sg.c 71 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * History:
  4. * Started: Aug 9 by Lawrence Foard (entropy@world.std.com),
  5. * to allow user process control of SCSI devices.
  6. * Development Sponsored by Killy Corp. NY NY
  7. *
  8. * Original driver (sg.c):
  9. * Copyright (C) 1992 Lawrence Foard
  10. * Version 2 and 3 extensions to driver:
  11. * Copyright (C) 1998 - 2014 Douglas Gilbert
  12. */
  13. static int sg_version_num = 30536; /* 2 digits for each component */
  14. #define SG_VERSION_STR "3.5.36"
  15. /*
  16. * D. P. Gilbert (dgilbert@interlog.com), notes:
  17. * - scsi logging is available via SCSI_LOG_TIMEOUT macros. First
  18. * the kernel/module needs to be built with CONFIG_SCSI_LOGGING
  19. * (otherwise the macros compile to empty statements).
  20. *
  21. */
  22. #include <linux/module.h>
  23. #include <linux/fs.h>
  24. #include <linux/kernel.h>
  25. #include <linux/sched.h>
  26. #include <linux/string.h>
  27. #include <linux/mm.h>
  28. #include <linux/errno.h>
  29. #include <linux/mtio.h>
  30. #include <linux/ioctl.h>
  31. #include <linux/slab.h>
  32. #include <linux/fcntl.h>
  33. #include <linux/init.h>
  34. #include <linux/poll.h>
  35. #include <linux/moduleparam.h>
  36. #include <linux/cdev.h>
  37. #include <linux/idr.h>
  38. #include <linux/seq_file.h>
  39. #include <linux/blkdev.h>
  40. #include <linux/delay.h>
  41. #include <linux/blktrace_api.h>
  42. #include <linux/mutex.h>
  43. #include <linux/atomic.h>
  44. #include <linux/ratelimit.h>
  45. #include <linux/uio.h>
  46. #include <linux/cred.h> /* for sg_check_file_access() */
  47. #include "scsi.h"
  48. #include <scsi/scsi_dbg.h>
  49. #include <scsi/scsi_host.h>
  50. #include <scsi/scsi_driver.h>
  51. #include <scsi/scsi_ioctl.h>
  52. #include <scsi/sg.h>
  53. #include "scsi_logging.h"
  54. #ifdef CONFIG_SCSI_PROC_FS
  55. #include <linux/proc_fs.h>
  56. static char *sg_version_date = "20140603";
  57. static int sg_proc_init(void);
  58. #endif
  59. #define SG_ALLOW_DIO_DEF 0
  60. #define SG_MAX_DEVS 32768
  61. /* SG_MAX_CDB_SIZE should be 260 (spc4r37 section 3.1.30) however the type
  62. * of sg_io_hdr::cmd_len can only represent 255. All SCSI commands greater
  63. * than 16 bytes are "variable length" whose length is a multiple of 4
  64. */
  65. #define SG_MAX_CDB_SIZE 252
  66. #define SG_DEFAULT_TIMEOUT mult_frac(SG_DEFAULT_TIMEOUT_USER, HZ, USER_HZ)
  67. int sg_big_buff = SG_DEF_RESERVED_SIZE;
  68. /* N.B. This variable is readable and writeable via
  69. /proc/scsi/sg/def_reserved_size . Each time sg_open() is called a buffer
  70. of this size (or less if there is not enough memory) will be reserved
  71. for use by this file descriptor. [Deprecated usage: this variable is also
  72. readable via /proc/sys/kernel/sg-big-buff if the sg driver is built into
  73. the kernel (i.e. it is not a module).] */
  74. static int def_reserved_size = -1; /* picks up init parameter */
  75. static int sg_allow_dio = SG_ALLOW_DIO_DEF;
  76. static int scatter_elem_sz = SG_SCATTER_SZ;
  77. static int scatter_elem_sz_prev = SG_SCATTER_SZ;
  78. #define SG_SECTOR_SZ 512
  79. static int sg_add_device(struct device *, struct class_interface *);
  80. static void sg_remove_device(struct device *, struct class_interface *);
  81. static DEFINE_IDR(sg_index_idr);
  82. static DEFINE_RWLOCK(sg_index_lock); /* Also used to lock
  83. file descriptor list for device */
  84. static struct class_interface sg_interface = {
  85. .add_dev = sg_add_device,
  86. .remove_dev = sg_remove_device,
  87. };
  88. typedef struct sg_scatter_hold { /* holding area for scsi scatter gather info */
  89. unsigned short k_use_sg; /* Count of kernel scatter-gather pieces */
  90. unsigned sglist_len; /* size of malloc'd scatter-gather list ++ */
  91. unsigned bufflen; /* Size of (aggregate) data buffer */
  92. struct page **pages;
  93. int page_order;
  94. char dio_in_use; /* 0->indirect IO (or mmap), 1->dio */
  95. unsigned char cmd_opcode; /* first byte of command */
  96. } Sg_scatter_hold;
  97. struct sg_device; /* forward declarations */
  98. struct sg_fd;
  99. typedef struct sg_request { /* SG_MAX_QUEUE requests outstanding per file */
  100. struct list_head entry; /* list entry */
  101. struct sg_fd *parentfp; /* NULL -> not in use */
  102. Sg_scatter_hold data; /* hold buffer, perhaps scatter list */
  103. sg_io_hdr_t header; /* scsi command+info, see <scsi/sg.h> */
  104. unsigned char sense_b[SCSI_SENSE_BUFFERSIZE];
  105. char res_used; /* 1 -> using reserve buffer, 0 -> not ... */
  106. char orphan; /* 1 -> drop on sight, 0 -> normal */
  107. char sg_io_owned; /* 1 -> packet belongs to SG_IO */
  108. /* done protected by rq_list_lock */
  109. char done; /* 0->before bh, 1->before read, 2->read */
  110. struct request *rq;
  111. struct bio *bio;
  112. struct execute_work ew;
  113. } Sg_request;
  114. typedef struct sg_fd { /* holds the state of a file descriptor */
  115. struct list_head sfd_siblings; /* protected by device's sfd_lock */
  116. struct sg_device *parentdp; /* owning device */
  117. wait_queue_head_t read_wait; /* queue read until command done */
  118. rwlock_t rq_list_lock; /* protect access to list in req_arr */
  119. struct mutex f_mutex; /* protect against changes in this fd */
  120. int timeout; /* defaults to SG_DEFAULT_TIMEOUT */
  121. int timeout_user; /* defaults to SG_DEFAULT_TIMEOUT_USER */
  122. Sg_scatter_hold reserve; /* buffer held for this file descriptor */
  123. struct list_head rq_list; /* head of request list */
  124. struct fasync_struct *async_qp; /* used by asynchronous notification */
  125. Sg_request req_arr[SG_MAX_QUEUE]; /* used as singly-linked list */
  126. char force_packid; /* 1 -> pack_id input to read(), 0 -> ignored */
  127. char cmd_q; /* 1 -> allow command queuing, 0 -> don't */
  128. unsigned char next_cmd_len; /* 0: automatic, >0: use on next write() */
  129. char keep_orphan; /* 0 -> drop orphan (def), 1 -> keep for read() */
  130. char mmap_called; /* 0 -> mmap() never called on this fd */
  131. char res_in_use; /* 1 -> 'reserve' array in use */
  132. struct kref f_ref;
  133. struct execute_work ew;
  134. } Sg_fd;
  135. typedef struct sg_device { /* holds the state of each scsi generic device */
  136. struct scsi_device *device;
  137. wait_queue_head_t open_wait; /* queue open() when O_EXCL present */
  138. struct mutex open_rel_lock; /* held when in open() or release() */
  139. int sg_tablesize; /* adapter's max scatter-gather table size */
  140. u32 index; /* device index number */
  141. struct list_head sfds;
  142. rwlock_t sfd_lock; /* protect access to sfd list */
  143. atomic_t detaching; /* 0->device usable, 1->device detaching */
  144. bool exclude; /* 1->open(O_EXCL) succeeded and is active */
  145. int open_cnt; /* count of opens (perhaps < num(sfds) ) */
  146. char sgdebug; /* 0->off, 1->sense, 9->dump dev, 10-> all devs */
  147. struct gendisk *disk;
  148. struct cdev * cdev; /* char_dev [sysfs: /sys/cdev/major/sg<n>] */
  149. struct kref d_ref;
  150. } Sg_device;
  151. /* tasklet or soft irq callback */
  152. static void sg_rq_end_io(struct request *rq, blk_status_t status);
  153. static int sg_start_req(Sg_request *srp, unsigned char *cmd);
  154. static int sg_finish_rem_req(Sg_request * srp);
  155. static int sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size);
  156. static ssize_t sg_new_read(Sg_fd * sfp, char __user *buf, size_t count,
  157. Sg_request * srp);
  158. static ssize_t sg_new_write(Sg_fd *sfp, struct file *file,
  159. const char __user *buf, size_t count, int blocking,
  160. int read_only, int sg_io_owned, Sg_request **o_srp);
  161. static int sg_common_write(Sg_fd * sfp, Sg_request * srp,
  162. unsigned char *cmnd, int timeout, int blocking);
  163. static int sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer);
  164. static void sg_remove_scat(Sg_fd * sfp, Sg_scatter_hold * schp);
  165. static void sg_build_reserve(Sg_fd * sfp, int req_size);
  166. static void sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size);
  167. static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp);
  168. static Sg_fd *sg_add_sfp(Sg_device * sdp);
  169. static void sg_remove_sfp(struct kref *);
  170. static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id);
  171. static Sg_request *sg_add_request(Sg_fd * sfp);
  172. static int sg_remove_request(Sg_fd * sfp, Sg_request * srp);
  173. static Sg_device *sg_get_dev(int dev);
  174. static void sg_device_destroy(struct kref *kref);
  175. #define SZ_SG_HEADER sizeof(struct sg_header)
  176. #define SZ_SG_IO_HDR sizeof(sg_io_hdr_t)
  177. #define SZ_SG_IOVEC sizeof(sg_iovec_t)
  178. #define SZ_SG_REQ_INFO sizeof(sg_req_info_t)
  179. #define sg_printk(prefix, sdp, fmt, a...) \
  180. sdev_prefix_printk(prefix, (sdp)->device, \
  181. (sdp)->disk->disk_name, fmt, ##a)
  182. /*
  183. * The SCSI interfaces that use read() and write() as an asynchronous variant of
  184. * ioctl(..., SG_IO, ...) are fundamentally unsafe, since there are lots of ways
  185. * to trigger read() and write() calls from various contexts with elevated
  186. * privileges. This can lead to kernel memory corruption (e.g. if these
  187. * interfaces are called through splice()) and privilege escalation inside
  188. * userspace (e.g. if a process with access to such a device passes a file
  189. * descriptor to a SUID binary as stdin/stdout/stderr).
  190. *
  191. * This function provides protection for the legacy API by restricting the
  192. * calling context.
  193. */
  194. static int sg_check_file_access(struct file *filp, const char *caller)
  195. {
  196. if (filp->f_cred != current_real_cred()) {
  197. pr_err_once("%s: process %d (%s) changed security contexts after opening file descriptor, this is not allowed.\n",
  198. caller, task_tgid_vnr(current), current->comm);
  199. return -EPERM;
  200. }
  201. if (uaccess_kernel()) {
  202. pr_err_once("%s: process %d (%s) called from kernel context, this is not allowed.\n",
  203. caller, task_tgid_vnr(current), current->comm);
  204. return -EACCES;
  205. }
  206. return 0;
  207. }
  208. static int sg_allow_access(struct file *filp, unsigned char *cmd)
  209. {
  210. struct sg_fd *sfp = filp->private_data;
  211. if (sfp->parentdp->device->type == TYPE_SCANNER)
  212. return 0;
  213. return blk_verify_command(cmd, filp->f_mode);
  214. }
  215. static int
  216. open_wait(Sg_device *sdp, int flags)
  217. {
  218. int retval = 0;
  219. if (flags & O_EXCL) {
  220. while (sdp->open_cnt > 0) {
  221. mutex_unlock(&sdp->open_rel_lock);
  222. retval = wait_event_interruptible(sdp->open_wait,
  223. (atomic_read(&sdp->detaching) ||
  224. !sdp->open_cnt));
  225. mutex_lock(&sdp->open_rel_lock);
  226. if (retval) /* -ERESTARTSYS */
  227. return retval;
  228. if (atomic_read(&sdp->detaching))
  229. return -ENODEV;
  230. }
  231. } else {
  232. while (sdp->exclude) {
  233. mutex_unlock(&sdp->open_rel_lock);
  234. retval = wait_event_interruptible(sdp->open_wait,
  235. (atomic_read(&sdp->detaching) ||
  236. !sdp->exclude));
  237. mutex_lock(&sdp->open_rel_lock);
  238. if (retval) /* -ERESTARTSYS */
  239. return retval;
  240. if (atomic_read(&sdp->detaching))
  241. return -ENODEV;
  242. }
  243. }
  244. return retval;
  245. }
  246. /* Returns 0 on success, else a negated errno value */
  247. static int
  248. sg_open(struct inode *inode, struct file *filp)
  249. {
  250. int dev = iminor(inode);
  251. int flags = filp->f_flags;
  252. struct request_queue *q;
  253. Sg_device *sdp;
  254. Sg_fd *sfp;
  255. int retval;
  256. nonseekable_open(inode, filp);
  257. if ((flags & O_EXCL) && (O_RDONLY == (flags & O_ACCMODE)))
  258. return -EPERM; /* Can't lock it with read only access */
  259. sdp = sg_get_dev(dev);
  260. if (IS_ERR(sdp))
  261. return PTR_ERR(sdp);
  262. SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
  263. "sg_open: flags=0x%x\n", flags));
  264. /* This driver's module count bumped by fops_get in <linux/fs.h> */
  265. /* Prevent the device driver from vanishing while we sleep */
  266. retval = scsi_device_get(sdp->device);
  267. if (retval)
  268. goto sg_put;
  269. retval = scsi_autopm_get_device(sdp->device);
  270. if (retval)
  271. goto sdp_put;
  272. /* scsi_block_when_processing_errors() may block so bypass
  273. * check if O_NONBLOCK. Permits SCSI commands to be issued
  274. * during error recovery. Tread carefully. */
  275. if (!((flags & O_NONBLOCK) ||
  276. scsi_block_when_processing_errors(sdp->device))) {
  277. retval = -ENXIO;
  278. /* we are in error recovery for this device */
  279. goto error_out;
  280. }
  281. mutex_lock(&sdp->open_rel_lock);
  282. if (flags & O_NONBLOCK) {
  283. if (flags & O_EXCL) {
  284. if (sdp->open_cnt > 0) {
  285. retval = -EBUSY;
  286. goto error_mutex_locked;
  287. }
  288. } else {
  289. if (sdp->exclude) {
  290. retval = -EBUSY;
  291. goto error_mutex_locked;
  292. }
  293. }
  294. } else {
  295. retval = open_wait(sdp, flags);
  296. if (retval) /* -ERESTARTSYS or -ENODEV */
  297. goto error_mutex_locked;
  298. }
  299. /* N.B. at this point we are holding the open_rel_lock */
  300. if (flags & O_EXCL)
  301. sdp->exclude = true;
  302. if (sdp->open_cnt < 1) { /* no existing opens */
  303. sdp->sgdebug = 0;
  304. q = sdp->device->request_queue;
  305. sdp->sg_tablesize = queue_max_segments(q);
  306. }
  307. sfp = sg_add_sfp(sdp);
  308. if (IS_ERR(sfp)) {
  309. retval = PTR_ERR(sfp);
  310. goto out_undo;
  311. }
  312. filp->private_data = sfp;
  313. sdp->open_cnt++;
  314. mutex_unlock(&sdp->open_rel_lock);
  315. retval = 0;
  316. sg_put:
  317. kref_put(&sdp->d_ref, sg_device_destroy);
  318. return retval;
  319. out_undo:
  320. if (flags & O_EXCL) {
  321. sdp->exclude = false; /* undo if error */
  322. wake_up_interruptible(&sdp->open_wait);
  323. }
  324. error_mutex_locked:
  325. mutex_unlock(&sdp->open_rel_lock);
  326. error_out:
  327. scsi_autopm_put_device(sdp->device);
  328. sdp_put:
  329. scsi_device_put(sdp->device);
  330. goto sg_put;
  331. }
  332. /* Release resources associated with a successful sg_open()
  333. * Returns 0 on success, else a negated errno value */
  334. static int
  335. sg_release(struct inode *inode, struct file *filp)
  336. {
  337. Sg_device *sdp;
  338. Sg_fd *sfp;
  339. if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
  340. return -ENXIO;
  341. SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp, "sg_release\n"));
  342. mutex_lock(&sdp->open_rel_lock);
  343. scsi_autopm_put_device(sdp->device);
  344. kref_put(&sfp->f_ref, sg_remove_sfp);
  345. sdp->open_cnt--;
  346. /* possibly many open()s waiting on exlude clearing, start many;
  347. * only open(O_EXCL)s wait on 0==open_cnt so only start one */
  348. if (sdp->exclude) {
  349. sdp->exclude = false;
  350. wake_up_interruptible_all(&sdp->open_wait);
  351. } else if (0 == sdp->open_cnt) {
  352. wake_up_interruptible(&sdp->open_wait);
  353. }
  354. mutex_unlock(&sdp->open_rel_lock);
  355. return 0;
  356. }
  357. static int get_sg_io_pack_id(int *pack_id, void __user *buf, size_t count)
  358. {
  359. struct sg_header __user *old_hdr = buf;
  360. int reply_len;
  361. if (count >= SZ_SG_HEADER) {
  362. /* negative reply_len means v3 format, otherwise v1/v2 */
  363. if (get_user(reply_len, &old_hdr->reply_len))
  364. return -EFAULT;
  365. if (reply_len >= 0)
  366. return get_user(*pack_id, &old_hdr->pack_id);
  367. if (in_compat_syscall() &&
  368. count >= sizeof(struct compat_sg_io_hdr)) {
  369. struct compat_sg_io_hdr __user *hp = buf;
  370. return get_user(*pack_id, &hp->pack_id);
  371. }
  372. if (count >= sizeof(struct sg_io_hdr)) {
  373. struct sg_io_hdr __user *hp = buf;
  374. return get_user(*pack_id, &hp->pack_id);
  375. }
  376. }
  377. /* no valid header was passed, so ignore the pack_id */
  378. *pack_id = -1;
  379. return 0;
  380. }
  381. static ssize_t
  382. sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
  383. {
  384. Sg_device *sdp;
  385. Sg_fd *sfp;
  386. Sg_request *srp;
  387. int req_pack_id = -1;
  388. sg_io_hdr_t *hp;
  389. struct sg_header *old_hdr;
  390. int retval;
  391. /*
  392. * This could cause a response to be stranded. Close the associated
  393. * file descriptor to free up any resources being held.
  394. */
  395. retval = sg_check_file_access(filp, __func__);
  396. if (retval)
  397. return retval;
  398. if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
  399. return -ENXIO;
  400. SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
  401. "sg_read: count=%d\n", (int) count));
  402. if (sfp->force_packid)
  403. retval = get_sg_io_pack_id(&req_pack_id, buf, count);
  404. if (retval)
  405. return retval;
  406. srp = sg_get_rq_mark(sfp, req_pack_id);
  407. if (!srp) { /* now wait on packet to arrive */
  408. if (atomic_read(&sdp->detaching))
  409. return -ENODEV;
  410. if (filp->f_flags & O_NONBLOCK)
  411. return -EAGAIN;
  412. retval = wait_event_interruptible(sfp->read_wait,
  413. (atomic_read(&sdp->detaching) ||
  414. (srp = sg_get_rq_mark(sfp, req_pack_id))));
  415. if (atomic_read(&sdp->detaching))
  416. return -ENODEV;
  417. if (retval)
  418. /* -ERESTARTSYS as signal hit process */
  419. return retval;
  420. }
  421. if (srp->header.interface_id != '\0')
  422. return sg_new_read(sfp, buf, count, srp);
  423. hp = &srp->header;
  424. old_hdr = kzalloc(SZ_SG_HEADER, GFP_KERNEL);
  425. if (!old_hdr)
  426. return -ENOMEM;
  427. old_hdr->reply_len = (int) hp->timeout;
  428. old_hdr->pack_len = old_hdr->reply_len; /* old, strange behaviour */
  429. old_hdr->pack_id = hp->pack_id;
  430. old_hdr->twelve_byte =
  431. ((srp->data.cmd_opcode >= 0xc0) && (12 == hp->cmd_len)) ? 1 : 0;
  432. old_hdr->target_status = hp->masked_status;
  433. old_hdr->host_status = hp->host_status;
  434. old_hdr->driver_status = hp->driver_status;
  435. if ((CHECK_CONDITION & hp->masked_status) ||
  436. (DRIVER_SENSE & hp->driver_status))
  437. memcpy(old_hdr->sense_buffer, srp->sense_b,
  438. sizeof (old_hdr->sense_buffer));
  439. switch (hp->host_status) {
  440. /* This setup of 'result' is for backward compatibility and is best
  441. ignored by the user who should use target, host + driver status */
  442. case DID_OK:
  443. case DID_PASSTHROUGH:
  444. case DID_SOFT_ERROR:
  445. old_hdr->result = 0;
  446. break;
  447. case DID_NO_CONNECT:
  448. case DID_BUS_BUSY:
  449. case DID_TIME_OUT:
  450. old_hdr->result = EBUSY;
  451. break;
  452. case DID_BAD_TARGET:
  453. case DID_ABORT:
  454. case DID_PARITY:
  455. case DID_RESET:
  456. case DID_BAD_INTR:
  457. old_hdr->result = EIO;
  458. break;
  459. case DID_ERROR:
  460. old_hdr->result = (srp->sense_b[0] == 0 &&
  461. hp->masked_status == GOOD) ? 0 : EIO;
  462. break;
  463. default:
  464. old_hdr->result = EIO;
  465. break;
  466. }
  467. /* Now copy the result back to the user buffer. */
  468. if (count >= SZ_SG_HEADER) {
  469. if (copy_to_user(buf, old_hdr, SZ_SG_HEADER)) {
  470. retval = -EFAULT;
  471. goto free_old_hdr;
  472. }
  473. buf += SZ_SG_HEADER;
  474. if (count > old_hdr->reply_len)
  475. count = old_hdr->reply_len;
  476. if (count > SZ_SG_HEADER) {
  477. if (sg_read_oxfer(srp, buf, count - SZ_SG_HEADER)) {
  478. retval = -EFAULT;
  479. goto free_old_hdr;
  480. }
  481. }
  482. } else
  483. count = (old_hdr->result == 0) ? 0 : -EIO;
  484. sg_finish_rem_req(srp);
  485. sg_remove_request(sfp, srp);
  486. retval = count;
  487. free_old_hdr:
  488. kfree(old_hdr);
  489. return retval;
  490. }
  491. static ssize_t
  492. sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
  493. {
  494. sg_io_hdr_t *hp = &srp->header;
  495. int err = 0, err2;
  496. int len;
  497. if (in_compat_syscall()) {
  498. if (count < sizeof(struct compat_sg_io_hdr)) {
  499. err = -EINVAL;
  500. goto err_out;
  501. }
  502. } else if (count < SZ_SG_IO_HDR) {
  503. err = -EINVAL;
  504. goto err_out;
  505. }
  506. hp->sb_len_wr = 0;
  507. if ((hp->mx_sb_len > 0) && hp->sbp) {
  508. if ((CHECK_CONDITION & hp->masked_status) ||
  509. (DRIVER_SENSE & hp->driver_status)) {
  510. int sb_len = SCSI_SENSE_BUFFERSIZE;
  511. sb_len = (hp->mx_sb_len > sb_len) ? sb_len : hp->mx_sb_len;
  512. len = 8 + (int) srp->sense_b[7]; /* Additional sense length field */
  513. len = (len > sb_len) ? sb_len : len;
  514. if (copy_to_user(hp->sbp, srp->sense_b, len)) {
  515. err = -EFAULT;
  516. goto err_out;
  517. }
  518. hp->sb_len_wr = len;
  519. }
  520. }
  521. if (hp->masked_status || hp->host_status || hp->driver_status)
  522. hp->info |= SG_INFO_CHECK;
  523. err = put_sg_io_hdr(hp, buf);
  524. err_out:
  525. err2 = sg_finish_rem_req(srp);
  526. sg_remove_request(sfp, srp);
  527. return err ? : err2 ? : count;
  528. }
  529. static ssize_t
  530. sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
  531. {
  532. int mxsize, cmd_size, k;
  533. int input_size, blocking;
  534. unsigned char opcode;
  535. Sg_device *sdp;
  536. Sg_fd *sfp;
  537. Sg_request *srp;
  538. struct sg_header old_hdr;
  539. sg_io_hdr_t *hp;
  540. unsigned char cmnd[SG_MAX_CDB_SIZE];
  541. int retval;
  542. retval = sg_check_file_access(filp, __func__);
  543. if (retval)
  544. return retval;
  545. if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
  546. return -ENXIO;
  547. SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
  548. "sg_write: count=%d\n", (int) count));
  549. if (atomic_read(&sdp->detaching))
  550. return -ENODEV;
  551. if (!((filp->f_flags & O_NONBLOCK) ||
  552. scsi_block_when_processing_errors(sdp->device)))
  553. return -ENXIO;
  554. if (count < SZ_SG_HEADER)
  555. return -EIO;
  556. if (copy_from_user(&old_hdr, buf, SZ_SG_HEADER))
  557. return -EFAULT;
  558. blocking = !(filp->f_flags & O_NONBLOCK);
  559. if (old_hdr.reply_len < 0)
  560. return sg_new_write(sfp, filp, buf, count,
  561. blocking, 0, 0, NULL);
  562. if (count < (SZ_SG_HEADER + 6))
  563. return -EIO; /* The minimum scsi command length is 6 bytes. */
  564. buf += SZ_SG_HEADER;
  565. if (get_user(opcode, buf))
  566. return -EFAULT;
  567. if (!(srp = sg_add_request(sfp))) {
  568. SCSI_LOG_TIMEOUT(1, sg_printk(KERN_INFO, sdp,
  569. "sg_write: queue full\n"));
  570. return -EDOM;
  571. }
  572. mutex_lock(&sfp->f_mutex);
  573. if (sfp->next_cmd_len > 0) {
  574. cmd_size = sfp->next_cmd_len;
  575. sfp->next_cmd_len = 0; /* reset so only this write() effected */
  576. } else {
  577. cmd_size = COMMAND_SIZE(opcode); /* based on SCSI command group */
  578. if ((opcode >= 0xc0) && old_hdr.twelve_byte)
  579. cmd_size = 12;
  580. }
  581. mutex_unlock(&sfp->f_mutex);
  582. SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sdp,
  583. "sg_write: scsi opcode=0x%02x, cmd_size=%d\n", (int) opcode, cmd_size));
  584. /* Determine buffer size. */
  585. input_size = count - cmd_size;
  586. mxsize = (input_size > old_hdr.reply_len) ? input_size : old_hdr.reply_len;
  587. mxsize -= SZ_SG_HEADER;
  588. input_size -= SZ_SG_HEADER;
  589. if (input_size < 0) {
  590. sg_remove_request(sfp, srp);
  591. return -EIO; /* User did not pass enough bytes for this command. */
  592. }
  593. hp = &srp->header;
  594. hp->interface_id = '\0'; /* indicator of old interface tunnelled */
  595. hp->cmd_len = (unsigned char) cmd_size;
  596. hp->iovec_count = 0;
  597. hp->mx_sb_len = 0;
  598. if (input_size > 0)
  599. hp->dxfer_direction = (old_hdr.reply_len > SZ_SG_HEADER) ?
  600. SG_DXFER_TO_FROM_DEV : SG_DXFER_TO_DEV;
  601. else
  602. hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE;
  603. hp->dxfer_len = mxsize;
  604. if ((hp->dxfer_direction == SG_DXFER_TO_DEV) ||
  605. (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV))
  606. hp->dxferp = (char __user *)buf + cmd_size;
  607. else
  608. hp->dxferp = NULL;
  609. hp->sbp = NULL;
  610. hp->timeout = old_hdr.reply_len; /* structure abuse ... */
  611. hp->flags = input_size; /* structure abuse ... */
  612. hp->pack_id = old_hdr.pack_id;
  613. hp->usr_ptr = NULL;
  614. if (copy_from_user(cmnd, buf, cmd_size)) {
  615. sg_remove_request(sfp, srp);
  616. return -EFAULT;
  617. }
  618. /*
  619. * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV,
  620. * but is is possible that the app intended SG_DXFER_TO_DEV, because there
  621. * is a non-zero input_size, so emit a warning.
  622. */
  623. if (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV) {
  624. printk_ratelimited(KERN_WARNING
  625. "sg_write: data in/out %d/%d bytes "
  626. "for SCSI command 0x%x-- guessing "
  627. "data in;\n program %s not setting "
  628. "count and/or reply_len properly\n",
  629. old_hdr.reply_len - (int)SZ_SG_HEADER,
  630. input_size, (unsigned int) cmnd[0],
  631. current->comm);
  632. }
  633. k = sg_common_write(sfp, srp, cmnd, sfp->timeout, blocking);
  634. return (k < 0) ? k : count;
  635. }
  636. static ssize_t
  637. sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
  638. size_t count, int blocking, int read_only, int sg_io_owned,
  639. Sg_request **o_srp)
  640. {
  641. int k;
  642. Sg_request *srp;
  643. sg_io_hdr_t *hp;
  644. unsigned char cmnd[SG_MAX_CDB_SIZE];
  645. int timeout;
  646. unsigned long ul_timeout;
  647. if (count < SZ_SG_IO_HDR)
  648. return -EINVAL;
  649. sfp->cmd_q = 1; /* when sg_io_hdr seen, set command queuing on */
  650. if (!(srp = sg_add_request(sfp))) {
  651. SCSI_LOG_TIMEOUT(1, sg_printk(KERN_INFO, sfp->parentdp,
  652. "sg_new_write: queue full\n"));
  653. return -EDOM;
  654. }
  655. srp->sg_io_owned = sg_io_owned;
  656. hp = &srp->header;
  657. if (get_sg_io_hdr(hp, buf)) {
  658. sg_remove_request(sfp, srp);
  659. return -EFAULT;
  660. }
  661. if (hp->interface_id != 'S') {
  662. sg_remove_request(sfp, srp);
  663. return -ENOSYS;
  664. }
  665. if (hp->flags & SG_FLAG_MMAP_IO) {
  666. if (hp->dxfer_len > sfp->reserve.bufflen) {
  667. sg_remove_request(sfp, srp);
  668. return -ENOMEM; /* MMAP_IO size must fit in reserve buffer */
  669. }
  670. if (hp->flags & SG_FLAG_DIRECT_IO) {
  671. sg_remove_request(sfp, srp);
  672. return -EINVAL; /* either MMAP_IO or DIRECT_IO (not both) */
  673. }
  674. if (sfp->res_in_use) {
  675. sg_remove_request(sfp, srp);
  676. return -EBUSY; /* reserve buffer already being used */
  677. }
  678. }
  679. ul_timeout = msecs_to_jiffies(srp->header.timeout);
  680. timeout = (ul_timeout < INT_MAX) ? ul_timeout : INT_MAX;
  681. if ((!hp->cmdp) || (hp->cmd_len < 6) || (hp->cmd_len > sizeof (cmnd))) {
  682. sg_remove_request(sfp, srp);
  683. return -EMSGSIZE;
  684. }
  685. if (copy_from_user(cmnd, hp->cmdp, hp->cmd_len)) {
  686. sg_remove_request(sfp, srp);
  687. return -EFAULT;
  688. }
  689. if (read_only && sg_allow_access(file, cmnd)) {
  690. sg_remove_request(sfp, srp);
  691. return -EPERM;
  692. }
  693. k = sg_common_write(sfp, srp, cmnd, timeout, blocking);
  694. if (k < 0)
  695. return k;
  696. if (o_srp)
  697. *o_srp = srp;
  698. return count;
  699. }
  700. static int
  701. sg_common_write(Sg_fd * sfp, Sg_request * srp,
  702. unsigned char *cmnd, int timeout, int blocking)
  703. {
  704. int k, at_head;
  705. Sg_device *sdp = sfp->parentdp;
  706. sg_io_hdr_t *hp = &srp->header;
  707. srp->data.cmd_opcode = cmnd[0]; /* hold opcode of command */
  708. hp->status = 0;
  709. hp->masked_status = 0;
  710. hp->msg_status = 0;
  711. hp->info = 0;
  712. hp->host_status = 0;
  713. hp->driver_status = 0;
  714. hp->resid = 0;
  715. SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp,
  716. "sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n",
  717. (int) cmnd[0], (int) hp->cmd_len));
  718. if (hp->dxfer_len >= SZ_256M) {
  719. sg_remove_request(sfp, srp);
  720. return -EINVAL;
  721. }
  722. k = sg_start_req(srp, cmnd);
  723. if (k) {
  724. SCSI_LOG_TIMEOUT(1, sg_printk(KERN_INFO, sfp->parentdp,
  725. "sg_common_write: start_req err=%d\n", k));
  726. sg_finish_rem_req(srp);
  727. sg_remove_request(sfp, srp);
  728. return k; /* probably out of space --> ENOMEM */
  729. }
  730. if (atomic_read(&sdp->detaching)) {
  731. if (srp->bio) {
  732. scsi_req_free_cmd(scsi_req(srp->rq));
  733. blk_put_request(srp->rq);
  734. srp->rq = NULL;
  735. }
  736. sg_finish_rem_req(srp);
  737. sg_remove_request(sfp, srp);
  738. return -ENODEV;
  739. }
  740. hp->duration = jiffies_to_msecs(jiffies);
  741. if (hp->interface_id != '\0' && /* v3 (or later) interface */
  742. (SG_FLAG_Q_AT_TAIL & hp->flags))
  743. at_head = 0;
  744. else
  745. at_head = 1;
  746. srp->rq->timeout = timeout;
  747. kref_get(&sfp->f_ref); /* sg_rq_end_io() does kref_put(). */
  748. blk_execute_rq_nowait(sdp->device->request_queue, sdp->disk,
  749. srp->rq, at_head, sg_rq_end_io);
  750. return 0;
  751. }
  752. static int srp_done(Sg_fd *sfp, Sg_request *srp)
  753. {
  754. unsigned long flags;
  755. int ret;
  756. read_lock_irqsave(&sfp->rq_list_lock, flags);
  757. ret = srp->done;
  758. read_unlock_irqrestore(&sfp->rq_list_lock, flags);
  759. return ret;
  760. }
  761. static int max_sectors_bytes(struct request_queue *q)
  762. {
  763. unsigned int max_sectors = queue_max_sectors(q);
  764. max_sectors = min_t(unsigned int, max_sectors, INT_MAX >> 9);
  765. return max_sectors << 9;
  766. }
  767. static void
  768. sg_fill_request_table(Sg_fd *sfp, sg_req_info_t *rinfo)
  769. {
  770. Sg_request *srp;
  771. int val;
  772. unsigned int ms;
  773. val = 0;
  774. list_for_each_entry(srp, &sfp->rq_list, entry) {
  775. if (val >= SG_MAX_QUEUE)
  776. break;
  777. rinfo[val].req_state = srp->done + 1;
  778. rinfo[val].problem =
  779. srp->header.masked_status &
  780. srp->header.host_status &
  781. srp->header.driver_status;
  782. if (srp->done)
  783. rinfo[val].duration =
  784. srp->header.duration;
  785. else {
  786. ms = jiffies_to_msecs(jiffies);
  787. rinfo[val].duration =
  788. (ms > srp->header.duration) ?
  789. (ms - srp->header.duration) : 0;
  790. }
  791. rinfo[val].orphan = srp->orphan;
  792. rinfo[val].sg_io_owned = srp->sg_io_owned;
  793. rinfo[val].pack_id = srp->header.pack_id;
  794. rinfo[val].usr_ptr = srp->header.usr_ptr;
  795. val++;
  796. }
  797. }
  798. #ifdef CONFIG_COMPAT
  799. struct compat_sg_req_info { /* used by SG_GET_REQUEST_TABLE ioctl() */
  800. char req_state;
  801. char orphan;
  802. char sg_io_owned;
  803. char problem;
  804. int pack_id;
  805. compat_uptr_t usr_ptr;
  806. unsigned int duration;
  807. int unused;
  808. };
  809. static int put_compat_request_table(struct compat_sg_req_info __user *o,
  810. struct sg_req_info *rinfo)
  811. {
  812. int i;
  813. for (i = 0; i < SG_MAX_QUEUE; i++) {
  814. if (copy_to_user(o + i, rinfo + i, offsetof(sg_req_info_t, usr_ptr)) ||
  815. put_user((uintptr_t)rinfo[i].usr_ptr, &o[i].usr_ptr) ||
  816. put_user(rinfo[i].duration, &o[i].duration) ||
  817. put_user(rinfo[i].unused, &o[i].unused))
  818. return -EFAULT;
  819. }
  820. return 0;
  821. }
  822. #endif
  823. static long
  824. sg_ioctl_common(struct file *filp, Sg_device *sdp, Sg_fd *sfp,
  825. unsigned int cmd_in, void __user *p)
  826. {
  827. int __user *ip = p;
  828. int result, val, read_only;
  829. Sg_request *srp;
  830. unsigned long iflags;
  831. SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
  832. "sg_ioctl: cmd=0x%x\n", (int) cmd_in));
  833. read_only = (O_RDWR != (filp->f_flags & O_ACCMODE));
  834. switch (cmd_in) {
  835. case SG_IO:
  836. if (atomic_read(&sdp->detaching))
  837. return -ENODEV;
  838. if (!scsi_block_when_processing_errors(sdp->device))
  839. return -ENXIO;
  840. result = sg_new_write(sfp, filp, p, SZ_SG_IO_HDR,
  841. 1, read_only, 1, &srp);
  842. if (result < 0)
  843. return result;
  844. result = wait_event_interruptible(sfp->read_wait,
  845. (srp_done(sfp, srp) || atomic_read(&sdp->detaching)));
  846. if (atomic_read(&sdp->detaching))
  847. return -ENODEV;
  848. write_lock_irq(&sfp->rq_list_lock);
  849. if (srp->done) {
  850. srp->done = 2;
  851. write_unlock_irq(&sfp->rq_list_lock);
  852. result = sg_new_read(sfp, p, SZ_SG_IO_HDR, srp);
  853. return (result < 0) ? result : 0;
  854. }
  855. srp->orphan = 1;
  856. write_unlock_irq(&sfp->rq_list_lock);
  857. return result; /* -ERESTARTSYS because signal hit process */
  858. case SG_SET_TIMEOUT:
  859. result = get_user(val, ip);
  860. if (result)
  861. return result;
  862. if (val < 0)
  863. return -EIO;
  864. if (val >= mult_frac((s64)INT_MAX, USER_HZ, HZ))
  865. val = min_t(s64, mult_frac((s64)INT_MAX, USER_HZ, HZ),
  866. INT_MAX);
  867. sfp->timeout_user = val;
  868. sfp->timeout = mult_frac(val, HZ, USER_HZ);
  869. return 0;
  870. case SG_GET_TIMEOUT: /* N.B. User receives timeout as return value */
  871. /* strange ..., for backward compatibility */
  872. return sfp->timeout_user;
  873. case SG_SET_FORCE_LOW_DMA:
  874. /*
  875. * N.B. This ioctl never worked properly, but failed to
  876. * return an error value. So returning '0' to keep compability
  877. * with legacy applications.
  878. */
  879. return 0;
  880. case SG_GET_LOW_DMA:
  881. return put_user((int) sdp->device->host->unchecked_isa_dma, ip);
  882. case SG_GET_SCSI_ID:
  883. {
  884. sg_scsi_id_t v;
  885. if (atomic_read(&sdp->detaching))
  886. return -ENODEV;
  887. memset(&v, 0, sizeof(v));
  888. v.host_no = sdp->device->host->host_no;
  889. v.channel = sdp->device->channel;
  890. v.scsi_id = sdp->device->id;
  891. v.lun = sdp->device->lun;
  892. v.scsi_type = sdp->device->type;
  893. v.h_cmd_per_lun = sdp->device->host->cmd_per_lun;
  894. v.d_queue_depth = sdp->device->queue_depth;
  895. if (copy_to_user(p, &v, sizeof(sg_scsi_id_t)))
  896. return -EFAULT;
  897. return 0;
  898. }
  899. case SG_SET_FORCE_PACK_ID:
  900. result = get_user(val, ip);
  901. if (result)
  902. return result;
  903. sfp->force_packid = val ? 1 : 0;
  904. return 0;
  905. case SG_GET_PACK_ID:
  906. read_lock_irqsave(&sfp->rq_list_lock, iflags);
  907. list_for_each_entry(srp, &sfp->rq_list, entry) {
  908. if ((1 == srp->done) && (!srp->sg_io_owned)) {
  909. read_unlock_irqrestore(&sfp->rq_list_lock,
  910. iflags);
  911. return put_user(srp->header.pack_id, ip);
  912. }
  913. }
  914. read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
  915. return put_user(-1, ip);
  916. case SG_GET_NUM_WAITING:
  917. read_lock_irqsave(&sfp->rq_list_lock, iflags);
  918. val = 0;
  919. list_for_each_entry(srp, &sfp->rq_list, entry) {
  920. if ((1 == srp->done) && (!srp->sg_io_owned))
  921. ++val;
  922. }
  923. read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
  924. return put_user(val, ip);
  925. case SG_GET_SG_TABLESIZE:
  926. return put_user(sdp->sg_tablesize, ip);
  927. case SG_SET_RESERVED_SIZE:
  928. result = get_user(val, ip);
  929. if (result)
  930. return result;
  931. if (val < 0)
  932. return -EINVAL;
  933. val = min_t(int, val,
  934. max_sectors_bytes(sdp->device->request_queue));
  935. mutex_lock(&sfp->f_mutex);
  936. if (val != sfp->reserve.bufflen) {
  937. if (sfp->mmap_called ||
  938. sfp->res_in_use) {
  939. mutex_unlock(&sfp->f_mutex);
  940. return -EBUSY;
  941. }
  942. sg_remove_scat(sfp, &sfp->reserve);
  943. sg_build_reserve(sfp, val);
  944. }
  945. mutex_unlock(&sfp->f_mutex);
  946. return 0;
  947. case SG_GET_RESERVED_SIZE:
  948. val = min_t(int, sfp->reserve.bufflen,
  949. max_sectors_bytes(sdp->device->request_queue));
  950. return put_user(val, ip);
  951. case SG_SET_COMMAND_Q:
  952. result = get_user(val, ip);
  953. if (result)
  954. return result;
  955. sfp->cmd_q = val ? 1 : 0;
  956. return 0;
  957. case SG_GET_COMMAND_Q:
  958. return put_user((int) sfp->cmd_q, ip);
  959. case SG_SET_KEEP_ORPHAN:
  960. result = get_user(val, ip);
  961. if (result)
  962. return result;
  963. sfp->keep_orphan = val;
  964. return 0;
  965. case SG_GET_KEEP_ORPHAN:
  966. return put_user((int) sfp->keep_orphan, ip);
  967. case SG_NEXT_CMD_LEN:
  968. result = get_user(val, ip);
  969. if (result)
  970. return result;
  971. if (val > SG_MAX_CDB_SIZE)
  972. return -ENOMEM;
  973. sfp->next_cmd_len = (val > 0) ? val : 0;
  974. return 0;
  975. case SG_GET_VERSION_NUM:
  976. return put_user(sg_version_num, ip);
  977. case SG_GET_ACCESS_COUNT:
  978. /* faked - we don't have a real access count anymore */
  979. val = (sdp->device ? 1 : 0);
  980. return put_user(val, ip);
  981. case SG_GET_REQUEST_TABLE:
  982. {
  983. sg_req_info_t *rinfo;
  984. rinfo = kcalloc(SG_MAX_QUEUE, SZ_SG_REQ_INFO,
  985. GFP_KERNEL);
  986. if (!rinfo)
  987. return -ENOMEM;
  988. read_lock_irqsave(&sfp->rq_list_lock, iflags);
  989. sg_fill_request_table(sfp, rinfo);
  990. read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
  991. #ifdef CONFIG_COMPAT
  992. if (in_compat_syscall())
  993. result = put_compat_request_table(p, rinfo);
  994. else
  995. #endif
  996. result = copy_to_user(p, rinfo,
  997. SZ_SG_REQ_INFO * SG_MAX_QUEUE);
  998. result = result ? -EFAULT : 0;
  999. kfree(rinfo);
  1000. return result;
  1001. }
  1002. case SG_EMULATED_HOST:
  1003. if (atomic_read(&sdp->detaching))
  1004. return -ENODEV;
  1005. return put_user(sdp->device->host->hostt->emulated, ip);
  1006. case SCSI_IOCTL_SEND_COMMAND:
  1007. if (atomic_read(&sdp->detaching))
  1008. return -ENODEV;
  1009. return sg_scsi_ioctl(sdp->device->request_queue, NULL, filp->f_mode, p);
  1010. case SG_SET_DEBUG:
  1011. result = get_user(val, ip);
  1012. if (result)
  1013. return result;
  1014. sdp->sgdebug = (char) val;
  1015. return 0;
  1016. case BLKSECTGET:
  1017. return put_user(max_sectors_bytes(sdp->device->request_queue),
  1018. ip);
  1019. case BLKTRACESETUP:
  1020. return blk_trace_setup(sdp->device->request_queue,
  1021. sdp->disk->disk_name,
  1022. MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
  1023. NULL, p);
  1024. case BLKTRACESTART:
  1025. return blk_trace_startstop(sdp->device->request_queue, 1);
  1026. case BLKTRACESTOP:
  1027. return blk_trace_startstop(sdp->device->request_queue, 0);
  1028. case BLKTRACETEARDOWN:
  1029. return blk_trace_remove(sdp->device->request_queue);
  1030. case SCSI_IOCTL_GET_IDLUN:
  1031. case SCSI_IOCTL_GET_BUS_NUMBER:
  1032. case SCSI_IOCTL_PROBE_HOST:
  1033. case SG_GET_TRANSFORM:
  1034. case SG_SCSI_RESET:
  1035. if (atomic_read(&sdp->detaching))
  1036. return -ENODEV;
  1037. break;
  1038. default:
  1039. if (read_only)
  1040. return -EPERM; /* don't know so take safe approach */
  1041. break;
  1042. }
  1043. result = scsi_ioctl_block_when_processing_errors(sdp->device,
  1044. cmd_in, filp->f_flags & O_NDELAY);
  1045. if (result)
  1046. return result;
  1047. return -ENOIOCTLCMD;
  1048. }
  1049. static long
  1050. sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
  1051. {
  1052. void __user *p = (void __user *)arg;
  1053. Sg_device *sdp;
  1054. Sg_fd *sfp;
  1055. int ret;
  1056. if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
  1057. return -ENXIO;
  1058. ret = sg_ioctl_common(filp, sdp, sfp, cmd_in, p);
  1059. if (ret != -ENOIOCTLCMD)
  1060. return ret;
  1061. return scsi_ioctl(sdp->device, cmd_in, p);
  1062. }
  1063. #ifdef CONFIG_COMPAT
  1064. static long sg_compat_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
  1065. {
  1066. void __user *p = compat_ptr(arg);
  1067. Sg_device *sdp;
  1068. Sg_fd *sfp;
  1069. int ret;
  1070. if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
  1071. return -ENXIO;
  1072. ret = sg_ioctl_common(filp, sdp, sfp, cmd_in, p);
  1073. if (ret != -ENOIOCTLCMD)
  1074. return ret;
  1075. return scsi_compat_ioctl(sdp->device, cmd_in, p);
  1076. }
  1077. #endif
  1078. static __poll_t
  1079. sg_poll(struct file *filp, poll_table * wait)
  1080. {
  1081. __poll_t res = 0;
  1082. Sg_device *sdp;
  1083. Sg_fd *sfp;
  1084. Sg_request *srp;
  1085. int count = 0;
  1086. unsigned long iflags;
  1087. sfp = filp->private_data;
  1088. if (!sfp)
  1089. return EPOLLERR;
  1090. sdp = sfp->parentdp;
  1091. if (!sdp)
  1092. return EPOLLERR;
  1093. poll_wait(filp, &sfp->read_wait, wait);
  1094. read_lock_irqsave(&sfp->rq_list_lock, iflags);
  1095. list_for_each_entry(srp, &sfp->rq_list, entry) {
  1096. /* if any read waiting, flag it */
  1097. if ((0 == res) && (1 == srp->done) && (!srp->sg_io_owned))
  1098. res = EPOLLIN | EPOLLRDNORM;
  1099. ++count;
  1100. }
  1101. read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
  1102. if (atomic_read(&sdp->detaching))
  1103. res |= EPOLLHUP;
  1104. else if (!sfp->cmd_q) {
  1105. if (0 == count)
  1106. res |= EPOLLOUT | EPOLLWRNORM;
  1107. } else if (count < SG_MAX_QUEUE)
  1108. res |= EPOLLOUT | EPOLLWRNORM;
  1109. SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
  1110. "sg_poll: res=0x%x\n", (__force u32) res));
  1111. return res;
  1112. }
  1113. static int
  1114. sg_fasync(int fd, struct file *filp, int mode)
  1115. {
  1116. Sg_device *sdp;
  1117. Sg_fd *sfp;
  1118. if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
  1119. return -ENXIO;
  1120. SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
  1121. "sg_fasync: mode=%d\n", mode));
  1122. return fasync_helper(fd, filp, mode, &sfp->async_qp);
  1123. }
  1124. static vm_fault_t
  1125. sg_vma_fault(struct vm_fault *vmf)
  1126. {
  1127. struct vm_area_struct *vma = vmf->vma;
  1128. Sg_fd *sfp;
  1129. unsigned long offset, len, sa;
  1130. Sg_scatter_hold *rsv_schp;
  1131. int k, length;
  1132. if ((NULL == vma) || (!(sfp = (Sg_fd *) vma->vm_private_data)))
  1133. return VM_FAULT_SIGBUS;
  1134. rsv_schp = &sfp->reserve;
  1135. offset = vmf->pgoff << PAGE_SHIFT;
  1136. if (offset >= rsv_schp->bufflen)
  1137. return VM_FAULT_SIGBUS;
  1138. SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sfp->parentdp,
  1139. "sg_vma_fault: offset=%lu, scatg=%d\n",
  1140. offset, rsv_schp->k_use_sg));
  1141. sa = vma->vm_start;
  1142. length = 1 << (PAGE_SHIFT + rsv_schp->page_order);
  1143. for (k = 0; k < rsv_schp->k_use_sg && sa < vma->vm_end; k++) {
  1144. len = vma->vm_end - sa;
  1145. len = (len < length) ? len : length;
  1146. if (offset < len) {
  1147. struct page *page = nth_page(rsv_schp->pages[k],
  1148. offset >> PAGE_SHIFT);
  1149. get_page(page); /* increment page count */
  1150. vmf->page = page;
  1151. return 0; /* success */
  1152. }
  1153. sa += len;
  1154. offset -= len;
  1155. }
  1156. return VM_FAULT_SIGBUS;
  1157. }
  1158. static const struct vm_operations_struct sg_mmap_vm_ops = {
  1159. .fault = sg_vma_fault,
  1160. };
  1161. static int
  1162. sg_mmap(struct file *filp, struct vm_area_struct *vma)
  1163. {
  1164. Sg_fd *sfp;
  1165. unsigned long req_sz, len, sa;
  1166. Sg_scatter_hold *rsv_schp;
  1167. int k, length;
  1168. int ret = 0;
  1169. if ((!filp) || (!vma) || (!(sfp = (Sg_fd *) filp->private_data)))
  1170. return -ENXIO;
  1171. req_sz = vma->vm_end - vma->vm_start;
  1172. SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sfp->parentdp,
  1173. "sg_mmap starting, vm_start=%p, len=%d\n",
  1174. (void *) vma->vm_start, (int) req_sz));
  1175. if (vma->vm_pgoff)
  1176. return -EINVAL; /* want no offset */
  1177. rsv_schp = &sfp->reserve;
  1178. mutex_lock(&sfp->f_mutex);
  1179. if (req_sz > rsv_schp->bufflen) {
  1180. ret = -ENOMEM; /* cannot map more than reserved buffer */
  1181. goto out;
  1182. }
  1183. sa = vma->vm_start;
  1184. length = 1 << (PAGE_SHIFT + rsv_schp->page_order);
  1185. for (k = 0; k < rsv_schp->k_use_sg && sa < vma->vm_end; k++) {
  1186. len = vma->vm_end - sa;
  1187. len = (len < length) ? len : length;
  1188. sa += len;
  1189. }
  1190. sfp->mmap_called = 1;
  1191. vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
  1192. vma->vm_private_data = sfp;
  1193. vma->vm_ops = &sg_mmap_vm_ops;
  1194. out:
  1195. mutex_unlock(&sfp->f_mutex);
  1196. return ret;
  1197. }
  1198. static void
  1199. sg_rq_end_io_usercontext(struct work_struct *work)
  1200. {
  1201. struct sg_request *srp = container_of(work, struct sg_request, ew.work);
  1202. struct sg_fd *sfp = srp->parentfp;
  1203. sg_finish_rem_req(srp);
  1204. sg_remove_request(sfp, srp);
  1205. kref_put(&sfp->f_ref, sg_remove_sfp);
  1206. }
  1207. /*
  1208. * This function is a "bottom half" handler that is called by the mid
  1209. * level when a command is completed (or has failed).
  1210. */
  1211. static void
  1212. sg_rq_end_io(struct request *rq, blk_status_t status)
  1213. {
  1214. struct sg_request *srp = rq->end_io_data;
  1215. struct scsi_request *req = scsi_req(rq);
  1216. Sg_device *sdp;
  1217. Sg_fd *sfp;
  1218. unsigned long iflags;
  1219. unsigned int ms;
  1220. char *sense;
  1221. int result, resid, done = 1;
  1222. if (WARN_ON(srp->done != 0))
  1223. return;
  1224. sfp = srp->parentfp;
  1225. if (WARN_ON(sfp == NULL))
  1226. return;
  1227. sdp = sfp->parentdp;
  1228. if (unlikely(atomic_read(&sdp->detaching)))
  1229. pr_info("%s: device detaching\n", __func__);
  1230. sense = req->sense;
  1231. result = req->result;
  1232. resid = req->resid_len;
  1233. SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sdp,
  1234. "sg_cmd_done: pack_id=%d, res=0x%x\n",
  1235. srp->header.pack_id, result));
  1236. srp->header.resid = resid;
  1237. ms = jiffies_to_msecs(jiffies);
  1238. srp->header.duration = (ms > srp->header.duration) ?
  1239. (ms - srp->header.duration) : 0;
  1240. if (0 != result) {
  1241. struct scsi_sense_hdr sshdr;
  1242. srp->header.status = 0xff & result;
  1243. srp->header.masked_status = status_byte(result);
  1244. srp->header.msg_status = msg_byte(result);
  1245. srp->header.host_status = host_byte(result);
  1246. srp->header.driver_status = driver_byte(result);
  1247. if ((sdp->sgdebug > 0) &&
  1248. ((CHECK_CONDITION == srp->header.masked_status) ||
  1249. (COMMAND_TERMINATED == srp->header.masked_status)))
  1250. __scsi_print_sense(sdp->device, __func__, sense,
  1251. SCSI_SENSE_BUFFERSIZE);
  1252. /* Following if statement is a patch supplied by Eric Youngdale */
  1253. if (driver_byte(result) != 0
  1254. && scsi_normalize_sense(sense, SCSI_SENSE_BUFFERSIZE, &sshdr)
  1255. && !scsi_sense_is_deferred(&sshdr)
  1256. && sshdr.sense_key == UNIT_ATTENTION
  1257. && sdp->device->removable) {
  1258. /* Detected possible disc change. Set the bit - this */
  1259. /* may be used if there are filesystems using this device */
  1260. sdp->device->changed = 1;
  1261. }
  1262. }
  1263. if (req->sense_len)
  1264. memcpy(srp->sense_b, req->sense, SCSI_SENSE_BUFFERSIZE);
  1265. /* Rely on write phase to clean out srp status values, so no "else" */
  1266. /*
  1267. * Free the request as soon as it is complete so that its resources
  1268. * can be reused without waiting for userspace to read() the
  1269. * result. But keep the associated bio (if any) around until
  1270. * blk_rq_unmap_user() can be called from user context.
  1271. */
  1272. srp->rq = NULL;
  1273. scsi_req_free_cmd(scsi_req(rq));
  1274. blk_put_request(rq);
  1275. write_lock_irqsave(&sfp->rq_list_lock, iflags);
  1276. if (unlikely(srp->orphan)) {
  1277. if (sfp->keep_orphan)
  1278. srp->sg_io_owned = 0;
  1279. else
  1280. done = 0;
  1281. }
  1282. srp->done = done;
  1283. write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
  1284. if (likely(done)) {
  1285. /* Now wake up any sg_read() that is waiting for this
  1286. * packet.
  1287. */
  1288. wake_up_interruptible(&sfp->read_wait);
  1289. kill_fasync(&sfp->async_qp, SIGPOLL, POLL_IN);
  1290. kref_put(&sfp->f_ref, sg_remove_sfp);
  1291. } else {
  1292. INIT_WORK(&srp->ew.work, sg_rq_end_io_usercontext);
  1293. schedule_work(&srp->ew.work);
  1294. }
  1295. }
  1296. static const struct file_operations sg_fops = {
  1297. .owner = THIS_MODULE,
  1298. .read = sg_read,
  1299. .write = sg_write,
  1300. .poll = sg_poll,
  1301. .unlocked_ioctl = sg_ioctl,
  1302. #ifdef CONFIG_COMPAT
  1303. .compat_ioctl = sg_compat_ioctl,
  1304. #endif
  1305. .open = sg_open,
  1306. .mmap = sg_mmap,
  1307. .release = sg_release,
  1308. .fasync = sg_fasync,
  1309. .llseek = no_llseek,
  1310. };
  1311. static struct class *sg_sysfs_class;
  1312. static int sg_sysfs_valid = 0;
  1313. static Sg_device *
  1314. sg_alloc(struct gendisk *disk, struct scsi_device *scsidp)
  1315. {
  1316. struct request_queue *q = scsidp->request_queue;
  1317. Sg_device *sdp;
  1318. unsigned long iflags;
  1319. int error;
  1320. u32 k;
  1321. sdp = kzalloc(sizeof(Sg_device), GFP_KERNEL);
  1322. if (!sdp) {
  1323. sdev_printk(KERN_WARNING, scsidp, "%s: kmalloc Sg_device "
  1324. "failure\n", __func__);
  1325. return ERR_PTR(-ENOMEM);
  1326. }
  1327. idr_preload(GFP_KERNEL);
  1328. write_lock_irqsave(&sg_index_lock, iflags);
  1329. error = idr_alloc(&sg_index_idr, sdp, 0, SG_MAX_DEVS, GFP_NOWAIT);
  1330. if (error < 0) {
  1331. if (error == -ENOSPC) {
  1332. sdev_printk(KERN_WARNING, scsidp,
  1333. "Unable to attach sg device type=%d, minor number exceeds %d\n",
  1334. scsidp->type, SG_MAX_DEVS - 1);
  1335. error = -ENODEV;
  1336. } else {
  1337. sdev_printk(KERN_WARNING, scsidp, "%s: idr "
  1338. "allocation Sg_device failure: %d\n",
  1339. __func__, error);
  1340. }
  1341. goto out_unlock;
  1342. }
  1343. k = error;
  1344. SCSI_LOG_TIMEOUT(3, sdev_printk(KERN_INFO, scsidp,
  1345. "sg_alloc: dev=%d \n", k));
  1346. sprintf(disk->disk_name, "sg%d", k);
  1347. disk->first_minor = k;
  1348. sdp->disk = disk;
  1349. sdp->device = scsidp;
  1350. mutex_init(&sdp->open_rel_lock);
  1351. INIT_LIST_HEAD(&sdp->sfds);
  1352. init_waitqueue_head(&sdp->open_wait);
  1353. atomic_set(&sdp->detaching, 0);
  1354. rwlock_init(&sdp->sfd_lock);
  1355. sdp->sg_tablesize = queue_max_segments(q);
  1356. sdp->index = k;
  1357. kref_init(&sdp->d_ref);
  1358. error = 0;
  1359. out_unlock:
  1360. write_unlock_irqrestore(&sg_index_lock, iflags);
  1361. idr_preload_end();
  1362. if (error) {
  1363. kfree(sdp);
  1364. return ERR_PTR(error);
  1365. }
  1366. return sdp;
  1367. }
  1368. static int
  1369. sg_add_device(struct device *cl_dev, struct class_interface *cl_intf)
  1370. {
  1371. struct scsi_device *scsidp = to_scsi_device(cl_dev->parent);
  1372. struct gendisk *disk;
  1373. Sg_device *sdp = NULL;
  1374. struct cdev * cdev = NULL;
  1375. int error;
  1376. unsigned long iflags;
  1377. disk = alloc_disk(1);
  1378. if (!disk) {
  1379. pr_warn("%s: alloc_disk failed\n", __func__);
  1380. return -ENOMEM;
  1381. }
  1382. disk->major = SCSI_GENERIC_MAJOR;
  1383. error = -ENOMEM;
  1384. cdev = cdev_alloc();
  1385. if (!cdev) {
  1386. pr_warn("%s: cdev_alloc failed\n", __func__);
  1387. goto out;
  1388. }
  1389. cdev->owner = THIS_MODULE;
  1390. cdev->ops = &sg_fops;
  1391. sdp = sg_alloc(disk, scsidp);
  1392. if (IS_ERR(sdp)) {
  1393. pr_warn("%s: sg_alloc failed\n", __func__);
  1394. error = PTR_ERR(sdp);
  1395. goto out;
  1396. }
  1397. error = cdev_add(cdev, MKDEV(SCSI_GENERIC_MAJOR, sdp->index), 1);
  1398. if (error)
  1399. goto cdev_add_err;
  1400. sdp->cdev = cdev;
  1401. if (sg_sysfs_valid) {
  1402. struct device *sg_class_member;
  1403. sg_class_member = device_create(sg_sysfs_class, cl_dev->parent,
  1404. MKDEV(SCSI_GENERIC_MAJOR,
  1405. sdp->index),
  1406. sdp, "%s", disk->disk_name);
  1407. if (IS_ERR(sg_class_member)) {
  1408. pr_err("%s: device_create failed\n", __func__);
  1409. error = PTR_ERR(sg_class_member);
  1410. goto cdev_add_err;
  1411. }
  1412. error = sysfs_create_link(&scsidp->sdev_gendev.kobj,
  1413. &sg_class_member->kobj, "generic");
  1414. if (error)
  1415. pr_err("%s: unable to make symlink 'generic' back "
  1416. "to sg%d\n", __func__, sdp->index);
  1417. } else
  1418. pr_warn("%s: sg_sys Invalid\n", __func__);
  1419. sdev_printk(KERN_NOTICE, scsidp, "Attached scsi generic sg%d "
  1420. "type %d\n", sdp->index, scsidp->type);
  1421. dev_set_drvdata(cl_dev, sdp);
  1422. return 0;
  1423. cdev_add_err:
  1424. write_lock_irqsave(&sg_index_lock, iflags);
  1425. idr_remove(&sg_index_idr, sdp->index);
  1426. write_unlock_irqrestore(&sg_index_lock, iflags);
  1427. kfree(sdp);
  1428. out:
  1429. put_disk(disk);
  1430. if (cdev)
  1431. cdev_del(cdev);
  1432. return error;
  1433. }
  1434. static void
  1435. sg_device_destroy(struct kref *kref)
  1436. {
  1437. struct sg_device *sdp = container_of(kref, struct sg_device, d_ref);
  1438. unsigned long flags;
  1439. /* CAUTION! Note that the device can still be found via idr_find()
  1440. * even though the refcount is 0. Therefore, do idr_remove() BEFORE
  1441. * any other cleanup.
  1442. */
  1443. write_lock_irqsave(&sg_index_lock, flags);
  1444. idr_remove(&sg_index_idr, sdp->index);
  1445. write_unlock_irqrestore(&sg_index_lock, flags);
  1446. SCSI_LOG_TIMEOUT(3,
  1447. sg_printk(KERN_INFO, sdp, "sg_device_destroy\n"));
  1448. put_disk(sdp->disk);
  1449. kfree(sdp);
  1450. }
  1451. static void
  1452. sg_remove_device(struct device *cl_dev, struct class_interface *cl_intf)
  1453. {
  1454. struct scsi_device *scsidp = to_scsi_device(cl_dev->parent);
  1455. Sg_device *sdp = dev_get_drvdata(cl_dev);
  1456. unsigned long iflags;
  1457. Sg_fd *sfp;
  1458. int val;
  1459. if (!sdp)
  1460. return;
  1461. /* want sdp->detaching non-zero as soon as possible */
  1462. val = atomic_inc_return(&sdp->detaching);
  1463. if (val > 1)
  1464. return; /* only want to do following once per device */
  1465. SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
  1466. "%s\n", __func__));
  1467. read_lock_irqsave(&sdp->sfd_lock, iflags);
  1468. list_for_each_entry(sfp, &sdp->sfds, sfd_siblings) {
  1469. wake_up_interruptible_all(&sfp->read_wait);
  1470. kill_fasync(&sfp->async_qp, SIGPOLL, POLL_HUP);
  1471. }
  1472. wake_up_interruptible_all(&sdp->open_wait);
  1473. read_unlock_irqrestore(&sdp->sfd_lock, iflags);
  1474. sysfs_remove_link(&scsidp->sdev_gendev.kobj, "generic");
  1475. device_destroy(sg_sysfs_class, MKDEV(SCSI_GENERIC_MAJOR, sdp->index));
  1476. cdev_del(sdp->cdev);
  1477. sdp->cdev = NULL;
  1478. kref_put(&sdp->d_ref, sg_device_destroy);
  1479. }
  1480. module_param_named(scatter_elem_sz, scatter_elem_sz, int, S_IRUGO | S_IWUSR);
  1481. module_param_named(def_reserved_size, def_reserved_size, int,
  1482. S_IRUGO | S_IWUSR);
  1483. module_param_named(allow_dio, sg_allow_dio, int, S_IRUGO | S_IWUSR);
  1484. MODULE_AUTHOR("Douglas Gilbert");
  1485. MODULE_DESCRIPTION("SCSI generic (sg) driver");
  1486. MODULE_LICENSE("GPL");
  1487. MODULE_VERSION(SG_VERSION_STR);
  1488. MODULE_ALIAS_CHARDEV_MAJOR(SCSI_GENERIC_MAJOR);
  1489. MODULE_PARM_DESC(scatter_elem_sz, "scatter gather element "
  1490. "size (default: max(SG_SCATTER_SZ, PAGE_SIZE))");
  1491. MODULE_PARM_DESC(def_reserved_size, "size of buffer reserved for each fd");
  1492. MODULE_PARM_DESC(allow_dio, "allow direct I/O (default: 0 (disallow))");
  1493. static int __init
  1494. init_sg(void)
  1495. {
  1496. int rc;
  1497. if (scatter_elem_sz < PAGE_SIZE) {
  1498. scatter_elem_sz = PAGE_SIZE;
  1499. scatter_elem_sz_prev = scatter_elem_sz;
  1500. }
  1501. if (def_reserved_size >= 0)
  1502. sg_big_buff = def_reserved_size;
  1503. else
  1504. def_reserved_size = sg_big_buff;
  1505. rc = register_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0),
  1506. SG_MAX_DEVS, "sg");
  1507. if (rc)
  1508. return rc;
  1509. sg_sysfs_class = class_create(THIS_MODULE, "scsi_generic");
  1510. if ( IS_ERR(sg_sysfs_class) ) {
  1511. rc = PTR_ERR(sg_sysfs_class);
  1512. goto err_out;
  1513. }
  1514. sg_sysfs_valid = 1;
  1515. rc = scsi_register_interface(&sg_interface);
  1516. if (0 == rc) {
  1517. #ifdef CONFIG_SCSI_PROC_FS
  1518. sg_proc_init();
  1519. #endif /* CONFIG_SCSI_PROC_FS */
  1520. return 0;
  1521. }
  1522. class_destroy(sg_sysfs_class);
  1523. err_out:
  1524. unregister_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0), SG_MAX_DEVS);
  1525. return rc;
  1526. }
  1527. static void __exit
  1528. exit_sg(void)
  1529. {
  1530. #ifdef CONFIG_SCSI_PROC_FS
  1531. remove_proc_subtree("scsi/sg", NULL);
  1532. #endif /* CONFIG_SCSI_PROC_FS */
  1533. scsi_unregister_interface(&sg_interface);
  1534. class_destroy(sg_sysfs_class);
  1535. sg_sysfs_valid = 0;
  1536. unregister_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0),
  1537. SG_MAX_DEVS);
  1538. idr_destroy(&sg_index_idr);
  1539. }
  1540. static int
  1541. sg_start_req(Sg_request *srp, unsigned char *cmd)
  1542. {
  1543. int res;
  1544. struct request *rq;
  1545. struct scsi_request *req;
  1546. Sg_fd *sfp = srp->parentfp;
  1547. sg_io_hdr_t *hp = &srp->header;
  1548. int dxfer_len = (int) hp->dxfer_len;
  1549. int dxfer_dir = hp->dxfer_direction;
  1550. unsigned int iov_count = hp->iovec_count;
  1551. Sg_scatter_hold *req_schp = &srp->data;
  1552. Sg_scatter_hold *rsv_schp = &sfp->reserve;
  1553. struct request_queue *q = sfp->parentdp->device->request_queue;
  1554. struct rq_map_data *md, map_data;
  1555. int rw = hp->dxfer_direction == SG_DXFER_TO_DEV ? WRITE : READ;
  1556. unsigned char *long_cmdp = NULL;
  1557. SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp,
  1558. "sg_start_req: dxfer_len=%d\n",
  1559. dxfer_len));
  1560. if (hp->cmd_len > BLK_MAX_CDB) {
  1561. long_cmdp = kzalloc(hp->cmd_len, GFP_KERNEL);
  1562. if (!long_cmdp)
  1563. return -ENOMEM;
  1564. }
  1565. /*
  1566. * NOTE
  1567. *
  1568. * With scsi-mq enabled, there are a fixed number of preallocated
  1569. * requests equal in number to shost->can_queue. If all of the
  1570. * preallocated requests are already in use, then blk_get_request()
  1571. * will sleep until an active command completes, freeing up a request.
  1572. * Although waiting in an asynchronous interface is less than ideal, we
  1573. * do not want to use BLK_MQ_REQ_NOWAIT here because userspace might
  1574. * not expect an EWOULDBLOCK from this condition.
  1575. */
  1576. rq = blk_get_request(q, hp->dxfer_direction == SG_DXFER_TO_DEV ?
  1577. REQ_OP_SCSI_OUT : REQ_OP_SCSI_IN, 0);
  1578. if (IS_ERR(rq)) {
  1579. kfree(long_cmdp);
  1580. return PTR_ERR(rq);
  1581. }
  1582. req = scsi_req(rq);
  1583. if (hp->cmd_len > BLK_MAX_CDB)
  1584. req->cmd = long_cmdp;
  1585. memcpy(req->cmd, cmd, hp->cmd_len);
  1586. req->cmd_len = hp->cmd_len;
  1587. srp->rq = rq;
  1588. rq->end_io_data = srp;
  1589. req->retries = SG_DEFAULT_RETRIES;
  1590. if ((dxfer_len <= 0) || (dxfer_dir == SG_DXFER_NONE))
  1591. return 0;
  1592. if (sg_allow_dio && hp->flags & SG_FLAG_DIRECT_IO &&
  1593. dxfer_dir != SG_DXFER_UNKNOWN && !iov_count &&
  1594. !sfp->parentdp->device->host->unchecked_isa_dma &&
  1595. blk_rq_aligned(q, (unsigned long)hp->dxferp, dxfer_len))
  1596. md = NULL;
  1597. else
  1598. md = &map_data;
  1599. if (md) {
  1600. mutex_lock(&sfp->f_mutex);
  1601. if (dxfer_len <= rsv_schp->bufflen &&
  1602. !sfp->res_in_use) {
  1603. sfp->res_in_use = 1;
  1604. sg_link_reserve(sfp, srp, dxfer_len);
  1605. } else if (hp->flags & SG_FLAG_MMAP_IO) {
  1606. res = -EBUSY; /* sfp->res_in_use == 1 */
  1607. if (dxfer_len > rsv_schp->bufflen)
  1608. res = -ENOMEM;
  1609. mutex_unlock(&sfp->f_mutex);
  1610. return res;
  1611. } else {
  1612. res = sg_build_indirect(req_schp, sfp, dxfer_len);
  1613. if (res) {
  1614. mutex_unlock(&sfp->f_mutex);
  1615. return res;
  1616. }
  1617. }
  1618. mutex_unlock(&sfp->f_mutex);
  1619. md->pages = req_schp->pages;
  1620. md->page_order = req_schp->page_order;
  1621. md->nr_entries = req_schp->k_use_sg;
  1622. md->offset = 0;
  1623. md->null_mapped = hp->dxferp ? 0 : 1;
  1624. if (dxfer_dir == SG_DXFER_TO_FROM_DEV)
  1625. md->from_user = 1;
  1626. else
  1627. md->from_user = 0;
  1628. }
  1629. if (iov_count) {
  1630. struct iovec *iov = NULL;
  1631. struct iov_iter i;
  1632. res = import_iovec(rw, hp->dxferp, iov_count, 0, &iov, &i);
  1633. if (res < 0)
  1634. return res;
  1635. iov_iter_truncate(&i, hp->dxfer_len);
  1636. if (!iov_iter_count(&i)) {
  1637. kfree(iov);
  1638. return -EINVAL;
  1639. }
  1640. res = blk_rq_map_user_iov(q, rq, md, &i, GFP_ATOMIC);
  1641. kfree(iov);
  1642. } else
  1643. res = blk_rq_map_user(q, rq, md, hp->dxferp,
  1644. hp->dxfer_len, GFP_ATOMIC);
  1645. if (!res) {
  1646. srp->bio = rq->bio;
  1647. if (!md) {
  1648. req_schp->dio_in_use = 1;
  1649. hp->info |= SG_INFO_DIRECT_IO;
  1650. }
  1651. }
  1652. return res;
  1653. }
  1654. static int
  1655. sg_finish_rem_req(Sg_request *srp)
  1656. {
  1657. int ret = 0;
  1658. Sg_fd *sfp = srp->parentfp;
  1659. Sg_scatter_hold *req_schp = &srp->data;
  1660. SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp,
  1661. "sg_finish_rem_req: res_used=%d\n",
  1662. (int) srp->res_used));
  1663. if (srp->bio)
  1664. ret = blk_rq_unmap_user(srp->bio);
  1665. if (srp->rq) {
  1666. scsi_req_free_cmd(scsi_req(srp->rq));
  1667. blk_put_request(srp->rq);
  1668. }
  1669. if (srp->res_used)
  1670. sg_unlink_reserve(sfp, srp);
  1671. else
  1672. sg_remove_scat(sfp, req_schp);
  1673. return ret;
  1674. }
  1675. static int
  1676. sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp, int tablesize)
  1677. {
  1678. int sg_bufflen = tablesize * sizeof(struct page *);
  1679. gfp_t gfp_flags = GFP_ATOMIC | __GFP_NOWARN;
  1680. schp->pages = kzalloc(sg_bufflen, gfp_flags);
  1681. if (!schp->pages)
  1682. return -ENOMEM;
  1683. schp->sglist_len = sg_bufflen;
  1684. return tablesize; /* number of scat_gath elements allocated */
  1685. }
  1686. static int
  1687. sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
  1688. {
  1689. int ret_sz = 0, i, k, rem_sz, num, mx_sc_elems;
  1690. int sg_tablesize = sfp->parentdp->sg_tablesize;
  1691. int blk_size = buff_size, order;
  1692. gfp_t gfp_mask = GFP_ATOMIC | __GFP_COMP | __GFP_NOWARN | __GFP_ZERO;
  1693. struct sg_device *sdp = sfp->parentdp;
  1694. if (blk_size < 0)
  1695. return -EFAULT;
  1696. if (0 == blk_size)
  1697. ++blk_size; /* don't know why */
  1698. /* round request up to next highest SG_SECTOR_SZ byte boundary */
  1699. blk_size = ALIGN(blk_size, SG_SECTOR_SZ);
  1700. SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp,
  1701. "sg_build_indirect: buff_size=%d, blk_size=%d\n",
  1702. buff_size, blk_size));
  1703. /* N.B. ret_sz carried into this block ... */
  1704. mx_sc_elems = sg_build_sgat(schp, sfp, sg_tablesize);
  1705. if (mx_sc_elems < 0)
  1706. return mx_sc_elems; /* most likely -ENOMEM */
  1707. num = scatter_elem_sz;
  1708. if (unlikely(num != scatter_elem_sz_prev)) {
  1709. if (num < PAGE_SIZE) {
  1710. scatter_elem_sz = PAGE_SIZE;
  1711. scatter_elem_sz_prev = PAGE_SIZE;
  1712. } else
  1713. scatter_elem_sz_prev = num;
  1714. }
  1715. if (sdp->device->host->unchecked_isa_dma)
  1716. gfp_mask |= GFP_DMA;
  1717. order = get_order(num);
  1718. retry:
  1719. ret_sz = 1 << (PAGE_SHIFT + order);
  1720. for (k = 0, rem_sz = blk_size; rem_sz > 0 && k < mx_sc_elems;
  1721. k++, rem_sz -= ret_sz) {
  1722. num = (rem_sz > scatter_elem_sz_prev) ?
  1723. scatter_elem_sz_prev : rem_sz;
  1724. schp->pages[k] = alloc_pages(gfp_mask, order);
  1725. if (!schp->pages[k])
  1726. goto out;
  1727. if (num == scatter_elem_sz_prev) {
  1728. if (unlikely(ret_sz > scatter_elem_sz_prev)) {
  1729. scatter_elem_sz = ret_sz;
  1730. scatter_elem_sz_prev = ret_sz;
  1731. }
  1732. }
  1733. SCSI_LOG_TIMEOUT(5, sg_printk(KERN_INFO, sfp->parentdp,
  1734. "sg_build_indirect: k=%d, num=%d, ret_sz=%d\n",
  1735. k, num, ret_sz));
  1736. } /* end of for loop */
  1737. schp->page_order = order;
  1738. schp->k_use_sg = k;
  1739. SCSI_LOG_TIMEOUT(5, sg_printk(KERN_INFO, sfp->parentdp,
  1740. "sg_build_indirect: k_use_sg=%d, rem_sz=%d\n",
  1741. k, rem_sz));
  1742. schp->bufflen = blk_size;
  1743. if (rem_sz > 0) /* must have failed */
  1744. return -ENOMEM;
  1745. return 0;
  1746. out:
  1747. for (i = 0; i < k; i++)
  1748. __free_pages(schp->pages[i], order);
  1749. if (--order >= 0)
  1750. goto retry;
  1751. return -ENOMEM;
  1752. }
  1753. static void
  1754. sg_remove_scat(Sg_fd * sfp, Sg_scatter_hold * schp)
  1755. {
  1756. SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp,
  1757. "sg_remove_scat: k_use_sg=%d\n", schp->k_use_sg));
  1758. if (schp->pages && schp->sglist_len > 0) {
  1759. if (!schp->dio_in_use) {
  1760. int k;
  1761. for (k = 0; k < schp->k_use_sg && schp->pages[k]; k++) {
  1762. SCSI_LOG_TIMEOUT(5,
  1763. sg_printk(KERN_INFO, sfp->parentdp,
  1764. "sg_remove_scat: k=%d, pg=0x%p\n",
  1765. k, schp->pages[k]));
  1766. __free_pages(schp->pages[k], schp->page_order);
  1767. }
  1768. kfree(schp->pages);
  1769. }
  1770. }
  1771. memset(schp, 0, sizeof (*schp));
  1772. }
  1773. static int
  1774. sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer)
  1775. {
  1776. Sg_scatter_hold *schp = &srp->data;
  1777. int k, num;
  1778. SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, srp->parentfp->parentdp,
  1779. "sg_read_oxfer: num_read_xfer=%d\n",
  1780. num_read_xfer));
  1781. if ((!outp) || (num_read_xfer <= 0))
  1782. return 0;
  1783. num = 1 << (PAGE_SHIFT + schp->page_order);
  1784. for (k = 0; k < schp->k_use_sg && schp->pages[k]; k++) {
  1785. if (num > num_read_xfer) {
  1786. if (copy_to_user(outp, page_address(schp->pages[k]),
  1787. num_read_xfer))
  1788. return -EFAULT;
  1789. break;
  1790. } else {
  1791. if (copy_to_user(outp, page_address(schp->pages[k]),
  1792. num))
  1793. return -EFAULT;
  1794. num_read_xfer -= num;
  1795. if (num_read_xfer <= 0)
  1796. break;
  1797. outp += num;
  1798. }
  1799. }
  1800. return 0;
  1801. }
  1802. static void
  1803. sg_build_reserve(Sg_fd * sfp, int req_size)
  1804. {
  1805. Sg_scatter_hold *schp = &sfp->reserve;
  1806. SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp,
  1807. "sg_build_reserve: req_size=%d\n", req_size));
  1808. do {
  1809. if (req_size < PAGE_SIZE)
  1810. req_size = PAGE_SIZE;
  1811. if (0 == sg_build_indirect(schp, sfp, req_size))
  1812. return;
  1813. else
  1814. sg_remove_scat(sfp, schp);
  1815. req_size >>= 1; /* divide by 2 */
  1816. } while (req_size > (PAGE_SIZE / 2));
  1817. }
  1818. static void
  1819. sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size)
  1820. {
  1821. Sg_scatter_hold *req_schp = &srp->data;
  1822. Sg_scatter_hold *rsv_schp = &sfp->reserve;
  1823. int k, num, rem;
  1824. srp->res_used = 1;
  1825. SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sfp->parentdp,
  1826. "sg_link_reserve: size=%d\n", size));
  1827. rem = size;
  1828. num = 1 << (PAGE_SHIFT + rsv_schp->page_order);
  1829. for (k = 0; k < rsv_schp->k_use_sg; k++) {
  1830. if (rem <= num) {
  1831. req_schp->k_use_sg = k + 1;
  1832. req_schp->sglist_len = rsv_schp->sglist_len;
  1833. req_schp->pages = rsv_schp->pages;
  1834. req_schp->bufflen = size;
  1835. req_schp->page_order = rsv_schp->page_order;
  1836. break;
  1837. } else
  1838. rem -= num;
  1839. }
  1840. if (k >= rsv_schp->k_use_sg)
  1841. SCSI_LOG_TIMEOUT(1, sg_printk(KERN_INFO, sfp->parentdp,
  1842. "sg_link_reserve: BAD size\n"));
  1843. }
  1844. static void
  1845. sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp)
  1846. {
  1847. Sg_scatter_hold *req_schp = &srp->data;
  1848. SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, srp->parentfp->parentdp,
  1849. "sg_unlink_reserve: req->k_use_sg=%d\n",
  1850. (int) req_schp->k_use_sg));
  1851. req_schp->k_use_sg = 0;
  1852. req_schp->bufflen = 0;
  1853. req_schp->pages = NULL;
  1854. req_schp->page_order = 0;
  1855. req_schp->sglist_len = 0;
  1856. srp->res_used = 0;
  1857. /* Called without mutex lock to avoid deadlock */
  1858. sfp->res_in_use = 0;
  1859. }
  1860. static Sg_request *
  1861. sg_get_rq_mark(Sg_fd * sfp, int pack_id)
  1862. {
  1863. Sg_request *resp;
  1864. unsigned long iflags;
  1865. write_lock_irqsave(&sfp->rq_list_lock, iflags);
  1866. list_for_each_entry(resp, &sfp->rq_list, entry) {
  1867. /* look for requests that are ready + not SG_IO owned */
  1868. if ((1 == resp->done) && (!resp->sg_io_owned) &&
  1869. ((-1 == pack_id) || (resp->header.pack_id == pack_id))) {
  1870. resp->done = 2; /* guard against other readers */
  1871. write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
  1872. return resp;
  1873. }
  1874. }
  1875. write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
  1876. return NULL;
  1877. }
  1878. /* always adds to end of list */
  1879. static Sg_request *
  1880. sg_add_request(Sg_fd * sfp)
  1881. {
  1882. int k;
  1883. unsigned long iflags;
  1884. Sg_request *rp = sfp->req_arr;
  1885. write_lock_irqsave(&sfp->rq_list_lock, iflags);
  1886. if (!list_empty(&sfp->rq_list)) {
  1887. if (!sfp->cmd_q)
  1888. goto out_unlock;
  1889. for (k = 0; k < SG_MAX_QUEUE; ++k, ++rp) {
  1890. if (!rp->parentfp)
  1891. break;
  1892. }
  1893. if (k >= SG_MAX_QUEUE)
  1894. goto out_unlock;
  1895. }
  1896. memset(rp, 0, sizeof (Sg_request));
  1897. rp->parentfp = sfp;
  1898. rp->header.duration = jiffies_to_msecs(jiffies);
  1899. list_add_tail(&rp->entry, &sfp->rq_list);
  1900. write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
  1901. return rp;
  1902. out_unlock:
  1903. write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
  1904. return NULL;
  1905. }
  1906. /* Return of 1 for found; 0 for not found */
  1907. static int
  1908. sg_remove_request(Sg_fd * sfp, Sg_request * srp)
  1909. {
  1910. unsigned long iflags;
  1911. int res = 0;
  1912. if (!sfp || !srp || list_empty(&sfp->rq_list))
  1913. return res;
  1914. write_lock_irqsave(&sfp->rq_list_lock, iflags);
  1915. if (!list_empty(&srp->entry)) {
  1916. list_del(&srp->entry);
  1917. srp->parentfp = NULL;
  1918. res = 1;
  1919. }
  1920. write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
  1921. return res;
  1922. }
  1923. static Sg_fd *
  1924. sg_add_sfp(Sg_device * sdp)
  1925. {
  1926. Sg_fd *sfp;
  1927. unsigned long iflags;
  1928. int bufflen;
  1929. sfp = kzalloc(sizeof(*sfp), GFP_ATOMIC | __GFP_NOWARN);
  1930. if (!sfp)
  1931. return ERR_PTR(-ENOMEM);
  1932. init_waitqueue_head(&sfp->read_wait);
  1933. rwlock_init(&sfp->rq_list_lock);
  1934. INIT_LIST_HEAD(&sfp->rq_list);
  1935. kref_init(&sfp->f_ref);
  1936. mutex_init(&sfp->f_mutex);
  1937. sfp->timeout = SG_DEFAULT_TIMEOUT;
  1938. sfp->timeout_user = SG_DEFAULT_TIMEOUT_USER;
  1939. sfp->force_packid = SG_DEF_FORCE_PACK_ID;
  1940. sfp->cmd_q = SG_DEF_COMMAND_Q;
  1941. sfp->keep_orphan = SG_DEF_KEEP_ORPHAN;
  1942. sfp->parentdp = sdp;
  1943. write_lock_irqsave(&sdp->sfd_lock, iflags);
  1944. if (atomic_read(&sdp->detaching)) {
  1945. write_unlock_irqrestore(&sdp->sfd_lock, iflags);
  1946. kfree(sfp);
  1947. return ERR_PTR(-ENODEV);
  1948. }
  1949. list_add_tail(&sfp->sfd_siblings, &sdp->sfds);
  1950. write_unlock_irqrestore(&sdp->sfd_lock, iflags);
  1951. SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
  1952. "sg_add_sfp: sfp=0x%p\n", sfp));
  1953. if (unlikely(sg_big_buff != def_reserved_size))
  1954. sg_big_buff = def_reserved_size;
  1955. bufflen = min_t(int, sg_big_buff,
  1956. max_sectors_bytes(sdp->device->request_queue));
  1957. sg_build_reserve(sfp, bufflen);
  1958. SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
  1959. "sg_add_sfp: bufflen=%d, k_use_sg=%d\n",
  1960. sfp->reserve.bufflen,
  1961. sfp->reserve.k_use_sg));
  1962. kref_get(&sdp->d_ref);
  1963. __module_get(THIS_MODULE);
  1964. return sfp;
  1965. }
  1966. static void
  1967. sg_remove_sfp_usercontext(struct work_struct *work)
  1968. {
  1969. struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work);
  1970. struct sg_device *sdp = sfp->parentdp;
  1971. Sg_request *srp;
  1972. unsigned long iflags;
  1973. /* Cleanup any responses which were never read(). */
  1974. write_lock_irqsave(&sfp->rq_list_lock, iflags);
  1975. while (!list_empty(&sfp->rq_list)) {
  1976. srp = list_first_entry(&sfp->rq_list, Sg_request, entry);
  1977. sg_finish_rem_req(srp);
  1978. list_del(&srp->entry);
  1979. srp->parentfp = NULL;
  1980. }
  1981. write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
  1982. if (sfp->reserve.bufflen > 0) {
  1983. SCSI_LOG_TIMEOUT(6, sg_printk(KERN_INFO, sdp,
  1984. "sg_remove_sfp: bufflen=%d, k_use_sg=%d\n",
  1985. (int) sfp->reserve.bufflen,
  1986. (int) sfp->reserve.k_use_sg));
  1987. sg_remove_scat(sfp, &sfp->reserve);
  1988. }
  1989. SCSI_LOG_TIMEOUT(6, sg_printk(KERN_INFO, sdp,
  1990. "sg_remove_sfp: sfp=0x%p\n", sfp));
  1991. kfree(sfp);
  1992. scsi_device_put(sdp->device);
  1993. kref_put(&sdp->d_ref, sg_device_destroy);
  1994. module_put(THIS_MODULE);
  1995. }
  1996. static void
  1997. sg_remove_sfp(struct kref *kref)
  1998. {
  1999. struct sg_fd *sfp = container_of(kref, struct sg_fd, f_ref);
  2000. struct sg_device *sdp = sfp->parentdp;
  2001. unsigned long iflags;
  2002. write_lock_irqsave(&sdp->sfd_lock, iflags);
  2003. list_del(&sfp->sfd_siblings);
  2004. write_unlock_irqrestore(&sdp->sfd_lock, iflags);
  2005. INIT_WORK(&sfp->ew.work, sg_remove_sfp_usercontext);
  2006. schedule_work(&sfp->ew.work);
  2007. }
  2008. #ifdef CONFIG_SCSI_PROC_FS
  2009. static int
  2010. sg_idr_max_id(int id, void *p, void *data)
  2011. {
  2012. int *k = data;
  2013. if (*k < id)
  2014. *k = id;
  2015. return 0;
  2016. }
  2017. static int
  2018. sg_last_dev(void)
  2019. {
  2020. int k = -1;
  2021. unsigned long iflags;
  2022. read_lock_irqsave(&sg_index_lock, iflags);
  2023. idr_for_each(&sg_index_idr, sg_idr_max_id, &k);
  2024. read_unlock_irqrestore(&sg_index_lock, iflags);
  2025. return k + 1; /* origin 1 */
  2026. }
  2027. #endif
  2028. /* must be called with sg_index_lock held */
  2029. static Sg_device *sg_lookup_dev(int dev)
  2030. {
  2031. return idr_find(&sg_index_idr, dev);
  2032. }
  2033. static Sg_device *
  2034. sg_get_dev(int dev)
  2035. {
  2036. struct sg_device *sdp;
  2037. unsigned long flags;
  2038. read_lock_irqsave(&sg_index_lock, flags);
  2039. sdp = sg_lookup_dev(dev);
  2040. if (!sdp)
  2041. sdp = ERR_PTR(-ENXIO);
  2042. else if (atomic_read(&sdp->detaching)) {
  2043. /* If sdp->detaching, then the refcount may already be 0, in
  2044. * which case it would be a bug to do kref_get().
  2045. */
  2046. sdp = ERR_PTR(-ENODEV);
  2047. } else
  2048. kref_get(&sdp->d_ref);
  2049. read_unlock_irqrestore(&sg_index_lock, flags);
  2050. return sdp;
  2051. }
  2052. #ifdef CONFIG_SCSI_PROC_FS
  2053. static int sg_proc_seq_show_int(struct seq_file *s, void *v);
  2054. static int sg_proc_single_open_adio(struct inode *inode, struct file *file);
  2055. static ssize_t sg_proc_write_adio(struct file *filp, const char __user *buffer,
  2056. size_t count, loff_t *off);
  2057. static const struct proc_ops adio_proc_ops = {
  2058. .proc_open = sg_proc_single_open_adio,
  2059. .proc_read = seq_read,
  2060. .proc_lseek = seq_lseek,
  2061. .proc_write = sg_proc_write_adio,
  2062. .proc_release = single_release,
  2063. };
  2064. static int sg_proc_single_open_dressz(struct inode *inode, struct file *file);
  2065. static ssize_t sg_proc_write_dressz(struct file *filp,
  2066. const char __user *buffer, size_t count, loff_t *off);
  2067. static const struct proc_ops dressz_proc_ops = {
  2068. .proc_open = sg_proc_single_open_dressz,
  2069. .proc_read = seq_read,
  2070. .proc_lseek = seq_lseek,
  2071. .proc_write = sg_proc_write_dressz,
  2072. .proc_release = single_release,
  2073. };
  2074. static int sg_proc_seq_show_version(struct seq_file *s, void *v);
  2075. static int sg_proc_seq_show_devhdr(struct seq_file *s, void *v);
  2076. static int sg_proc_seq_show_dev(struct seq_file *s, void *v);
  2077. static void * dev_seq_start(struct seq_file *s, loff_t *pos);
  2078. static void * dev_seq_next(struct seq_file *s, void *v, loff_t *pos);
  2079. static void dev_seq_stop(struct seq_file *s, void *v);
  2080. static const struct seq_operations dev_seq_ops = {
  2081. .start = dev_seq_start,
  2082. .next = dev_seq_next,
  2083. .stop = dev_seq_stop,
  2084. .show = sg_proc_seq_show_dev,
  2085. };
  2086. static int sg_proc_seq_show_devstrs(struct seq_file *s, void *v);
  2087. static const struct seq_operations devstrs_seq_ops = {
  2088. .start = dev_seq_start,
  2089. .next = dev_seq_next,
  2090. .stop = dev_seq_stop,
  2091. .show = sg_proc_seq_show_devstrs,
  2092. };
  2093. static int sg_proc_seq_show_debug(struct seq_file *s, void *v);
  2094. static const struct seq_operations debug_seq_ops = {
  2095. .start = dev_seq_start,
  2096. .next = dev_seq_next,
  2097. .stop = dev_seq_stop,
  2098. .show = sg_proc_seq_show_debug,
  2099. };
  2100. static int
  2101. sg_proc_init(void)
  2102. {
  2103. struct proc_dir_entry *p;
  2104. p = proc_mkdir("scsi/sg", NULL);
  2105. if (!p)
  2106. return 1;
  2107. proc_create("allow_dio", S_IRUGO | S_IWUSR, p, &adio_proc_ops);
  2108. proc_create_seq("debug", S_IRUGO, p, &debug_seq_ops);
  2109. proc_create("def_reserved_size", S_IRUGO | S_IWUSR, p, &dressz_proc_ops);
  2110. proc_create_single("device_hdr", S_IRUGO, p, sg_proc_seq_show_devhdr);
  2111. proc_create_seq("devices", S_IRUGO, p, &dev_seq_ops);
  2112. proc_create_seq("device_strs", S_IRUGO, p, &devstrs_seq_ops);
  2113. proc_create_single("version", S_IRUGO, p, sg_proc_seq_show_version);
  2114. return 0;
  2115. }
  2116. static int sg_proc_seq_show_int(struct seq_file *s, void *v)
  2117. {
  2118. seq_printf(s, "%d\n", *((int *)s->private));
  2119. return 0;
  2120. }
  2121. static int sg_proc_single_open_adio(struct inode *inode, struct file *file)
  2122. {
  2123. return single_open(file, sg_proc_seq_show_int, &sg_allow_dio);
  2124. }
  2125. static ssize_t
  2126. sg_proc_write_adio(struct file *filp, const char __user *buffer,
  2127. size_t count, loff_t *off)
  2128. {
  2129. int err;
  2130. unsigned long num;
  2131. if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
  2132. return -EACCES;
  2133. err = kstrtoul_from_user(buffer, count, 0, &num);
  2134. if (err)
  2135. return err;
  2136. sg_allow_dio = num ? 1 : 0;
  2137. return count;
  2138. }
  2139. static int sg_proc_single_open_dressz(struct inode *inode, struct file *file)
  2140. {
  2141. return single_open(file, sg_proc_seq_show_int, &sg_big_buff);
  2142. }
  2143. static ssize_t
  2144. sg_proc_write_dressz(struct file *filp, const char __user *buffer,
  2145. size_t count, loff_t *off)
  2146. {
  2147. int err;
  2148. unsigned long k = ULONG_MAX;
  2149. if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
  2150. return -EACCES;
  2151. err = kstrtoul_from_user(buffer, count, 0, &k);
  2152. if (err)
  2153. return err;
  2154. if (k <= 1048576) { /* limit "big buff" to 1 MB */
  2155. sg_big_buff = k;
  2156. return count;
  2157. }
  2158. return -ERANGE;
  2159. }
  2160. static int sg_proc_seq_show_version(struct seq_file *s, void *v)
  2161. {
  2162. seq_printf(s, "%d\t%s [%s]\n", sg_version_num, SG_VERSION_STR,
  2163. sg_version_date);
  2164. return 0;
  2165. }
  2166. static int sg_proc_seq_show_devhdr(struct seq_file *s, void *v)
  2167. {
  2168. seq_puts(s, "host\tchan\tid\tlun\ttype\topens\tqdepth\tbusy\tonline\n");
  2169. return 0;
  2170. }
  2171. struct sg_proc_deviter {
  2172. loff_t index;
  2173. size_t max;
  2174. };
  2175. static void * dev_seq_start(struct seq_file *s, loff_t *pos)
  2176. {
  2177. struct sg_proc_deviter * it = kmalloc(sizeof(*it), GFP_KERNEL);
  2178. s->private = it;
  2179. if (! it)
  2180. return NULL;
  2181. it->index = *pos;
  2182. it->max = sg_last_dev();
  2183. if (it->index >= it->max)
  2184. return NULL;
  2185. return it;
  2186. }
  2187. static void * dev_seq_next(struct seq_file *s, void *v, loff_t *pos)
  2188. {
  2189. struct sg_proc_deviter * it = s->private;
  2190. *pos = ++it->index;
  2191. return (it->index < it->max) ? it : NULL;
  2192. }
  2193. static void dev_seq_stop(struct seq_file *s, void *v)
  2194. {
  2195. kfree(s->private);
  2196. }
  2197. static int sg_proc_seq_show_dev(struct seq_file *s, void *v)
  2198. {
  2199. struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
  2200. Sg_device *sdp;
  2201. struct scsi_device *scsidp;
  2202. unsigned long iflags;
  2203. read_lock_irqsave(&sg_index_lock, iflags);
  2204. sdp = it ? sg_lookup_dev(it->index) : NULL;
  2205. if ((NULL == sdp) || (NULL == sdp->device) ||
  2206. (atomic_read(&sdp->detaching)))
  2207. seq_puts(s, "-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\n");
  2208. else {
  2209. scsidp = sdp->device;
  2210. seq_printf(s, "%d\t%d\t%d\t%llu\t%d\t%d\t%d\t%d\t%d\n",
  2211. scsidp->host->host_no, scsidp->channel,
  2212. scsidp->id, scsidp->lun, (int) scsidp->type,
  2213. 1,
  2214. (int) scsidp->queue_depth,
  2215. (int) atomic_read(&scsidp->device_busy),
  2216. (int) scsi_device_online(scsidp));
  2217. }
  2218. read_unlock_irqrestore(&sg_index_lock, iflags);
  2219. return 0;
  2220. }
  2221. static int sg_proc_seq_show_devstrs(struct seq_file *s, void *v)
  2222. {
  2223. struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
  2224. Sg_device *sdp;
  2225. struct scsi_device *scsidp;
  2226. unsigned long iflags;
  2227. read_lock_irqsave(&sg_index_lock, iflags);
  2228. sdp = it ? sg_lookup_dev(it->index) : NULL;
  2229. scsidp = sdp ? sdp->device : NULL;
  2230. if (sdp && scsidp && (!atomic_read(&sdp->detaching)))
  2231. seq_printf(s, "%8.8s\t%16.16s\t%4.4s\n",
  2232. scsidp->vendor, scsidp->model, scsidp->rev);
  2233. else
  2234. seq_puts(s, "<no active device>\n");
  2235. read_unlock_irqrestore(&sg_index_lock, iflags);
  2236. return 0;
  2237. }
  2238. /* must be called while holding sg_index_lock */
  2239. static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp)
  2240. {
  2241. int k, new_interface, blen, usg;
  2242. Sg_request *srp;
  2243. Sg_fd *fp;
  2244. const sg_io_hdr_t *hp;
  2245. const char * cp;
  2246. unsigned int ms;
  2247. k = 0;
  2248. list_for_each_entry(fp, &sdp->sfds, sfd_siblings) {
  2249. k++;
  2250. read_lock(&fp->rq_list_lock); /* irqs already disabled */
  2251. seq_printf(s, " FD(%d): timeout=%dms bufflen=%d "
  2252. "(res)sgat=%d low_dma=%d\n", k,
  2253. jiffies_to_msecs(fp->timeout),
  2254. fp->reserve.bufflen,
  2255. (int) fp->reserve.k_use_sg,
  2256. (int) sdp->device->host->unchecked_isa_dma);
  2257. seq_printf(s, " cmd_q=%d f_packid=%d k_orphan=%d closed=0\n",
  2258. (int) fp->cmd_q, (int) fp->force_packid,
  2259. (int) fp->keep_orphan);
  2260. list_for_each_entry(srp, &fp->rq_list, entry) {
  2261. hp = &srp->header;
  2262. new_interface = (hp->interface_id == '\0') ? 0 : 1;
  2263. if (srp->res_used) {
  2264. if (new_interface &&
  2265. (SG_FLAG_MMAP_IO & hp->flags))
  2266. cp = " mmap>> ";
  2267. else
  2268. cp = " rb>> ";
  2269. } else {
  2270. if (SG_INFO_DIRECT_IO_MASK & hp->info)
  2271. cp = " dio>> ";
  2272. else
  2273. cp = " ";
  2274. }
  2275. seq_puts(s, cp);
  2276. blen = srp->data.bufflen;
  2277. usg = srp->data.k_use_sg;
  2278. seq_puts(s, srp->done ?
  2279. ((1 == srp->done) ? "rcv:" : "fin:")
  2280. : "act:");
  2281. seq_printf(s, " id=%d blen=%d",
  2282. srp->header.pack_id, blen);
  2283. if (srp->done)
  2284. seq_printf(s, " dur=%d", hp->duration);
  2285. else {
  2286. ms = jiffies_to_msecs(jiffies);
  2287. seq_printf(s, " t_o/elap=%d/%d",
  2288. (new_interface ? hp->timeout :
  2289. jiffies_to_msecs(fp->timeout)),
  2290. (ms > hp->duration ? ms - hp->duration : 0));
  2291. }
  2292. seq_printf(s, "ms sgat=%d op=0x%02x\n", usg,
  2293. (int) srp->data.cmd_opcode);
  2294. }
  2295. if (list_empty(&fp->rq_list))
  2296. seq_puts(s, " No requests active\n");
  2297. read_unlock(&fp->rq_list_lock);
  2298. }
  2299. }
  2300. static int sg_proc_seq_show_debug(struct seq_file *s, void *v)
  2301. {
  2302. struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
  2303. Sg_device *sdp;
  2304. unsigned long iflags;
  2305. if (it && (0 == it->index))
  2306. seq_printf(s, "max_active_device=%d def_reserved_size=%d\n",
  2307. (int)it->max, sg_big_buff);
  2308. read_lock_irqsave(&sg_index_lock, iflags);
  2309. sdp = it ? sg_lookup_dev(it->index) : NULL;
  2310. if (NULL == sdp)
  2311. goto skip;
  2312. read_lock(&sdp->sfd_lock);
  2313. if (!list_empty(&sdp->sfds)) {
  2314. seq_printf(s, " >>> device=%s ", sdp->disk->disk_name);
  2315. if (atomic_read(&sdp->detaching))
  2316. seq_puts(s, "detaching pending close ");
  2317. else if (sdp->device) {
  2318. struct scsi_device *scsidp = sdp->device;
  2319. seq_printf(s, "%d:%d:%d:%llu em=%d",
  2320. scsidp->host->host_no,
  2321. scsidp->channel, scsidp->id,
  2322. scsidp->lun,
  2323. scsidp->host->hostt->emulated);
  2324. }
  2325. seq_printf(s, " sg_tablesize=%d excl=%d open_cnt=%d\n",
  2326. sdp->sg_tablesize, sdp->exclude, sdp->open_cnt);
  2327. sg_proc_debug_helper(s, sdp);
  2328. }
  2329. read_unlock(&sdp->sfd_lock);
  2330. skip:
  2331. read_unlock_irqrestore(&sg_index_lock, iflags);
  2332. return 0;
  2333. }
  2334. #endif /* CONFIG_SCSI_PROC_FS */
  2335. module_init(init_sg);
  2336. module_exit(exit_sg);