1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Changes:
4 * Arnaldo Carvalho de Melo <acme@conectiva.com.br> 08/23/2000
5 * - get rid of some verify_areas and use __copy*user and __get/put_user
6 * for the ones that remain
7 */
8#include <linux/module.h>
9#include <linux/blkdev.h>
10#include <linux/interrupt.h>
11#include <linux/errno.h>
12#include <linux/kernel.h>
13#include <linux/sched.h>
14#include <linux/mm.h>
15#include <linux/string.h>
16#include <linux/uaccess.h>
17#include <linux/cdrom.h>
18
19#include <scsi/scsi.h>
20#include <scsi/scsi_cmnd.h>
21#include <scsi/scsi_device.h>
22#include <scsi/scsi_eh.h>
23#include <scsi/scsi_host.h>
24#include <scsi/scsi_ioctl.h>
25#include <scsi/sg.h>
26#include <scsi/scsi_dbg.h>
27
28#include "scsi_logging.h"
29
30#define NORMAL_RETRIES 5
31#define IOCTL_NORMAL_TIMEOUT (10 * HZ)
32
33#define MAX_BUF PAGE_SIZE
34
35/**
36 * ioctl_probe -- return host identification
37 * @host: host to identify
38 * @buffer: userspace buffer for identification
39 *
40 * Return:
41 * * if successful, %1 and an identifying string at @buffer, if @buffer
42 * is non-NULL, filling to the length stored at * (int *) @buffer.
43 * * <0 error code on failure.
44 */
45static int ioctl_probe(struct Scsi_Host *host, void __user *buffer)
46{
47 unsigned int len, slen;
48 const char *string;
49
50 if (buffer) {
51 if (get_user(len, (unsigned int __user *) buffer))
52 return -EFAULT;
53
54 if (host->hostt->info)
55 string = host->hostt->info(host);
56 else
57 string = host->hostt->name;
58 if (string) {
59 slen = strlen(string);
60 if (len > slen)
61 len = slen + 1;
62 if (copy_to_user(to: buffer, from: string, n: len))
63 return -EFAULT;
64 }
65 }
66 return 1;
67}
68
69static int ioctl_internal_command(struct scsi_device *sdev, char *cmd,
70 int timeout, int retries)
71{
72 int result;
73 struct scsi_sense_hdr sshdr;
74 const struct scsi_exec_args exec_args = {
75 .sshdr = &sshdr,
76 };
77
78 SCSI_LOG_IOCTL(1, sdev_printk(KERN_INFO, sdev,
79 "Trying ioctl with scsi command %d\n", *cmd));
80
81 result = scsi_execute_cmd(sdev, cmd, opf: REQ_OP_DRV_IN, NULL, bufflen: 0, timeout,
82 retries, args: &exec_args);
83
84 SCSI_LOG_IOCTL(2, sdev_printk(KERN_INFO, sdev,
85 "Ioctl returned 0x%x\n", result));
86
87 if (result < 0)
88 goto out;
89 if (scsi_sense_valid(sshdr: &sshdr)) {
90 switch (sshdr.sense_key) {
91 case ILLEGAL_REQUEST:
92 if (cmd[0] == ALLOW_MEDIUM_REMOVAL)
93 sdev->lockable = 0;
94 else
95 sdev_printk(KERN_INFO, sdev,
96 "ioctl_internal_command: "
97 "ILLEGAL REQUEST "
98 "asc=0x%x ascq=0x%x\n",
99 sshdr.asc, sshdr.ascq);
100 break;
101 case NOT_READY: /* This happens if there is no disc in drive */
102 if (sdev->removable)
103 break;
104 fallthrough;
105 case UNIT_ATTENTION:
106 if (sdev->removable) {
107 sdev->changed = 1;
108 result = 0; /* This is no longer considered an error */
109 break;
110 }
111 fallthrough; /* for non-removable media */
112 default:
113 sdev_printk(KERN_INFO, sdev,
114 "ioctl_internal_command return code = %x\n",
115 result);
116 scsi_print_sense_hdr(sdev, NULL, &sshdr);
117 break;
118 }
119 }
120out:
121 SCSI_LOG_IOCTL(2, sdev_printk(KERN_INFO, sdev,
122 "IOCTL Releasing command\n"));
123 return result;
124}
125
126/**
127 * scsi_set_medium_removal() - send command to allow or prevent medium removal
128 * @sdev: target scsi device
129 * @state: removal state to set (prevent or allow)
130 *
131 * Returns:
132 * * %0 if @sdev is not removable or not lockable or successful.
133 * * non-%0 is a SCSI result code if > 0 or kernel error code if < 0.
134 * * Sets @sdev->locked to the new state on success.
135 */
136int scsi_set_medium_removal(struct scsi_device *sdev, char state)
137{
138 char scsi_cmd[MAX_COMMAND_SIZE];
139 int ret;
140
141 if (!sdev->removable || !sdev->lockable)
142 return 0;
143
144 scsi_cmd[0] = ALLOW_MEDIUM_REMOVAL;
145 scsi_cmd[1] = 0;
146 scsi_cmd[2] = 0;
147 scsi_cmd[3] = 0;
148 scsi_cmd[4] = state;
149 scsi_cmd[5] = 0;
150
151 ret = ioctl_internal_command(sdev, cmd: scsi_cmd,
152 IOCTL_NORMAL_TIMEOUT, NORMAL_RETRIES);
153 if (ret == 0)
154 sdev->locked = (state == SCSI_REMOVAL_PREVENT);
155 return ret;
156}
157EXPORT_SYMBOL(scsi_set_medium_removal);
158
159/*
160 * The scsi_ioctl_get_pci() function places into arg the value
161 * pci_dev::slot_name (8 characters) for the PCI device (if any).
162 * Returns: 0 on success
163 * -ENXIO if there isn't a PCI device pointer
164 * (could be because the SCSI driver hasn't been
165 * updated yet, or because it isn't a SCSI
166 * device)
167 * any copy_to_user() error on failure there
168 */
169static int scsi_ioctl_get_pci(struct scsi_device *sdev, void __user *arg)
170{
171 struct device *dev = scsi_get_device(shost: sdev->host);
172 const char *name;
173
174 if (!dev)
175 return -ENXIO;
176
177 name = dev_name(dev);
178
179 /* compatibility with old ioctl which only returned
180 * 20 characters */
181 return copy_to_user(to: arg, from: name, min(strlen(name), (size_t)20))
182 ? -EFAULT: 0;
183}
184
185static int sg_get_version(int __user *p)
186{
187 static const int sg_version_num = 30527;
188 return put_user(sg_version_num, p);
189}
190
191static int sg_set_timeout(struct scsi_device *sdev, int __user *p)
192{
193 int timeout, err = get_user(timeout, p);
194
195 if (!err)
196 sdev->sg_timeout = clock_t_to_jiffies(x: timeout);
197
198 return err;
199}
200
201static int sg_get_reserved_size(struct scsi_device *sdev, int __user *p)
202{
203 int val = min(sdev->sg_reserved_size,
204 queue_max_bytes(sdev->request_queue));
205
206 return put_user(val, p);
207}
208
209static int sg_set_reserved_size(struct scsi_device *sdev, int __user *p)
210{
211 int size, err = get_user(size, p);
212
213 if (err)
214 return err;
215
216 if (size < 0)
217 return -EINVAL;
218
219 sdev->sg_reserved_size = min_t(unsigned int, size,
220 queue_max_bytes(sdev->request_queue));
221 return 0;
222}
223
224/*
225 * will always return that we are ATAPI even for a real SCSI drive, I'm not
226 * so sure this is worth doing anything about (why would you care??)
227 */
228static int sg_emulated_host(struct request_queue *q, int __user *p)
229{
230 return put_user(1, p);
231}
232
233static int scsi_get_idlun(struct scsi_device *sdev, void __user *argp)
234{
235 struct scsi_idlun v = {
236 .dev_id = (sdev->id & 0xff) +
237 ((sdev->lun & 0xff) << 8) +
238 ((sdev->channel & 0xff) << 16) +
239 ((sdev->host->host_no & 0xff) << 24),
240 .host_unique_id = sdev->host->unique_id
241 };
242 if (copy_to_user(to: argp, from: &v, n: sizeof(struct scsi_idlun)))
243 return -EFAULT;
244 return 0;
245}
246
247static int scsi_send_start_stop(struct scsi_device *sdev, int data)
248{
249 u8 cdb[MAX_COMMAND_SIZE] = { };
250
251 cdb[0] = START_STOP;
252 cdb[4] = data;
253 return ioctl_internal_command(sdev, cmd: cdb, START_STOP_TIMEOUT,
254 NORMAL_RETRIES);
255}
256
257/**
258 * scsi_cmd_allowed() - Check if the given command is allowed.
259 * @cmd: SCSI command to check
260 * @open_for_write: is the file / block device opened for writing?
261 *
262 * Only a subset of commands are allowed for unprivileged users. Commands used
263 * to format the media, update the firmware, etc. are not permitted.
264 *
265 * Return: %true if the cmd is allowed, otherwise @false.
266 */
267bool scsi_cmd_allowed(unsigned char *cmd, bool open_for_write)
268{
269 /* root can do any command. */
270 if (capable(CAP_SYS_RAWIO))
271 return true;
272
273 /* Anybody who can open the device can do a read-safe command */
274 switch (cmd[0]) {
275 /* Basic read-only commands */
276 case TEST_UNIT_READY:
277 case REQUEST_SENSE:
278 case READ_6:
279 case READ_10:
280 case READ_12:
281 case READ_16:
282 case READ_BUFFER:
283 case READ_DEFECT_DATA:
284 case READ_CAPACITY: /* also GPCMD_READ_CDVD_CAPACITY */
285 case READ_LONG:
286 case INQUIRY:
287 case MODE_SENSE:
288 case MODE_SENSE_10:
289 case LOG_SENSE:
290 case START_STOP:
291 case GPCMD_VERIFY_10:
292 case VERIFY_16:
293 case REPORT_LUNS:
294 case SERVICE_ACTION_IN_16:
295 case RECEIVE_DIAGNOSTIC:
296 case MAINTENANCE_IN: /* also GPCMD_SEND_KEY, which is a write command */
297 case GPCMD_READ_BUFFER_CAPACITY:
298 /* Audio CD commands */
299 case GPCMD_PLAY_CD:
300 case GPCMD_PLAY_AUDIO_10:
301 case GPCMD_PLAY_AUDIO_MSF:
302 case GPCMD_PLAY_AUDIO_TI:
303 case GPCMD_PAUSE_RESUME:
304 /* CD/DVD data reading */
305 case GPCMD_READ_CD:
306 case GPCMD_READ_CD_MSF:
307 case GPCMD_READ_DISC_INFO:
308 case GPCMD_READ_DVD_STRUCTURE:
309 case GPCMD_READ_HEADER:
310 case GPCMD_READ_TRACK_RZONE_INFO:
311 case GPCMD_READ_SUBCHANNEL:
312 case GPCMD_READ_TOC_PMA_ATIP:
313 case GPCMD_REPORT_KEY:
314 case GPCMD_SCAN:
315 case GPCMD_GET_CONFIGURATION:
316 case GPCMD_READ_FORMAT_CAPACITIES:
317 case GPCMD_GET_EVENT_STATUS_NOTIFICATION:
318 case GPCMD_GET_PERFORMANCE:
319 case GPCMD_SEEK:
320 case GPCMD_STOP_PLAY_SCAN:
321 /* ZBC */
322 case ZBC_IN:
323 return true;
324 /* Basic writing commands */
325 case WRITE_6:
326 case WRITE_10:
327 case WRITE_VERIFY:
328 case WRITE_12:
329 case WRITE_VERIFY_12:
330 case WRITE_16:
331 case WRITE_LONG:
332 case WRITE_LONG_2:
333 case WRITE_SAME:
334 case WRITE_SAME_16:
335 case WRITE_SAME_32:
336 case ERASE:
337 case GPCMD_MODE_SELECT_10:
338 case MODE_SELECT:
339 case LOG_SELECT:
340 case GPCMD_BLANK:
341 case GPCMD_CLOSE_TRACK:
342 case GPCMD_FLUSH_CACHE:
343 case GPCMD_FORMAT_UNIT:
344 case GPCMD_REPAIR_RZONE_TRACK:
345 case GPCMD_RESERVE_RZONE_TRACK:
346 case GPCMD_SEND_DVD_STRUCTURE:
347 case GPCMD_SEND_EVENT:
348 case GPCMD_SEND_OPC:
349 case GPCMD_SEND_CUE_SHEET:
350 case GPCMD_SET_SPEED:
351 case GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL:
352 case GPCMD_LOAD_UNLOAD:
353 case GPCMD_SET_STREAMING:
354 case GPCMD_SET_READ_AHEAD:
355 /* ZBC */
356 case ZBC_OUT:
357 return open_for_write;
358 default:
359 return false;
360 }
361}
362EXPORT_SYMBOL(scsi_cmd_allowed);
363
364static int scsi_fill_sghdr_rq(struct scsi_device *sdev, struct request *rq,
365 struct sg_io_hdr *hdr, bool open_for_write)
366{
367 struct scsi_cmnd *scmd = blk_mq_rq_to_pdu(rq);
368
369 if (hdr->cmd_len < 6)
370 return -EMSGSIZE;
371 if (copy_from_user(to: scmd->cmnd, from: hdr->cmdp, n: hdr->cmd_len))
372 return -EFAULT;
373 if (!scsi_cmd_allowed(scmd->cmnd, open_for_write))
374 return -EPERM;
375 scmd->cmd_len = hdr->cmd_len;
376
377 rq->timeout = msecs_to_jiffies(m: hdr->timeout);
378 if (!rq->timeout)
379 rq->timeout = sdev->sg_timeout;
380 if (!rq->timeout)
381 rq->timeout = BLK_DEFAULT_SG_TIMEOUT;
382 if (rq->timeout < BLK_MIN_SG_TIMEOUT)
383 rq->timeout = BLK_MIN_SG_TIMEOUT;
384
385 return 0;
386}
387
388static int scsi_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,
389 struct bio *bio)
390{
391 struct scsi_cmnd *scmd = blk_mq_rq_to_pdu(rq);
392 int r, ret = 0;
393
394 /*
395 * fill in all the output members
396 */
397 hdr->status = scmd->result & 0xff;
398 hdr->masked_status = sg_status_byte(scmd->result);
399 hdr->msg_status = COMMAND_COMPLETE;
400 hdr->host_status = host_byte(scmd->result);
401 hdr->driver_status = 0;
402 if (scsi_status_is_check_condition(status: hdr->status))
403 hdr->driver_status = DRIVER_SENSE;
404 hdr->info = 0;
405 if (hdr->masked_status || hdr->host_status || hdr->driver_status)
406 hdr->info |= SG_INFO_CHECK;
407 hdr->resid = scmd->resid_len;
408 hdr->sb_len_wr = 0;
409
410 if (scmd->sense_len && hdr->sbp) {
411 int len = min((unsigned int) hdr->mx_sb_len, scmd->sense_len);
412
413 if (!copy_to_user(to: hdr->sbp, from: scmd->sense_buffer, n: len))
414 hdr->sb_len_wr = len;
415 else
416 ret = -EFAULT;
417 }
418
419 r = blk_rq_unmap_user(bio);
420 if (!ret)
421 ret = r;
422
423 return ret;
424}
425
426static int sg_io(struct scsi_device *sdev, struct sg_io_hdr *hdr,
427 bool open_for_write)
428{
429 unsigned long start_time;
430 ssize_t ret = 0;
431 int writing = 0;
432 int at_head = 0;
433 struct request *rq;
434 struct scsi_cmnd *scmd;
435 struct bio *bio;
436
437 if (hdr->interface_id != 'S')
438 return -EINVAL;
439
440 if (hdr->dxfer_len > (queue_max_hw_sectors(q: sdev->request_queue) << 9))
441 return -EIO;
442
443 if (hdr->dxfer_len)
444 switch (hdr->dxfer_direction) {
445 default:
446 return -EINVAL;
447 case SG_DXFER_TO_DEV:
448 writing = 1;
449 break;
450 case SG_DXFER_TO_FROM_DEV:
451 case SG_DXFER_FROM_DEV:
452 break;
453 }
454 if (hdr->flags & SG_FLAG_Q_AT_HEAD)
455 at_head = 1;
456
457 rq = scsi_alloc_request(q: sdev->request_queue, opf: writing ?
458 REQ_OP_DRV_OUT : REQ_OP_DRV_IN, flags: 0);
459 if (IS_ERR(ptr: rq))
460 return PTR_ERR(ptr: rq);
461 scmd = blk_mq_rq_to_pdu(rq);
462
463 if (hdr->cmd_len > sizeof(scmd->cmnd)) {
464 ret = -EINVAL;
465 goto out_put_request;
466 }
467
468 ret = scsi_fill_sghdr_rq(sdev, rq, hdr, open_for_write);
469 if (ret < 0)
470 goto out_put_request;
471
472 ret = blk_rq_map_user_io(rq, NULL, hdr->dxferp, hdr->dxfer_len,
473 GFP_KERNEL, hdr->iovec_count && hdr->dxfer_len,
474 hdr->iovec_count, 0, rq_data_dir(rq));
475 if (ret)
476 goto out_put_request;
477
478 bio = rq->bio;
479 scmd->allowed = 0;
480
481 start_time = jiffies;
482
483 blk_execute_rq(rq, at_head);
484
485 hdr->duration = jiffies_to_msecs(j: jiffies - start_time);
486
487 ret = scsi_complete_sghdr_rq(rq, hdr, bio);
488
489out_put_request:
490 blk_mq_free_request(rq);
491 return ret;
492}
493
494/**
495 * sg_scsi_ioctl -- handle deprecated SCSI_IOCTL_SEND_COMMAND ioctl
496 * @q: request queue to send scsi commands down
497 * @open_for_write: is the file / block device opened for writing?
498 * @sic: userspace structure describing the command to perform
499 *
500 * Send down the scsi command described by @sic to the device below
501 * the request queue @q.
502 *
503 * Notes:
504 * - This interface is deprecated - users should use the SG_IO
505 * interface instead, as this is a more flexible approach to
506 * performing SCSI commands on a device.
507 * - The SCSI command length is determined by examining the 1st byte
508 * of the given command. There is no way to override this.
509 * - Data transfers are limited to PAGE_SIZE
510 * - The length (x + y) must be at least OMAX_SB_LEN bytes long to
511 * accommodate the sense buffer when an error occurs.
512 * The sense buffer is truncated to OMAX_SB_LEN (16) bytes so that
513 * old code will not be surprised.
514 * - If a Unix error occurs (e.g. ENOMEM) then the user will receive
515 * a negative return and the Unix error code in 'errno'.
516 * If the SCSI command succeeds then 0 is returned.
517 * Positive numbers returned are the compacted SCSI error codes (4
518 * bytes in one int) where the lowest byte is the SCSI status.
519 */
520static int sg_scsi_ioctl(struct request_queue *q, bool open_for_write,
521 struct scsi_ioctl_command __user *sic)
522{
523 struct request *rq;
524 int err;
525 unsigned int in_len, out_len, bytes, opcode, cmdlen;
526 struct scsi_cmnd *scmd;
527 char *buffer = NULL;
528
529 if (!sic)
530 return -EINVAL;
531
532 /*
533 * get in an out lengths, verify they don't exceed a page worth of data
534 */
535 if (get_user(in_len, &sic->inlen))
536 return -EFAULT;
537 if (get_user(out_len, &sic->outlen))
538 return -EFAULT;
539 if (in_len > PAGE_SIZE || out_len > PAGE_SIZE)
540 return -EINVAL;
541 if (get_user(opcode, &sic->data[0]))
542 return -EFAULT;
543
544 bytes = max(in_len, out_len);
545 if (bytes) {
546 buffer = kzalloc(bytes, GFP_NOIO | GFP_USER | __GFP_NOWARN);
547 if (!buffer)
548 return -ENOMEM;
549
550 }
551
552 rq = scsi_alloc_request(q, opf: in_len ? REQ_OP_DRV_OUT : REQ_OP_DRV_IN, flags: 0);
553 if (IS_ERR(ptr: rq)) {
554 err = PTR_ERR(ptr: rq);
555 goto error_free_buffer;
556 }
557 scmd = blk_mq_rq_to_pdu(rq);
558
559 cmdlen = COMMAND_SIZE(opcode);
560
561 /*
562 * get command and data to send to device, if any
563 */
564 err = -EFAULT;
565 scmd->cmd_len = cmdlen;
566 if (copy_from_user(to: scmd->cmnd, from: sic->data, n: cmdlen))
567 goto error;
568
569 if (in_len && copy_from_user(to: buffer, from: sic->data + cmdlen, n: in_len))
570 goto error;
571
572 err = -EPERM;
573 if (!scsi_cmd_allowed(scmd->cmnd, open_for_write))
574 goto error;
575
576 /* default. possible overridden later */
577 scmd->allowed = 5;
578
579 switch (opcode) {
580 case SEND_DIAGNOSTIC:
581 case FORMAT_UNIT:
582 rq->timeout = FORMAT_UNIT_TIMEOUT;
583 scmd->allowed = 1;
584 break;
585 case START_STOP:
586 rq->timeout = START_STOP_TIMEOUT;
587 break;
588 case MOVE_MEDIUM:
589 rq->timeout = MOVE_MEDIUM_TIMEOUT;
590 break;
591 case READ_ELEMENT_STATUS:
592 rq->timeout = READ_ELEMENT_STATUS_TIMEOUT;
593 break;
594 case READ_DEFECT_DATA:
595 rq->timeout = READ_DEFECT_DATA_TIMEOUT;
596 scmd->allowed = 1;
597 break;
598 default:
599 rq->timeout = BLK_DEFAULT_SG_TIMEOUT;
600 break;
601 }
602
603 if (bytes) {
604 err = blk_rq_map_kern(rq, kbuf: buffer, len: bytes, GFP_NOIO);
605 if (err)
606 goto error;
607 }
608
609 blk_execute_rq(rq, at_head: false);
610
611 err = scmd->result & 0xff; /* only 8 bit SCSI status */
612 if (err) {
613 if (scmd->sense_len && scmd->sense_buffer) {
614 /* limit sense len for backward compatibility */
615 if (copy_to_user(to: sic->data, from: scmd->sense_buffer,
616 min(scmd->sense_len, 16U)))
617 err = -EFAULT;
618 }
619 } else {
620 if (copy_to_user(to: sic->data, from: buffer, n: out_len))
621 err = -EFAULT;
622 }
623
624error:
625 blk_mq_free_request(rq);
626
627error_free_buffer:
628 kfree(objp: buffer);
629
630 return err;
631}
632
633int put_sg_io_hdr(const struct sg_io_hdr *hdr, void __user *argp)
634{
635#ifdef CONFIG_COMPAT
636 if (in_compat_syscall()) {
637 struct compat_sg_io_hdr hdr32 = {
638 .interface_id = hdr->interface_id,
639 .dxfer_direction = hdr->dxfer_direction,
640 .cmd_len = hdr->cmd_len,
641 .mx_sb_len = hdr->mx_sb_len,
642 .iovec_count = hdr->iovec_count,
643 .dxfer_len = hdr->dxfer_len,
644 .dxferp = (uintptr_t)hdr->dxferp,
645 .cmdp = (uintptr_t)hdr->cmdp,
646 .sbp = (uintptr_t)hdr->sbp,
647 .timeout = hdr->timeout,
648 .flags = hdr->flags,
649 .pack_id = hdr->pack_id,
650 .usr_ptr = (uintptr_t)hdr->usr_ptr,
651 .status = hdr->status,
652 .masked_status = hdr->masked_status,
653 .msg_status = hdr->msg_status,
654 .sb_len_wr = hdr->sb_len_wr,
655 .host_status = hdr->host_status,
656 .driver_status = hdr->driver_status,
657 .resid = hdr->resid,
658 .duration = hdr->duration,
659 .info = hdr->info,
660 };
661
662 if (copy_to_user(to: argp, from: &hdr32, n: sizeof(hdr32)))
663 return -EFAULT;
664
665 return 0;
666 }
667#endif
668
669 if (copy_to_user(to: argp, from: hdr, n: sizeof(*hdr)))
670 return -EFAULT;
671
672 return 0;
673}
674EXPORT_SYMBOL(put_sg_io_hdr);
675
676int get_sg_io_hdr(struct sg_io_hdr *hdr, const void __user *argp)
677{
678#ifdef CONFIG_COMPAT
679 struct compat_sg_io_hdr hdr32;
680
681 if (in_compat_syscall()) {
682 if (copy_from_user(to: &hdr32, from: argp, n: sizeof(hdr32)))
683 return -EFAULT;
684
685 *hdr = (struct sg_io_hdr) {
686 .interface_id = hdr32.interface_id,
687 .dxfer_direction = hdr32.dxfer_direction,
688 .cmd_len = hdr32.cmd_len,
689 .mx_sb_len = hdr32.mx_sb_len,
690 .iovec_count = hdr32.iovec_count,
691 .dxfer_len = hdr32.dxfer_len,
692 .dxferp = compat_ptr(uptr: hdr32.dxferp),
693 .cmdp = compat_ptr(uptr: hdr32.cmdp),
694 .sbp = compat_ptr(uptr: hdr32.sbp),
695 .timeout = hdr32.timeout,
696 .flags = hdr32.flags,
697 .pack_id = hdr32.pack_id,
698 .usr_ptr = compat_ptr(uptr: hdr32.usr_ptr),
699 .status = hdr32.status,
700 .masked_status = hdr32.masked_status,
701 .msg_status = hdr32.msg_status,
702 .sb_len_wr = hdr32.sb_len_wr,
703 .host_status = hdr32.host_status,
704 .driver_status = hdr32.driver_status,
705 .resid = hdr32.resid,
706 .duration = hdr32.duration,
707 .info = hdr32.info,
708 };
709
710 return 0;
711 }
712#endif
713
714 if (copy_from_user(to: hdr, from: argp, n: sizeof(*hdr)))
715 return -EFAULT;
716
717 return 0;
718}
719EXPORT_SYMBOL(get_sg_io_hdr);
720
721#ifdef CONFIG_COMPAT
722struct compat_cdrom_generic_command {
723 unsigned char cmd[CDROM_PACKET_SIZE];
724 compat_caddr_t buffer;
725 compat_uint_t buflen;
726 compat_int_t stat;
727 compat_caddr_t sense;
728 unsigned char data_direction;
729 unsigned char pad[3];
730 compat_int_t quiet;
731 compat_int_t timeout;
732 compat_caddr_t unused;
733};
734#endif
735
736static int scsi_get_cdrom_generic_arg(struct cdrom_generic_command *cgc,
737 const void __user *arg)
738{
739#ifdef CONFIG_COMPAT
740 if (in_compat_syscall()) {
741 struct compat_cdrom_generic_command cgc32;
742
743 if (copy_from_user(to: &cgc32, from: arg, n: sizeof(cgc32)))
744 return -EFAULT;
745
746 *cgc = (struct cdrom_generic_command) {
747 .buffer = compat_ptr(uptr: cgc32.buffer),
748 .buflen = cgc32.buflen,
749 .stat = cgc32.stat,
750 .sense = compat_ptr(uptr: cgc32.sense),
751 .data_direction = cgc32.data_direction,
752 .quiet = cgc32.quiet,
753 .timeout = cgc32.timeout,
754 .unused = compat_ptr(uptr: cgc32.unused),
755 };
756 memcpy(to: &cgc->cmd, from: &cgc32.cmd, CDROM_PACKET_SIZE);
757 return 0;
758 }
759#endif
760 if (copy_from_user(to: cgc, from: arg, n: sizeof(*cgc)))
761 return -EFAULT;
762
763 return 0;
764}
765
766static int scsi_put_cdrom_generic_arg(const struct cdrom_generic_command *cgc,
767 void __user *arg)
768{
769#ifdef CONFIG_COMPAT
770 if (in_compat_syscall()) {
771 struct compat_cdrom_generic_command cgc32 = {
772 .buffer = (uintptr_t)(cgc->buffer),
773 .buflen = cgc->buflen,
774 .stat = cgc->stat,
775 .sense = (uintptr_t)(cgc->sense),
776 .data_direction = cgc->data_direction,
777 .quiet = cgc->quiet,
778 .timeout = cgc->timeout,
779 .unused = (uintptr_t)(cgc->unused),
780 };
781 memcpy(to: &cgc32.cmd, from: &cgc->cmd, CDROM_PACKET_SIZE);
782
783 if (copy_to_user(to: arg, from: &cgc32, n: sizeof(cgc32)))
784 return -EFAULT;
785
786 return 0;
787 }
788#endif
789 if (copy_to_user(to: arg, from: cgc, n: sizeof(*cgc)))
790 return -EFAULT;
791
792 return 0;
793}
794
795static int scsi_cdrom_send_packet(struct scsi_device *sdev, bool open_for_write,
796 void __user *arg)
797{
798 struct cdrom_generic_command cgc;
799 struct sg_io_hdr hdr;
800 int err;
801
802 err = scsi_get_cdrom_generic_arg(cgc: &cgc, arg);
803 if (err)
804 return err;
805
806 cgc.timeout = clock_t_to_jiffies(x: cgc.timeout);
807 memset(s: &hdr, c: 0, n: sizeof(hdr));
808 hdr.interface_id = 'S';
809 hdr.cmd_len = sizeof(cgc.cmd);
810 hdr.dxfer_len = cgc.buflen;
811 switch (cgc.data_direction) {
812 case CGC_DATA_UNKNOWN:
813 hdr.dxfer_direction = SG_DXFER_UNKNOWN;
814 break;
815 case CGC_DATA_WRITE:
816 hdr.dxfer_direction = SG_DXFER_TO_DEV;
817 break;
818 case CGC_DATA_READ:
819 hdr.dxfer_direction = SG_DXFER_FROM_DEV;
820 break;
821 case CGC_DATA_NONE:
822 hdr.dxfer_direction = SG_DXFER_NONE;
823 break;
824 default:
825 return -EINVAL;
826 }
827
828 hdr.dxferp = cgc.buffer;
829 hdr.sbp = cgc.sense;
830 if (hdr.sbp)
831 hdr.mx_sb_len = sizeof(struct request_sense);
832 hdr.timeout = jiffies_to_msecs(j: cgc.timeout);
833 hdr.cmdp = ((struct cdrom_generic_command __user *) arg)->cmd;
834 hdr.cmd_len = sizeof(cgc.cmd);
835
836 err = sg_io(sdev, hdr: &hdr, open_for_write);
837 if (err == -EFAULT)
838 return -EFAULT;
839
840 if (hdr.status)
841 return -EIO;
842
843 cgc.stat = err;
844 cgc.buflen = hdr.resid;
845 if (scsi_put_cdrom_generic_arg(cgc: &cgc, arg))
846 return -EFAULT;
847
848 return err;
849}
850
851static int scsi_ioctl_sg_io(struct scsi_device *sdev, bool open_for_write,
852 void __user *argp)
853{
854 struct sg_io_hdr hdr;
855 int error;
856
857 error = get_sg_io_hdr(&hdr, argp);
858 if (error)
859 return error;
860 error = sg_io(sdev, hdr: &hdr, open_for_write);
861 if (error == -EFAULT)
862 return error;
863 if (put_sg_io_hdr(&hdr, argp))
864 return -EFAULT;
865 return error;
866}
867
868/**
869 * scsi_ioctl - Dispatch ioctl to scsi device
870 * @sdev: scsi device receiving ioctl
871 * @open_for_write: is the file / block device opened for writing?
872 * @cmd: which ioctl is it
873 * @arg: data associated with ioctl
874 *
875 * Description: The scsi_ioctl() function differs from most ioctls in that it
876 * does not take a major/minor number as the dev field. Rather, it takes
877 * a pointer to a &struct scsi_device.
878 *
879 * Return: varies depending on the @cmd
880 */
881int scsi_ioctl(struct scsi_device *sdev, bool open_for_write, int cmd,
882 void __user *arg)
883{
884 struct request_queue *q = sdev->request_queue;
885 struct scsi_sense_hdr sense_hdr;
886
887 /* Check for deprecated ioctls ... all the ioctls which don't
888 * follow the new unique numbering scheme are deprecated */
889 switch (cmd) {
890 case SCSI_IOCTL_SEND_COMMAND:
891 case SCSI_IOCTL_TEST_UNIT_READY:
892 case SCSI_IOCTL_BENCHMARK_COMMAND:
893 case SCSI_IOCTL_SYNC:
894 case SCSI_IOCTL_START_UNIT:
895 case SCSI_IOCTL_STOP_UNIT:
896 printk(KERN_WARNING "program %s is using a deprecated SCSI "
897 "ioctl, please convert it to SG_IO\n", current->comm);
898 break;
899 default:
900 break;
901 }
902
903 switch (cmd) {
904 case SG_GET_VERSION_NUM:
905 return sg_get_version(p: arg);
906 case SG_SET_TIMEOUT:
907 return sg_set_timeout(sdev, p: arg);
908 case SG_GET_TIMEOUT:
909 return jiffies_to_clock_t(x: sdev->sg_timeout);
910 case SG_GET_RESERVED_SIZE:
911 return sg_get_reserved_size(sdev, p: arg);
912 case SG_SET_RESERVED_SIZE:
913 return sg_set_reserved_size(sdev, p: arg);
914 case SG_EMULATED_HOST:
915 return sg_emulated_host(q, p: arg);
916 case SG_IO:
917 return scsi_ioctl_sg_io(sdev, open_for_write, argp: arg);
918 case SCSI_IOCTL_SEND_COMMAND:
919 return sg_scsi_ioctl(q, open_for_write, sic: arg);
920 case CDROM_SEND_PACKET:
921 return scsi_cdrom_send_packet(sdev, open_for_write, arg);
922 case CDROMCLOSETRAY:
923 return scsi_send_start_stop(sdev, data: 3);
924 case CDROMEJECT:
925 return scsi_send_start_stop(sdev, data: 2);
926 case SCSI_IOCTL_GET_IDLUN:
927 return scsi_get_idlun(sdev, argp: arg);
928 case SCSI_IOCTL_GET_BUS_NUMBER:
929 return put_user(sdev->host->host_no, (int __user *)arg);
930 case SCSI_IOCTL_PROBE_HOST:
931 return ioctl_probe(host: sdev->host, buffer: arg);
932 case SCSI_IOCTL_DOORLOCK:
933 return scsi_set_medium_removal(sdev, SCSI_REMOVAL_PREVENT);
934 case SCSI_IOCTL_DOORUNLOCK:
935 return scsi_set_medium_removal(sdev, SCSI_REMOVAL_ALLOW);
936 case SCSI_IOCTL_TEST_UNIT_READY:
937 return scsi_test_unit_ready(sdev, IOCTL_NORMAL_TIMEOUT,
938 NORMAL_RETRIES, sshdr: &sense_hdr);
939 case SCSI_IOCTL_START_UNIT:
940 return scsi_send_start_stop(sdev, data: 1);
941 case SCSI_IOCTL_STOP_UNIT:
942 return scsi_send_start_stop(sdev, data: 0);
943 case SCSI_IOCTL_GET_PCI:
944 return scsi_ioctl_get_pci(sdev, arg);
945 case SG_SCSI_RESET:
946 return scsi_ioctl_reset(sdev, arg);
947 }
948
949#ifdef CONFIG_COMPAT
950 if (in_compat_syscall()) {
951 if (!sdev->host->hostt->compat_ioctl)
952 return -EINVAL;
953 return sdev->host->hostt->compat_ioctl(sdev, cmd, arg);
954 }
955#endif
956 if (!sdev->host->hostt->ioctl)
957 return -EINVAL;
958 return sdev->host->hostt->ioctl(sdev, cmd, arg);
959}
960EXPORT_SYMBOL(scsi_ioctl);
961
962/**
963 * scsi_ioctl_block_when_processing_errors - prevent commands from being queued
964 * @sdev: target scsi device
965 * @cmd: which ioctl is it
966 * @ndelay: no delay (non-blocking)
967 *
968 * We can process a reset even when a device isn't fully operable.
969 *
970 * Return: %0 on success, <0 error code.
971 */
972int scsi_ioctl_block_when_processing_errors(struct scsi_device *sdev, int cmd,
973 bool ndelay)
974{
975 if (cmd == SG_SCSI_RESET && ndelay) {
976 if (scsi_host_in_recovery(shost: sdev->host))
977 return -EAGAIN;
978 } else {
979 if (!scsi_block_when_processing_errors(sdev))
980 return -ENODEV;
981 }
982
983 return 0;
984}
985EXPORT_SYMBOL_GPL(scsi_ioctl_block_when_processing_errors);
986