1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Changes: 4 * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 08/23/2000 5 * - get rid of some verify_areas and use __copy*user and __get/put_user 6 * for the ones that remain 7 */ 8 #include <linux/module.h> 9 #include <linux/blkdev.h> 10 #include <linux/interrupt.h> 11 #include <linux/errno.h> 12 #include <linux/kernel.h> 13 #include <linux/sched.h> 14 #include <linux/mm.h> 15 #include <linux/string.h> 16 #include <linux/uaccess.h> 17 #include <linux/cdrom.h> 18 19 #include <scsi/scsi.h> 20 #include <scsi/scsi_cmnd.h> 21 #include <scsi/scsi_device.h> 22 #include <scsi/scsi_eh.h> 23 #include <scsi/scsi_host.h> 24 #include <scsi/scsi_ioctl.h> 25 #include <scsi/sg.h> 26 #include <scsi/scsi_dbg.h> 27 28 #include "scsi_logging.h" 29 30 #define NORMAL_RETRIES 5 31 #define IOCTL_NORMAL_TIMEOUT (10 * HZ) 32 33 #define MAX_BUF PAGE_SIZE 34 35 /** 36 * ioctl_probe -- return host identification 37 * @host: host to identify 38 * @buffer: userspace buffer for identification 39 * 40 * Return: 41 * * if successful, %1 and an identifying string at @buffer, if @buffer 42 * is non-NULL, filling to the length stored at * (int *) @buffer. 43 * * <0 error code on failure. 44 */ 45 static int ioctl_probe(struct Scsi_Host *host, void __user *buffer) 46 { 47 unsigned int len, slen; 48 const char *string; 49 50 if (buffer) { 51 if (get_user(len, (unsigned int __user *) buffer)) 52 return -EFAULT; 53 54 if (host->hostt->info) 55 string = host->hostt->info(host); 56 else 57 string = host->hostt->name; 58 if (string) { 59 slen = strlen(string); 60 if (len > slen) 61 len = slen + 1; 62 if (copy_to_user(buffer, string, len)) 63 return -EFAULT; 64 } 65 } 66 return 1; 67 } 68 69 static int ioctl_internal_command(struct scsi_device *sdev, char *cmd, 70 int timeout, int retries) 71 { 72 int result; 73 struct scsi_sense_hdr sshdr; 74 const struct scsi_exec_args exec_args = { 75 .sshdr = &sshdr, 76 }; 77 78 SCSI_LOG_IOCTL(1, sdev_printk(KERN_INFO, sdev, 79 "Trying ioctl with scsi command %d\n", *cmd)); 80 81 result = scsi_execute_cmd(sdev, cmd, REQ_OP_DRV_IN, NULL, 0, timeout, 82 retries, &exec_args); 83 84 SCSI_LOG_IOCTL(2, sdev_printk(KERN_INFO, sdev, 85 "Ioctl returned 0x%x\n", result)); 86 87 if (result < 0) 88 goto out; 89 if (scsi_sense_valid(&sshdr)) { 90 switch (sshdr.sense_key) { 91 case ILLEGAL_REQUEST: 92 if (cmd[0] == ALLOW_MEDIUM_REMOVAL) 93 sdev->lockable = 0; 94 else 95 sdev_printk(KERN_INFO, sdev, 96 "ioctl_internal_command: " 97 "ILLEGAL REQUEST " 98 "asc=0x%x ascq=0x%x\n", 99 sshdr.asc, sshdr.ascq); 100 break; 101 case NOT_READY: /* This happens if there is no disc in drive */ 102 if (sdev->removable) 103 break; 104 fallthrough; 105 case UNIT_ATTENTION: 106 if (sdev->removable) { 107 sdev->changed = 1; 108 result = 0; /* This is no longer considered an error */ 109 break; 110 } 111 fallthrough; /* for non-removable media */ 112 default: 113 sdev_printk(KERN_INFO, sdev, 114 "ioctl_internal_command return code = %x\n", 115 result); 116 scsi_print_sense_hdr(sdev, NULL, &sshdr); 117 break; 118 } 119 } 120 out: 121 SCSI_LOG_IOCTL(2, sdev_printk(KERN_INFO, sdev, 122 "IOCTL Releasing command\n")); 123 return result; 124 } 125 126 /** 127 * scsi_set_medium_removal() - send command to allow or prevent medium removal 128 * @sdev: target scsi device 129 * @state: removal state to set (prevent or allow) 130 * 131 * Returns: 132 * * %0 if @sdev is not removable or not lockable or successful. 133 * * non-%0 is a SCSI result code if > 0 or kernel error code if < 0. 134 * * Sets @sdev->locked to the new state on success. 135 */ 136 int scsi_set_medium_removal(struct scsi_device *sdev, char state) 137 { 138 char scsi_cmd[MAX_COMMAND_SIZE]; 139 int ret; 140 141 if (!sdev->removable || !sdev->lockable) 142 return 0; 143 144 scsi_cmd[0] = ALLOW_MEDIUM_REMOVAL; 145 scsi_cmd[1] = 0; 146 scsi_cmd[2] = 0; 147 scsi_cmd[3] = 0; 148 scsi_cmd[4] = state; 149 scsi_cmd[5] = 0; 150 151 ret = ioctl_internal_command(sdev, scsi_cmd, 152 IOCTL_NORMAL_TIMEOUT, NORMAL_RETRIES); 153 if (ret == 0) 154 sdev->locked = (state == SCSI_REMOVAL_PREVENT); 155 return ret; 156 } 157 EXPORT_SYMBOL(scsi_set_medium_removal); 158 159 /* 160 * The scsi_ioctl_get_pci() function places into arg the value 161 * pci_dev::slot_name (8 characters) for the PCI device (if any). 162 * Returns: 0 on success 163 * -ENXIO if there isn't a PCI device pointer 164 * (could be because the SCSI driver hasn't been 165 * updated yet, or because it isn't a SCSI 166 * device) 167 * any copy_to_user() error on failure there 168 */ 169 static int scsi_ioctl_get_pci(struct scsi_device *sdev, void __user *arg) 170 { 171 struct device *dev = scsi_get_device(sdev->host); 172 const char *name; 173 174 if (!dev) 175 return -ENXIO; 176 177 name = dev_name(dev); 178 179 /* 180 * Compatibility with old ioctl which only returned 20 characters. 181 */ 182 if (copy_to_user(arg, name, strnlen(name, 20))) 183 return -EFAULT; 184 185 return 0; 186 } 187 188 static int sg_get_version(int __user *p) 189 { 190 static const int sg_version_num = 30527; 191 return put_user(sg_version_num, p); 192 } 193 194 static int sg_set_timeout(struct scsi_device *sdev, int __user *p) 195 { 196 int timeout, err = get_user(timeout, p); 197 198 if (!err) 199 sdev->sg_timeout = clock_t_to_jiffies(timeout); 200 201 return err; 202 } 203 204 static int sg_get_reserved_size(struct scsi_device *sdev, int __user *p) 205 { 206 int val = min(sdev->sg_reserved_size, 207 queue_max_bytes(sdev->request_queue)); 208 209 return put_user(val, p); 210 } 211 212 static int sg_set_reserved_size(struct scsi_device *sdev, int __user *p) 213 { 214 int size, err = get_user(size, p); 215 216 if (err) 217 return err; 218 219 if (size < 0) 220 return -EINVAL; 221 222 sdev->sg_reserved_size = min_t(unsigned int, size, 223 queue_max_bytes(sdev->request_queue)); 224 return 0; 225 } 226 227 /* 228 * will always return that we are ATAPI even for a real SCSI drive, I'm not 229 * so sure this is worth doing anything about (why would you care??) 230 */ 231 static int sg_emulated_host(struct request_queue *q, int __user *p) 232 { 233 return put_user(1, p); 234 } 235 236 static int scsi_get_idlun(struct scsi_device *sdev, void __user *argp) 237 { 238 struct scsi_idlun v = { 239 .dev_id = (sdev->id & 0xff) + 240 ((sdev->lun & 0xff) << 8) + 241 ((sdev->channel & 0xff) << 16) + 242 ((sdev->host->host_no & 0xff) << 24), 243 .host_unique_id = sdev->host->unique_id 244 }; 245 if (copy_to_user(argp, &v, sizeof(struct scsi_idlun))) 246 return -EFAULT; 247 return 0; 248 } 249 250 static int scsi_send_start_stop(struct scsi_device *sdev, int data) 251 { 252 u8 cdb[MAX_COMMAND_SIZE] = { }; 253 254 cdb[0] = START_STOP; 255 cdb[4] = data; 256 return ioctl_internal_command(sdev, cdb, START_STOP_TIMEOUT, 257 NORMAL_RETRIES); 258 } 259 260 /** 261 * scsi_cmd_allowed() - Check if the given command is allowed. 262 * @cmd: SCSI command to check 263 * @open_for_write: is the file / block device opened for writing? 264 * 265 * Only a subset of commands are allowed for unprivileged users. Commands used 266 * to format the media, update the firmware, etc. are not permitted. 267 * 268 * Return: %true if the cmd is allowed, otherwise @false. 269 */ 270 bool scsi_cmd_allowed(unsigned char *cmd, bool open_for_write) 271 { 272 /* root can do any command. */ 273 if (capable(CAP_SYS_RAWIO)) 274 return true; 275 276 /* Anybody who can open the device can do a read-safe command */ 277 switch (cmd[0]) { 278 /* Basic read-only commands */ 279 case TEST_UNIT_READY: 280 case REQUEST_SENSE: 281 case READ_6: 282 case READ_10: 283 case READ_12: 284 case READ_16: 285 case READ_BUFFER: 286 case READ_DEFECT_DATA: 287 case READ_CAPACITY: /* also GPCMD_READ_CDVD_CAPACITY */ 288 case READ_LONG: 289 case INQUIRY: 290 case MODE_SENSE: 291 case MODE_SENSE_10: 292 case LOG_SENSE: 293 case START_STOP: 294 case GPCMD_VERIFY_10: 295 case VERIFY_16: 296 case REPORT_LUNS: 297 case SERVICE_ACTION_IN_16: 298 case RECEIVE_DIAGNOSTIC: 299 case MAINTENANCE_IN: /* also GPCMD_SEND_KEY, which is a write command */ 300 case GPCMD_READ_BUFFER_CAPACITY: 301 /* Audio CD commands */ 302 case GPCMD_PLAY_CD: 303 case GPCMD_PLAY_AUDIO_10: 304 case GPCMD_PLAY_AUDIO_MSF: 305 case GPCMD_PLAY_AUDIO_TI: 306 case GPCMD_PAUSE_RESUME: 307 /* CD/DVD data reading */ 308 case GPCMD_READ_CD: 309 case GPCMD_READ_CD_MSF: 310 case GPCMD_READ_DISC_INFO: 311 case GPCMD_READ_DVD_STRUCTURE: 312 case GPCMD_READ_HEADER: 313 case GPCMD_READ_TRACK_RZONE_INFO: 314 case GPCMD_READ_SUBCHANNEL: 315 case GPCMD_READ_TOC_PMA_ATIP: 316 case GPCMD_REPORT_KEY: 317 case GPCMD_SCAN: 318 case GPCMD_GET_CONFIGURATION: 319 case GPCMD_READ_FORMAT_CAPACITIES: 320 case GPCMD_GET_EVENT_STATUS_NOTIFICATION: 321 case GPCMD_GET_PERFORMANCE: 322 case GPCMD_SEEK: 323 case GPCMD_STOP_PLAY_SCAN: 324 /* ZBC */ 325 case ZBC_IN: 326 return true; 327 /* Basic writing commands */ 328 case WRITE_6: 329 case WRITE_10: 330 case WRITE_VERIFY: 331 case WRITE_12: 332 case WRITE_VERIFY_12: 333 case WRITE_16: 334 case WRITE_LONG: 335 case WRITE_LONG_2: 336 case WRITE_SAME: 337 case WRITE_SAME_16: 338 case WRITE_SAME_32: 339 case ERASE: 340 case GPCMD_MODE_SELECT_10: 341 case MODE_SELECT: 342 case LOG_SELECT: 343 case GPCMD_BLANK: 344 case GPCMD_CLOSE_TRACK: 345 case GPCMD_FLUSH_CACHE: 346 case GPCMD_FORMAT_UNIT: 347 case GPCMD_REPAIR_RZONE_TRACK: 348 case GPCMD_RESERVE_RZONE_TRACK: 349 case GPCMD_SEND_DVD_STRUCTURE: 350 case GPCMD_SEND_EVENT: 351 case GPCMD_SEND_OPC: 352 case GPCMD_SEND_CUE_SHEET: 353 case GPCMD_SET_SPEED: 354 case GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL: 355 case GPCMD_LOAD_UNLOAD: 356 case GPCMD_SET_STREAMING: 357 case GPCMD_SET_READ_AHEAD: 358 /* ZBC */ 359 case ZBC_OUT: 360 return open_for_write; 361 default: 362 return false; 363 } 364 } 365 EXPORT_SYMBOL(scsi_cmd_allowed); 366 367 static int scsi_fill_sghdr_rq(struct scsi_device *sdev, struct request *rq, 368 struct sg_io_hdr *hdr, bool open_for_write) 369 { 370 struct scsi_cmnd *scmd = blk_mq_rq_to_pdu(rq); 371 372 if (hdr->cmd_len < 6) 373 return -EMSGSIZE; 374 if (copy_from_user(scmd->cmnd, hdr->cmdp, hdr->cmd_len)) 375 return -EFAULT; 376 if (!scsi_cmd_allowed(scmd->cmnd, open_for_write)) 377 return -EPERM; 378 scmd->cmd_len = hdr->cmd_len; 379 380 rq->timeout = msecs_to_jiffies(hdr->timeout); 381 if (!rq->timeout) 382 rq->timeout = sdev->sg_timeout; 383 if (!rq->timeout) 384 rq->timeout = BLK_DEFAULT_SG_TIMEOUT; 385 if (rq->timeout < BLK_MIN_SG_TIMEOUT) 386 rq->timeout = BLK_MIN_SG_TIMEOUT; 387 388 return 0; 389 } 390 391 static int scsi_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr, 392 struct bio *bio) 393 { 394 struct scsi_cmnd *scmd = blk_mq_rq_to_pdu(rq); 395 int r, ret = 0; 396 397 /* 398 * fill in all the output members 399 */ 400 hdr->status = scmd->result & 0xff; 401 hdr->masked_status = sg_status_byte(scmd->result); 402 hdr->msg_status = COMMAND_COMPLETE; 403 hdr->host_status = host_byte(scmd->result); 404 hdr->driver_status = 0; 405 if (scsi_status_is_check_condition(hdr->status)) 406 hdr->driver_status = DRIVER_SENSE; 407 hdr->info = 0; 408 if (hdr->masked_status || hdr->host_status || hdr->driver_status) 409 hdr->info |= SG_INFO_CHECK; 410 hdr->resid = scmd->resid_len; 411 hdr->sb_len_wr = 0; 412 413 if (scmd->sense_len && hdr->sbp) { 414 int len = min((unsigned int) hdr->mx_sb_len, scmd->sense_len); 415 416 if (!copy_to_user(hdr->sbp, scmd->sense_buffer, len)) 417 hdr->sb_len_wr = len; 418 else 419 ret = -EFAULT; 420 } 421 422 r = blk_rq_unmap_user(bio); 423 if (!ret) 424 ret = r; 425 426 return ret; 427 } 428 429 static int sg_io(struct scsi_device *sdev, struct sg_io_hdr *hdr, 430 bool open_for_write) 431 { 432 unsigned long start_time; 433 ssize_t ret = 0; 434 int writing = 0; 435 int at_head = 0; 436 struct request *rq; 437 struct scsi_cmnd *scmd; 438 struct bio *bio; 439 440 if (hdr->interface_id != 'S') 441 return -EINVAL; 442 443 if (hdr->dxfer_len > (queue_max_hw_sectors(sdev->request_queue) << 9)) 444 return -EIO; 445 446 if (hdr->dxfer_len) 447 switch (hdr->dxfer_direction) { 448 default: 449 return -EINVAL; 450 case SG_DXFER_TO_DEV: 451 writing = 1; 452 break; 453 case SG_DXFER_TO_FROM_DEV: 454 case SG_DXFER_FROM_DEV: 455 break; 456 } 457 if (hdr->flags & SG_FLAG_Q_AT_HEAD) 458 at_head = 1; 459 460 rq = scsi_alloc_request(sdev->request_queue, writing ? 461 REQ_OP_DRV_OUT : REQ_OP_DRV_IN, 0); 462 if (IS_ERR(rq)) 463 return PTR_ERR(rq); 464 scmd = blk_mq_rq_to_pdu(rq); 465 466 if (hdr->cmd_len > sizeof(scmd->cmnd)) { 467 ret = -EINVAL; 468 goto out_put_request; 469 } 470 471 ret = scsi_fill_sghdr_rq(sdev, rq, hdr, open_for_write); 472 if (ret < 0) 473 goto out_put_request; 474 475 ret = blk_rq_map_user_io(rq, NULL, hdr->dxferp, hdr->dxfer_len, 476 GFP_KERNEL, hdr->iovec_count && hdr->dxfer_len, 477 hdr->iovec_count, 0, rq_data_dir(rq)); 478 if (ret) 479 goto out_put_request; 480 481 bio = rq->bio; 482 scmd->allowed = 0; 483 484 start_time = jiffies; 485 486 blk_execute_rq(rq, at_head); 487 488 hdr->duration = jiffies_to_msecs(jiffies - start_time); 489 490 ret = scsi_complete_sghdr_rq(rq, hdr, bio); 491 492 out_put_request: 493 blk_mq_free_request(rq); 494 return ret; 495 } 496 497 /** 498 * sg_scsi_ioctl -- handle deprecated SCSI_IOCTL_SEND_COMMAND ioctl 499 * @q: request queue to send scsi commands down 500 * @open_for_write: is the file / block device opened for writing? 501 * @sic: userspace structure describing the command to perform 502 * 503 * Send down the scsi command described by @sic to the device below 504 * the request queue @q. 505 * 506 * Notes: 507 * - This interface is deprecated - users should use the SG_IO 508 * interface instead, as this is a more flexible approach to 509 * performing SCSI commands on a device. 510 * - The SCSI command length is determined by examining the 1st byte 511 * of the given command. There is no way to override this. 512 * - Data transfers are limited to PAGE_SIZE 513 * - The length (x + y) must be at least OMAX_SB_LEN bytes long to 514 * accommodate the sense buffer when an error occurs. 515 * The sense buffer is truncated to OMAX_SB_LEN (16) bytes so that 516 * old code will not be surprised. 517 * - If a Unix error occurs (e.g. ENOMEM) then the user will receive 518 * a negative return and the Unix error code in 'errno'. 519 * If the SCSI command succeeds then 0 is returned. 520 * Positive numbers returned are the compacted SCSI error codes (4 521 * bytes in one int) where the lowest byte is the SCSI status. 522 */ 523 static int sg_scsi_ioctl(struct request_queue *q, bool open_for_write, 524 struct scsi_ioctl_command __user *sic) 525 { 526 struct request *rq; 527 int err; 528 unsigned int in_len, out_len, bytes, opcode, cmdlen; 529 struct scsi_cmnd *scmd; 530 char *buffer = NULL; 531 532 if (!sic) 533 return -EINVAL; 534 535 /* 536 * get in an out lengths, verify they don't exceed a page worth of data 537 */ 538 if (get_user(in_len, &sic->inlen)) 539 return -EFAULT; 540 if (get_user(out_len, &sic->outlen)) 541 return -EFAULT; 542 if (in_len > PAGE_SIZE || out_len > PAGE_SIZE) 543 return -EINVAL; 544 if (get_user(opcode, &sic->data[0])) 545 return -EFAULT; 546 547 bytes = max(in_len, out_len); 548 if (bytes) { 549 buffer = kzalloc(bytes, GFP_NOIO | GFP_USER | __GFP_NOWARN); 550 if (!buffer) 551 return -ENOMEM; 552 553 } 554 555 rq = scsi_alloc_request(q, in_len ? REQ_OP_DRV_OUT : REQ_OP_DRV_IN, 0); 556 if (IS_ERR(rq)) { 557 err = PTR_ERR(rq); 558 goto error_free_buffer; 559 } 560 scmd = blk_mq_rq_to_pdu(rq); 561 562 cmdlen = COMMAND_SIZE(opcode); 563 564 /* 565 * get command and data to send to device, if any 566 */ 567 err = -EFAULT; 568 scmd->cmd_len = cmdlen; 569 if (copy_from_user(scmd->cmnd, sic->data, cmdlen)) 570 goto error; 571 572 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len)) 573 goto error; 574 575 err = -EPERM; 576 if (!scsi_cmd_allowed(scmd->cmnd, open_for_write)) 577 goto error; 578 579 /* default. possible overridden later */ 580 scmd->allowed = 5; 581 582 switch (opcode) { 583 case SEND_DIAGNOSTIC: 584 case FORMAT_UNIT: 585 rq->timeout = FORMAT_UNIT_TIMEOUT; 586 scmd->allowed = 1; 587 break; 588 case START_STOP: 589 rq->timeout = START_STOP_TIMEOUT; 590 break; 591 case MOVE_MEDIUM: 592 rq->timeout = MOVE_MEDIUM_TIMEOUT; 593 break; 594 case READ_ELEMENT_STATUS: 595 rq->timeout = READ_ELEMENT_STATUS_TIMEOUT; 596 break; 597 case READ_DEFECT_DATA: 598 rq->timeout = READ_DEFECT_DATA_TIMEOUT; 599 scmd->allowed = 1; 600 break; 601 default: 602 rq->timeout = BLK_DEFAULT_SG_TIMEOUT; 603 break; 604 } 605 606 if (bytes) { 607 err = blk_rq_map_kern(rq, buffer, bytes, GFP_NOIO); 608 if (err) 609 goto error; 610 } 611 612 blk_execute_rq(rq, false); 613 614 err = scmd->result & 0xff; /* only 8 bit SCSI status */ 615 if (err) { 616 if (scmd->sense_len && scmd->sense_buffer) { 617 /* limit sense len for backward compatibility */ 618 if (copy_to_user(sic->data, scmd->sense_buffer, 619 min(scmd->sense_len, 16U))) 620 err = -EFAULT; 621 } 622 } else { 623 if (copy_to_user(sic->data, buffer, out_len)) 624 err = -EFAULT; 625 } 626 627 error: 628 blk_mq_free_request(rq); 629 630 error_free_buffer: 631 kfree(buffer); 632 633 return err; 634 } 635 636 int put_sg_io_hdr(const struct sg_io_hdr *hdr, void __user *argp) 637 { 638 #ifdef CONFIG_COMPAT 639 if (in_compat_syscall()) { 640 struct compat_sg_io_hdr hdr32 = { 641 .interface_id = hdr->interface_id, 642 .dxfer_direction = hdr->dxfer_direction, 643 .cmd_len = hdr->cmd_len, 644 .mx_sb_len = hdr->mx_sb_len, 645 .iovec_count = hdr->iovec_count, 646 .dxfer_len = hdr->dxfer_len, 647 .dxferp = (uintptr_t)hdr->dxferp, 648 .cmdp = (uintptr_t)hdr->cmdp, 649 .sbp = (uintptr_t)hdr->sbp, 650 .timeout = hdr->timeout, 651 .flags = hdr->flags, 652 .pack_id = hdr->pack_id, 653 .usr_ptr = (uintptr_t)hdr->usr_ptr, 654 .status = hdr->status, 655 .masked_status = hdr->masked_status, 656 .msg_status = hdr->msg_status, 657 .sb_len_wr = hdr->sb_len_wr, 658 .host_status = hdr->host_status, 659 .driver_status = hdr->driver_status, 660 .resid = hdr->resid, 661 .duration = hdr->duration, 662 .info = hdr->info, 663 }; 664 665 if (copy_to_user(argp, &hdr32, sizeof(hdr32))) 666 return -EFAULT; 667 668 return 0; 669 } 670 #endif 671 672 if (copy_to_user(argp, hdr, sizeof(*hdr))) 673 return -EFAULT; 674 675 return 0; 676 } 677 EXPORT_SYMBOL(put_sg_io_hdr); 678 679 int get_sg_io_hdr(struct sg_io_hdr *hdr, const void __user *argp) 680 { 681 #ifdef CONFIG_COMPAT 682 struct compat_sg_io_hdr hdr32; 683 684 if (in_compat_syscall()) { 685 if (copy_from_user(&hdr32, argp, sizeof(hdr32))) 686 return -EFAULT; 687 688 *hdr = (struct sg_io_hdr) { 689 .interface_id = hdr32.interface_id, 690 .dxfer_direction = hdr32.dxfer_direction, 691 .cmd_len = hdr32.cmd_len, 692 .mx_sb_len = hdr32.mx_sb_len, 693 .iovec_count = hdr32.iovec_count, 694 .dxfer_len = hdr32.dxfer_len, 695 .dxferp = compat_ptr(hdr32.dxferp), 696 .cmdp = compat_ptr(hdr32.cmdp), 697 .sbp = compat_ptr(hdr32.sbp), 698 .timeout = hdr32.timeout, 699 .flags = hdr32.flags, 700 .pack_id = hdr32.pack_id, 701 .usr_ptr = compat_ptr(hdr32.usr_ptr), 702 .status = hdr32.status, 703 .masked_status = hdr32.masked_status, 704 .msg_status = hdr32.msg_status, 705 .sb_len_wr = hdr32.sb_len_wr, 706 .host_status = hdr32.host_status, 707 .driver_status = hdr32.driver_status, 708 .resid = hdr32.resid, 709 .duration = hdr32.duration, 710 .info = hdr32.info, 711 }; 712 713 return 0; 714 } 715 #endif 716 717 if (copy_from_user(hdr, argp, sizeof(*hdr))) 718 return -EFAULT; 719 720 return 0; 721 } 722 EXPORT_SYMBOL(get_sg_io_hdr); 723 724 #ifdef CONFIG_COMPAT 725 struct compat_cdrom_generic_command { 726 unsigned char cmd[CDROM_PACKET_SIZE]; 727 compat_caddr_t buffer; 728 compat_uint_t buflen; 729 compat_int_t stat; 730 compat_caddr_t sense; 731 unsigned char data_direction; 732 unsigned char pad[3]; 733 compat_int_t quiet; 734 compat_int_t timeout; 735 compat_caddr_t unused; 736 }; 737 #endif 738 739 static int scsi_get_cdrom_generic_arg(struct cdrom_generic_command *cgc, 740 const void __user *arg) 741 { 742 #ifdef CONFIG_COMPAT 743 if (in_compat_syscall()) { 744 struct compat_cdrom_generic_command cgc32; 745 746 if (copy_from_user(&cgc32, arg, sizeof(cgc32))) 747 return -EFAULT; 748 749 *cgc = (struct cdrom_generic_command) { 750 .buffer = compat_ptr(cgc32.buffer), 751 .buflen = cgc32.buflen, 752 .stat = cgc32.stat, 753 .sense = compat_ptr(cgc32.sense), 754 .data_direction = cgc32.data_direction, 755 .quiet = cgc32.quiet, 756 .timeout = cgc32.timeout, 757 .unused = compat_ptr(cgc32.unused), 758 }; 759 memcpy(&cgc->cmd, &cgc32.cmd, CDROM_PACKET_SIZE); 760 return 0; 761 } 762 #endif 763 if (copy_from_user(cgc, arg, sizeof(*cgc))) 764 return -EFAULT; 765 766 return 0; 767 } 768 769 static int scsi_put_cdrom_generic_arg(const struct cdrom_generic_command *cgc, 770 void __user *arg) 771 { 772 #ifdef CONFIG_COMPAT 773 if (in_compat_syscall()) { 774 struct compat_cdrom_generic_command cgc32 = { 775 .buffer = (uintptr_t)(cgc->buffer), 776 .buflen = cgc->buflen, 777 .stat = cgc->stat, 778 .sense = (uintptr_t)(cgc->sense), 779 .data_direction = cgc->data_direction, 780 .quiet = cgc->quiet, 781 .timeout = cgc->timeout, 782 .unused = (uintptr_t)(cgc->unused), 783 }; 784 memcpy(&cgc32.cmd, &cgc->cmd, CDROM_PACKET_SIZE); 785 786 if (copy_to_user(arg, &cgc32, sizeof(cgc32))) 787 return -EFAULT; 788 789 return 0; 790 } 791 #endif 792 if (copy_to_user(arg, cgc, sizeof(*cgc))) 793 return -EFAULT; 794 795 return 0; 796 } 797 798 static int scsi_cdrom_send_packet(struct scsi_device *sdev, bool open_for_write, 799 void __user *arg) 800 { 801 struct cdrom_generic_command cgc; 802 struct sg_io_hdr hdr; 803 int err; 804 805 err = scsi_get_cdrom_generic_arg(&cgc, arg); 806 if (err) 807 return err; 808 809 cgc.timeout = clock_t_to_jiffies(cgc.timeout); 810 memset(&hdr, 0, sizeof(hdr)); 811 hdr.interface_id = 'S'; 812 hdr.cmd_len = sizeof(cgc.cmd); 813 hdr.dxfer_len = cgc.buflen; 814 switch (cgc.data_direction) { 815 case CGC_DATA_UNKNOWN: 816 hdr.dxfer_direction = SG_DXFER_UNKNOWN; 817 break; 818 case CGC_DATA_WRITE: 819 hdr.dxfer_direction = SG_DXFER_TO_DEV; 820 break; 821 case CGC_DATA_READ: 822 hdr.dxfer_direction = SG_DXFER_FROM_DEV; 823 break; 824 case CGC_DATA_NONE: 825 hdr.dxfer_direction = SG_DXFER_NONE; 826 break; 827 default: 828 return -EINVAL; 829 } 830 831 hdr.dxferp = cgc.buffer; 832 hdr.sbp = cgc.sense; 833 if (hdr.sbp) 834 hdr.mx_sb_len = sizeof(struct request_sense); 835 hdr.timeout = jiffies_to_msecs(cgc.timeout); 836 hdr.cmdp = ((struct cdrom_generic_command __user *) arg)->cmd; 837 hdr.cmd_len = sizeof(cgc.cmd); 838 839 err = sg_io(sdev, &hdr, open_for_write); 840 if (err == -EFAULT) 841 return -EFAULT; 842 843 if (hdr.status) 844 return -EIO; 845 846 cgc.stat = err; 847 cgc.buflen = hdr.resid; 848 if (scsi_put_cdrom_generic_arg(&cgc, arg)) 849 return -EFAULT; 850 851 return err; 852 } 853 854 static int scsi_ioctl_sg_io(struct scsi_device *sdev, bool open_for_write, 855 void __user *argp) 856 { 857 struct sg_io_hdr hdr; 858 int error; 859 860 error = get_sg_io_hdr(&hdr, argp); 861 if (error) 862 return error; 863 error = sg_io(sdev, &hdr, open_for_write); 864 if (error == -EFAULT) 865 return error; 866 if (put_sg_io_hdr(&hdr, argp)) 867 return -EFAULT; 868 return error; 869 } 870 871 /** 872 * scsi_ioctl - Dispatch ioctl to scsi device 873 * @sdev: scsi device receiving ioctl 874 * @open_for_write: is the file / block device opened for writing? 875 * @cmd: which ioctl is it 876 * @arg: data associated with ioctl 877 * 878 * Description: The scsi_ioctl() function differs from most ioctls in that it 879 * does not take a major/minor number as the dev field. Rather, it takes 880 * a pointer to a &struct scsi_device. 881 * 882 * Return: varies depending on the @cmd 883 */ 884 int scsi_ioctl(struct scsi_device *sdev, bool open_for_write, int cmd, 885 void __user *arg) 886 { 887 struct request_queue *q = sdev->request_queue; 888 struct scsi_sense_hdr sense_hdr; 889 890 /* Check for deprecated ioctls ... all the ioctls which don't 891 * follow the new unique numbering scheme are deprecated */ 892 switch (cmd) { 893 case SCSI_IOCTL_SEND_COMMAND: 894 case SCSI_IOCTL_TEST_UNIT_READY: 895 case SCSI_IOCTL_BENCHMARK_COMMAND: 896 case SCSI_IOCTL_SYNC: 897 case SCSI_IOCTL_START_UNIT: 898 case SCSI_IOCTL_STOP_UNIT: 899 printk(KERN_WARNING "program %s is using a deprecated SCSI " 900 "ioctl, please convert it to SG_IO\n", current->comm); 901 break; 902 default: 903 break; 904 } 905 906 switch (cmd) { 907 case SG_GET_VERSION_NUM: 908 return sg_get_version(arg); 909 case SG_SET_TIMEOUT: 910 return sg_set_timeout(sdev, arg); 911 case SG_GET_TIMEOUT: 912 return jiffies_to_clock_t(sdev->sg_timeout); 913 case SG_GET_RESERVED_SIZE: 914 return sg_get_reserved_size(sdev, arg); 915 case SG_SET_RESERVED_SIZE: 916 return sg_set_reserved_size(sdev, arg); 917 case SG_EMULATED_HOST: 918 return sg_emulated_host(q, arg); 919 case SG_IO: 920 return scsi_ioctl_sg_io(sdev, open_for_write, arg); 921 case SCSI_IOCTL_SEND_COMMAND: 922 return sg_scsi_ioctl(q, open_for_write, arg); 923 case CDROM_SEND_PACKET: 924 return scsi_cdrom_send_packet(sdev, open_for_write, arg); 925 case CDROMCLOSETRAY: 926 return scsi_send_start_stop(sdev, 3); 927 case CDROMEJECT: 928 return scsi_send_start_stop(sdev, 2); 929 case SCSI_IOCTL_GET_IDLUN: 930 return scsi_get_idlun(sdev, arg); 931 case SCSI_IOCTL_GET_BUS_NUMBER: 932 return put_user(sdev->host->host_no, (int __user *)arg); 933 case SCSI_IOCTL_PROBE_HOST: 934 return ioctl_probe(sdev->host, arg); 935 case SCSI_IOCTL_DOORLOCK: 936 return scsi_set_medium_removal(sdev, SCSI_REMOVAL_PREVENT); 937 case SCSI_IOCTL_DOORUNLOCK: 938 return scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW); 939 case SCSI_IOCTL_TEST_UNIT_READY: 940 return scsi_test_unit_ready(sdev, IOCTL_NORMAL_TIMEOUT, 941 NORMAL_RETRIES, &sense_hdr); 942 case SCSI_IOCTL_START_UNIT: 943 return scsi_send_start_stop(sdev, 1); 944 case SCSI_IOCTL_STOP_UNIT: 945 return scsi_send_start_stop(sdev, 0); 946 case SCSI_IOCTL_GET_PCI: 947 return scsi_ioctl_get_pci(sdev, arg); 948 case SG_SCSI_RESET: 949 return scsi_ioctl_reset(sdev, arg); 950 } 951 952 #ifdef CONFIG_COMPAT 953 if (in_compat_syscall()) { 954 if (!sdev->host->hostt->compat_ioctl) 955 return -EINVAL; 956 return sdev->host->hostt->compat_ioctl(sdev, cmd, arg); 957 } 958 #endif 959 if (!sdev->host->hostt->ioctl) 960 return -EINVAL; 961 return sdev->host->hostt->ioctl(sdev, cmd, arg); 962 } 963 EXPORT_SYMBOL(scsi_ioctl); 964 965 /** 966 * scsi_ioctl_block_when_processing_errors - prevent commands from being queued 967 * @sdev: target scsi device 968 * @cmd: which ioctl is it 969 * @ndelay: no delay (non-blocking) 970 * 971 * We can process a reset even when a device isn't fully operable. 972 * 973 * Return: %0 on success, <0 error code. 974 */ 975 int scsi_ioctl_block_when_processing_errors(struct scsi_device *sdev, int cmd, 976 bool ndelay) 977 { 978 if (cmd == SG_SCSI_RESET && ndelay) { 979 if (scsi_host_in_recovery(sdev->host)) 980 return -EAGAIN; 981 } else { 982 if (!scsi_block_when_processing_errors(sdev)) 983 return -ENODEV; 984 } 985 986 return 0; 987 } 988 EXPORT_SYMBOL_GPL(scsi_ioctl_block_when_processing_errors); 989