drivers/scsi/sg.c

   1 /*
   2  *  History:
   3  *  Started: Aug 9 by Lawrence Foard (entropy@world.std.com),
   4  *           to allow user process control of SCSI devices.
   5  *  Development Sponsored by Killy Corp. NY NY
   6  *
   7  * Original driver (sg.c):
   8  *        Copyright (C) 1992 Lawrence Foard
   9  * Version 2 and 3 extensions to driver:
  10  *        Copyright (C) 1998 - 2005 Douglas Gilbert
  11  *
  12  *  Modified  19-JAN-1998  Richard Gooch <rgooch@atnf.csiro.au>  Devfs support
  13  *
  14  * This program is free software; you can redistribute it and/or modify
  15  * it under the terms of the GNU General Public License as published by
  16  * the Free Software Foundation; either version 2, or (at your option)
  17  * any later version.
  18  *
  19  */
  20
  21 static int sg_version_num = 30534;      /* 2 digits for each component */
  22 #define SG_VERSION_STR "3.5.34"
  23
  24 /*
  25  *  D. P. Gilbert (dgilbert@interlog.com, dougg@triode.net.au), notes:
  26  *      - scsi logging is available via SCSI_LOG_TIMEOUT macros. First
  27  *        the kernel/module needs to be built with CONFIG_SCSI_LOGGING
  28  *        (otherwise the macros compile to empty statements).
  29  *
  30  */
  31 #include <linux/module.h>
  32
  33 #include <linux/fs.h>
  34 #include <linux/kernel.h>
  35 #include <linux/sched.h>
  36 #include <linux/string.h>
  37 #include <linux/mm.h>
  38 #include <linux/aio.h>
  39 #include <linux/errno.h>
  40 #include <linux/mtio.h>
  41 #include <linux/ioctl.h>
  42 #include <linux/slab.h>
  43 #include <linux/fcntl.h>
  44 #include <linux/init.h>
  45 #include <linux/poll.h>
  46 #include <linux/moduleparam.h>
  47 #include <linux/cdev.h>
  48 #include <linux/idr.h>
  49 #include <linux/seq_file.h>
  50 #include <linux/blkdev.h>
  51 #include <linux/delay.h>
  52 #include <linux/blktrace_api.h>
  53 #include <linux/mutex.h>
  54 #include <linux/ratelimit.h>
  55
  56 #include "scsi.h"
  57 #include <scsi/scsi_dbg.h>
  58 #include <scsi/scsi_host.h>
  59 #include <scsi/scsi_driver.h>
  60 #include <scsi/scsi_ioctl.h>
  61 #include <scsi/sg.h>
  62
  63 #include "scsi_logging.h"
  64
  65 #ifdef CONFIG_SCSI_PROC_FS
  66 #include <linux/proc_fs.h>
  67 static char *sg_version_date = "20061027";
  68
  69 static int sg_proc_init(void);
  70 static void sg_proc_cleanup(void);
  71 #endif
  72
  73 #define SG_ALLOW_DIO_DEF 0
  74
  75 #define SG_MAX_DEVS 32768
  76
  77 /*
  78  * Suppose you want to calculate the formula muldiv(x,m,d)=int(x * m / d)
  79  * Then when using 32 bit integers x * m may overflow during the calculation.
  80  * Replacing muldiv(x) by muldiv(x)=((x % d) * m) / d + int(x / d) * m
  81  * calculates the same, but prevents the overflow when both m and d
  82  * are "small" numbers (like HZ and USER_HZ).
  83  * Of course an overflow is inavoidable if the result of muldiv doesn't fit
  84  * in 32 bits.
  85  */
  86 #define MULDIV(X,MUL,DIV) ((((X % DIV) * MUL) / DIV) + ((X / DIV) * MUL))
  87
  88 #define SG_DEFAULT_TIMEOUT MULDIV(SG_DEFAULT_TIMEOUT_USER, HZ, USER_HZ)
  89
  90 int sg_big_buff = SG_DEF_RESERVED_SIZE;
  91 /* N.B. This variable is readable and writeable via
  92    /proc/scsi/sg/def_reserved_size . Each time sg_open() is called a buffer
  93    of this size (or less if there is not enough memory) will be reserved
  94    for use by this file descriptor. [Deprecated usage: this variable is also
  95    readable via /proc/sys/kernel/sg-big-buff if the sg driver is built into
  96    the kernel (i.e. it is not a module).] */
  97 static int def_reserved_size = -1;      /* picks up init parameter */
  98 static int sg_allow_dio = SG_ALLOW_DIO_DEF;
  99
 100 static int scatter_elem_sz = SG_SCATTER_SZ;
 101 static int scatter_elem_sz_prev = SG_SCATTER_SZ;
 102
 103 #define SG_SECTOR_SZ 512
 104
 105 static int sg_add(struct device *, struct class_interface *);
 106 static void sg_remove(struct device *, struct class_interface *);
 107
 108 static DEFINE_SPINLOCK(sg_open_exclusive_lock);
 109
 110 static DEFINE_IDR(sg_index_idr);
 111 static DEFINE_RWLOCK(sg_index_lock);    /* Also used to lock
 112                                                            file descriptor list for device */
 113
 114 static struct class_interface sg_interface = {
 115         .add_dev        = sg_add,
 116         .remove_dev     = sg_remove,
 117 };
 118
 119 typedef struct sg_scatter_hold { /* holding area for scsi scatter gather info */
 120         unsigned short k_use_sg; /* Count of kernel scatter-gather pieces */
 121         unsigned sglist_len; /* size of malloc'd scatter-gather list ++ */
 122         unsigned bufflen;       /* Size of (aggregate) data buffer */
 123         struct page **pages;
 124         int page_order;
 125         char dio_in_use;        /* 0->indirect IO (or mmap), 1->dio */
 126         unsigned char cmd_opcode; /* first byte of command */
 127 } Sg_scatter_hold;
 128
 129 struct sg_device;               /* forward declarations */
 130 struct sg_fd;
 131
 132 typedef struct sg_request {     /* SG_MAX_QUEUE requests outstanding per file */
 133         struct sg_request *nextrp;      /* NULL -> tail request (slist) */
 134         struct sg_fd *parentfp; /* NULL -> not in use */
 135         Sg_scatter_hold data;   /* hold buffer, perhaps scatter list */
 136         sg_io_hdr_t header;     /* scsi command+info, see <scsi/sg.h> */
 137         unsigned char sense_b[SCSI_SENSE_BUFFERSIZE];
 138         char res_used;          /* 1 -> using reserve buffer, 0 -> not ... */
 139         char orphan;            /* 1 -> drop on sight, 0 -> normal */
 140         char sg_io_owned;       /* 1 -> packet belongs to SG_IO */
 141         /* done protected by rq_list_lock */
 142         char done;              /* 0->before bh, 1->before read, 2->read */
 143         struct request *rq;
 144         struct bio *bio;
 145         struct execute_work ew;
 146 } Sg_request;
 147
 148 typedef struct sg_fd {          /* holds the state of a file descriptor */
 149         /* sfd_siblings is protected by sg_index_lock */
 150         struct list_head sfd_siblings;
 151         struct sg_device *parentdp;     /* owning device */
 152         wait_queue_head_t read_wait;    /* queue read until command done */
 153         rwlock_t rq_list_lock;  /* protect access to list in req_arr */
 154         int timeout;            /* defaults to SG_DEFAULT_TIMEOUT      */
 155         int timeout_user;       /* defaults to SG_DEFAULT_TIMEOUT_USER */
 156         Sg_scatter_hold reserve;        /* buffer held for this file descriptor */
 157         unsigned save_scat_len; /* original length of trunc. scat. element */
 158         Sg_request *headrp;     /* head of request slist, NULL->empty */
 159         struct fasync_struct *async_qp; /* used by asynchronous notification */
 160         Sg_request req_arr[SG_MAX_QUEUE];       /* used as singly-linked list */
 161         char low_dma;           /* as in parent but possibly overridden to 1 */
 162         char force_packid;      /* 1 -> pack_id input to read(), 0 -> ignored */
 163         char cmd_q;             /* 1 -> allow command queuing, 0 -> don't */
 164         char next_cmd_len;      /* 0 -> automatic (def), >0 -> use on next write() */
 165         char keep_orphan;       /* 0 -> drop orphan (def), 1 -> keep for read() */
 166         char mmap_called;       /* 0 -> mmap() never called on this fd */
 167         struct kref f_ref;
 168         struct execute_work ew;
 169 } Sg_fd;
 170
 171 typedef struct sg_device { /* holds the state of each scsi generic device */
 172         struct scsi_device *device;
 173         int sg_tablesize;       /* adapter's max scatter-gather table size */
 174         u32 index;              /* device index number */
 175         /* sfds is protected by sg_index_lock */
 176         struct list_head sfds;
 177         struct rw_semaphore o_sem;      /* exclude open should hold this rwsem */
 178         volatile char detached; /* 0->attached, 1->detached pending removal */
 179         /* exclude protected by sg_open_exclusive_lock */
 180         char exclude;           /* opened for exclusive access */
 181         char sgdebug;           /* 0->off, 1->sense, 9->dump dev, 10-> all devs */
 182         struct gendisk *disk;
 183         struct cdev * cdev;     /* char_dev [sysfs: /sys/cdev/major/sg<n>] */
 184         struct kref d_ref;
 185 } Sg_device;
 186
 187 /* tasklet or soft irq callback */
 188 static void sg_rq_end_io(struct request *rq, int uptodate);
 189 static int sg_start_req(Sg_request *srp, unsigned char *cmd);
 190 static int sg_finish_rem_req(Sg_request * srp);
 191 static int sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size);
 192 static ssize_t sg_new_read(Sg_fd * sfp, char __user *buf, size_t count,
 193                            Sg_request * srp);
 194 static ssize_t sg_new_write(Sg_fd *sfp, struct file *file,
 195                         const char __user *buf, size_t count, int blocking,
 196                         int read_only, int sg_io_owned, Sg_request **o_srp);
 197 static int sg_common_write(Sg_fd * sfp, Sg_request * srp,
 198                            unsigned char *cmnd, int timeout, int blocking);
 199 static int sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer);
 200 static void sg_remove_scat(Sg_scatter_hold * schp);
 201 static void sg_build_reserve(Sg_fd * sfp, int req_size);
 202 static void sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size);
 203 static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp);
 204 static Sg_fd *sg_add_sfp(Sg_device * sdp, int dev);
 205 static void sg_remove_sfp(struct kref *);
 206 static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id);
 207 static Sg_request *sg_add_request(Sg_fd * sfp);
 208 static int sg_remove_request(Sg_fd * sfp, Sg_request * srp);
 209 static int sg_res_in_use(Sg_fd * sfp);
 210 static Sg_device *sg_get_dev(int dev);
 211 static void sg_put_dev(Sg_device *sdp);
 212
 213 #define SZ_SG_HEADER sizeof(struct sg_header)
 214 #define SZ_SG_IO_HDR sizeof(sg_io_hdr_t)
 215 #define SZ_SG_IOVEC sizeof(sg_iovec_t)
 216 #define SZ_SG_REQ_INFO sizeof(sg_req_info_t)
 217
 218 static int sg_allow_access(struct file *filp, unsigned char *cmd)
 219 {
 220         struct sg_fd *sfp = filp->private_data;
 221
 222         if (sfp->parentdp->device->type == TYPE_SCANNER)
 223                 return 0;
 224
 225         return blk_verify_command(cmd, filp->f_mode & FMODE_WRITE);
 226 }
 227
 228 static int get_exclude(Sg_device *sdp)
 229 {
 230         unsigned long flags;
 231         int ret;
 232
 233         spin_lock_irqsave(&sg_open_exclusive_lock, flags);
 234         ret = sdp->exclude;
 235         spin_unlock_irqrestore(&sg_open_exclusive_lock, flags);
 236         return ret;
 237 }
 238
 239 static int set_exclude(Sg_device *sdp, char val)
 240 {
 241         unsigned long flags;
 242
 243         spin_lock_irqsave(&sg_open_exclusive_lock, flags);
 244         sdp->exclude = val;
 245         spin_unlock_irqrestore(&sg_open_exclusive_lock, flags);
 246         return val;
 247 }
 248
 249 static int sfds_list_empty(Sg_device *sdp)
 250 {
 251         unsigned long flags;
 252         int ret;
 253
 254         read_lock_irqsave(&sg_index_lock, flags);
 255         ret = list_empty(&sdp->sfds);
 256         read_unlock_irqrestore(&sg_index_lock, flags);
 257         return ret;
 258 }
 259
 260 static int
 261 sg_open(struct inode *inode, struct file *filp)
 262 {
 263         int dev = iminor(inode);
 264         int flags = filp->f_flags;
 265         struct request_queue *q;
 266         Sg_device *sdp;
 267         Sg_fd *sfp;
 268         int retval;
 269
 270         nonseekable_open(inode, filp);
 271         SCSI_LOG_TIMEOUT(3, printk("sg_open: dev=%d, flags=0x%x\n", dev, flags));
 272         sdp = sg_get_dev(dev);
 273         if (IS_ERR(sdp)) {
 274                 retval = PTR_ERR(sdp);
 275                 sdp = NULL;
 276                 goto sg_put;
 277         }
 278
 279         /* This driver's module count bumped by fops_get in <linux/fs.h> */
 280         /* Prevent the device driver from vanishing while we sleep */
 281         retval = scsi_device_get(sdp->device);
 282         if (retval)
 283                 goto sg_put;
 284
 285         retval = scsi_autopm_get_device(sdp->device);
 286         if (retval)
 287                 goto sdp_put;
 288
 289         if (!((flags & O_NONBLOCK) ||
 290               scsi_block_when_processing_errors(sdp->device))) {
 291                 retval = -ENXIO;
 292                 /* we are in error recovery for this device */
 293                 goto error_out;
 294         }
 295
 296         if ((flags & O_EXCL) && (O_RDONLY == (flags & O_ACCMODE))) {
 297                 retval = -EPERM; /* Can't lock it with read only access */
 298                 goto error_out;
 299         }
 300         if (flags & O_NONBLOCK) {
 301                 if (flags & O_EXCL) {
 302                         if (!down_write_trylock(&sdp->o_sem)) {
 303                                 retval = -EBUSY;
 304                                 goto error_out;
 305                         }
 306                 } else {
 307                         if (!down_read_trylock(&sdp->o_sem)) {
 308                                 retval = -EBUSY;
 309                                 goto error_out;
 310                         }
 311                 }
 312         } else {
 313                 if (flags & O_EXCL)
 314                         down_write(&sdp->o_sem);
 315                 else
 316                         down_read(&sdp->o_sem);
 317         }
 318         /* Since write lock is held, no need to check sfd_list */
 319         if (flags & O_EXCL)
 320                 set_exclude(sdp, 1);
 321
 322         if (sdp->detached) {
 323                 retval = -ENODEV;
 324                 goto sem_out;
 325         }
 326         if (sfds_list_empty(sdp)) {     /* no existing opens on this device */
 327                 sdp->sgdebug = 0;
 328                 q = sdp->device->request_queue;
 329                 sdp->sg_tablesize = queue_max_segments(q);
 330         }
 331         if ((sfp = sg_add_sfp(sdp, dev)))
 332                 filp->private_data = sfp;
 333                 /* retval is already provably zero at this point because of the
 334                  * check after retval = scsi_autopm_get_device(sdp->device))
 335                  */
 336         else {
 337                 retval = -ENOMEM;
 338 sem_out:
 339                 if (flags & O_EXCL) {
 340                         set_exclude(sdp, 0);    /* undo if error */
 341                         up_write(&sdp->o_sem);
 342                 } else
 343                         up_read(&sdp->o_sem);
 344 error_out:
 345                 scsi_autopm_put_device(sdp->device);
 346 sdp_put:
 347                 scsi_device_put(sdp->device);
 348         }
 349 sg_put:
 350         if (sdp)
 351                 sg_put_dev(sdp);
 352         return retval;
 353 }
 354
 355 /* Following function was formerly called 'sg_close' */
 356 static int
 357 sg_release(struct inode *inode, struct file *filp)
 358 {
 359         Sg_device *sdp;
 360         Sg_fd *sfp;
 361         int excl;
 362
 363         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
 364                 return -ENXIO;
 365         SCSI_LOG_TIMEOUT(3, printk("sg_release: %s\n", sdp->disk->disk_name));
 366
 367         excl = get_exclude(sdp);
 368         set_exclude(sdp, 0);
 369         if (excl)
 370                 up_write(&sdp->o_sem);
 371         else
 372                 up_read(&sdp->o_sem);
 373
 374         scsi_autopm_put_device(sdp->device);
 375         kref_put(&sfp->f_ref, sg_remove_sfp);
 376         return 0;
 377 }
 378
 379 static ssize_t
 380 sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
 381 {
 382         Sg_device *sdp;
 383         Sg_fd *sfp;
 384         Sg_request *srp;
 385         int req_pack_id = -1;
 386         sg_io_hdr_t *hp;
 387         struct sg_header *old_hdr = NULL;
 388         int retval = 0;
 389
 390         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
 391                 return -ENXIO;
 392         SCSI_LOG_TIMEOUT(3, printk("sg_read: %s, count=%d\n",
 393                                    sdp->disk->disk_name, (int) count));
 394
 395         if (!access_ok(VERIFY_WRITE, buf, count))
 396                 return -EFAULT;
 397         if (sfp->force_packid && (count >= SZ_SG_HEADER)) {
 398                 old_hdr = kmalloc(SZ_SG_HEADER, GFP_KERNEL);
 399                 if (!old_hdr)
 400                         return -ENOMEM;
 401                 if (__copy_from_user(old_hdr, buf, SZ_SG_HEADER)) {
 402                         retval = -EFAULT;
 403                         goto free_old_hdr;
 404                 }
 405                 if (old_hdr->reply_len < 0) {
 406                         if (count >= SZ_SG_IO_HDR) {
 407                                 sg_io_hdr_t *new_hdr;
 408                                 new_hdr = kmalloc(SZ_SG_IO_HDR, GFP_KERNEL);
 409                                 if (!new_hdr) {
 410                                         retval = -ENOMEM;
 411                                         goto free_old_hdr;
 412                                 }
 413                                 retval =__copy_from_user
 414                                     (new_hdr, buf, SZ_SG_IO_HDR);
 415                                 req_pack_id = new_hdr->pack_id;
 416                                 kfree(new_hdr);
 417                                 if (retval) {
 418                                         retval = -EFAULT;
 419                                         goto free_old_hdr;
 420                                 }
 421                         }
 422                 } else
 423                         req_pack_id = old_hdr->pack_id;
 424         }
 425         srp = sg_get_rq_mark(sfp, req_pack_id);
 426         if (!srp) {             /* now wait on packet to arrive */
 427                 if (sdp->detached) {
 428                         retval = -ENODEV;
 429                         goto free_old_hdr;
 430                 }
 431                 if (filp->f_flags & O_NONBLOCK) {
 432                         retval = -EAGAIN;
 433                         goto free_old_hdr;
 434                 }
 435                 retval = wait_event_interruptible(sfp->read_wait,
 436                         (sdp->detached ||
 437                         (srp = sg_get_rq_mark(sfp, req_pack_id))));
 438                 if (sdp->detached) {
 439                         retval = -ENODEV;
 440                         goto free_old_hdr;
 441                 }
 442                 if (retval) {
 443                         /* -ERESTARTSYS as signal hit process */
 444                         goto free_old_hdr;
 445                 }
 446         }
 447         if (srp->header.interface_id != '\0') {
 448                 retval = sg_new_read(sfp, buf, count, srp);
 449                 goto free_old_hdr;
 450         }
 451
 452         hp = &srp->header;
 453         if (old_hdr == NULL) {
 454                 old_hdr = kmalloc(SZ_SG_HEADER, GFP_KERNEL);
 455                 if (! old_hdr) {
 456                         retval = -ENOMEM;
 457                         goto free_old_hdr;
 458                 }
 459         }
 460         memset(old_hdr, 0, SZ_SG_HEADER);
 461         old_hdr->reply_len = (int) hp->timeout;
 462         old_hdr->pack_len = old_hdr->reply_len; /* old, strange behaviour */
 463         old_hdr->pack_id = hp->pack_id;
 464         old_hdr->twelve_byte =
 465             ((srp->data.cmd_opcode >= 0xc0) && (12 == hp->cmd_len)) ? 1 : 0;
 466         old_hdr->target_status = hp->masked_status;
 467         old_hdr->host_status = hp->host_status;
 468         old_hdr->driver_status = hp->driver_status;
 469         if ((CHECK_CONDITION & hp->masked_status) ||
 470             (DRIVER_SENSE & hp->driver_status))
 471                 memcpy(old_hdr->sense_buffer, srp->sense_b,
 472                        sizeof (old_hdr->sense_buffer));
 473         switch (hp->host_status) {
 474         /* This setup of 'result' is for backward compatibility and is best
 475            ignored by the user who should use target, host + driver status */
 476         case DID_OK:
 477         case DID_PASSTHROUGH:
 478         case DID_SOFT_ERROR:
 479                 old_hdr->result = 0;
 480                 break;
 481         case DID_NO_CONNECT:
 482         case DID_BUS_BUSY:
 483         case DID_TIME_OUT:
 484                 old_hdr->result = EBUSY;
 485                 break;
 486         case DID_BAD_TARGET:
 487         case DID_ABORT:
 488         case DID_PARITY:
 489         case DID_RESET:
 490         case DID_BAD_INTR:
 491                 old_hdr->result = EIO;
 492                 break;
 493         case DID_ERROR:
 494                 old_hdr->result = (srp->sense_b[0] == 0 &&
 495                                   hp->masked_status == GOOD) ? 0 : EIO;
 496                 break;
 497         default:
 498                 old_hdr->result = EIO;
 499                 break;
 500         }
 501
 502         /* Now copy the result back to the user buffer.  */
 503         if (count >= SZ_SG_HEADER) {
 504                 if (__copy_to_user(buf, old_hdr, SZ_SG_HEADER)) {
 505                         retval = -EFAULT;
 506                         goto free_old_hdr;
 507                 }
 508                 buf += SZ_SG_HEADER;
 509                 if (count > old_hdr->reply_len)
 510                         count = old_hdr->reply_len;
 511                 if (count > SZ_SG_HEADER) {
 512                         if (sg_read_oxfer(srp, buf, count - SZ_SG_HEADER)) {
 513                                 retval = -EFAULT;
 514                                 goto free_old_hdr;
 515                         }
 516                 }
 517         } else
 518                 count = (old_hdr->result == 0) ? 0 : -EIO;
 519         sg_finish_rem_req(srp);
 520         retval = count;
 521 free_old_hdr:
 522         kfree(old_hdr);
 523         return retval;
 524 }
 525
 526 static ssize_t
 527 sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
 528 {
 529         sg_io_hdr_t *hp = &srp->header;
 530         int err = 0;
 531         int len;
 532
 533         if (count < SZ_SG_IO_HDR) {
 534                 err = -EINVAL;
 535                 goto err_out;
 536         }
 537         hp->sb_len_wr = 0;
 538         if ((hp->mx_sb_len > 0) && hp->sbp) {
 539                 if ((CHECK_CONDITION & hp->masked_status) ||
 540                     (DRIVER_SENSE & hp->driver_status)) {
 541                         int sb_len = SCSI_SENSE_BUFFERSIZE;
 542                         sb_len = (hp->mx_sb_len > sb_len) ? sb_len : hp->mx_sb_len;
 543                         len = 8 + (int) srp->sense_b[7];        /* Additional sense length field */
 544                         len = (len > sb_len) ? sb_len : len;
 545                         if (copy_to_user(hp->sbp, srp->sense_b, len)) {
 546                                 err = -EFAULT;
 547                                 goto err_out;
 548                         }
 549                         hp->sb_len_wr = len;
 550                 }
 551         }
 552         if (hp->masked_status || hp->host_status || hp->driver_status)
 553                 hp->info |= SG_INFO_CHECK;
 554         if (copy_to_user(buf, hp, SZ_SG_IO_HDR)) {
 555                 err = -EFAULT;
 556                 goto err_out;
 557         }
 558 err_out:
 559         err = sg_finish_rem_req(srp);
 560         return (0 == err) ? count : err;
 561 }
 562
 563 static ssize_t
 564 sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
 565 {
 566         int mxsize, cmd_size, k;
 567         int input_size, blocking;
 568         unsigned char opcode;
 569         Sg_device *sdp;
 570         Sg_fd *sfp;
 571         Sg_request *srp;
 572         struct sg_header old_hdr;
 573         sg_io_hdr_t *hp;
 574         unsigned char cmnd[MAX_COMMAND_SIZE];
 575
 576         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
 577                 return -ENXIO;
 578         SCSI_LOG_TIMEOUT(3, printk("sg_write: %s, count=%d\n",
 579                                    sdp->disk->disk_name, (int) count));
 580         if (sdp->detached)
 581                 return -ENODEV;
 582         if (!((filp->f_flags & O_NONBLOCK) ||
 583               scsi_block_when_processing_errors(sdp->device)))
 584                 return -ENXIO;
 585
 586         if (!access_ok(VERIFY_READ, buf, count))
 587                 return -EFAULT; /* protects following copy_from_user()s + get_user()s */
 588         if (count < SZ_SG_HEADER)
 589                 return -EIO;
 590         if (__copy_from_user(&old_hdr, buf, SZ_SG_HEADER))
 591                 return -EFAULT;
 592         blocking = !(filp->f_flags & O_NONBLOCK);
 593         if (old_hdr.reply_len < 0)
 594                 return sg_new_write(sfp, filp, buf, count,
 595                                     blocking, 0, 0, NULL);
 596         if (count < (SZ_SG_HEADER + 6))
 597                 return -EIO;    /* The minimum scsi command length is 6 bytes. */
 598
 599         if (!(srp = sg_add_request(sfp))) {
 600                 SCSI_LOG_TIMEOUT(1, printk("sg_write: queue full\n"));
 601                 return -EDOM;
 602         }
 603         buf += SZ_SG_HEADER;
 604         __get_user(opcode, buf);
 605         if (sfp->next_cmd_len > 0) {
 606                 if (sfp->next_cmd_len > MAX_COMMAND_SIZE) {
 607                         SCSI_LOG_TIMEOUT(1, printk("sg_write: command length too long\n"));
 608                         sfp->next_cmd_len = 0;
 609                         sg_remove_request(sfp, srp);
 610                         return -EIO;
 611                 }
 612                 cmd_size = sfp->next_cmd_len;
 613                 sfp->next_cmd_len = 0;  /* reset so only this write() effected */
 614         } else {
 615                 cmd_size = COMMAND_SIZE(opcode);        /* based on SCSI command group */
 616                 if ((opcode >= 0xc0) && old_hdr.twelve_byte)
 617                         cmd_size = 12;
 618         }
 619         SCSI_LOG_TIMEOUT(4, printk(
 620                 "sg_write:   scsi opcode=0x%02x, cmd_size=%d\n", (int) opcode, cmd_size));
 621 /* Determine buffer size.  */
 622         input_size = count - cmd_size;
 623         mxsize = (input_size > old_hdr.reply_len) ? input_size : old_hdr.reply_len;
 624         mxsize -= SZ_SG_HEADER;
 625         input_size -= SZ_SG_HEADER;
 626         if (input_size < 0) {
 627                 sg_remove_request(sfp, srp);
 628                 return -EIO;    /* User did not pass enough bytes for this command. */
 629         }
 630         hp = &srp->header;
 631         hp->interface_id = '\0';        /* indicator of old interface tunnelled */
 632         hp->cmd_len = (unsigned char) cmd_size;
 633         hp->iovec_count = 0;
 634         hp->mx_sb_len = 0;
 635         if (input_size > 0)
 636                 hp->dxfer_direction = (old_hdr.reply_len > SZ_SG_HEADER) ?
 637                     SG_DXFER_TO_FROM_DEV : SG_DXFER_TO_DEV;
 638         else
 639                 hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE;
 640         hp->dxfer_len = mxsize;
 641         if (hp->dxfer_direction == SG_DXFER_TO_DEV)
 642                 hp->dxferp = (char __user *)buf + cmd_size;
 643         else
 644                 hp->dxferp = NULL;
 645         hp->sbp = NULL;
 646         hp->timeout = old_hdr.reply_len;        /* structure abuse ... */
 647         hp->flags = input_size; /* structure abuse ... */
 648         hp->pack_id = old_hdr.pack_id;
 649         hp->usr_ptr = NULL;
 650         if (__copy_from_user(cmnd, buf, cmd_size))
 651                 return -EFAULT;
 652         /*
 653          * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV,
 654          * but is is possible that the app intended SG_DXFER_TO_DEV, because there
 655          * is a non-zero input_size, so emit a warning.
 656          */
 657         if (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV) {
 658                 static char cmd[TASK_COMM_LEN];
 659                 if (strcmp(current->comm, cmd)) {
 660                         printk_ratelimited(KERN_WARNING
 661                                            "sg_write: data in/out %d/%d bytes "
 662                                            "for SCSI command 0x%x-- guessing "
 663                                            "data in;\n   program %s not setting "
 664                                            "count and/or reply_len properly\n",
 665                                            old_hdr.reply_len - (int)SZ_SG_HEADER,
 666                                            input_size, (unsigned int) cmnd[0],
 667                                            current->comm);
 668                         strcpy(cmd, current->comm);
 669                 }
 670         }
 671         k = sg_common_write(sfp, srp, cmnd, sfp->timeout, blocking);
 672         return (k < 0) ? k : count;
 673 }
 674
 675 static ssize_t
 676 sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
 677                  size_t count, int blocking, int read_only, int sg_io_owned,
 678                  Sg_request **o_srp)
 679 {
 680         int k;
 681         Sg_request *srp;
 682         sg_io_hdr_t *hp;
 683         unsigned char cmnd[MAX_COMMAND_SIZE];
 684         int timeout;
 685         unsigned long ul_timeout;
 686
 687         if (count < SZ_SG_IO_HDR)
 688                 return -EINVAL;
 689         if (!access_ok(VERIFY_READ, buf, count))
 690                 return -EFAULT; /* protects following copy_from_user()s + get_user()s */
 691
 692         sfp->cmd_q = 1; /* when sg_io_hdr seen, set command queuing on */
 693         if (!(srp = sg_add_request(sfp))) {
 694                 SCSI_LOG_TIMEOUT(1, printk("sg_new_write: queue full\n"));
 695                 return -EDOM;
 696         }
 697         srp->sg_io_owned = sg_io_owned;
 698         hp = &srp->header;
 699         if (__copy_from_user(hp, buf, SZ_SG_IO_HDR)) {
 700                 sg_remove_request(sfp, srp);
 701                 return -EFAULT;
 702         }
 703         if (hp->interface_id != 'S') {
 704                 sg_remove_request(sfp, srp);
 705                 return -ENOSYS;
 706         }
 707         if (hp->flags & SG_FLAG_MMAP_IO) {
 708                 if (hp->dxfer_len > sfp->reserve.bufflen) {
 709                         sg_remove_request(sfp, srp);
 710                         return -ENOMEM; /* MMAP_IO size must fit in reserve buffer */
 711                 }
 712                 if (hp->flags & SG_FLAG_DIRECT_IO) {
 713                         sg_remove_request(sfp, srp);
 714                         return -EINVAL; /* either MMAP_IO or DIRECT_IO (not both) */
 715                 }
 716                 if (sg_res_in_use(sfp)) {
 717                         sg_remove_request(sfp, srp);
 718                         return -EBUSY;  /* reserve buffer already being used */
 719                 }
 720         }
 721         ul_timeout = msecs_to_jiffies(srp->header.timeout);
 722         timeout = (ul_timeout < INT_MAX) ? ul_timeout : INT_MAX;
 723         if ((!hp->cmdp) || (hp->cmd_len < 6) || (hp->cmd_len > sizeof (cmnd))) {
 724                 sg_remove_request(sfp, srp);
 725                 return -EMSGSIZE;
 726         }
 727         if (!access_ok(VERIFY_READ, hp->cmdp, hp->cmd_len)) {
 728                 sg_remove_request(sfp, srp);
 729                 return -EFAULT; /* protects following copy_from_user()s + get_user()s */
 730         }
 731         if (__copy_from_user(cmnd, hp->cmdp, hp->cmd_len)) {
 732                 sg_remove_request(sfp, srp);
 733                 return -EFAULT;
 734         }
 735         if (read_only && sg_allow_access(file, cmnd)) {
 736                 sg_remove_request(sfp, srp);
 737                 return -EPERM;
 738         }
 739         k = sg_common_write(sfp, srp, cmnd, timeout, blocking);
 740         if (k < 0)
 741                 return k;
 742         if (o_srp)
 743                 *o_srp = srp;
 744         return count;
 745 }
 746
 747 static int
 748 sg_common_write(Sg_fd * sfp, Sg_request * srp,
 749                 unsigned char *cmnd, int timeout, int blocking)
 750 {
 751         int k, data_dir;
 752         Sg_device *sdp = sfp->parentdp;
 753         sg_io_hdr_t *hp = &srp->header;
 754
 755         srp->data.cmd_opcode = cmnd[0]; /* hold opcode of command */
 756         hp->status = 0;
 757         hp->masked_status = 0;
 758         hp->msg_status = 0;
 759         hp->info = 0;
 760         hp->host_status = 0;
 761         hp->driver_status = 0;
 762         hp->resid = 0;
 763         SCSI_LOG_TIMEOUT(4, printk("sg_common_write:  scsi opcode=0x%02x, cmd_size=%d\n",
 764                           (int) cmnd[0], (int) hp->cmd_len));
 765
 766         k = sg_start_req(srp, cmnd);
 767         if (k) {
 768                 SCSI_LOG_TIMEOUT(1, printk("sg_common_write: start_req err=%d\n", k));
 769                 sg_finish_rem_req(srp);
 770                 return k;       /* probably out of space --> ENOMEM */
 771         }
 772         if (sdp->detached) {
 773                 if (srp->bio)
 774                         blk_end_request_all(srp->rq, -EIO);
 775                 sg_finish_rem_req(srp);
 776                 return -ENODEV;
 777         }
 778
 779         switch (hp->dxfer_direction) {
 780         case SG_DXFER_TO_FROM_DEV:
 781         case SG_DXFER_FROM_DEV:
 782                 data_dir = DMA_FROM_DEVICE;
 783                 break;
 784         case SG_DXFER_TO_DEV:
 785                 data_dir = DMA_TO_DEVICE;
 786                 break;
 787         case SG_DXFER_UNKNOWN:
 788                 data_dir = DMA_BIDIRECTIONAL;
 789                 break;
 790         default:
 791                 data_dir = DMA_NONE;
 792                 break;
 793         }
 794         hp->duration = jiffies_to_msecs(jiffies);
 795
 796         srp->rq->timeout = timeout;
 797         kref_get(&sfp->f_ref); /* sg_rq_end_io() does kref_put(). */
 798         blk_execute_rq_nowait(sdp->device->request_queue, sdp->disk,
 799                               srp->rq, 1, sg_rq_end_io);
 800         return 0;
 801 }
 802
 803 static int srp_done(Sg_fd *sfp, Sg_request *srp)
 804 {
 805         unsigned long flags;
 806         int ret;
 807
 808         read_lock_irqsave(&sfp->rq_list_lock, flags);
 809         ret = srp->done;
 810         read_unlock_irqrestore(&sfp->rq_list_lock, flags);
 811         return ret;
 812 }
 813
 814 static long
 815 sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
 816 {
 817         void __user *p = (void __user *)arg;
 818         int __user *ip = p;
 819         int result, val, read_only;
 820         Sg_device *sdp;
 821         Sg_fd *sfp;
 822         Sg_request *srp;
 823         unsigned long iflags;
 824
 825         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
 826                 return -ENXIO;
 827
 828         SCSI_LOG_TIMEOUT(3, printk("sg_ioctl: %s, cmd=0x%x\n",
 829                                    sdp->disk->disk_name, (int) cmd_in));
 830         read_only = (O_RDWR != (filp->f_flags & O_ACCMODE));
 831
 832         switch (cmd_in) {
 833         case SG_IO:
 834                 if (sdp->detached)
 835                         return -ENODEV;
 836                 if (!scsi_block_when_processing_errors(sdp->device))
 837                         return -ENXIO;
 838                 if (!access_ok(VERIFY_WRITE, p, SZ_SG_IO_HDR))
 839                         return -EFAULT;
 840                 result = sg_new_write(sfp, filp, p, SZ_SG_IO_HDR,
 841                                  1, read_only, 1, &srp);
 842                 if (result < 0)
 843                         return result;
 844                 result = wait_event_interruptible(sfp->read_wait,
 845                         (srp_done(sfp, srp) || sdp->detached));
 846                 if (sdp->detached)
 847                         return -ENODEV;
 848                 write_lock_irq(&sfp->rq_list_lock);
 849                 if (srp->done) {
 850                         srp->done = 2;
 851                         write_unlock_irq(&sfp->rq_list_lock);
 852                         result = sg_new_read(sfp, p, SZ_SG_IO_HDR, srp);
 853                         return (result < 0) ? result : 0;
 854                 }
 855                 srp->orphan = 1;
 856                 write_unlock_irq(&sfp->rq_list_lock);
 857                 return result;  /* -ERESTARTSYS because signal hit process */
 858         case SG_SET_TIMEOUT:
 859                 result = get_user(val, ip);
 860                 if (result)
 861                         return result;
 862                 if (val < 0)
 863                         return -EIO;
 864                 if (val >= MULDIV (INT_MAX, USER_HZ, HZ))
 865                     val = MULDIV (INT_MAX, USER_HZ, HZ);
 866                 sfp->timeout_user = val;
 867                 sfp->timeout = MULDIV (val, HZ, USER_HZ);
 868
 869                 return 0;
 870         case SG_GET_TIMEOUT:    /* N.B. User receives timeout as return value */
 871                                 /* strange ..., for backward compatibility */
 872                 return sfp->timeout_user;
 873         case SG_SET_FORCE_LOW_DMA:
 874                 result = get_user(val, ip);
 875                 if (result)
 876                         return result;
 877                 if (val) {
 878                         sfp->low_dma = 1;
 879                         if ((0 == sfp->low_dma) && (0 == sg_res_in_use(sfp))) {
 880                                 val = (int) sfp->reserve.bufflen;
 881                                 sg_remove_scat(&sfp->reserve);
 882                                 sg_build_reserve(sfp, val);
 883                         }
 884                 } else {
 885                         if (sdp->detached)
 886                                 return -ENODEV;
 887                         sfp->low_dma = sdp->device->host->unchecked_isa_dma;
 888                 }
 889                 return 0;
 890         case SG_GET_LOW_DMA:
 891                 return put_user((int) sfp->low_dma, ip);
 892         case SG_GET_SCSI_ID:
 893                 if (!access_ok(VERIFY_WRITE, p, sizeof (sg_scsi_id_t)))
 894                         return -EFAULT;
 895                 else {
 896                         sg_scsi_id_t __user *sg_idp = p;
 897
 898                         if (sdp->detached)
 899                                 return -ENODEV;
 900                         __put_user((int) sdp->device->host->host_no,
 901                                    &sg_idp->host_no);
 902                         __put_user((int) sdp->device->channel,
 903                                    &sg_idp->channel);
 904                         __put_user((int) sdp->device->id, &sg_idp->scsi_id);
 905                         __put_user((int) sdp->device->lun, &sg_idp->lun);
 906                         __put_user((int) sdp->device->type, &sg_idp->scsi_type);
 907                         __put_user((short) sdp->device->host->cmd_per_lun,
 908                                    &sg_idp->h_cmd_per_lun);
 909                         __put_user((short) sdp->device->queue_depth,
 910                                    &sg_idp->d_queue_depth);
 911                         __put_user(0, &sg_idp->unused[0]);
 912                         __put_user(0, &sg_idp->unused[1]);
 913                         return 0;
 914                 }
 915         case SG_SET_FORCE_PACK_ID:
 916                 result = get_user(val, ip);
 917                 if (result)
 918                         return result;
 919                 sfp->force_packid = val ? 1 : 0;
 920                 return 0;
 921         case SG_GET_PACK_ID:
 922                 if (!access_ok(VERIFY_WRITE, ip, sizeof (int)))
 923                         return -EFAULT;
 924                 read_lock_irqsave(&sfp->rq_list_lock, iflags);
 925                 for (srp = sfp->headrp; srp; srp = srp->nextrp) {
 926                         if ((1 == srp->done) && (!srp->sg_io_owned)) {
 927                                 read_unlock_irqrestore(&sfp->rq_list_lock,
 928                                                        iflags);
 929                                 __put_user(srp->header.pack_id, ip);
 930                                 return 0;
 931                         }
 932                 }
 933                 read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
 934                 __put_user(-1, ip);
 935                 return 0;
 936         case SG_GET_NUM_WAITING:
 937                 read_lock_irqsave(&sfp->rq_list_lock, iflags);
 938                 for (val = 0, srp = sfp->headrp; srp; srp = srp->nextrp) {
 939                         if ((1 == srp->done) && (!srp->sg_io_owned))
 940                                 ++val;
 941                 }
 942                 read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
 943                 return put_user(val, ip);
 944         case SG_GET_SG_TABLESIZE:
 945                 return put_user(sdp->sg_tablesize, ip);
 946         case SG_SET_RESERVED_SIZE:
 947                 result = get_user(val, ip);
 948                 if (result)
 949                         return result;
 950                 if (val < 0)
 951                         return -EINVAL;
 952                 val = min_t(int, val,
 953                             queue_max_sectors(sdp->device->request_queue) * 512);
 954                 if (val != sfp->reserve.bufflen) {
 955                         if (sg_res_in_use(sfp) || sfp->mmap_called)
 956                                 return -EBUSY;
 957                         sg_remove_scat(&sfp->reserve);
 958                         sg_build_reserve(sfp, val);
 959                 }
 960                 return 0;
 961         case SG_GET_RESERVED_SIZE:
 962                 val = min_t(int, sfp->reserve.bufflen,
 963                             queue_max_sectors(sdp->device->request_queue) * 512);
 964                 return put_user(val, ip);
 965         case SG_SET_COMMAND_Q:
 966                 result = get_user(val, ip);
 967                 if (result)
 968                         return result;
 969                 sfp->cmd_q = val ? 1 : 0;
 970                 return 0;
 971         case SG_GET_COMMAND_Q:
 972                 return put_user((int) sfp->cmd_q, ip);
 973         case SG_SET_KEEP_ORPHAN:
 974                 result = get_user(val, ip);
 975                 if (result)
 976                         return result;
 977                 sfp->keep_orphan = val;
 978                 return 0;
 979         case SG_GET_KEEP_ORPHAN:
 980                 return put_user((int) sfp->keep_orphan, ip);
 981         case SG_NEXT_CMD_LEN:
 982                 result = get_user(val, ip);
 983                 if (result)
 984                         return result;
 985                 sfp->next_cmd_len = (val > 0) ? val : 0;
 986                 return 0;
 987         case SG_GET_VERSION_NUM:
 988                 return put_user(sg_version_num, ip);
 989         case SG_GET_ACCESS_COUNT:
 990                 /* faked - we don't have a real access count anymore */
 991                 val = (sdp->device ? 1 : 0);
 992                 return put_user(val, ip);
 993         case SG_GET_REQUEST_TABLE:
 994                 if (!access_ok(VERIFY_WRITE, p, SZ_SG_REQ_INFO * SG_MAX_QUEUE))
 995                         return -EFAULT;
 996                 else {
 997                         sg_req_info_t *rinfo;
 998                         unsigned int ms;
 999
1000                         rinfo = kmalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
1001                                                                 GFP_KERNEL);
1002                         if (!rinfo)
1003                                 return -ENOMEM;
1004                         read_lock_irqsave(&sfp->rq_list_lock, iflags);
1005                         for (srp = sfp->headrp, val = 0; val < SG_MAX_QUEUE;
1006                              ++val, srp = srp ? srp->nextrp : srp) {
1007                                 memset(&rinfo[val], 0, SZ_SG_REQ_INFO);
1008                                 if (srp) {
1009                                         rinfo[val].req_state = srp->done + 1;
1010                                         rinfo[val].problem =
1011                                             srp->header.masked_status &
1012                                             srp->header.host_status &
1013                                             srp->header.driver_status;
1014                                         if (srp->done)
1015                                                 rinfo[val].duration =
1016                                                         srp->header.duration;
1017                                         else {
1018                                                 ms = jiffies_to_msecs(jiffies);
1019                                                 rinfo[val].duration =
1020                                                     (ms > srp->header.duration) ?
1021                                                     (ms - srp->header.duration) : 0;
1022                                         }
1023                                         rinfo[val].orphan = srp->orphan;
1024                                         rinfo[val].sg_io_owned =
1025                                                         srp->sg_io_owned;
1026                                         rinfo[val].pack_id =
1027                                                         srp->header.pack_id;
1028                                         rinfo[val].usr_ptr =
1029                                                         srp->header.usr_ptr;
1030                                 }
1031                         }
1032                         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
1033                         result = __copy_to_user(p, rinfo,
1034                                                 SZ_SG_REQ_INFO * SG_MAX_QUEUE);
1035                         result = result ? -EFAULT : 0;
1036                         kfree(rinfo);
1037                         return result;
1038                 }
1039         case SG_EMULATED_HOST:
1040                 if (sdp->detached)
1041                         return -ENODEV;
1042                 return put_user(sdp->device->host->hostt->emulated, ip);
1043         case SG_SCSI_RESET:
1044                 if (sdp->detached)
1045                         return -ENODEV;
1046                 if (filp->f_flags & O_NONBLOCK) {
1047                         if (scsi_host_in_recovery(sdp->device->host))
1048                                 return -EBUSY;
1049                 } else if (!scsi_block_when_processing_errors(sdp->device))
1050                         return -EBUSY;
1051                 result = get_user(val, ip);
1052                 if (result)
1053                         return result;
1054                 if (SG_SCSI_RESET_NOTHING == val)
1055                         return 0;
1056                 switch (val) {
1057                 case SG_SCSI_RESET_DEVICE:
1058                         val = SCSI_TRY_RESET_DEVICE;
1059                         break;
1060                 case SG_SCSI_RESET_TARGET:
1061                         val = SCSI_TRY_RESET_TARGET;
1062                         break;
1063                 case SG_SCSI_RESET_BUS:
1064                         val = SCSI_TRY_RESET_BUS;
1065                         break;
1066                 case SG_SCSI_RESET_HOST:
1067                         val = SCSI_TRY_RESET_HOST;
1068                         break;
1069                 default:
1070                         return -EINVAL;
1071                 }
1072                 if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
1073                         return -EACCES;
1074                 return (scsi_reset_provider(sdp->device, val) ==
1075                         SUCCESS) ? 0 : -EIO;
1076         case SCSI_IOCTL_SEND_COMMAND:
1077                 if (sdp->detached)
1078                         return -ENODEV;
1079                 if (read_only) {
1080                         unsigned char opcode = WRITE_6;
1081                         Scsi_Ioctl_Command __user *siocp = p;
1082
1083                         if (copy_from_user(&opcode, siocp->data, 1))
1084                                 return -EFAULT;
1085                         if (sg_allow_access(filp, &opcode))
1086                                 return -EPERM;
1087                 }
1088                 return sg_scsi_ioctl(sdp->device->request_queue, NULL, filp->f_mode, p);
1089         case SG_SET_DEBUG:
1090                 result = get_user(val, ip);
1091                 if (result)
1092                         return result;
1093                 sdp->sgdebug = (char) val;
1094                 return 0;
1095         case SCSI_IOCTL_GET_IDLUN:
1096         case SCSI_IOCTL_GET_BUS_NUMBER:
1097         case SCSI_IOCTL_PROBE_HOST:
1098         case SG_GET_TRANSFORM:
1099                 if (sdp->detached)
1100                         return -ENODEV;
1101                 return scsi_ioctl(sdp->device, cmd_in, p);
1102         case BLKSECTGET:
1103                 return put_user(queue_max_sectors(sdp->device->request_queue) * 512,
1104                                 ip);
1105         case BLKTRACESETUP:
1106                 return blk_trace_setup(sdp->device->request_queue,
1107                                        sdp->disk->disk_name,
1108                                        MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
1109                                        NULL,
1110                                        (char *)arg);
1111         case BLKTRACESTART:
1112                 return blk_trace_startstop(sdp->device->request_queue, 1);
1113         case BLKTRACESTOP:
1114                 return blk_trace_startstop(sdp->device->request_queue, 0);
1115         case BLKTRACETEARDOWN:
1116                 return blk_trace_remove(sdp->device->request_queue);
1117         default:
1118                 if (read_only)
1119                         return -EPERM;  /* don't know so take safe approach */
1120                 return scsi_ioctl(sdp->device, cmd_in, p);
1121         }
1122 }
1123
1124 #ifdef CONFIG_COMPAT
1125 static long sg_compat_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
1126 {
1127         Sg_device *sdp;
1128         Sg_fd *sfp;
1129         struct scsi_device *sdev;
1130
1131         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
1132                 return -ENXIO;
1133
1134         sdev = sdp->device;
1135         if (sdev->host->hostt->compat_ioctl) {
1136                 int ret;
1137
1138                 ret = sdev->host->hostt->compat_ioctl(sdev, cmd_in, (void __user *)arg);
1139
1140                 return ret;
1141         }
1142
1143         return -ENOIOCTLCMD;
1144 }
1145 #endif
1146
1147 static unsigned int
1148 sg_poll(struct file *filp, poll_table * wait)
1149 {
1150         unsigned int res = 0;
1151         Sg_device *sdp;
1152         Sg_fd *sfp;
1153         Sg_request *srp;
1154         int count = 0;
1155         unsigned long iflags;
1156
1157         sfp = filp->private_data;
1158         if (!sfp)
1159                 return POLLERR;
1160         sdp = sfp->parentdp;
1161         if (!sdp)
1162                 return POLLERR;
1163         poll_wait(filp, &sfp->read_wait, wait);
1164         read_lock_irqsave(&sfp->rq_list_lock, iflags);
1165         for (srp = sfp->headrp; srp; srp = srp->nextrp) {
1166                 /* if any read waiting, flag it */
1167                 if ((0 == res) && (1 == srp->done) && (!srp->sg_io_owned))
1168                         res = POLLIN | POLLRDNORM;
1169                 ++count;
1170         }
1171         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
1172
1173         if (sdp->detached)
1174                 res |= POLLHUP;
1175         else if (!sfp->cmd_q) {
1176                 if (0 == count)
1177                         res |= POLLOUT | POLLWRNORM;
1178         } else if (count < SG_MAX_QUEUE)
1179                 res |= POLLOUT | POLLWRNORM;
1180         SCSI_LOG_TIMEOUT(3, printk("sg_poll: %s, res=0x%x\n",
1181                                    sdp->disk->disk_name, (int) res));
1182         return res;
1183 }
1184
1185 static int
1186 sg_fasync(int fd, struct file *filp, int mode)
1187 {
1188         Sg_device *sdp;
1189         Sg_fd *sfp;
1190
1191         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
1192                 return -ENXIO;
1193         SCSI_LOG_TIMEOUT(3, printk("sg_fasync: %s, mode=%d\n",
1194                                    sdp->disk->disk_name, mode));
1195
1196         return fasync_helper(fd, filp, mode, &sfp->async_qp);
1197 }
1198
1199 static int
1200 sg_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
1201 {
1202         Sg_fd *sfp;
1203         unsigned long offset, len, sa;
1204         Sg_scatter_hold *rsv_schp;
1205         int k, length;
1206
1207         if ((NULL == vma) || (!(sfp = (Sg_fd *) vma->vm_private_data)))
1208                 return VM_FAULT_SIGBUS;
1209         rsv_schp = &sfp->reserve;
1210         offset = vmf->pgoff << PAGE_SHIFT;
1211         if (offset >= rsv_schp->bufflen)
1212                 return VM_FAULT_SIGBUS;
1213         SCSI_LOG_TIMEOUT(3, printk("sg_vma_fault: offset=%lu, scatg=%d\n",
1214                                    offset, rsv_schp->k_use_sg));
1215         sa = vma->vm_start;
1216         length = 1 << (PAGE_SHIFT + rsv_schp->page_order);
1217         for (k = 0; k < rsv_schp->k_use_sg && sa < vma->vm_end; k++) {
1218                 len = vma->vm_end - sa;
1219                 len = (len < length) ? len : length;
1220                 if (offset < len) {
1221                         struct page *page = nth_page(rsv_schp->pages[k],
1222                                                      offset >> PAGE_SHIFT);
1223                         get_page(page); /* increment page count */
1224                         vmf->page = page;
1225                         return 0; /* success */
1226                 }
1227                 sa += len;
1228                 offset -= len;
1229         }
1230
1231         return VM_FAULT_SIGBUS;
1232 }
1233
1234 static const struct vm_operations_struct sg_mmap_vm_ops = {
1235         .fault = sg_vma_fault,
1236 };
1237
1238 static int
1239 sg_mmap(struct file *filp, struct vm_area_struct *vma)
1240 {
1241         Sg_fd *sfp;
1242         unsigned long req_sz, len, sa;
1243         Sg_scatter_hold *rsv_schp;
1244         int k, length;
1245
1246         if ((!filp) || (!vma) || (!(sfp = (Sg_fd *) filp->private_data)))
1247                 return -ENXIO;
1248         req_sz = vma->vm_end - vma->vm_start;
1249         SCSI_LOG_TIMEOUT(3, printk("sg_mmap starting, vm_start=%p, len=%d\n",
1250                                    (void *) vma->vm_start, (int) req_sz));
1251         if (vma->vm_pgoff)
1252                 return -EINVAL; /* want no offset */
1253         rsv_schp = &sfp->reserve;
1254         if (req_sz > rsv_schp->bufflen)
1255                 return -ENOMEM; /* cannot map more than reserved buffer */
1256
1257         sa = vma->vm_start;
1258         length = 1 << (PAGE_SHIFT + rsv_schp->page_order);
1259         for (k = 0; k < rsv_schp->k_use_sg && sa < vma->vm_end; k++) {
1260                 len = vma->vm_end - sa;
1261                 len = (len < length) ? len : length;
1262                 sa += len;
1263         }
1264
1265         sfp->mmap_called = 1;
1266         vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
1267         vma->vm_private_data = sfp;
1268         vma->vm_ops = &sg_mmap_vm_ops;
1269         return 0;
1270 }
1271
1272 static void sg_rq_end_io_usercontext(struct work_struct *work)
1273 {
1274         struct sg_request *srp = container_of(work, struct sg_request, ew.work);
1275         struct sg_fd *sfp = srp->parentfp;
1276
1277         sg_finish_rem_req(srp);
1278         kref_put(&sfp->f_ref, sg_remove_sfp);
1279 }
1280
1281 /*
1282  * This function is a "bottom half" handler that is called by the mid
1283  * level when a command is completed (or has failed).
1284  */
1285 static void sg_rq_end_io(struct request *rq, int uptodate)
1286 {
1287         struct sg_request *srp = rq->end_io_data;
1288         Sg_device *sdp;
1289         Sg_fd *sfp;
1290         unsigned long iflags;
1291         unsigned int ms;
1292         char *sense;
1293         int result, resid, done = 1;
1294
1295         if (WARN_ON(srp->done != 0))
1296                 return;
1297
1298         sfp = srp->parentfp;
1299         if (WARN_ON(sfp == NULL))
1300                 return;
1301
1302         sdp = sfp->parentdp;
1303         if (unlikely(sdp->detached))
1304                 printk(KERN_INFO "sg_rq_end_io: device detached\n");
1305
1306         sense = rq->sense;
1307         result = rq->errors;
1308         resid = rq->resid_len;
1309
1310         SCSI_LOG_TIMEOUT(4, printk("sg_cmd_done: %s, pack_id=%d, res=0x%x\n",
1311                 sdp->disk->disk_name, srp->header.pack_id, result));
1312         srp->header.resid = resid;
1313         ms = jiffies_to_msecs(jiffies);
1314         srp->header.duration = (ms > srp->header.duration) ?
1315                                 (ms - srp->header.duration) : 0;
1316         if (0 != result) {
1317                 struct scsi_sense_hdr sshdr;
1318
1319                 srp->header.status = 0xff & result;
1320                 srp->header.masked_status = status_byte(result);
1321                 srp->header.msg_status = msg_byte(result);
1322                 srp->header.host_status = host_byte(result);
1323                 srp->header.driver_status = driver_byte(result);
1324                 if ((sdp->sgdebug > 0) &&
1325                     ((CHECK_CONDITION == srp->header.masked_status) ||
1326                      (COMMAND_TERMINATED == srp->header.masked_status)))
1327                         __scsi_print_sense("sg_cmd_done", sense,
1328                                            SCSI_SENSE_BUFFERSIZE);
1329
1330                 /* Following if statement is a patch supplied by Eric Youngdale */
1331                 if (driver_byte(result) != 0
1332                     && scsi_normalize_sense(sense, SCSI_SENSE_BUFFERSIZE, &sshdr)
1333                     && !scsi_sense_is_deferred(&sshdr)
1334                     && sshdr.sense_key == UNIT_ATTENTION
1335                     && sdp->device->removable) {
1336                         /* Detected possible disc change. Set the bit - this */
1337                         /* may be used if there are filesystems using this device */
1338                         sdp->device->changed = 1;
1339                 }
1340         }
1341         /* Rely on write phase to clean out srp status values, so no "else" */
1342
1343         write_lock_irqsave(&sfp->rq_list_lock, iflags);
1344         if (unlikely(srp->orphan)) {
1345                 if (sfp->keep_orphan)
1346                         srp->sg_io_owned = 0;
1347                 else
1348                         done = 0;
1349         }
1350         srp->done = done;
1351         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
1352
1353         if (likely(done)) {
1354                 /* Now wake up any sg_read() that is waiting for this
1355                  * packet.
1356                  */
1357                 wake_up_interruptible(&sfp->read_wait);
1358                 kill_fasync(&sfp->async_qp, SIGPOLL, POLL_IN);
1359                 kref_put(&sfp->f_ref, sg_remove_sfp);
1360         } else {
1361                 INIT_WORK(&srp->ew.work, sg_rq_end_io_usercontext);
1362                 schedule_work(&srp->ew.work);
1363         }
1364 }
1365
1366 static const struct file_operations sg_fops = {
1367         .owner = THIS_MODULE,
1368         .read = sg_read,
1369         .write = sg_write,
1370         .poll = sg_poll,
1371         .unlocked_ioctl = sg_ioctl,
1372 #ifdef CONFIG_COMPAT
1373         .compat_ioctl = sg_compat_ioctl,
1374 #endif
1375         .open = sg_open,
1376         .mmap = sg_mmap,
1377         .release = sg_release,
1378         .fasync = sg_fasync,
1379         .llseek = no_llseek,
1380 };
1381
1382 static struct class *sg_sysfs_class;
1383
1384 static int sg_sysfs_valid = 0;
1385
1386 static Sg_device *sg_alloc(struct gendisk *disk, struct scsi_device *scsidp)
1387 {
1388         struct request_queue *q = scsidp->request_queue;
1389         Sg_device *sdp;
1390         unsigned long iflags;
1391         int error;
1392         u32 k;
1393
1394         sdp = kzalloc(sizeof(Sg_device), GFP_KERNEL);
1395         if (!sdp) {
1396                 printk(KERN_WARNING "kmalloc Sg_device failure\n");
1397                 return ERR_PTR(-ENOMEM);
1398         }
1399
1400         idr_preload(GFP_KERNEL);
1401         write_lock_irqsave(&sg_index_lock, iflags);
1402
1403         error = idr_alloc(&sg_index_idr, sdp, 0, SG_MAX_DEVS, GFP_NOWAIT);
1404         if (error < 0) {
1405                 if (error == -ENOSPC) {
1406                         sdev_printk(KERN_WARNING, scsidp,
1407                                     "Unable to attach sg device type=%d, minor number exceeds %d\n",
1408                                     scsidp->type, SG_MAX_DEVS - 1);
1409                         error = -ENODEV;
1410                 } else {
1411                         printk(KERN_WARNING
1412                                "idr allocation Sg_device failure: %d\n", error);
1413                 }
1414                 goto out_unlock;
1415         }
1416         k = error;
1417
1418         SCSI_LOG_TIMEOUT(3, printk("sg_alloc: dev=%d \n", k));
1419         sprintf(disk->disk_name, "sg%d", k);
1420         disk->first_minor = k;
1421         sdp->disk = disk;
1422         sdp->device = scsidp;
1423         INIT_LIST_HEAD(&sdp->sfds);
1424         init_rwsem(&sdp->o_sem);
1425         sdp->sg_tablesize = queue_max_segments(q);
1426         sdp->index = k;
1427         kref_init(&sdp->d_ref);
1428         error = 0;
1429
1430 out_unlock:
1431         write_unlock_irqrestore(&sg_index_lock, iflags);
1432         idr_preload_end();
1433
1434         if (error) {
1435                 kfree(sdp);
1436                 return ERR_PTR(error);
1437         }
1438         return sdp;
1439 }
1440
1441 static int
1442 sg_add(struct device *cl_dev, struct class_interface *cl_intf)
1443 {
1444         struct scsi_device *scsidp = to_scsi_device(cl_dev->parent);
1445         struct gendisk *disk;
1446         Sg_device *sdp = NULL;
1447         struct cdev * cdev = NULL;
1448         int error;
1449         unsigned long iflags;
1450
1451         disk = alloc_disk(1);
1452         if (!disk) {
1453                 printk(KERN_WARNING "alloc_disk failed\n");
1454                 return -ENOMEM;
1455         }
1456         disk->major = SCSI_GENERIC_MAJOR;
1457
1458         error = -ENOMEM;
1459         cdev = cdev_alloc();
1460         if (!cdev) {
1461                 printk(KERN_WARNING "cdev_alloc failed\n");
1462                 goto out;
1463         }
1464         cdev->owner = THIS_MODULE;
1465         cdev->ops = &sg_fops;
1466
1467         sdp = sg_alloc(disk, scsidp);
1468         if (IS_ERR(sdp)) {
1469                 printk(KERN_WARNING "sg_alloc failed\n");
1470                 error = PTR_ERR(sdp);
1471                 goto out;
1472         }
1473
1474         error = cdev_add(cdev, MKDEV(SCSI_GENERIC_MAJOR, sdp->index), 1);
1475         if (error)
1476                 goto cdev_add_err;
1477
1478         sdp->cdev = cdev;
1479         if (sg_sysfs_valid) {
1480                 struct device *sg_class_member;
1481
1482                 sg_class_member = device_create(sg_sysfs_class, cl_dev->parent,
1483                                                 MKDEV(SCSI_GENERIC_MAJOR,
1484                                                       sdp->index),
1485                                                 sdp, "%s", disk->disk_name);
1486                 if (IS_ERR(sg_class_member)) {
1487                         printk(KERN_ERR "sg_add: "
1488                                "device_create failed\n");
1489                         error = PTR_ERR(sg_class_member);
1490                         goto cdev_add_err;
1491                 }
1492                 error = sysfs_create_link(&scsidp->sdev_gendev.kobj,
1493                                           &sg_class_member->kobj, "generic");
1494                 if (error)
1495                         printk(KERN_ERR "sg_add: unable to make symlink "
1496                                         "'generic' back to sg%d\n", sdp->index);
1497         } else
1498                 printk(KERN_WARNING "sg_add: sg_sys Invalid\n");
1499
1500         sdev_printk(KERN_NOTICE, scsidp,
1501                     "Attached scsi generic sg%d type %d\n", sdp->index,
1502                     scsidp->type);
1503
1504         dev_set_drvdata(cl_dev, sdp);
1505
1506         return 0;
1507
1508 cdev_add_err:
1509         write_lock_irqsave(&sg_index_lock, iflags);
1510         idr_remove(&sg_index_idr, sdp->index);
1511         write_unlock_irqrestore(&sg_index_lock, iflags);
1512         kfree(sdp);
1513
1514 out:
1515         put_disk(disk);
1516         if (cdev)
1517                 cdev_del(cdev);
1518         return error;
1519 }
1520
1521 static void sg_device_destroy(struct kref *kref)
1522 {
1523         struct sg_device *sdp = container_of(kref, struct sg_device, d_ref);
1524         unsigned long flags;
1525
1526         /* CAUTION!  Note that the device can still be found via idr_find()
1527          * even though the refcount is 0.  Therefore, do idr_remove() BEFORE
1528          * any other cleanup.
1529          */
1530
1531         write_lock_irqsave(&sg_index_lock, flags);
1532         idr_remove(&sg_index_idr, sdp->index);
1533         write_unlock_irqrestore(&sg_index_lock, flags);
1534
1535         SCSI_LOG_TIMEOUT(3,
1536                 printk("sg_device_destroy: %s\n",
1537                         sdp->disk->disk_name));
1538
1539         put_disk(sdp->disk);
1540         kfree(sdp);
1541 }
1542
1543 static void sg_remove(struct device *cl_dev, struct class_interface *cl_intf)
1544 {
1545         struct scsi_device *scsidp = to_scsi_device(cl_dev->parent);
1546         Sg_device *sdp = dev_get_drvdata(cl_dev);
1547         unsigned long iflags;
1548         Sg_fd *sfp;
1549
1550         if (!sdp || sdp->detached)
1551                 return;
1552
1553         SCSI_LOG_TIMEOUT(3, printk("sg_remove: %s\n", sdp->disk->disk_name));
1554
1555         /* Need a write lock to set sdp->detached. */
1556         write_lock_irqsave(&sg_index_lock, iflags);
1557         sdp->detached = 1;
1558         list_for_each_entry(sfp, &sdp->sfds, sfd_siblings) {
1559                 wake_up_interruptible(&sfp->read_wait);
1560                 kill_fasync(&sfp->async_qp, SIGPOLL, POLL_HUP);
1561         }
1562         write_unlock_irqrestore(&sg_index_lock, iflags);
1563
1564         sysfs_remove_link(&scsidp->sdev_gendev.kobj, "generic");
1565         device_destroy(sg_sysfs_class, MKDEV(SCSI_GENERIC_MAJOR, sdp->index));
1566         cdev_del(sdp->cdev);
1567         sdp->cdev = NULL;
1568
1569         sg_put_dev(sdp);
1570 }
1571
1572 module_param_named(scatter_elem_sz, scatter_elem_sz, int, S_IRUGO | S_IWUSR);
1573 module_param_named(def_reserved_size, def_reserved_size, int,
1574                    S_IRUGO | S_IWUSR);
1575 module_param_named(allow_dio, sg_allow_dio, int, S_IRUGO | S_IWUSR);
1576
1577 MODULE_AUTHOR("Douglas Gilbert");
1578 MODULE_DESCRIPTION("SCSI generic (sg) driver");
1579 MODULE_LICENSE("GPL");
1580 MODULE_VERSION(SG_VERSION_STR);
1581 MODULE_ALIAS_CHARDEV_MAJOR(SCSI_GENERIC_MAJOR);
1582
1583 MODULE_PARM_DESC(scatter_elem_sz, "scatter gather element "
1584                 "size (default: max(SG_SCATTER_SZ, PAGE_SIZE))");
1585 MODULE_PARM_DESC(def_reserved_size, "size of buffer reserved for each fd");
1586 MODULE_PARM_DESC(allow_dio, "allow direct I/O (default: 0 (disallow))");
1587
1588 static int __init
1589 init_sg(void)
1590 {
1591         int rc;
1592
1593         if (scatter_elem_sz < PAGE_SIZE) {
1594                 scatter_elem_sz = PAGE_SIZE;
1595                 scatter_elem_sz_prev = scatter_elem_sz;
1596         }
1597         if (def_reserved_size >= 0)
1598                 sg_big_buff = def_reserved_size;
1599         else
1600                 def_reserved_size = sg_big_buff;
1601
1602         rc = register_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0),
1603                                     SG_MAX_DEVS, "sg");
1604         if (rc)
1605                 return rc;
1606         sg_sysfs_class = class_create(THIS_MODULE, "scsi_generic");
1607         if ( IS_ERR(sg_sysfs_class) ) {
1608                 rc = PTR_ERR(sg_sysfs_class);
1609                 goto err_out;
1610         }
1611         sg_sysfs_valid = 1;
1612         rc = scsi_register_interface(&sg_interface);
1613         if (0 == rc) {
1614 #ifdef CONFIG_SCSI_PROC_FS
1615                 sg_proc_init();
1616 #endif                          /* CONFIG_SCSI_PROC_FS */
1617                 return 0;
1618         }
1619         class_destroy(sg_sysfs_class);
1620 err_out:
1621         unregister_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0), SG_MAX_DEVS);
1622         return rc;
1623 }
1624
1625 static void __exit
1626 exit_sg(void)
1627 {
1628 #ifdef CONFIG_SCSI_PROC_FS
1629         sg_proc_cleanup();
1630 #endif                          /* CONFIG_SCSI_PROC_FS */
1631         scsi_unregister_interface(&sg_interface);
1632         class_destroy(sg_sysfs_class);
1633         sg_sysfs_valid = 0;
1634         unregister_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0),
1635                                  SG_MAX_DEVS);
1636         idr_destroy(&sg_index_idr);
1637 }
1638
1639 static int sg_start_req(Sg_request *srp, unsigned char *cmd)
1640 {
1641         int res;
1642         struct request *rq;
1643         Sg_fd *sfp = srp->parentfp;
1644         sg_io_hdr_t *hp = &srp->header;
1645         int dxfer_len = (int) hp->dxfer_len;
1646         int dxfer_dir = hp->dxfer_direction;
1647         unsigned int iov_count = hp->iovec_count;
1648         Sg_scatter_hold *req_schp = &srp->data;
1649         Sg_scatter_hold *rsv_schp = &sfp->reserve;
1650         struct request_queue *q = sfp->parentdp->device->request_queue;
1651         struct rq_map_data *md, map_data;
1652         int rw = hp->dxfer_direction == SG_DXFER_TO_DEV ? WRITE : READ;
1653
1654         SCSI_LOG_TIMEOUT(4, printk(KERN_INFO "sg_start_req: dxfer_len=%d\n",
1655                                    dxfer_len));
1656
1657         rq = blk_get_request(q, rw, GFP_ATOMIC);
1658         if (!rq)
1659                 return -ENOMEM;
1660
1661         memcpy(rq->cmd, cmd, hp->cmd_len);
1662
1663         rq->cmd_len = hp->cmd_len;
1664         rq->cmd_type = REQ_TYPE_BLOCK_PC;
1665
1666         srp->rq = rq;
1667         rq->end_io_data = srp;
1668         rq->sense = srp->sense_b;
1669         rq->retries = SG_DEFAULT_RETRIES;
1670
1671         if ((dxfer_len <= 0) || (dxfer_dir == SG_DXFER_NONE))
1672                 return 0;
1673
1674         if (sg_allow_dio && hp->flags & SG_FLAG_DIRECT_IO &&
1675             dxfer_dir != SG_DXFER_UNKNOWN && !iov_count &&
1676             !sfp->parentdp->device->host->unchecked_isa_dma &&
1677             blk_rq_aligned(q, (unsigned long)hp->dxferp, dxfer_len))
1678                 md = NULL;
1679         else
1680                 md = &map_data;
1681
1682         if (md) {
1683                 if (!sg_res_in_use(sfp) && dxfer_len <= rsv_schp->bufflen)
1684                         sg_link_reserve(sfp, srp, dxfer_len);
1685                 else {
1686                         res = sg_build_indirect(req_schp, sfp, dxfer_len);
1687                         if (res)
1688                                 return res;
1689                 }
1690
1691                 md->pages = req_schp->pages;
1692                 md->page_order = req_schp->page_order;
1693                 md->nr_entries = req_schp->k_use_sg;
1694                 md->offset = 0;
1695                 md->null_mapped = hp->dxferp ? 0 : 1;
1696                 if (dxfer_dir == SG_DXFER_TO_FROM_DEV)
1697                         md->from_user = 1;
1698                 else
1699                         md->from_user = 0;
1700         }
1701
1702         if (iov_count) {
1703                 int len, size = sizeof(struct sg_iovec) * iov_count;
1704                 struct iovec *iov;
1705
1706                 iov = memdup_user(hp->dxferp, size);
1707                 if (IS_ERR(iov))
1708                         return PTR_ERR(iov);
1709
1710                 len = iov_length(iov, iov_count);
1711                 if (hp->dxfer_len < len) {
1712                         iov_count = iov_shorten(iov, iov_count, hp->dxfer_len);
1713                         len = hp->dxfer_len;
1714                 }
1715
1716                 res = blk_rq_map_user_iov(q, rq, md, (struct sg_iovec *)iov,
1717                                           iov_count,
1718                                           len, GFP_ATOMIC);
1719                 kfree(iov);
1720         } else
1721                 res = blk_rq_map_user(q, rq, md, hp->dxferp,
1722                                       hp->dxfer_len, GFP_ATOMIC);
1723
1724         if (!res) {
1725                 srp->bio = rq->bio;
1726
1727                 if (!md) {
1728                         req_schp->dio_in_use = 1;
1729                         hp->info |= SG_INFO_DIRECT_IO;
1730                 }
1731         }
1732         return res;
1733 }
1734
1735 static int sg_finish_rem_req(Sg_request * srp)
1736 {
1737         int ret = 0;
1738
1739         Sg_fd *sfp = srp->parentfp;
1740         Sg_scatter_hold *req_schp = &srp->data;
1741
1742         SCSI_LOG_TIMEOUT(4, printk("sg_finish_rem_req: res_used=%d\n", (int) srp->res_used));
1743         if (srp->rq) {
1744                 if (srp->bio)
1745                         ret = blk_rq_unmap_user(srp->bio);
1746
1747                 blk_put_request(srp->rq);
1748         }
1749
1750         if (srp->res_used)
1751                 sg_unlink_reserve(sfp, srp);
1752         else
1753                 sg_remove_scat(req_schp);
1754
1755         sg_remove_request(sfp, srp);
1756
1757         return ret;
1758 }
1759
1760 static int
1761 sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp, int tablesize)
1762 {
1763         int sg_bufflen = tablesize * sizeof(struct page *);
1764         gfp_t gfp_flags = GFP_ATOMIC | __GFP_NOWARN;
1765
1766         schp->pages = kzalloc(sg_bufflen, gfp_flags);
1767         if (!schp->pages)
1768                 return -ENOMEM;
1769         schp->sglist_len = sg_bufflen;
1770         return tablesize;       /* number of scat_gath elements allocated */
1771 }
1772
1773 static int
1774 sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
1775 {
1776         int ret_sz = 0, i, k, rem_sz, num, mx_sc_elems;
1777         int sg_tablesize = sfp->parentdp->sg_tablesize;
1778         int blk_size = buff_size, order;
1779         gfp_t gfp_mask = GFP_ATOMIC | __GFP_COMP | __GFP_NOWARN;
1780
1781         if (blk_size < 0)
1782                 return -EFAULT;
1783         if (0 == blk_size)
1784                 ++blk_size;     /* don't know why */
1785         /* round request up to next highest SG_SECTOR_SZ byte boundary */
1786         blk_size = ALIGN(blk_size, SG_SECTOR_SZ);
1787         SCSI_LOG_TIMEOUT(4, printk("sg_build_indirect: buff_size=%d, blk_size=%d\n",
1788                                    buff_size, blk_size));
1789
1790         /* N.B. ret_sz carried into this block ... */
1791         mx_sc_elems = sg_build_sgat(schp, sfp, sg_tablesize);
1792         if (mx_sc_elems < 0)
1793                 return mx_sc_elems;     /* most likely -ENOMEM */
1794
1795         num = scatter_elem_sz;
1796         if (unlikely(num != scatter_elem_sz_prev)) {
1797                 if (num < PAGE_SIZE) {
1798                         scatter_elem_sz = PAGE_SIZE;
1799                         scatter_elem_sz_prev = PAGE_SIZE;
1800                 } else
1801                         scatter_elem_sz_prev = num;
1802         }
1803
1804         if (sfp->low_dma)
1805                 gfp_mask |= GFP_DMA;
1806
1807         if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
1808                 gfp_mask |= __GFP_ZERO;
1809
1810         order = get_order(num);
1811 retry:
1812         ret_sz = 1 << (PAGE_SHIFT + order);
1813
1814         for (k = 0, rem_sz = blk_size; rem_sz > 0 && k < mx_sc_elems;
1815              k++, rem_sz -= ret_sz) {
1816
1817                 num = (rem_sz > scatter_elem_sz_prev) ?
1818                         scatter_elem_sz_prev : rem_sz;
1819
1820                 schp->pages[k] = alloc_pages(gfp_mask, order);
1821                 if (!schp->pages[k])
1822                         goto out;
1823
1824                 if (num == scatter_elem_sz_prev) {
1825                         if (unlikely(ret_sz > scatter_elem_sz_prev)) {
1826                                 scatter_elem_sz = ret_sz;
1827                                 scatter_elem_sz_prev = ret_sz;
1828                         }
1829                 }
1830
1831                 SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k=%d, num=%d, "
1832                                  "ret_sz=%d\n", k, num, ret_sz));
1833         }               /* end of for loop */
1834
1835         schp->page_order = order;
1836         schp->k_use_sg = k;
1837         SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k_use_sg=%d, "
1838                          "rem_sz=%d\n", k, rem_sz));
1839
1840         schp->bufflen = blk_size;
1841         if (rem_sz > 0) /* must have failed */
1842                 return -ENOMEM;
1843         return 0;
1844 out:
1845         for (i = 0; i < k; i++)
1846                 __free_pages(schp->pages[i], order);
1847
1848         if (--order >= 0)
1849                 goto retry;
1850
1851         return -ENOMEM;
1852 }
1853
1854 static void
1855 sg_remove_scat(Sg_scatter_hold * schp)
1856 {
1857         SCSI_LOG_TIMEOUT(4, printk("sg_remove_scat: k_use_sg=%d\n", schp->k_use_sg));
1858         if (schp->pages && schp->sglist_len > 0) {
1859                 if (!schp->dio_in_use) {
1860                         int k;
1861
1862                         for (k = 0; k < schp->k_use_sg && schp->pages[k]; k++) {
1863                                 SCSI_LOG_TIMEOUT(5, printk(
1864                                     "sg_remove_scat: k=%d, pg=0x%p\n",
1865                                     k, schp->pages[k]));
1866                                 __free_pages(schp->pages[k], schp->page_order);
1867                         }
1868
1869                         kfree(schp->pages);
1870                 }
1871         }
1872         memset(schp, 0, sizeof (*schp));
1873 }
1874
1875 static int
1876 sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer)
1877 {
1878         Sg_scatter_hold *schp = &srp->data;
1879         int k, num;
1880
1881         SCSI_LOG_TIMEOUT(4, printk("sg_read_oxfer: num_read_xfer=%d\n",
1882                                    num_read_xfer));
1883         if ((!outp) || (num_read_xfer <= 0))
1884                 return 0;
1885
1886         num = 1 << (PAGE_SHIFT + schp->page_order);
1887         for (k = 0; k < schp->k_use_sg && schp->pages[k]; k++) {
1888                 if (num > num_read_xfer) {
1889                         if (__copy_to_user(outp, page_address(schp->pages[k]),
1890                                            num_read_xfer))
1891                                 return -EFAULT;
1892                         break;
1893                 } else {
1894                         if (__copy_to_user(outp, page_address(schp->pages[k]),
1895                                            num))
1896                                 return -EFAULT;
1897                         num_read_xfer -= num;
1898                         if (num_read_xfer <= 0)
1899                                 break;
1900                         outp += num;
1901                 }
1902         }
1903
1904         return 0;
1905 }
1906
1907 static void
1908 sg_build_reserve(Sg_fd * sfp, int req_size)
1909 {
1910         Sg_scatter_hold *schp = &sfp->reserve;
1911
1912         SCSI_LOG_TIMEOUT(4, printk("sg_build_reserve: req_size=%d\n", req_size));
1913         do {
1914                 if (req_size < PAGE_SIZE)
1915                         req_size = PAGE_SIZE;
1916                 if (0 == sg_build_indirect(schp, sfp, req_size))
1917                         return;
1918                 else
1919                         sg_remove_scat(schp);
1920                 req_size >>= 1; /* divide by 2 */
1921         } while (req_size > (PAGE_SIZE / 2));
1922 }
1923
1924 static void
1925 sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size)
1926 {
1927         Sg_scatter_hold *req_schp = &srp->data;
1928         Sg_scatter_hold *rsv_schp = &sfp->reserve;
1929         int k, num, rem;
1930
1931         srp->res_used = 1;
1932         SCSI_LOG_TIMEOUT(4, printk("sg_link_reserve: size=%d\n", size));
1933         rem = size;
1934
1935         num = 1 << (PAGE_SHIFT + rsv_schp->page_order);
1936         for (k = 0; k < rsv_schp->k_use_sg; k++) {
1937                 if (rem <= num) {
1938                         req_schp->k_use_sg = k + 1;
1939                         req_schp->sglist_len = rsv_schp->sglist_len;
1940                         req_schp->pages = rsv_schp->pages;
1941
1942                         req_schp->bufflen = size;
1943                         req_schp->page_order = rsv_schp->page_order;
1944                         break;
1945                 } else
1946                         rem -= num;
1947         }
1948
1949         if (k >= rsv_schp->k_use_sg)
1950                 SCSI_LOG_TIMEOUT(1, printk("sg_link_reserve: BAD size\n"));
1951 }
1952
1953 static void
1954 sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp)
1955 {
1956         Sg_scatter_hold *req_schp = &srp->data;
1957
1958         SCSI_LOG_TIMEOUT(4, printk("sg_unlink_reserve: req->k_use_sg=%d\n",
1959                                    (int) req_schp->k_use_sg));
1960         req_schp->k_use_sg = 0;
1961         req_schp->bufflen = 0;
1962         req_schp->pages = NULL;
1963         req_schp->page_order = 0;
1964         req_schp->sglist_len = 0;
1965         sfp->save_scat_len = 0;
1966         srp->res_used = 0;
1967 }
1968
1969 static Sg_request *
1970 sg_get_rq_mark(Sg_fd * sfp, int pack_id)
1971 {
1972         Sg_request *resp;
1973         unsigned long iflags;
1974
1975         write_lock_irqsave(&sfp->rq_list_lock, iflags);
1976         for (resp = sfp->headrp; resp; resp = resp->nextrp) {
1977                 /* look for requests that are ready + not SG_IO owned */
1978                 if ((1 == resp->done) && (!resp->sg_io_owned) &&
1979                     ((-1 == pack_id) || (resp->header.pack_id == pack_id))) {
1980                         resp->done = 2; /* guard against other readers */
1981                         break;
1982                 }
1983         }
1984         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
1985         return resp;
1986 }
1987
1988 /* always adds to end of list */
1989 static Sg_request *
1990 sg_add_request(Sg_fd * sfp)
1991 {
1992         int k;
1993         unsigned long iflags;
1994         Sg_request *resp;
1995         Sg_request *rp = sfp->req_arr;
1996
1997         write_lock_irqsave(&sfp->rq_list_lock, iflags);
1998         resp = sfp->headrp;
1999         if (!resp) {
2000                 memset(rp, 0, sizeof (Sg_request));
2001                 rp->parentfp = sfp;
2002                 resp = rp;
2003                 sfp->headrp = resp;
2004         } else {
2005                 if (0 == sfp->cmd_q)
2006                         resp = NULL;    /* command queuing disallowed */
2007                 else {
2008                         for (k = 0; k < SG_MAX_QUEUE; ++k, ++rp) {
2009                                 if (!rp->parentfp)
2010                                         break;
2011                         }
2012                         if (k < SG_MAX_QUEUE) {
2013                                 memset(rp, 0, sizeof (Sg_request));
2014                                 rp->parentfp = sfp;
2015                                 while (resp->nextrp)
2016                                         resp = resp->nextrp;
2017                                 resp->nextrp = rp;
2018                                 resp = rp;
2019                         } else
2020                                 resp = NULL;
2021                 }
2022         }
2023         if (resp) {
2024                 resp->nextrp = NULL;
2025                 resp->header.duration = jiffies_to_msecs(jiffies);
2026         }
2027         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2028         return resp;
2029 }
2030
2031 /* Return of 1 for found; 0 for not found */
2032 static int
2033 sg_remove_request(Sg_fd * sfp, Sg_request * srp)
2034 {
2035         Sg_request *prev_rp;
2036         Sg_request *rp;
2037         unsigned long iflags;
2038         int res = 0;
2039
2040         if ((!sfp) || (!srp) || (!sfp->headrp))
2041                 return res;
2042         write_lock_irqsave(&sfp->rq_list_lock, iflags);
2043         prev_rp = sfp->headrp;
2044         if (srp == prev_rp) {
2045                 sfp->headrp = prev_rp->nextrp;
2046                 prev_rp->parentfp = NULL;
2047                 res = 1;
2048         } else {
2049                 while ((rp = prev_rp->nextrp)) {
2050                         if (srp == rp) {
2051                                 prev_rp->nextrp = rp->nextrp;
2052                                 rp->parentfp = NULL;
2053                                 res = 1;
2054                                 break;
2055                         }
2056                         prev_rp = rp;
2057                 }
2058         }
2059         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2060         return res;
2061 }
2062
2063 static Sg_fd *
2064 sg_add_sfp(Sg_device * sdp, int dev)
2065 {
2066         Sg_fd *sfp;
2067         unsigned long iflags;
2068         int bufflen;
2069
2070         sfp = kzalloc(sizeof(*sfp), GFP_ATOMIC | __GFP_NOWARN);
2071         if (!sfp)
2072                 return NULL;
2073
2074         init_waitqueue_head(&sfp->read_wait);
2075         rwlock_init(&sfp->rq_list_lock);
2076
2077         kref_init(&sfp->f_ref);
2078         sfp->timeout = SG_DEFAULT_TIMEOUT;
2079         sfp->timeout_user = SG_DEFAULT_TIMEOUT_USER;
2080         sfp->force_packid = SG_DEF_FORCE_PACK_ID;
2081         sfp->low_dma = (SG_DEF_FORCE_LOW_DMA == 0) ?
2082             sdp->device->host->unchecked_isa_dma : 1;
2083         sfp->cmd_q = SG_DEF_COMMAND_Q;
2084         sfp->keep_orphan = SG_DEF_KEEP_ORPHAN;
2085         sfp->parentdp = sdp;
2086         write_lock_irqsave(&sg_index_lock, iflags);
2087         list_add_tail(&sfp->sfd_siblings, &sdp->sfds);
2088         write_unlock_irqrestore(&sg_index_lock, iflags);
2089         SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp: sfp=0x%p\n", sfp));
2090         if (unlikely(sg_big_buff != def_reserved_size))
2091                 sg_big_buff = def_reserved_size;
2092
2093         bufflen = min_t(int, sg_big_buff,
2094                         queue_max_sectors(sdp->device->request_queue) * 512);
2095         sg_build_reserve(sfp, bufflen);
2096         SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp:   bufflen=%d, k_use_sg=%d\n",
2097                            sfp->reserve.bufflen, sfp->reserve.k_use_sg));
2098
2099         kref_get(&sdp->d_ref);
2100         __module_get(THIS_MODULE);
2101         return sfp;
2102 }
2103
2104 static void sg_remove_sfp_usercontext(struct work_struct *work)
2105 {
2106         struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work);
2107         struct sg_device *sdp = sfp->parentdp;
2108
2109         /* Cleanup any responses which were never read(). */
2110         while (sfp->headrp)
2111                 sg_finish_rem_req(sfp->headrp);
2112
2113         if (sfp->reserve.bufflen > 0) {
2114                 SCSI_LOG_TIMEOUT(6,
2115                         printk("sg_remove_sfp:    bufflen=%d, k_use_sg=%d\n",
2116                                 (int) sfp->reserve.bufflen,
2117                                 (int) sfp->reserve.k_use_sg));
2118                 sg_remove_scat(&sfp->reserve);
2119         }
2120
2121         SCSI_LOG_TIMEOUT(6,
2122                 printk("sg_remove_sfp: %s, sfp=0x%p\n",
2123                         sdp->disk->disk_name,
2124                         sfp));
2125         kfree(sfp);
2126
2127         scsi_device_put(sdp->device);
2128         sg_put_dev(sdp);
2129         module_put(THIS_MODULE);
2130 }
2131
2132 static void sg_remove_sfp(struct kref *kref)
2133 {
2134         struct sg_fd *sfp = container_of(kref, struct sg_fd, f_ref);
2135         unsigned long iflags;
2136
2137         write_lock_irqsave(&sg_index_lock, iflags);
2138         list_del(&sfp->sfd_siblings);
2139         write_unlock_irqrestore(&sg_index_lock, iflags);
2140
2141         INIT_WORK(&sfp->ew.work, sg_remove_sfp_usercontext);
2142         schedule_work(&sfp->ew.work);
2143 }
2144
2145 static int
2146 sg_res_in_use(Sg_fd * sfp)
2147 {
2148         const Sg_request *srp;
2149         unsigned long iflags;
2150
2151         read_lock_irqsave(&sfp->rq_list_lock, iflags);
2152         for (srp = sfp->headrp; srp; srp = srp->nextrp)
2153                 if (srp->res_used)
2154                         break;
2155         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2156         return srp ? 1 : 0;
2157 }
2158
2159 #ifdef CONFIG_SCSI_PROC_FS
2160 static int
2161 sg_idr_max_id(int id, void *p, void *data)
2162 {
2163         int *k = data;
2164
2165         if (*k < id)
2166                 *k = id;
2167
2168         return 0;
2169 }
2170
2171 static int
2172 sg_last_dev(void)
2173 {
2174         int k = -1;
2175         unsigned long iflags;
2176
2177         read_lock_irqsave(&sg_index_lock, iflags);
2178         idr_for_each(&sg_index_idr, sg_idr_max_id, &k);
2179         read_unlock_irqrestore(&sg_index_lock, iflags);
2180         return k + 1;           /* origin 1 */
2181 }
2182 #endif
2183
2184 /* must be called with sg_index_lock held */
2185 static Sg_device *sg_lookup_dev(int dev)
2186 {
2187         return idr_find(&sg_index_idr, dev);
2188 }
2189
2190 static Sg_device *sg_get_dev(int dev)
2191 {
2192         struct sg_device *sdp;
2193         unsigned long flags;
2194
2195         read_lock_irqsave(&sg_index_lock, flags);
2196         sdp = sg_lookup_dev(dev);
2197         if (!sdp)
2198                 sdp = ERR_PTR(-ENXIO);
2199         else if (sdp->detached) {
2200                 /* If sdp->detached, then the refcount may already be 0, in
2201                  * which case it would be a bug to do kref_get().
2202                  */
2203                 sdp = ERR_PTR(-ENODEV);
2204         } else
2205                 kref_get(&sdp->d_ref);
2206         read_unlock_irqrestore(&sg_index_lock, flags);
2207
2208         return sdp;
2209 }
2210
2211 static void sg_put_dev(struct sg_device *sdp)
2212 {
2213         kref_put(&sdp->d_ref, sg_device_destroy);
2214 }
2215
2216 #ifdef CONFIG_SCSI_PROC_FS
2217
2218 static struct proc_dir_entry *sg_proc_sgp = NULL;
2219
2220 static char sg_proc_sg_dirname[] = "scsi/sg";
2221
2222 static int sg_proc_seq_show_int(struct seq_file *s, void *v);
2223
2224 static int sg_proc_single_open_adio(struct inode *inode, struct file *file);
2225 static ssize_t sg_proc_write_adio(struct file *filp, const char __user *buffer,
2226                                   size_t count, loff_t *off);
2227 static const struct file_operations adio_fops = {
2228         .owner = THIS_MODULE,
2229         .open = sg_proc_single_open_adio,
2230         .read = seq_read,
2231         .llseek = seq_lseek,
2232         .write = sg_proc_write_adio,
2233         .release = single_release,
2234 };
2235
2236 static int sg_proc_single_open_dressz(struct inode *inode, struct file *file);
2237 static ssize_t sg_proc_write_dressz(struct file *filp,
2238                 const char __user *buffer, size_t count, loff_t *off);
2239 static const struct file_operations dressz_fops = {
2240         .owner = THIS_MODULE,
2241         .open = sg_proc_single_open_dressz,
2242         .read = seq_read,
2243         .llseek = seq_lseek,
2244         .write = sg_proc_write_dressz,
2245         .release = single_release,
2246 };
2247
2248 static int sg_proc_seq_show_version(struct seq_file *s, void *v);
2249 static int sg_proc_single_open_version(struct inode *inode, struct file *file);
2250 static const struct file_operations version_fops = {
2251         .owner = THIS_MODULE,
2252         .open = sg_proc_single_open_version,
2253         .read = seq_read,
2254         .llseek = seq_lseek,
2255         .release = single_release,
2256 };
2257
2258 static int sg_proc_seq_show_devhdr(struct seq_file *s, void *v);
2259 static int sg_proc_single_open_devhdr(struct inode *inode, struct file *file);
2260 static const struct file_operations devhdr_fops = {
2261         .owner = THIS_MODULE,
2262         .open = sg_proc_single_open_devhdr,
2263         .read = seq_read,
2264         .llseek = seq_lseek,
2265         .release = single_release,
2266 };
2267
2268 static int sg_proc_seq_show_dev(struct seq_file *s, void *v);
2269 static int sg_proc_open_dev(struct inode *inode, struct file *file);
2270 static void * dev_seq_start(struct seq_file *s, loff_t *pos);
2271 static void * dev_seq_next(struct seq_file *s, void *v, loff_t *pos);
2272 static void dev_seq_stop(struct seq_file *s, void *v);
2273 static const struct file_operations dev_fops = {
2274         .owner = THIS_MODULE,
2275         .open = sg_proc_open_dev,
2276         .read = seq_read,
2277         .llseek = seq_lseek,
2278         .release = seq_release,
2279 };
2280 static const struct seq_operations dev_seq_ops = {
2281         .start = dev_seq_start,
2282         .next  = dev_seq_next,
2283         .stop  = dev_seq_stop,
2284         .show  = sg_proc_seq_show_dev,
2285 };
2286
2287 static int sg_proc_seq_show_devstrs(struct seq_file *s, void *v);
2288 static int sg_proc_open_devstrs(struct inode *inode, struct file *file);
2289 static const struct file_operations devstrs_fops = {
2290         .owner = THIS_MODULE,
2291         .open = sg_proc_open_devstrs,
2292         .read = seq_read,
2293         .llseek = seq_lseek,
2294         .release = seq_release,
2295 };
2296 static const struct seq_operations devstrs_seq_ops = {
2297         .start = dev_seq_start,
2298         .next  = dev_seq_next,
2299         .stop  = dev_seq_stop,
2300         .show  = sg_proc_seq_show_devstrs,
2301 };
2302
2303 static int sg_proc_seq_show_debug(struct seq_file *s, void *v);
2304 static int sg_proc_open_debug(struct inode *inode, struct file *file);
2305 static const struct file_operations debug_fops = {
2306         .owner = THIS_MODULE,
2307         .open = sg_proc_open_debug,
2308         .read = seq_read,
2309         .llseek = seq_lseek,
2310         .release = seq_release,
2311 };
2312 static const struct seq_operations debug_seq_ops = {
2313         .start = dev_seq_start,
2314         .next  = dev_seq_next,
2315         .stop  = dev_seq_stop,
2316         .show  = sg_proc_seq_show_debug,
2317 };
2318
2319
2320 struct sg_proc_leaf {
2321         const char * name;
2322         const struct file_operations * fops;
2323 };
2324
2325 static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
2326         {"allow_dio", &adio_fops},
2327         {"debug", &debug_fops},
2328         {"def_reserved_size", &dressz_fops},
2329         {"device_hdr", &devhdr_fops},
2330         {"devices", &dev_fops},
2331         {"device_strs", &devstrs_fops},
2332         {"version", &version_fops}
2333 };
2334
2335 static int
2336 sg_proc_init(void)
2337 {
2338         int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
2339         int k;
2340
2341         sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
2342         if (!sg_proc_sgp)
2343                 return 1;
2344         for (k = 0; k < num_leaves; ++k) {
2345                 const struct sg_proc_leaf *leaf = &sg_proc_leaf_arr[k];
2346                 umode_t mask = leaf->fops->write ? S_IRUGO | S_IWUSR : S_IRUGO;
2347                 proc_create(leaf->name, mask, sg_proc_sgp, leaf->fops);
2348         }
2349         return 0;
2350 }
2351
2352 static void
2353 sg_proc_cleanup(void)
2354 {
2355         int k;
2356         int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
2357
2358         if (!sg_proc_sgp)
2359                 return;
2360         for (k = 0; k < num_leaves; ++k)
2361                 remove_proc_entry(sg_proc_leaf_arr[k].name, sg_proc_sgp);
2362         remove_proc_entry(sg_proc_sg_dirname, NULL);
2363 }
2364
2365
2366 static int sg_proc_seq_show_int(struct seq_file *s, void *v)
2367 {
2368         seq_printf(s, "%d\n", *((int *)s->private));
2369         return 0;
2370 }
2371
2372 static int sg_proc_single_open_adio(struct inode *inode, struct file *file)
2373 {
2374         return single_open(file, sg_proc_seq_show_int, &sg_allow_dio);
2375 }
2376
2377 static ssize_t
2378 sg_proc_write_adio(struct file *filp, const char __user *buffer,
2379                    size_t count, loff_t *off)
2380 {
2381         int err;
2382         unsigned long num;
2383
2384         if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
2385                 return -EACCES;
2386         err = kstrtoul_from_user(buffer, count, 0, &num);
2387         if (err)
2388                 return err;
2389         sg_allow_dio = num ? 1 : 0;
2390         return count;
2391 }
2392
2393 static int sg_proc_single_open_dressz(struct inode *inode, struct file *file)
2394 {
2395         return single_open(file, sg_proc_seq_show_int, &sg_big_buff);
2396 }
2397
2398 static ssize_t
2399 sg_proc_write_dressz(struct file *filp, const char __user *buffer,
2400                      size_t count, loff_t *off)
2401 {
2402         int err;
2403         unsigned long k = ULONG_MAX;
2404
2405         if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
2406                 return -EACCES;
2407
2408         err = kstrtoul_from_user(buffer, count, 0, &k);
2409         if (err)
2410                 return err;
2411         if (k <= 1048576) {     /* limit "big buff" to 1 MB */
2412                 sg_big_buff = k;
2413                 return count;
2414         }
2415         return -ERANGE;
2416 }
2417
2418 static int sg_proc_seq_show_version(struct seq_file *s, void *v)
2419 {
2420         seq_printf(s, "%d\t%s [%s]\n", sg_version_num, SG_VERSION_STR,
2421                    sg_version_date);
2422         return 0;
2423 }
2424
2425 static int sg_proc_single_open_version(struct inode *inode, struct file *file)
2426 {
2427         return single_open(file, sg_proc_seq_show_version, NULL);
2428 }
2429
2430 static int sg_proc_seq_show_devhdr(struct seq_file *s, void *v)
2431 {
2432         seq_printf(s, "host\tchan\tid\tlun\ttype\topens\tqdepth\tbusy\t"
2433                    "online\n");
2434         return 0;
2435 }
2436
2437 static int sg_proc_single_open_devhdr(struct inode *inode, struct file *file)
2438 {
2439         return single_open(file, sg_proc_seq_show_devhdr, NULL);
2440 }
2441
2442 struct sg_proc_deviter {
2443         loff_t  index;
2444         size_t  max;
2445 };
2446
2447 static void * dev_seq_start(struct seq_file *s, loff_t *pos)
2448 {
2449         struct sg_proc_deviter * it = kmalloc(sizeof(*it), GFP_KERNEL);
2450
2451         s->private = it;
2452         if (! it)
2453                 return NULL;
2454
2455         it->index = *pos;
2456         it->max = sg_last_dev();
2457         if (it->index >= it->max)
2458                 return NULL;
2459         return it;
2460 }
2461
2462 static void * dev_seq_next(struct seq_file *s, void *v, loff_t *pos)
2463 {
2464         struct sg_proc_deviter * it = s->private;
2465
2466         *pos = ++it->index;
2467         return (it->index < it->max) ? it : NULL;
2468 }
2469
2470 static void dev_seq_stop(struct seq_file *s, void *v)
2471 {
2472         kfree(s->private);
2473 }
2474
2475 static int sg_proc_open_dev(struct inode *inode, struct file *file)
2476 {
2477         return seq_open(file, &dev_seq_ops);
2478 }
2479
2480 static int sg_proc_seq_show_dev(struct seq_file *s, void *v)
2481 {
2482         struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
2483         Sg_device *sdp;
2484         struct scsi_device *scsidp;
2485         unsigned long iflags;
2486
2487         read_lock_irqsave(&sg_index_lock, iflags);
2488         sdp = it ? sg_lookup_dev(it->index) : NULL;
2489         if (sdp && (scsidp = sdp->device) && (!sdp->detached))
2490                 seq_printf(s, "%d\t%d\t%d\t%d\t%d\t%d\t%d\t%d\t%d\n",
2491                               scsidp->host->host_no, scsidp->channel,
2492                               scsidp->id, scsidp->lun, (int) scsidp->type,
2493                               1,
2494                               (int) scsidp->queue_depth,
2495                               (int) scsidp->device_busy,
2496                               (int) scsi_device_online(scsidp));
2497         else
2498                 seq_printf(s, "-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\n");
2499         read_unlock_irqrestore(&sg_index_lock, iflags);
2500         return 0;
2501 }
2502
2503 static int sg_proc_open_devstrs(struct inode *inode, struct file *file)
2504 {
2505         return seq_open(file, &devstrs_seq_ops);
2506 }
2507
2508 static int sg_proc_seq_show_devstrs(struct seq_file *s, void *v)
2509 {
2510         struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
2511         Sg_device *sdp;
2512         struct scsi_device *scsidp;
2513         unsigned long iflags;
2514
2515         read_lock_irqsave(&sg_index_lock, iflags);
2516         sdp = it ? sg_lookup_dev(it->index) : NULL;
2517         if (sdp && (scsidp = sdp->device) && (!sdp->detached))
2518                 seq_printf(s, "%8.8s\t%16.16s\t%4.4s\n",
2519                            scsidp->vendor, scsidp->model, scsidp->rev);
2520         else
2521                 seq_printf(s, "<no active device>\n");
2522         read_unlock_irqrestore(&sg_index_lock, iflags);
2523         return 0;
2524 }
2525
2526 /* must be called while holding sg_index_lock */
2527 static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp)
2528 {
2529         int k, m, new_interface, blen, usg;
2530         Sg_request *srp;
2531         Sg_fd *fp;
2532         const sg_io_hdr_t *hp;
2533         const char * cp;
2534         unsigned int ms;
2535
2536         k = 0;
2537         list_for_each_entry(fp, &sdp->sfds, sfd_siblings) {
2538                 k++;
2539                 read_lock(&fp->rq_list_lock); /* irqs already disabled */
2540                 seq_printf(s, "   FD(%d): timeout=%dms bufflen=%d "
2541                            "(res)sgat=%d low_dma=%d\n", k,
2542                            jiffies_to_msecs(fp->timeout),
2543                            fp->reserve.bufflen,
2544                            (int) fp->reserve.k_use_sg,
2545                            (int) fp->low_dma);
2546                 seq_printf(s, "   cmd_q=%d f_packid=%d k_orphan=%d closed=0\n",
2547                            (int) fp->cmd_q, (int) fp->force_packid,
2548                            (int) fp->keep_orphan);
2549                 for (m = 0, srp = fp->headrp;
2550                                 srp != NULL;
2551                                 ++m, srp = srp->nextrp) {
2552                         hp = &srp->header;
2553                         new_interface = (hp->interface_id == '\0') ? 0 : 1;
2554                         if (srp->res_used) {
2555                                 if (new_interface &&
2556                                     (SG_FLAG_MMAP_IO & hp->flags))
2557                                         cp = "     mmap>> ";
2558                                 else
2559                                         cp = "     rb>> ";
2560                         } else {
2561                                 if (SG_INFO_DIRECT_IO_MASK & hp->info)
2562                                         cp = "     dio>> ";
2563                                 else
2564                                         cp = "     ";
2565                         }
2566                         seq_printf(s, cp);
2567                         blen = srp->data.bufflen;
2568                         usg = srp->data.k_use_sg;
2569                         seq_printf(s, srp->done ?
2570                                    ((1 == srp->done) ?  "rcv:" : "fin:")
2571                                    : "act:");
2572                         seq_printf(s, " id=%d blen=%d",
2573                                    srp->header.pack_id, blen);
2574                         if (srp->done)
2575                                 seq_printf(s, " dur=%d", hp->duration);
2576                         else {
2577                                 ms = jiffies_to_msecs(jiffies);
2578                                 seq_printf(s, " t_o/elap=%d/%d",
2579                                         (new_interface ? hp->timeout :
2580                                                   jiffies_to_msecs(fp->timeout)),
2581                                         (ms > hp->duration ? ms - hp->duration : 0));
2582                         }
2583                         seq_printf(s, "ms sgat=%d op=0x%02x\n", usg,
2584                                    (int) srp->data.cmd_opcode);
2585                 }
2586                 if (0 == m)
2587                         seq_printf(s, "     No requests active\n");
2588                 read_unlock(&fp->rq_list_lock);
2589         }
2590 }
2591
2592 static int sg_proc_open_debug(struct inode *inode, struct file *file)
2593 {
2594         return seq_open(file, &debug_seq_ops);
2595 }
2596
2597 static int sg_proc_seq_show_debug(struct seq_file *s, void *v)
2598 {
2599         struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
2600         Sg_device *sdp;
2601         unsigned long iflags;
2602
2603         if (it && (0 == it->index)) {
2604                 seq_printf(s, "max_active_device=%d(origin 1)\n",
2605                            (int)it->max);
2606                 seq_printf(s, " def_reserved_size=%d\n", sg_big_buff);
2607         }
2608
2609         read_lock_irqsave(&sg_index_lock, iflags);
2610         sdp = it ? sg_lookup_dev(it->index) : NULL;
2611         if (sdp && !list_empty(&sdp->sfds)) {
2612                 struct scsi_device *scsidp = sdp->device;
2613
2614                 seq_printf(s, " >>> device=%s ", sdp->disk->disk_name);
2615                 if (sdp->detached)
2616                         seq_printf(s, "detached pending close ");
2617                 else
2618                         seq_printf
2619                             (s, "scsi%d chan=%d id=%d lun=%d   em=%d",
2620                              scsidp->host->host_no,
2621                              scsidp->channel, scsidp->id,
2622                              scsidp->lun,
2623                              scsidp->host->hostt->emulated);
2624                 seq_printf(s, " sg_tablesize=%d excl=%d\n",
2625                            sdp->sg_tablesize, get_exclude(sdp));
2626                 sg_proc_debug_helper(s, sdp);
2627         }
2628         read_unlock_irqrestore(&sg_index_lock, iflags);
2629         return 0;
2630 }
2631
2632 #endif                          /* CONFIG_SCSI_PROC_FS */
2633
2634 module_init(init_sg);
2635 module_exit(exit_sg);