_for_write)) 374 return -EPERM; 375 scmd->cmd_len = hdr->cmd_len; 376 377 rq->timeout = msecs_to_jiffies(hdr->timeout); 378 if (!rq->timeout) 379 rq->timeout = sdev->sg_timeout; 380 if (!rq->timeout) 381 rq->timeout = BLK_DEFAULT_SG_TIMEOUT; 382 if (rq->timeout < BLK_MIN_SG_TIMEOUT) 383 rq->timeout = BLK_MIN_SG_TIMEOUT; 384 385 return 0; 386 } 387 388 static int scsi_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr, 389 struct bio *bio) 390 { 391 struct scsi_cmnd *scmd = blk_mq_rq_to_pdu(rq); 392 int r, ret = 0; 393 394 /* 395 * fill in all the output members 396 */ 397 hdr->status = scmd->result & 0xff; 398 hdr->masked_status = sg_status_byte(scmd->result); 399 hdr->msg_status = COMMAND_COMPLETE; 400 hdr->host_status = host_byte(scmd->result); 401 hdr->driver_status = 0; 402 if (scsi_status_is_check_condition(hdr->status)) 403 hdr->driver_status = DRIVER_SENSE; 404 hdr->info = 0; 405 if (hdr->masked_status || hdr->host_status || hdr->driver_status) 406 hdr->info |= SG_INFO_CHECK; 407 hdr->resid = scmd->resid_len; 408 hdr->sb_len_wr = 0; 409 410 if (scmd->sense_len && hdr->sbp) { 411 int len = min((unsigned int) hdr->mx_sb_len, scmd->sense_len); 412 413 if (!copy_to_user(hdr->sbp, scmd->sense_buffer, len)) 414 hdr->sb_len_wr = len; 415 else 416 ret = -EFAULT; 417 } 418 419 r = blk_rq_unmap_user(bio); 420 if (!ret) 421 ret = r; 422 423 return ret; 424 } 425 426 static int sg_io(struct scsi_device *sdev, struct sg_io_hdr *hdr, 427 bool open_for_write) 428 { 429 unsigned long start_time; 430 ssize_t ret = 0; 431 int writing = 0; 432 int at_head = 0; 433 struct request *rq; 434 struct scsi_cmnd *scmd; 435 struct bio *bio; 436 437 if (hdr->interface_id != 'S') 438 return -EINVAL; 439 440 if (hdr->dxfer_len > (queue_max_hw_sectors(sdev->request_queue) << 9)) 441 return -EIO; 442 443 if (hdr->dxfer_len) 444 switch (hdr->dxfer_direction) { 445 default: 446 return -EINVAL; 447 case SG_DXFER_TO_DEV: 448 writing = 1; 449 break; 450 case SG_DXFER_TO_FROM_DEV: 451 case SG_DXFER_FROM_DEV: 452 break; 453 } 454 if (hdr->flags & SG_FLAG_Q_AT_HEAD) 455 at_head = 1; 456 457 rq = scsi_alloc_request(sdev->request_queue, writing ? 458 REQ_OP_DRV_OUT : REQ_OP_DRV_IN, 0); 459 if (IS_ERR(rq)) 460 return PTR_ERR(rq); 461 scmd = blk_mq_rq_to_pdu(rq); 462 463 if (hdr->cmd_len > sizeof(scmd->cmnd)) { 464 ret = -EINVAL; 465 goto out_put_request; 466 } 467 468 ret = scsi_fill_sghdr_rq(sdev, rq, hdr, open_for_write); 469 if (ret < 0) 470 goto out_put_request; 471 472 ret = blk_rq_map_user_io(rq, NULL, hdr->dxferp, hdr->dxfer_len, 473 GFP_KERNEL, hdr->iovec_count && hdr->dxfer_len, 474 hdr->iovec_count, 0, rq_data_dir(rq)); 475 if (ret) 476 goto out_put_request; 477 478 bio = rq->bio; 479 scmd->allowed = 0; 480 481 start_time = jiffies; 482 483 blk_execute_rq(rq, at_head); 484 485 hdr->duration = jiffies_to_msecs(jiffies - start_time); 486 487 ret = scsi_complete_sghdr_rq(rq, hdr, bio); 488 489 out_put_request: 490 blk_mq_free_request(rq); 491 return ret; 492 } 493 494 /** 495 * sg_scsi_ioctl -- handle deprecated SCSI_IOCTL_SEND_COMMAND ioctl 496 * @q: request queue to send scsi commands down 497 * @open_for_write: is the file / block device opened for writing? 498 * @sic: userspace structure describing the command to perform 499 * 500 * Send down the scsi command described by @sic to the device below 501 * the request queue @q. 502 * 503 * Notes: 504 * - This interface is deprecated - users should use the SG_IO 505 * interface instead, as this is a more flexible approach to 506 * performing SCSI commands on a device. 507 * - The SCSI command length is determined by examining the 1st byte 508 * of the given command. There is no way to override this. 509 * - Data transfers are limited to PAGE_SIZE 510 * - The length (x + y) must be at least OMAX_SB_LEN bytes long to 511 * accommodate the sense buffer when an error occurs. 512 * The sense buffer is truncated to OMAX_SB_LEN (16) bytes so that 513 * old code will not be surprised. 514 * - If a Unix error occurs (e.g. ENOMEM) then the user will receive 515 * a negative return and the Unix error code in 'errno'. 516 * If the SCSI command succeeds then 0 is returned. 517 * Positive numbers returned are the compacted SCSI error codes (4 518 * bytes in one int) where the lowest byte is the SCSI status. 519 */ 520 static int sg_scsi_ioctl(struct request_queue *q, bool open_for_write, 521 struct scsi_ioctl_command __user *sic) 522 { 523 struct request *rq; 524 int err; 525 unsigned int in_len, out_len, bytes, opcode, cmdlen; 526 struct scsi_cmnd *scmd; 527 char *buffer = NULL; 528 529 if (!sic) 530 return -EINVAL; 531 532 /* 533 * get in an out lengths, verify they don't exceed a page worth of data 534 */ 535 if (get_user(in_len, &sic->inlen)) 536 return -EFAULT; 537 if (get_user(out_len, &sic->outlen)) 538 return -EFAULT; 539 if (in_len > PAGE_SIZE || out_len > PAGE_SIZE) 540 return -EINVAL; 541 if (get_user(opcode, &sic->data[0])) 542 return -EFAULT; 543 544 bytes = max(in_len, out_len); 545 if (bytes) { 546 buffer = kzalloc(bytes, GFP_NOIO | GFP_USER | __GFP_NOWARN); 547 if (!buffer) 548 return -ENOMEM; 549 550 } 551 552 rq = scsi_alloc_request(q, in_len ? REQ_OP_DRV_OUT : REQ_OP_DRV_IN, 0); 553 if (IS_ERR(rq)) { 554 err = PTR_ERR(rq); 555 goto error_free_buffer; 556 } 557 scmd = blk_mq_rq_to_pdu(rq); 558 559 cmdlen = COMMAND_SIZE(opcode); 560 561 /* 562 * get command and data to send to device, if any 563 */ 564 err = -EFAULT; 565 scmd->cmd_len = cmdlen; 566 if (copy_from_user(scmd->cmnd, sic->data, cmdlen)) 567 goto error; 568 569 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len)) 570 goto error; 571 572 err = -EPERM; 573 if (!scsi_cmd_allowed(scmd->cmnd, open_for_write)) 574 goto error; 575 576 /* default. possible overridden later */ 577 scmd->allowed = 5; 578 579 switch (opcode) { 580 case SEND_DIAGNOSTIC: 581 case FORMAT_UNIT: 582 rq->timeout = FORMAT_UNIT_TIMEOUT; 583 scmd->allowed = 1; 584 break; 585 case START_STOP: 586 rq->timeout = START_STOP_TIMEOUT; 587 break; 588 case MOVE_MEDIUM: 589 rq->timeout = MOVE_MEDIUM_TIMEOUT; 590 break; 591 case READ_ELEMENT_STATUS: 592 rq->timeout = READ_ELEMENT_STATUS_TIMEOUT; 593 break; 594 case READ_DEFECT_DATA: 595 rq->timeout = READ_DEFECT_DATA_TIMEOUT; 596 scmd->allowed = 1; 597 break; 598 default: 599 rq->timeout = BLK_DEFAULT_SG_TIMEOUT; 600 break; 601 } 602 603 if (bytes) { 604 err = blk_rq_map_kern(rq, buffer, bytes, GFP_NOIO); 605 if (err) 606 goto error; 607 } 608 609 blk_execute_rq(rq, false); 610 611 err = scmd->result & 0xff; /* only 8 bit SCSI status */ 612 if (err) { 613 if (scmd->sense_len && scmd->sense_buffer) { 614 /* limit sense len for backward compatibility */ 615 if (copy_to_user(sic->data, scmd->sense_buffer, 616 min(scmd->sense_len, 16U))) 617 err = -EFAULT; 618 } 619 } else { 620 if (copy_to_user(sic->data, buffer, out_len)) 621 err = -EFAULT; 622 } 623 624 error: 625 blk_mq_free_request(rq); 626 627 error_free_buffer: 628 kfree(buffer); 629 630 return err; 631 } 632 633 int put_sg_io_hdr(const struct sg_io_hdr *hdr, void __user *argp) 634 { 635 #ifdef CONFIG_COMPAT 636 if (in_compat_syscall()) { 637 struct compat_sg_io_hdr hdr32 = { 638 .interface_id = hdr->interface_id, 639 .dxfer_direction = hdr->dxfer_direction, 640 .cmd_len = hdr->cmd_len, 641 .mx_sb_len = hdr->mx_sb_len, 642 .iovec_count = hdr->iovec_count, 643 .dxfer_len = hdr->dxfer_len, 644 .dxferp = (uintptr_t)hdr->dxferp, 645 .cmdp = (uintptr_t)hdr->cmdp, 646 .sbp = (uintptr_t)hdr->sbp, 647 .timeout = hdr->timeout, 648 .flags = hdr->flags, 649 .pack_id = hdr->pack_id, 650 .usr_ptr = (uintptr_t)hdr->usr_ptr, 651 .status = hdr->status, 652 .masked_status = hdr->masked_status, 653 .msg_status = hdr->msg_status, 654 .sb_len_wr = hdr->sb_len_wr, 655 .host_status = hdr->host_status, 656 .driver_status = hdr->driver_status, 657 .resid = hdr->resid, 658 .duration = hdr->duration, 659 .info = hdr->info, 660 }; 661 662 if (copy_to_user(argp, &hdr32, sizeof(hdr32))) 663 return -EFAULT; 664 665 return 0; 666 } 667 #endif 668 669 if (copy_to_user(argp, hdr, sizeof(*hdr))) 670 return -EFAULT; 671 672 return 0; 673 } 674 EXPORT_SYMBOL(put_sg_io_hdr); 675 676 int get_sg_io_hdr(struct sg_io_hdr *hdr, const void __user *argp) 677 { 678 #ifdef CONFIG_COMPAT 679 struct compat_sg_io_hdr hdr32; 680 681 if (in_compat_syscall()) { 682 if (copy_from_user(&hdr32, argp, sizeof(hdr32))) 683 return -EFAULT; 684 685 *hdr = (struct sg_io_hdr) { 686 .interface_id = hdr32.interface_id, 687 .dxfer_direction = hdr32.dxfer_direction, 688 .cmd_len = hdr32.cmd_len, 689 .mx_sb_len = hdr32.mx_sb_len, 690 .iovec_count = hdr32.iovec_count, 691 .dxfer_len = hdr32.dxfer_len, 692 .dxferp = compat_ptr(hdr32.dxferp), 693 .cmdp = compat_ptr(hdr32.cmdp), 694 .sbp = compat_ptr(hdr32.sbp), 695 .timeout = hdr32.timeout, 696 .flags = hdr32.flags, 697 .pack_id = hdr32.pack_id, 698 .usr_ptr = compat_ptr(hdr32.usr_ptr), 699 .status = hdr32.status, 700 .masked_status = hdr32.masked_status, 701 .msg_status = hdr32.msg_status, 702 .sb_len_wr = hdr32.sb_len_wr, 703 .host_status = hdr32.host_status, 704 .driver_status = hdr32.driver_status, 705 .resid = hdr32.resid, 706 .duration = hdr32.duration, 707 .info = hdr32.info, 708 }; 709 710 return 0; 711 } 712 #endif 713 714 if (copy_from_user(hdr, argp, sizeof(*hdr))) 715 return -EFAULT; 716 717 return 0; 718 } 719 EXPORT_SYMBOL(get_sg_io_hdr); 720 721 #ifdef CONFIG_COMPAT 722 struct compat_cdrom_generic_command { 723 unsigned char cmd[CDROM_PACKET_SIZE]; 724 compat_caddr_t buffer; 725 compat_uint_t buflen; 726 compat_int_t stat; 727 compat_caddr_t sense; 728 unsigned char data_direction; 729 unsigned char pad[3]; 730 compat_int_t quiet; 731 compat_int_t timeout; 732 compat_caddr_t unused; 733 }; 734 #endif 735 736 static int scsi_get_cdrom_generic_arg(struct cdrom_generic_command *cgc, 737 const void __user *arg) 738 { 739 #ifdef CONFIG_COMPAT 740 if (in_compat_syscall()) { 741 struct compat_cdrom_generic_command cgc32; 742 743 if (copy_from_user(&cgc32, arg, sizeof(cgc32))) 744 return -EFAULT; 745 746 *cgc = (struct cdrom_generic_command) { 747 .buffer = compat_ptr(cgc32.buffer), 748 .buflen = cgc32.buflen, 749 .stat = cgc32.stat, 750 .sense = compat_ptr(cgc32.sense), 751 .data_direction = cgc32.data_direction, 752 .quiet = cgc32.quiet, 753 .timeout = cgc32.timeout, 754 .unused = compat_ptr(cgc32.unused), 755 }; 756 memcpy(&cgc->cmd, &cgc32.cmd, CDROM_PACKET_SIZE); 757 return 0; 758 } 759 #endif 760 if (copy_from_user(cgc, arg, sizeof(*cgc))) 761 return -EFAULT; 762 763 return 0; 764 } 765 766 static int scsi_put_cdrom_generic_arg(const struct cdrom_generic_command *cgc, 767 void __user *arg) 768 { 769 #ifdef CONFIG_COMPAT 770 if (in_compat_syscall()) { 771 struct compat_cdrom_generic_command cgc32 = { 772 .buffer = (uintptr_t)(cgc->buffer), 773 .buflen = cgc->buflen, 774 .stat = cgc->stat, 775 .sense = (uintptr_t)(cgc->sense), 776 .data_direction = cgc->data_direction, 777 .quiet = cgc->quiet, 778 .timeout = cgc->timeout, 779 .unused = (uintptr_t)(cgc->unused), 780 }; 781 memcpy(&cgc32.cmd, &cgc->cmd, CDROM_PACKET_SIZE); 782 783 if (copy_to_user(arg, &cgc32, sizeof(cgc32))) 784 return -EFAULT; 785 786 return 0; 787 } 788 #endif 789 if (copy_to_user(arg, cgc, sizeof(*cgc))) 790 return -EFAULT; 791 792 return 0; 793 } 794 795 static int scsi_cdrom_send_packet(struct scsi_device *sdev, bool open_for_write, 796 void __user *arg) 797 { 798 struct cdrom_generic_command cgc; 799 struct sg_io_hdr hdr; 800 int err; 801 802 err = scsi_get_cdrom_generic_arg(&cgc, arg); 803 if (err) 804 return err; 805 806 cgc.timeout = clock_t_to_jiffies(cgc.timeout); 807 memset(&hdr, 0, sizeof(hdr)); 808 hdr.interface_id = 'S'; 809 hdr.cmd_len = sizeof(cgc.cmd); 810 hdr.dxfer_len = cgc.buflen; 811 switch (cgc.data_direction) { 812 case CGC_DATA_UNKNOWN: 813 hdr.dxfer_direction = SG_DXFER_UNKNOWN; 814 break; 815 case CGC_DATA_WRITE: 816 hdr.dxfer_direction = SG_DXFER_TO_DEV; 817 break; 818 case CGC_DATA_READ: 819 hdr.dxfer_direction = SG_DXFER_FROM_DEV; 820 break; 821 case CGC_DATA_NONE: 822 hdr.dxfer_direction = SG_DXFER_NONE; 823 break; 824 default: 825 return -EINVAL; 826 } 827 828 hdr.dxferp = cgc.buffer; 829 hdr.sbp = cgc.sense; 830 if (hdr.sbp) 831 hdr.mx_sb_len = sizeof(struct request_sense); 832 hdr.timeout = jiffies_to_msecs(cgc.timeout); 833 hdr.cmdp = ((struct cdrom_generic_command __user *) arg)->cmd; 834 hdr.cmd_len = sizeof(cgc.cmd); 835 836 err = sg_io(sdev, &hdr, open_for_write); 837 if (err == -EFAULT) 838 return -EFAULT; 839 840 if (hdr.status) 841 return -EIO; 842 843 cgc.stat = err; 844 cgc.buflen = hdr.resid; 845 if (scsi_put_cdrom_generic_arg(&cgc, arg)) 846 return -EFAULT; 847 848 return err; 849 } 850 851 static int scsi_ioctl_sg_io(struct scsi_device *sdev, bool open_for_write, 852 void __user *argp) 853 { 854 struct sg_io_hdr hdr; 855 int error; 856 857 error = get_sg_io_hdr(&hdr, argp); 858 if (error) 859 return error; 860 error = sg_io(sdev, &hdr, open_for_write); 861 if (error == -EFAULT) 862 return error; 863 if (put_sg_io_hdr(&hdr, argp)) 864 return -EFAULT; 865 return error; 866 } 867 868 /** 869 * scsi_ioctl - Dispatch ioctl to scsi device 870 * @sdev: scsi device receiving ioctl 871 * @open_for_write: is the file / block device opened for writing? 872 * @cmd: which ioctl is it 873 * @arg: data associated with ioctl 874 * 875 * Description: The scsi_ioctl() function differs from most ioctls in that it 876 * does not take a major/minor number as the dev field. Rather, it takes 877 * a pointer to a &struct scsi_device. 878 * 879 * Return: varies depending on the @cmd 880 */ 881 int scsi_ioctl(struct scsi_device *sdev, bool open_for_write, int cmd, 882 void __user *arg) 883 { 884 struct request_queue *q = sdev->request_queue; 885 struct scsi_sense_hdr sense_hdr; 886 887 /* Check for deprecated ioctls ... all the ioctls which don't 888 * follow the new unique numbering scheme are deprecated */ 889 switch (cmd) { 890 case SCSI_IOCTL_SEND_COMMAND: 891 case SCSI_IOCTL_TEST_UNIT_READY: 892 case SCSI_IOCTL_BENCHMARK_COMMAND: 893 case SCSI_IOCTL_SYNC: 894 case SCSI_IOCTL_START_UNIT: 895 case SCSI_IOCTL_STOP_UNIT: 896 printk(KERN_WARNING "program %s is using a deprecated SCSI " 897 "ioctl, please convert it to SG_IO\n", current->comm); 898 break; 899 default: 900 break; 901 } 902 903 switch (cmd) { 904 case SG_GET_VERSION_NUM: 905 return sg_get_version(arg); 906 case SG_SET_TIMEOUT: 907 return sg_set_timeout(sdev, arg); 908 case SG_GET_TIMEOUT: 909 return jiffies_to_clock_t(sdev->sg_timeout); 910 case SG_GET_RESERVED_SIZE: 911 return sg_get_reserved_size(sdev, arg); 912 case SG_SET_RESERVED_SIZE: 913 return sg_set_reserved_size(sdev, arg); 914 case SG_EMULATED_HOST: 915 return sg_emulated_host(q, arg); 916 case SG_IO: 917 return scsi_ioctl_sg_io(sdev, open_for_write, arg); 918 case SCSI_IOCTL_SEND_COMMAND: 919 return sg_scsi_ioctl(q, open_for_write, arg); 920 case CDROM_SEND_PACKET: 921 return scsi_cdrom_send_packet(sdev, open_for_write, arg); 922 case CDROMCLOSETRAY: 923 return scsi_send_start_stop(sdev, 3); 924 case CDROMEJECT: 925 return scsi_send_start_stop(sdev, 2); 926 case SCSI_IOCTL_GET_IDLUN: 927 return scsi_get_idlun(sdev, arg); 928 case SCSI_IOCTL_GET_BUS_NUMBER: 929 return put_user(sdev->host->host_no, (int __user *)arg); 930 case SCSI_IOCTL_PROBE_HOST: 931 return ioctl_probe(sdev->host, arg); 932 case SCSI_IOCTL_DOORLOCK: 933 return scsi_set_medium_removal(sdev, SCSI_REMOVAL_PREVENT); 934 case SCSI_IOCTL_DOORUNLOCK: 935 return scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW); 936 case SCSI_IOCTL_TEST_UNIT_READY: 937 return scsi_test_unit_ready(sdev, IOCTL_NORMAL_TIMEOUT, 938 NORMAL_RETRIES, &sense_hdr); 939 case SCSI_IOCTL_START_UNIT: 940 return scsi_send_start_stop(sdev, 1); 941 case SCSI_IOCTL_STOP_UNIT: 942 return scsi_send_start_stop(sdev, 0); 943 case SCSI_IOCTL_GET_PCI: 944 return scsi_ioctl_get_pci(sdev, arg); 945 case SG_SCSI_RESET: 946 return scsi_ioctl_reset(sdev, arg); 947 } 948 949 #ifdef CONFIG_COMPAT 950 if (in_compat_syscall()) { 951 if (!sdev->host->hostt->compat_ioctl) 952 return -EINVAL; 953 return sdev->host->hostt->compat_ioctl(sdev, cmd, arg); 954 } 955 #endif 956 if (!sdev->host->hostt->ioctl) 957 return -EINVAL; 958 return sdev->host->hostt->ioctl(sdev, cmd, arg); 959 } 960 EXPORT_SYMBOL(scsi_ioctl); 961 962 /** 963 * scsi_ioctl_block_when_processing_errors - prevent commands from being queued 964 * @sdev: target scsi device 965 * @cmd: which ioctl is it 966 * @ndelay: no delay (non-blocking) 967 * 968 * We can process a reset even when a device isn't fully operable. 969 * 970 * Return: %0 on success, <0 error code. 971 */ 972 int scsi_ioctl_block_when_processing_errors(struct scsi_device *sdev, int cmd, 973 bool ndelay) 974 { 975 if (cmd == SG_SCSI_RESET && ndelay) { 976 if (scsi_host_in_recovery(sdev->host)) 977 return -EAGAIN; 978 } else { 979 if (!scsi_block_when_processing_errors(sdev)) 980 return -ENODEV; 981 } 982 983 return 0; 984 } 985 EXPORT_SYMBOL_GPL(scsi_ioctl_block_when_processing_errors); 986