1/* 2 * Copyright (C) 2001 Jens Axboe <axboe@suse.de> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 * 8 * This program is distributed in the hope that it will be useful, 9 * but WITHOUT ANY WARRANTY; without even the implied warranty of 10 * 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public Licens 15 * along with this program; if not, write to the Free Software 16 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111- 17 * 18 */ 19#include <linux/kernel.h> 20#include <linux/errno.h> 21#include <linux/string.h> 22#include <linux/module.h> 23#include <linux/blkdev.h> 24#include <linux/capability.h> 25#include <linux/completion.h> 26#include <linux/cdrom.h> 27#include <linux/slab.h> 28#include <linux/times.h> 29#include <asm/uaccess.h> 30 31#include <scsi/scsi.h> 32#include <scsi/scsi_ioctl.h> 33#include <scsi/scsi_cmnd.h> 34 35/* Command group 3 is reserved and should never be used. */ 36const unsigned char scsi_command_size[8] = 37{ 38 6, 10, 10, 12, 39 16, 12, 10, 10 40}; 41 42EXPORT_SYMBOL(scsi_command_size); 43 44#define BLK_DEFAULT_TIMEOUT (60 * HZ) 45 46#include <scsi/sg.h> 47 48static int sg_get_version(int __user *p) 49{ 50 static const int sg_version_num = 30527; 51 return put_user(sg_version_num, p); 52} 53 54static int scsi_get_idlun(request_queue_t *q, int __user *p) 55{ 56 return put_user(0, p); 57} 58 59static int scsi_get_bus(request_queue_t *q, int __user *p) 60{ 61 return put_user(0, p); 62} 63 64static int sg_get_timeout(request_queue_t *q) 65{ 66 return q->sg_timeout / (HZ / USER_HZ); 67} 68 69static int sg_set_timeout(request_queue_t *q, int __user *p) 70{ 71 int timeout, err = get_user(timeout, p); 72 73 if (!err) 74 q->sg_timeout = timeout * (HZ / USER_HZ); 75 76 return err; 77} 78 79static int sg_get_reserved_size(request_queue_t *q, int __user *p) 80{ 81 unsigned val = min(q->sg_reserved_size, q->max_sectors << 9); 82 83 return put_user(val, p); 84} 85 86static int sg_set_reserved_size(request_queue_t *q, int __user *p) 87{ 88 int size, err = get_user(size, p); 89 90 if (err) 91 return err; 92 93 if (size < 0) 94 return -EINVAL; 95 if (size > (q->max_sectors << 9)) 96 size = q->max_sectors << 9; 97 98 q->sg_reserved_size = size; 99 return 0; 100} 101 102/* 103 * will always return that we are ATAPI even for a real SCSI drive, I'm not 104 * so sure this is worth doing anything about (why would you care??) 105 */ 106static int sg_emulated_host(request_queue_t *q, int __user *p) 107{ 108 return put_user(1, p); 109} 110 111#define CMD_READ_SAFE 0x01 112#define CMD_WRITE_SAFE 0x02 113#define CMD_WARNED 0x04 114#define safe_for_read(cmd) [cmd] = CMD_READ_SAFE 115#define safe_for_write(cmd) [cmd] = CMD_WRITE_SAFE 116 117static int verify_command(struct file *file, unsigned char *cmd) 118{ 119 static unsigned char cmd_type[256] = { 120 121 /* Basic read-only commands */ 122 safe_for_read(TEST_UNIT_READY), 123 safe_for_read(REQUEST_SENSE), 124 safe_for_read(READ_6), 125 safe_for_read(READ_10), 126 safe_for_read(READ_12), 127 safe_for_read(READ_16), 128 safe_for_read(READ_BUFFER), 129 safe_for_read(READ_DEFECT_DATA), 130 safe_for_read(READ_LONG), 131 safe_for_read(INQUIRY), 132 safe_for_read(MODE_SENSE), 133 safe_for_read(MODE_SENSE_10), 134 safe_for_read(LOG_SENSE), 135 safe_for_read(START_STOP), 136 safe_for_read(GPCMD_VERIFY_10), 137 safe_for_read(VERIFY_16), 138 139 /* Audio CD commands */ 140 safe_for_read(GPCMD_PLAY_CD), 141 safe_for_read(GPCMD_PLAY_AUDIO_10), 142 safe_for_read(GPCMD_PLAY_AUDIO_MSF), 143 safe_for_read(GPCMD_PLAY_AUDIO_TI), 144 safe_for_read(GPCMD_PAUSE_RESUME), 145 146 /* CD/DVD data reading */ 147 safe_for_read(GPCMD_READ_BUFFER_CAPACITY), 148 safe_for_read(GPCMD_READ_CD), 149 safe_for_read(GPCMD_READ_CD_MSF), 150 safe_for_read(GPCMD_READ_DISC_INFO), 151 safe_for_read(GPCMD_READ_CDVD_CAPACITY), 152 safe_for_read(GPCMD_READ_DVD_STRUCTURE), 153 safe_for_read(GPCMD_READ_HEADER), 154 safe_for_read(GPCMD_READ_TRACK_RZONE_INFO), 155 safe_for_read(GPCMD_READ_SUBCHANNEL), 156 safe_for_read(GPCMD_READ_TOC_PMA_ATIP), 157 safe_for_read(GPCMD_REPORT_KEY), 158 safe_for_read(GPCMD_SCAN), 159 safe_for_read(GPCMD_GET_CONFIGURATION), 160 safe_for_read(GPCMD_READ_FORMAT_CAPACITIES), 161 safe_for_read(GPCMD_GET_EVENT_STATUS_NOTIFICATION), 162 safe_for_read(GPCMD_GET_PERFORMANCE), 163 safe_for_read(GPCMD_SEEK), 164 safe_for_read(GPCMD_STOP_PLAY_SCAN), 165 166 /* Basic writing commands */ 167 safe_for_write(WRITE_6), 168 safe_for_write(WRITE_10), 169 safe_for_write(WRITE_VERIFY), 170 safe_for_write(WRITE_12), 171 safe_for_write(WRITE_VERIFY_12), 172 safe_for_write(WRITE_16), 173 safe_for_write(WRITE_LONG), 174 safe_for_write(WRITE_LONG_2), 175 safe_for_write(ERASE), 176 safe_for_write(GPCMD_MODE_SELECT_10), 177 safe_for_write(MODE_SELECT), 178 safe_for_write(LOG_SELECT), 179 safe_for_write(GPCMD_BLANK), 180 safe_for_write(GPCMD_CLOSE_TRACK), 181 safe_for_write(GPCMD_FLUSH_CACHE), 182 safe_for_write(GPCMD_FORMAT_UNIT), 183 safe_for_write(GPCMD_REPAIR_RZONE_TRACK), 184 safe_for_write(GPCMD_RESERVE_RZONE_TRACK), 185 safe_for_write(GPCMD_SEND_DVD_STRUCTURE), 186 safe_for_write(GPCMD_SEND_EVENT), 187 safe_for_write(GPCMD_SEND_KEY), 188 safe_for_write(GPCMD_SEND_OPC), 189 safe_for_write(GPCMD_SEND_CUE_SHEET), 190 safe_for_write(GPCMD_SET_SPEED), 191 safe_for_write(GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL), 192 safe_for_write(GPCMD_LOAD_UNLOAD), 193 safe_for_write(GPCMD_SET_STREAMING), 194 }; 195 unsigned char type = cmd_type[cmd[0]]; 196 int has_write_perm = 0; 197 198 /* Anybody who can open the device can do a read-safe command */ 199 if (type & CMD_READ_SAFE) 200 return 0; 201 202 /* 203 * file can be NULL from ioctl_by_bdev()... 204 */ 205 if (file) 206 has_write_perm = file->f_mode & FMODE_WRITE; 207 208 /* Write-safe commands just require a writable open.. */ 209 if ((type & CMD_WRITE_SAFE) && has_write_perm) 210 return 0; 211 212 /* And root can do any command.. */ 213 if (capable(CAP_SYS_RAWIO)) 214 return 0; 215 216 if (!type) { 217 cmd_type[cmd[0]] = CMD_WARNED; 218 printk(KERN_WARNING "scsi: unknown opcode 0x%02x\n", cmd[0]); 219 } 220 221 /* Otherwise fail it with an "Operation not permitted" */ 222 return -EPERM; 223} 224 225static int sg_io(struct file *file, request_queue_t *q, 226 struct gendisk *bd_disk, struct sg_io_hdr *hdr) 227{ 228 unsigned long start_time, timeout; 229 int writing = 0, ret = 0; 230 struct request *rq; 231 char sense[SCSI_SENSE_BUFFERSIZE]; 232 unsigned char cmd[BLK_MAX_CDB]; 233 struct bio *bio; 234 235 if (hdr->interface_id != 'S') 236 return -EINVAL; 237 if (hdr->cmd_len > BLK_MAX_CDB) 238 return -EINVAL; 239 if (copy_from_user(cmd, hdr->cmdp, hdr->cmd_len)) 240 return -EFAULT; 241 if (verify_command(file, cmd)) 242 return -EPERM; 243 244 if (hdr->dxfer_len > (q->max_hw_sectors << 9)) 245 return -EIO; 246 247 if (hdr->dxfer_len) 248 switch (hdr->dxfer_direction) { 249 default: 250 return -EINVAL; 251 case SG_DXFER_TO_DEV: 252 writing = 1; 253 break; 254 case SG_DXFER_TO_FROM_DEV: 255 case SG_DXFER_FROM_DEV: 256 break; 257 } 258 259 rq = blk_get_request(q, writing ? WRITE : READ, GFP_KERNEL); 260 if (!rq) 261 return -ENOMEM; 262 263 /* 264 * fill in request structure 265 */ 266 rq->cmd_len = hdr->cmd_len; 267 memset(rq->cmd, 0, BLK_MAX_CDB); /* ATAPI hates garbage after CDB */ 268 memcpy(rq->cmd, cmd, hdr->cmd_len); 269 270 memset(sense, 0, sizeof(sense)); 271 rq->sense = sense; 272 rq->sense_len = 0; 273 274 rq->cmd_type = REQ_TYPE_BLOCK_PC; 275 276 timeout = msecs_to_jiffies(hdr->timeout); 277 rq->timeout = (timeout < INT_MAX) ? timeout : INT_MAX; 278 if (!rq->timeout) 279 rq->timeout = q->sg_timeout; 280 if (!rq->timeout) 281 rq->timeout = BLK_DEFAULT_TIMEOUT; 282 283 if (hdr->iovec_count) { 284 const int size = sizeof(struct sg_iovec) * hdr->iovec_count; 285 struct sg_iovec *iov; 286 287 iov = kmalloc(size, GFP_KERNEL); 288 if (!iov) { 289 ret = -ENOMEM; 290 goto out; 291 } 292 293 if (copy_from_user(iov, hdr->dxferp, size)) { 294 kfree(iov); 295 ret = -EFAULT; 296 goto out; 297 } 298 299 ret = blk_rq_map_user_iov(q, rq, iov, hdr->iovec_count, 300 hdr->dxfer_len); 301 kfree(iov); 302 } else if (hdr->dxfer_len) 303 ret = blk_rq_map_user(q, rq, hdr->dxferp, hdr->dxfer_len); 304 305 if (ret) 306 goto out; 307 308 bio = rq->bio; 309 rq->retries = 0; 310 311 start_time = jiffies; 312 313 /* ignore return value. All information is passed back to caller 314 * (if he doesn't check that is his problem). 315 * N.B. a non-zero SCSI status is _not_ necessarily an error. 316 */ 317 blk_execute_rq(q, bd_disk, rq, 0); 318 319 /* write to all output members */ 320 hdr->status = 0xff & rq->errors; 321 hdr->masked_status = status_byte(rq->errors); 322 hdr->msg_status = msg_byte(rq->errors); 323 hdr->host_status = host_byte(rq->errors); 324 hdr->driver_status = driver_byte(rq->errors); 325 hdr->info = 0; 326 if (hdr->masked_status || hdr->host_status || hdr->driver_status) 327 hdr->info |= SG_INFO_CHECK; 328 hdr->resid = rq->data_len; 329 hdr->duration = ((jiffies - start_time) * 1000) / HZ; 330 hdr->sb_len_wr = 0; 331 332 if (rq->sense_len && hdr->sbp) { 333 int len = min((unsigned int) hdr->mx_sb_len, rq->sense_len); 334 335 if (!copy_to_user(hdr->sbp, rq->sense, len)) 336 hdr->sb_len_wr = len; 337 } 338 339 if (blk_rq_unmap_user(bio)) 340 ret = -EFAULT; 341 342 /* may not have succeeded, but output values written to control 343 * structure (struct sg_io_hdr). */ 344out: 345 blk_put_request(rq); 346 return ret; 347} 348 349/** 350 * sg_scsi_ioctl -- handle deprecated SCSI_IOCTL_SEND_COMMAND ioctl 351 * @file: file this ioctl operates on (optional) 352 * @q: request queue to send scsi commands down 353 * @disk: gendisk to operate on (option) 354 * @sic: userspace structure describing the command to perform 355 * 356 * Send down the scsi command described by @sic to the device below 357 * the request queue @q. If @file is non-NULL it's used to perform 358 * fine-grained permission checks that allow users to send down 359 * non-destructive SCSI commands. If the caller has a struct gendisk 360 * available it should be passed in as @disk to allow the low level 361 * driver to use the information contained in it. A non-NULL @disk 362 * is only allowed if the caller knows that the low level driver doesn't 363 * need it (e.g. in the scsi subsystem). 364 * 365 * Notes: 366 * - This interface is deprecated - users should use the SG_IO 367 * interface instead, as this is a more flexible approach to 368 * performing SCSI commands on a device. 369 * - The SCSI command length is determined by examining the 1st byte 370 * of the given command. There is no way to override this. 371 * - Data transfers are limited to PAGE_SIZE 372 * - The length (x + y) must be at least OMAX_SB_LEN bytes long to 373 * accommodate the sense buffer when an error occurs. 374 * The sense buffer is truncated to OMAX_SB_LEN (16) bytes so that 375 * old code will not be surprised. 376 * - If a Unix error occurs (e.g. ENOMEM) then the user will receive 377 * a negative return and the Unix error code in 'errno'. 378 * If the SCSI command succeeds then 0 is returned. 379 * Positive numbers returned are the compacted SCSI error codes (4 380 * bytes in one int) where the lowest byte is the SCSI status. 381 */ 382#define OMAX_SB_LEN 16 /* For backward compatibility */ 383int sg_scsi_ioctl(struct file *file, struct request_queue *q, 384 struct gendisk *disk, struct scsi_ioctl_command __user *sic) 385{ 386 struct request *rq; 387 int err; 388 unsigned int in_len, out_len, bytes, opcode, cmdlen; 389 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE]; 390 391 if (!sic) 392 return -EINVAL; 393 394 /* 395 * get in an out lengths, verify they don't exceed a page worth of data 396 */ 397 if (get_user(in_len, &sic->inlen)) 398 return -EFAULT; 399 if (get_user(out_len, &sic->outlen)) 400 return -EFAULT; 401 if (in_len > PAGE_SIZE || out_len > PAGE_SIZE) 402 return -EINVAL; 403 if (get_user(opcode, sic->data)) 404 return -EFAULT; 405 406 bytes = max(in_len, out_len); 407 if (bytes) { 408 buffer = kmalloc(bytes, q->bounce_gfp | GFP_USER| __GFP_NOWARN); 409 if (!buffer) 410 return -ENOMEM; 411 412 memset(buffer, 0, bytes); 413 } 414 415 rq = blk_get_request(q, in_len ? WRITE : READ, __GFP_WAIT); 416 417 cmdlen = COMMAND_SIZE(opcode); 418 419 /* 420 * get command and data to send to device, if any 421 */ 422 err = -EFAULT; 423 rq->cmd_len = cmdlen; 424 if (copy_from_user(rq->cmd, sic->data, cmdlen)) 425 goto error; 426 427 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len)) 428 goto error; 429 430 err = verify_command(file, rq->cmd); 431 if (err) 432 goto error; 433 434 /* default. possible overriden later */ 435 rq->retries = 5; 436 437 switch (opcode) { 438 case SEND_DIAGNOSTIC: 439 case FORMAT_UNIT: 440 rq->timeout = FORMAT_UNIT_TIMEOUT; 441 rq->retries = 1; 442 break; 443 case START_STOP: 444 rq->timeout = START_STOP_TIMEOUT; 445 break; 446 case MOVE_MEDIUM: 447 rq->timeout = MOVE_MEDIUM_TIMEOUT; 448 break; 449 case READ_ELEMENT_STATUS: 450 rq->timeout = READ_ELEMENT_STATUS_TIMEOUT; 451 break; 452 case READ_DEFECT_DATA: 453 rq->timeout = READ_DEFECT_DATA_TIMEOUT; 454 rq->retries = 1; 455 break; 456 default: 457 rq->timeout = BLK_DEFAULT_TIMEOUT; 458 break; 459 } 460 461 if (bytes && blk_rq_map_kern(q, rq, buffer, bytes, __GFP_WAIT)) { 462 err = DRIVER_ERROR << 24; 463 goto out; 464 } 465 466 memset(sense, 0, sizeof(sense)); 467 rq->sense = sense; 468 rq->sense_len = 0; 469 rq->cmd_type = REQ_TYPE_BLOCK_PC; 470 471 blk_execute_rq(q, disk, rq, 0); 472 473out: 474 err = rq->errors & 0xff; /* only 8 bit SCSI status */ 475 if (err) { 476 if (rq->sense_len && rq->sense) { 477 bytes = (OMAX_SB_LEN > rq->sense_len) ? 478 rq->sense_len : OMAX_SB_LEN; 479 if (copy_to_user(sic->data, rq->sense, bytes)) 480 err = -EFAULT; 481 } 482 } else { 483 if (copy_to_user(sic->data, buffer, out_len)) 484 err = -EFAULT; 485 } 486 487error: 488 kfree(buffer); 489 blk_put_request(rq); 490 return err; 491} 492EXPORT_SYMBOL_GPL(sg_scsi_ioctl); 493 494/* Send basic block requests */ 495static int __blk_send_generic(request_queue_t *q, struct gendisk *bd_disk, int cmd, int data) 496{ 497 struct request *rq; 498 int err; 499 500 rq = blk_get_request(q, WRITE, __GFP_WAIT); 501 rq->cmd_type = REQ_TYPE_BLOCK_PC; 502 rq->data = NULL; 503 rq->data_len = 0; 504 rq->timeout = BLK_DEFAULT_TIMEOUT; 505 memset(rq->cmd, 0, sizeof(rq->cmd)); 506 rq->cmd[0] = cmd; 507 rq->cmd[4] = data; 508 rq->cmd_len = 6; 509 err = blk_execute_rq(q, bd_disk, rq, 0); 510 blk_put_request(rq); 511 512 return err; 513} 514 515static inline int blk_send_start_stop(request_queue_t *q, struct gendisk *bd_disk, int data) 516{ 517 return __blk_send_generic(q, bd_disk, GPCMD_START_STOP_UNIT, data); 518} 519 520int scsi_cmd_ioctl(struct file *file, struct gendisk *bd_disk, unsigned int cmd, void __user *arg) 521{ 522 request_queue_t *q; 523 int err; 524 525 q = bd_disk->queue; 526 if (!q) 527 return -ENXIO; 528 529 if (blk_get_queue(q)) 530 return -ENXIO; 531 532 switch (cmd) { 533 /* 534 * new sgv3 interface 535 */ 536 case SG_GET_VERSION_NUM: 537 err = sg_get_version(arg); 538 break; 539 case SCSI_IOCTL_GET_IDLUN: 540 err = scsi_get_idlun(q, arg); 541 break; 542 case SCSI_IOCTL_GET_BUS_NUMBER: 543 err = scsi_get_bus(q, arg); 544 break; 545 case SG_SET_TIMEOUT: 546 err = sg_set_timeout(q, arg); 547 break; 548 case SG_GET_TIMEOUT: 549 err = sg_get_timeout(q); 550 break; 551 case SG_GET_RESERVED_SIZE: 552 err = sg_get_reserved_size(q, arg); 553 break; 554 case SG_SET_RESERVED_SIZE: 555 err = sg_set_reserved_size(q, arg); 556 break; 557 case SG_EMULATED_HOST: 558 err = sg_emulated_host(q, arg); 559 break; 560 case SG_IO: { 561 struct sg_io_hdr hdr; 562 563 err = -EFAULT; 564 if (copy_from_user(&hdr, arg, sizeof(hdr))) 565 break; 566 err = sg_io(file, q, bd_disk, &hdr); 567 if (err == -EFAULT) 568 break; 569 570 if (copy_to_user(arg, &hdr, sizeof(hdr))) 571 err = -EFAULT; 572 break; 573 } 574 case CDROM_SEND_PACKET: { 575 struct cdrom_generic_command cgc; 576 struct sg_io_hdr hdr; 577 578 err = -EFAULT; 579 if (copy_from_user(&cgc, arg, sizeof(cgc))) 580 break; 581 cgc.timeout = clock_t_to_jiffies(cgc.timeout); 582 memset(&hdr, 0, sizeof(hdr)); 583 hdr.interface_id = 'S'; 584 hdr.cmd_len = sizeof(cgc.cmd); 585 hdr.dxfer_len = cgc.buflen; 586 err = 0; 587 switch (cgc.data_direction) { 588 case CGC_DATA_UNKNOWN: 589 hdr.dxfer_direction = SG_DXFER_UNKNOWN; 590 break; 591 case CGC_DATA_WRITE: 592 hdr.dxfer_direction = SG_DXFER_TO_DEV; 593 break; 594 case CGC_DATA_READ: 595 hdr.dxfer_direction = SG_DXFER_FROM_DEV; 596 break; 597 case CGC_DATA_NONE: 598 hdr.dxfer_direction = SG_DXFER_NONE; 599 break; 600 default: 601 err = -EINVAL; 602 } 603 if (err) 604 break; 605 606 hdr.dxferp = cgc.buffer; 607 hdr.sbp = cgc.sense; 608 if (hdr.sbp) 609 hdr.mx_sb_len = sizeof(struct request_sense); 610 hdr.timeout = cgc.timeout; 611 hdr.cmdp = ((struct cdrom_generic_command __user*) arg)->cmd; 612 hdr.cmd_len = sizeof(cgc.cmd); 613 614 err = sg_io(file, q, bd_disk, &hdr); 615 if (err == -EFAULT) 616 break; 617 618 if (hdr.status) 619 err = -EIO; 620 621 cgc.stat = err; 622 cgc.buflen = hdr.resid; 623 if (copy_to_user(arg, &cgc, sizeof(cgc))) 624 err = -EFAULT; 625 626 break; 627 } 628 629 /* 630 * old junk scsi send command ioctl 631 */ 632 case SCSI_IOCTL_SEND_COMMAND: 633 printk(KERN_WARNING "program %s is using a deprecated SCSI ioctl, please convert it to SG_IO\n", current->comm); 634 err = -EINVAL; 635 if (!arg) 636 break; 637 638 err = sg_scsi_ioctl(file, q, bd_disk, arg); 639 break; 640 case CDROMCLOSETRAY: 641 err = blk_send_start_stop(q, bd_disk, 0x03); 642 break; 643 case CDROMEJECT: 644 err = blk_send_start_stop(q, bd_disk, 0x02); 645 break; 646 default: 647 err = -ENOTTY; 648 } 649 650 blk_put_queue(q); 651 return err; 652} 653 654EXPORT_SYMBOL(scsi_cmd_ioctl); 655