1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright (C) 2001 Jens Axboe <axboe@suse.de>
4 */
5 #include <linux/compat.h>
6 #include <linux/kernel.h>
7 #include <linux/errno.h>
8 #include <linux/string.h>
9 #include <linux/module.h>
10 #include <linux/blkdev.h>
11 #include <linux/capability.h>
12 #include <linux/completion.h>
13 #include <linux/cdrom.h>
14 #include <linux/ratelimit.h>
15 #include <linux/slab.h>
16 #include <linux/times.h>
17 #include <linux/uio.h>
18 #include <linux/uaccess.h>
19
20 #include <scsi/scsi.h>
21 #include <scsi/scsi_ioctl.h>
22 #include <scsi/scsi_cmnd.h>
23 #include <scsi/sg.h>
24
25 struct blk_cmd_filter {
26 unsigned long read_ok[BLK_SCSI_CMD_PER_LONG];
27 unsigned long write_ok[BLK_SCSI_CMD_PER_LONG];
28 };
29
30 static struct blk_cmd_filter blk_default_cmd_filter;
31
32 /* Command group 3 is reserved and should never be used. */
33 const unsigned char scsi_command_size_tbl[8] =
34 {
35 6, 10, 10, 12,
36 16, 12, 10, 10
37 };
38 EXPORT_SYMBOL(scsi_command_size_tbl);
39
sg_get_version(int __user * p)40 static int sg_get_version(int __user *p)
41 {
42 static const int sg_version_num = 30527;
43 return put_user(sg_version_num, p);
44 }
45
scsi_get_idlun(struct request_queue * q,int __user * p)46 static int scsi_get_idlun(struct request_queue *q, int __user *p)
47 {
48 return put_user(0, p);
49 }
50
scsi_get_bus(struct request_queue * q,int __user * p)51 static int scsi_get_bus(struct request_queue *q, int __user *p)
52 {
53 return put_user(0, p);
54 }
55
sg_get_timeout(struct request_queue * q)56 static int sg_get_timeout(struct request_queue *q)
57 {
58 return jiffies_to_clock_t(q->sg_timeout);
59 }
60
sg_set_timeout(struct request_queue * q,int __user * p)61 static int sg_set_timeout(struct request_queue *q, int __user *p)
62 {
63 int timeout, err = get_user(timeout, p);
64
65 if (!err)
66 q->sg_timeout = clock_t_to_jiffies(timeout);
67
68 return err;
69 }
70
max_sectors_bytes(struct request_queue * q)71 static int max_sectors_bytes(struct request_queue *q)
72 {
73 unsigned int max_sectors = queue_max_sectors(q);
74
75 max_sectors = min_t(unsigned int, max_sectors, INT_MAX >> 9);
76
77 return max_sectors << 9;
78 }
79
sg_get_reserved_size(struct request_queue * q,int __user * p)80 static int sg_get_reserved_size(struct request_queue *q, int __user *p)
81 {
82 int val = min_t(int, q->sg_reserved_size, max_sectors_bytes(q));
83
84 return put_user(val, p);
85 }
86
sg_set_reserved_size(struct request_queue * q,int __user * p)87 static int sg_set_reserved_size(struct request_queue *q, int __user *p)
88 {
89 int size, err = get_user(size, p);
90
91 if (err)
92 return err;
93
94 if (size < 0)
95 return -EINVAL;
96
97 q->sg_reserved_size = min(size, max_sectors_bytes(q));
98 return 0;
99 }
100
101 /*
102 * will always return that we are ATAPI even for a real SCSI drive, I'm not
103 * so sure this is worth doing anything about (why would you care??)
104 */
sg_emulated_host(struct request_queue * q,int __user * p)105 static int sg_emulated_host(struct request_queue *q, int __user *p)
106 {
107 return put_user(1, p);
108 }
109
blk_set_cmd_filter_defaults(struct blk_cmd_filter * filter)110 static void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter)
111 {
112 /* Basic read-only commands */
113 __set_bit(TEST_UNIT_READY, filter->read_ok);
114 __set_bit(REQUEST_SENSE, filter->read_ok);
115 __set_bit(READ_6, filter->read_ok);
116 __set_bit(READ_10, filter->read_ok);
117 __set_bit(READ_12, filter->read_ok);
118 __set_bit(READ_16, filter->read_ok);
119 __set_bit(READ_BUFFER, filter->read_ok);
120 __set_bit(READ_DEFECT_DATA, filter->read_ok);
121 __set_bit(READ_CAPACITY, filter->read_ok);
122 __set_bit(READ_LONG, filter->read_ok);
123 __set_bit(INQUIRY, filter->read_ok);
124 __set_bit(MODE_SENSE, filter->read_ok);
125 __set_bit(MODE_SENSE_10, filter->read_ok);
126 __set_bit(LOG_SENSE, filter->read_ok);
127 __set_bit(START_STOP, filter->read_ok);
128 __set_bit(GPCMD_VERIFY_10, filter->read_ok);
129 __set_bit(VERIFY_16, filter->read_ok);
130 __set_bit(REPORT_LUNS, filter->read_ok);
131 __set_bit(SERVICE_ACTION_IN_16, filter->read_ok);
132 __set_bit(RECEIVE_DIAGNOSTIC, filter->read_ok);
133 __set_bit(MAINTENANCE_IN, filter->read_ok);
134 __set_bit(GPCMD_READ_BUFFER_CAPACITY, filter->read_ok);
135
136 /* Audio CD commands */
137 __set_bit(GPCMD_PLAY_CD, filter->read_ok);
138 __set_bit(GPCMD_PLAY_AUDIO_10, filter->read_ok);
139 __set_bit(GPCMD_PLAY_AUDIO_MSF, filter->read_ok);
140 __set_bit(GPCMD_PLAY_AUDIO_TI, filter->read_ok);
141 __set_bit(GPCMD_PAUSE_RESUME, filter->read_ok);
142
143 /* CD/DVD data reading */
144 __set_bit(GPCMD_READ_CD, filter->read_ok);
145 __set_bit(GPCMD_READ_CD_MSF, filter->read_ok);
146 __set_bit(GPCMD_READ_DISC_INFO, filter->read_ok);
147 __set_bit(GPCMD_READ_CDVD_CAPACITY, filter->read_ok);
148 __set_bit(GPCMD_READ_DVD_STRUCTURE, filter->read_ok);
149 __set_bit(GPCMD_READ_HEADER, filter->read_ok);
150 __set_bit(GPCMD_READ_TRACK_RZONE_INFO, filter->read_ok);
151 __set_bit(GPCMD_READ_SUBCHANNEL, filter->read_ok);
152 __set_bit(GPCMD_READ_TOC_PMA_ATIP, filter->read_ok);
153 __set_bit(GPCMD_REPORT_KEY, filter->read_ok);
154 __set_bit(GPCMD_SCAN, filter->read_ok);
155 __set_bit(GPCMD_GET_CONFIGURATION, filter->read_ok);
156 __set_bit(GPCMD_READ_FORMAT_CAPACITIES, filter->read_ok);
157 __set_bit(GPCMD_GET_EVENT_STATUS_NOTIFICATION, filter->read_ok);
158 __set_bit(GPCMD_GET_PERFORMANCE, filter->read_ok);
159 __set_bit(GPCMD_SEEK, filter->read_ok);
160 __set_bit(GPCMD_STOP_PLAY_SCAN, filter->read_ok);
161
162 /* Basic writing commands */
163 __set_bit(WRITE_6, filter->write_ok);
164 __set_bit(WRITE_10, filter->write_ok);
165 __set_bit(WRITE_VERIFY, filter->write_ok);
166 __set_bit(WRITE_12, filter->write_ok);
167 __set_bit(WRITE_VERIFY_12, filter->write_ok);
168 __set_bit(WRITE_16, filter->write_ok);
169 __set_bit(WRITE_LONG, filter->write_ok);
170 __set_bit(WRITE_LONG_2, filter->write_ok);
171 __set_bit(WRITE_SAME, filter->write_ok);
172 __set_bit(WRITE_SAME_16, filter->write_ok);
173 __set_bit(WRITE_SAME_32, filter->write_ok);
174 __set_bit(ERASE, filter->write_ok);
175 __set_bit(GPCMD_MODE_SELECT_10, filter->write_ok);
176 __set_bit(MODE_SELECT, filter->write_ok);
177 __set_bit(LOG_SELECT, filter->write_ok);
178 __set_bit(GPCMD_BLANK, filter->write_ok);
179 __set_bit(GPCMD_CLOSE_TRACK, filter->write_ok);
180 __set_bit(GPCMD_FLUSH_CACHE, filter->write_ok);
181 __set_bit(GPCMD_FORMAT_UNIT, filter->write_ok);
182 __set_bit(GPCMD_REPAIR_RZONE_TRACK, filter->write_ok);
183 __set_bit(GPCMD_RESERVE_RZONE_TRACK, filter->write_ok);
184 __set_bit(GPCMD_SEND_DVD_STRUCTURE, filter->write_ok);
185 __set_bit(GPCMD_SEND_EVENT, filter->write_ok);
186 __set_bit(GPCMD_SEND_KEY, filter->write_ok);
187 __set_bit(GPCMD_SEND_OPC, filter->write_ok);
188 __set_bit(GPCMD_SEND_CUE_SHEET, filter->write_ok);
189 __set_bit(GPCMD_SET_SPEED, filter->write_ok);
190 __set_bit(GPCMD_PREVENT_ALLOW_MEDIUM_REMOVAL, filter->write_ok);
191 __set_bit(GPCMD_LOAD_UNLOAD, filter->write_ok);
192 __set_bit(GPCMD_SET_STREAMING, filter->write_ok);
193 __set_bit(GPCMD_SET_READ_AHEAD, filter->write_ok);
194
195 /* ZBC Commands */
196 __set_bit(ZBC_OUT, filter->write_ok);
197 __set_bit(ZBC_IN, filter->read_ok);
198 }
199
blk_verify_command(unsigned char * cmd,fmode_t mode)200 int blk_verify_command(unsigned char *cmd, fmode_t mode)
201 {
202 struct blk_cmd_filter *filter = &blk_default_cmd_filter;
203
204 /* root can do any command. */
205 if (capable(CAP_SYS_RAWIO))
206 return 0;
207
208 /* Anybody who can open the device can do a read-safe command */
209 if (test_bit(cmd[0], filter->read_ok))
210 return 0;
211
212 /* Write-safe commands require a writable open */
213 if (test_bit(cmd[0], filter->write_ok) && (mode & FMODE_WRITE))
214 return 0;
215
216 return -EPERM;
217 }
218 EXPORT_SYMBOL(blk_verify_command);
219
blk_fill_sghdr_rq(struct request_queue * q,struct request * rq,struct sg_io_hdr * hdr,fmode_t mode)220 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
221 struct sg_io_hdr *hdr, fmode_t mode)
222 {
223 struct scsi_request *req = scsi_req(rq);
224
225 if (copy_from_user(req->cmd, hdr->cmdp, hdr->cmd_len))
226 return -EFAULT;
227 if (blk_verify_command(req->cmd, mode))
228 return -EPERM;
229
230 /*
231 * fill in request structure
232 */
233 req->cmd_len = hdr->cmd_len;
234
235 rq->timeout = msecs_to_jiffies(hdr->timeout);
236 if (!rq->timeout)
237 rq->timeout = q->sg_timeout;
238 if (!rq->timeout)
239 rq->timeout = BLK_DEFAULT_SG_TIMEOUT;
240 if (rq->timeout < BLK_MIN_SG_TIMEOUT)
241 rq->timeout = BLK_MIN_SG_TIMEOUT;
242
243 return 0;
244 }
245
blk_complete_sghdr_rq(struct request * rq,struct sg_io_hdr * hdr,struct bio * bio)246 static int blk_complete_sghdr_rq(struct request *rq, struct sg_io_hdr *hdr,
247 struct bio *bio)
248 {
249 struct scsi_request *req = scsi_req(rq);
250 int r, ret = 0;
251
252 /*
253 * fill in all the output members
254 */
255 hdr->status = req->result & 0xff;
256 hdr->masked_status = status_byte(req->result);
257 hdr->msg_status = msg_byte(req->result);
258 hdr->host_status = host_byte(req->result);
259 hdr->driver_status = driver_byte(req->result);
260 hdr->info = 0;
261 if (hdr->masked_status || hdr->host_status || hdr->driver_status)
262 hdr->info |= SG_INFO_CHECK;
263 hdr->resid = req->resid_len;
264 hdr->sb_len_wr = 0;
265
266 if (req->sense_len && hdr->sbp) {
267 int len = min((unsigned int) hdr->mx_sb_len, req->sense_len);
268
269 if (!copy_to_user(hdr->sbp, req->sense, len))
270 hdr->sb_len_wr = len;
271 else
272 ret = -EFAULT;
273 }
274
275 r = blk_rq_unmap_user(bio);
276 if (!ret)
277 ret = r;
278
279 return ret;
280 }
281
sg_io(struct request_queue * q,struct gendisk * bd_disk,struct sg_io_hdr * hdr,fmode_t mode)282 static int sg_io(struct request_queue *q, struct gendisk *bd_disk,
283 struct sg_io_hdr *hdr, fmode_t mode)
284 {
285 unsigned long start_time;
286 ssize_t ret = 0;
287 int writing = 0;
288 int at_head = 0;
289 struct request *rq;
290 struct scsi_request *req;
291 struct bio *bio;
292
293 if (hdr->interface_id != 'S')
294 return -EINVAL;
295
296 if (hdr->dxfer_len > (queue_max_hw_sectors(q) << 9))
297 return -EIO;
298
299 if (hdr->dxfer_len)
300 switch (hdr->dxfer_direction) {
301 default:
302 return -EINVAL;
303 case SG_DXFER_TO_DEV:
304 writing = 1;
305 break;
306 case SG_DXFER_TO_FROM_DEV:
307 case SG_DXFER_FROM_DEV:
308 break;
309 }
310 if (hdr->flags & SG_FLAG_Q_AT_HEAD)
311 at_head = 1;
312
313 ret = -ENOMEM;
314 rq = blk_get_request(q, writing ? REQ_OP_SCSI_OUT : REQ_OP_SCSI_IN, 0);
315 if (IS_ERR(rq))
316 return PTR_ERR(rq);
317 req = scsi_req(rq);
318
319 if (hdr->cmd_len > BLK_MAX_CDB) {
320 req->cmd = kzalloc(hdr->cmd_len, GFP_KERNEL);
321 if (!req->cmd)
322 goto out_put_request;
323 }
324
325 ret = blk_fill_sghdr_rq(q, rq, hdr, mode);
326 if (ret < 0)
327 goto out_free_cdb;
328
329 ret = 0;
330 if (hdr->iovec_count) {
331 struct iov_iter i;
332 struct iovec *iov = NULL;
333
334 ret = import_iovec(rq_data_dir(rq), hdr->dxferp,
335 hdr->iovec_count, 0, &iov, &i);
336 if (ret < 0)
337 goto out_free_cdb;
338
339 /* SG_IO howto says that the shorter of the two wins */
340 iov_iter_truncate(&i, hdr->dxfer_len);
341
342 ret = blk_rq_map_user_iov(q, rq, NULL, &i, GFP_KERNEL);
343 kfree(iov);
344 } else if (hdr->dxfer_len)
345 ret = blk_rq_map_user(q, rq, NULL, hdr->dxferp, hdr->dxfer_len,
346 GFP_KERNEL);
347
348 if (ret)
349 goto out_free_cdb;
350
351 bio = rq->bio;
352 req->retries = 0;
353
354 start_time = jiffies;
355
356 /* ignore return value. All information is passed back to caller
357 * (if he doesn't check that is his problem).
358 * N.B. a non-zero SCSI status is _not_ necessarily an error.
359 */
360 blk_execute_rq(q, bd_disk, rq, at_head);
361
362 hdr->duration = jiffies_to_msecs(jiffies - start_time);
363
364 ret = blk_complete_sghdr_rq(rq, hdr, bio);
365
366 out_free_cdb:
367 scsi_req_free_cmd(req);
368 out_put_request:
369 blk_put_request(rq);
370 return ret;
371 }
372
373 /**
374 * sg_scsi_ioctl -- handle deprecated SCSI_IOCTL_SEND_COMMAND ioctl
375 * @q: request queue to send scsi commands down
376 * @disk: gendisk to operate on (option)
377 * @mode: mode used to open the file through which the ioctl has been
378 * submitted
379 * @sic: userspace structure describing the command to perform
380 *
381 * Send down the scsi command described by @sic to the device below
382 * the request queue @q. If @file is non-NULL it's used to perform
383 * fine-grained permission checks that allow users to send down
384 * non-destructive SCSI commands. If the caller has a struct gendisk
385 * available it should be passed in as @disk to allow the low level
386 * driver to use the information contained in it. A non-NULL @disk
387 * is only allowed if the caller knows that the low level driver doesn't
388 * need it (e.g. in the scsi subsystem).
389 *
390 * Notes:
391 * - This interface is deprecated - users should use the SG_IO
392 * interface instead, as this is a more flexible approach to
393 * performing SCSI commands on a device.
394 * - The SCSI command length is determined by examining the 1st byte
395 * of the given command. There is no way to override this.
396 * - Data transfers are limited to PAGE_SIZE
397 * - The length (x + y) must be at least OMAX_SB_LEN bytes long to
398 * accommodate the sense buffer when an error occurs.
399 * The sense buffer is truncated to OMAX_SB_LEN (16) bytes so that
400 * old code will not be surprised.
401 * - If a Unix error occurs (e.g. ENOMEM) then the user will receive
402 * a negative return and the Unix error code in 'errno'.
403 * If the SCSI command succeeds then 0 is returned.
404 * Positive numbers returned are the compacted SCSI error codes (4
405 * bytes in one int) where the lowest byte is the SCSI status.
406 */
sg_scsi_ioctl(struct request_queue * q,struct gendisk * disk,fmode_t mode,struct scsi_ioctl_command __user * sic)407 int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
408 struct scsi_ioctl_command __user *sic)
409 {
410 enum { OMAX_SB_LEN = 16 }; /* For backward compatibility */
411 struct request *rq;
412 struct scsi_request *req;
413 int err;
414 unsigned int in_len, out_len, bytes, opcode, cmdlen;
415 char *buffer = NULL;
416
417 if (!sic)
418 return -EINVAL;
419
420 /*
421 * get in an out lengths, verify they don't exceed a page worth of data
422 */
423 if (get_user(in_len, &sic->inlen))
424 return -EFAULT;
425 if (get_user(out_len, &sic->outlen))
426 return -EFAULT;
427 if (in_len > PAGE_SIZE || out_len > PAGE_SIZE)
428 return -EINVAL;
429 if (get_user(opcode, sic->data))
430 return -EFAULT;
431
432 bytes = max(in_len, out_len);
433 if (bytes) {
434 buffer = kzalloc(bytes, q->bounce_gfp | GFP_USER| __GFP_NOWARN);
435 if (!buffer)
436 return -ENOMEM;
437
438 }
439
440 rq = blk_get_request(q, in_len ? REQ_OP_SCSI_OUT : REQ_OP_SCSI_IN, 0);
441 if (IS_ERR(rq)) {
442 err = PTR_ERR(rq);
443 goto error_free_buffer;
444 }
445 req = scsi_req(rq);
446
447 cmdlen = COMMAND_SIZE(opcode);
448
449 /*
450 * get command and data to send to device, if any
451 */
452 err = -EFAULT;
453 req->cmd_len = cmdlen;
454 if (copy_from_user(req->cmd, sic->data, cmdlen))
455 goto error;
456
457 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
458 goto error;
459
460 err = blk_verify_command(req->cmd, mode);
461 if (err)
462 goto error;
463
464 /* default. possible overriden later */
465 req->retries = 5;
466
467 switch (opcode) {
468 case SEND_DIAGNOSTIC:
469 case FORMAT_UNIT:
470 rq->timeout = FORMAT_UNIT_TIMEOUT;
471 req->retries = 1;
472 break;
473 case START_STOP:
474 rq->timeout = START_STOP_TIMEOUT;
475 break;
476 case MOVE_MEDIUM:
477 rq->timeout = MOVE_MEDIUM_TIMEOUT;
478 break;
479 case READ_ELEMENT_STATUS:
480 rq->timeout = READ_ELEMENT_STATUS_TIMEOUT;
481 break;
482 case READ_DEFECT_DATA:
483 rq->timeout = READ_DEFECT_DATA_TIMEOUT;
484 req->retries = 1;
485 break;
486 default:
487 rq->timeout = BLK_DEFAULT_SG_TIMEOUT;
488 break;
489 }
490
491 if (bytes && blk_rq_map_kern(q, rq, buffer, bytes, GFP_NOIO)) {
492 err = DRIVER_ERROR << 24;
493 goto error;
494 }
495
496 blk_execute_rq(q, disk, rq, 0);
497
498 err = req->result & 0xff; /* only 8 bit SCSI status */
499 if (err) {
500 if (req->sense_len && req->sense) {
501 bytes = (OMAX_SB_LEN > req->sense_len) ?
502 req->sense_len : OMAX_SB_LEN;
503 if (copy_to_user(sic->data, req->sense, bytes))
504 err = -EFAULT;
505 }
506 } else {
507 if (copy_to_user(sic->data, buffer, out_len))
508 err = -EFAULT;
509 }
510
511 error:
512 blk_put_request(rq);
513
514 error_free_buffer:
515 kfree(buffer);
516
517 return err;
518 }
519 EXPORT_SYMBOL_GPL(sg_scsi_ioctl);
520
521 /* Send basic block requests */
__blk_send_generic(struct request_queue * q,struct gendisk * bd_disk,int cmd,int data)522 static int __blk_send_generic(struct request_queue *q, struct gendisk *bd_disk,
523 int cmd, int data)
524 {
525 struct request *rq;
526 int err;
527
528 rq = blk_get_request(q, REQ_OP_SCSI_OUT, 0);
529 if (IS_ERR(rq))
530 return PTR_ERR(rq);
531 rq->timeout = BLK_DEFAULT_SG_TIMEOUT;
532 scsi_req(rq)->cmd[0] = cmd;
533 scsi_req(rq)->cmd[4] = data;
534 scsi_req(rq)->cmd_len = 6;
535 blk_execute_rq(q, bd_disk, rq, 0);
536 err = scsi_req(rq)->result ? -EIO : 0;
537 blk_put_request(rq);
538
539 return err;
540 }
541
blk_send_start_stop(struct request_queue * q,struct gendisk * bd_disk,int data)542 static inline int blk_send_start_stop(struct request_queue *q,
543 struct gendisk *bd_disk, int data)
544 {
545 return __blk_send_generic(q, bd_disk, GPCMD_START_STOP_UNIT, data);
546 }
547
put_sg_io_hdr(const struct sg_io_hdr * hdr,void __user * argp)548 int put_sg_io_hdr(const struct sg_io_hdr *hdr, void __user *argp)
549 {
550 #ifdef CONFIG_COMPAT
551 if (in_compat_syscall()) {
552 struct compat_sg_io_hdr hdr32 = {
553 .interface_id = hdr->interface_id,
554 .dxfer_direction = hdr->dxfer_direction,
555 .cmd_len = hdr->cmd_len,
556 .mx_sb_len = hdr->mx_sb_len,
557 .iovec_count = hdr->iovec_count,
558 .dxfer_len = hdr->dxfer_len,
559 .dxferp = (uintptr_t)hdr->dxferp,
560 .cmdp = (uintptr_t)hdr->cmdp,
561 .sbp = (uintptr_t)hdr->sbp,
562 .timeout = hdr->timeout,
563 .flags = hdr->flags,
564 .pack_id = hdr->pack_id,
565 .usr_ptr = (uintptr_t)hdr->usr_ptr,
566 .status = hdr->status,
567 .masked_status = hdr->masked_status,
568 .msg_status = hdr->msg_status,
569 .sb_len_wr = hdr->sb_len_wr,
570 .host_status = hdr->host_status,
571 .driver_status = hdr->driver_status,
572 .resid = hdr->resid,
573 .duration = hdr->duration,
574 .info = hdr->info,
575 };
576
577 if (copy_to_user(argp, &hdr32, sizeof(hdr32)))
578 return -EFAULT;
579
580 return 0;
581 }
582 #endif
583
584 if (copy_to_user(argp, hdr, sizeof(*hdr)))
585 return -EFAULT;
586
587 return 0;
588 }
589 EXPORT_SYMBOL(put_sg_io_hdr);
590
get_sg_io_hdr(struct sg_io_hdr * hdr,const void __user * argp)591 int get_sg_io_hdr(struct sg_io_hdr *hdr, const void __user *argp)
592 {
593 #ifdef CONFIG_COMPAT
594 struct compat_sg_io_hdr hdr32;
595
596 if (in_compat_syscall()) {
597 if (copy_from_user(&hdr32, argp, sizeof(hdr32)))
598 return -EFAULT;
599
600 *hdr = (struct sg_io_hdr) {
601 .interface_id = hdr32.interface_id,
602 .dxfer_direction = hdr32.dxfer_direction,
603 .cmd_len = hdr32.cmd_len,
604 .mx_sb_len = hdr32.mx_sb_len,
605 .iovec_count = hdr32.iovec_count,
606 .dxfer_len = hdr32.dxfer_len,
607 .dxferp = compat_ptr(hdr32.dxferp),
608 .cmdp = compat_ptr(hdr32.cmdp),
609 .sbp = compat_ptr(hdr32.sbp),
610 .timeout = hdr32.timeout,
611 .flags = hdr32.flags,
612 .pack_id = hdr32.pack_id,
613 .usr_ptr = compat_ptr(hdr32.usr_ptr),
614 .status = hdr32.status,
615 .masked_status = hdr32.masked_status,
616 .msg_status = hdr32.msg_status,
617 .sb_len_wr = hdr32.sb_len_wr,
618 .host_status = hdr32.host_status,
619 .driver_status = hdr32.driver_status,
620 .resid = hdr32.resid,
621 .duration = hdr32.duration,
622 .info = hdr32.info,
623 };
624
625 return 0;
626 }
627 #endif
628
629 if (copy_from_user(hdr, argp, sizeof(*hdr)))
630 return -EFAULT;
631
632 return 0;
633 }
634 EXPORT_SYMBOL(get_sg_io_hdr);
635
636 #ifdef CONFIG_COMPAT
637 struct compat_cdrom_generic_command {
638 unsigned char cmd[CDROM_PACKET_SIZE];
639 compat_caddr_t buffer;
640 compat_uint_t buflen;
641 compat_int_t stat;
642 compat_caddr_t sense;
643 unsigned char data_direction;
644 unsigned char pad[3];
645 compat_int_t quiet;
646 compat_int_t timeout;
647 compat_caddr_t unused;
648 };
649 #endif
650
scsi_get_cdrom_generic_arg(struct cdrom_generic_command * cgc,const void __user * arg)651 static int scsi_get_cdrom_generic_arg(struct cdrom_generic_command *cgc,
652 const void __user *arg)
653 {
654 #ifdef CONFIG_COMPAT
655 if (in_compat_syscall()) {
656 struct compat_cdrom_generic_command cgc32;
657
658 if (copy_from_user(&cgc32, arg, sizeof(cgc32)))
659 return -EFAULT;
660
661 *cgc = (struct cdrom_generic_command) {
662 .buffer = compat_ptr(cgc32.buffer),
663 .buflen = cgc32.buflen,
664 .stat = cgc32.stat,
665 .sense = compat_ptr(cgc32.sense),
666 .data_direction = cgc32.data_direction,
667 .quiet = cgc32.quiet,
668 .timeout = cgc32.timeout,
669 .unused = compat_ptr(cgc32.unused),
670 };
671 memcpy(&cgc->cmd, &cgc32.cmd, CDROM_PACKET_SIZE);
672 return 0;
673 }
674 #endif
675 if (copy_from_user(cgc, arg, sizeof(*cgc)))
676 return -EFAULT;
677
678 return 0;
679 }
680
scsi_put_cdrom_generic_arg(const struct cdrom_generic_command * cgc,void __user * arg)681 static int scsi_put_cdrom_generic_arg(const struct cdrom_generic_command *cgc,
682 void __user *arg)
683 {
684 #ifdef CONFIG_COMPAT
685 if (in_compat_syscall()) {
686 struct compat_cdrom_generic_command cgc32 = {
687 .buffer = (uintptr_t)(cgc->buffer),
688 .buflen = cgc->buflen,
689 .stat = cgc->stat,
690 .sense = (uintptr_t)(cgc->sense),
691 .data_direction = cgc->data_direction,
692 .quiet = cgc->quiet,
693 .timeout = cgc->timeout,
694 .unused = (uintptr_t)(cgc->unused),
695 };
696 memcpy(&cgc32.cmd, &cgc->cmd, CDROM_PACKET_SIZE);
697
698 if (copy_to_user(arg, &cgc32, sizeof(cgc32)))
699 return -EFAULT;
700
701 return 0;
702 }
703 #endif
704 if (copy_to_user(arg, cgc, sizeof(*cgc)))
705 return -EFAULT;
706
707 return 0;
708 }
709
scsi_cdrom_send_packet(struct request_queue * q,struct gendisk * bd_disk,fmode_t mode,void __user * arg)710 static int scsi_cdrom_send_packet(struct request_queue *q,
711 struct gendisk *bd_disk,
712 fmode_t mode, void __user *arg)
713 {
714 struct cdrom_generic_command cgc;
715 struct sg_io_hdr hdr;
716 int err;
717
718 err = scsi_get_cdrom_generic_arg(&cgc, arg);
719 if (err)
720 return err;
721
722 cgc.timeout = clock_t_to_jiffies(cgc.timeout);
723 memset(&hdr, 0, sizeof(hdr));
724 hdr.interface_id = 'S';
725 hdr.cmd_len = sizeof(cgc.cmd);
726 hdr.dxfer_len = cgc.buflen;
727 switch (cgc.data_direction) {
728 case CGC_DATA_UNKNOWN:
729 hdr.dxfer_direction = SG_DXFER_UNKNOWN;
730 break;
731 case CGC_DATA_WRITE:
732 hdr.dxfer_direction = SG_DXFER_TO_DEV;
733 break;
734 case CGC_DATA_READ:
735 hdr.dxfer_direction = SG_DXFER_FROM_DEV;
736 break;
737 case CGC_DATA_NONE:
738 hdr.dxfer_direction = SG_DXFER_NONE;
739 break;
740 default:
741 return -EINVAL;
742 }
743
744 hdr.dxferp = cgc.buffer;
745 hdr.sbp = cgc.sense;
746 if (hdr.sbp)
747 hdr.mx_sb_len = sizeof(struct request_sense);
748 hdr.timeout = jiffies_to_msecs(cgc.timeout);
749 hdr.cmdp = ((struct cdrom_generic_command __user*) arg)->cmd;
750 hdr.cmd_len = sizeof(cgc.cmd);
751
752 err = sg_io(q, bd_disk, &hdr, mode);
753 if (err == -EFAULT)
754 return -EFAULT;
755
756 if (hdr.status)
757 return -EIO;
758
759 cgc.stat = err;
760 cgc.buflen = hdr.resid;
761 if (scsi_put_cdrom_generic_arg(&cgc, arg))
762 return -EFAULT;
763
764 return err;
765 }
766
scsi_cmd_ioctl(struct request_queue * q,struct gendisk * bd_disk,fmode_t mode,unsigned int cmd,void __user * arg)767 int scsi_cmd_ioctl(struct request_queue *q, struct gendisk *bd_disk, fmode_t mode,
768 unsigned int cmd, void __user *arg)
769 {
770 int err;
771
772 if (!q)
773 return -ENXIO;
774
775 switch (cmd) {
776 /*
777 * new sgv3 interface
778 */
779 case SG_GET_VERSION_NUM:
780 err = sg_get_version(arg);
781 break;
782 case SCSI_IOCTL_GET_IDLUN:
783 err = scsi_get_idlun(q, arg);
784 break;
785 case SCSI_IOCTL_GET_BUS_NUMBER:
786 err = scsi_get_bus(q, arg);
787 break;
788 case SG_SET_TIMEOUT:
789 err = sg_set_timeout(q, arg);
790 break;
791 case SG_GET_TIMEOUT:
792 err = sg_get_timeout(q);
793 break;
794 case SG_GET_RESERVED_SIZE:
795 err = sg_get_reserved_size(q, arg);
796 break;
797 case SG_SET_RESERVED_SIZE:
798 err = sg_set_reserved_size(q, arg);
799 break;
800 case SG_EMULATED_HOST:
801 err = sg_emulated_host(q, arg);
802 break;
803 case SG_IO: {
804 struct sg_io_hdr hdr;
805
806 err = get_sg_io_hdr(&hdr, arg);
807 if (err)
808 break;
809 err = sg_io(q, bd_disk, &hdr, mode);
810 if (err == -EFAULT)
811 break;
812
813 if (put_sg_io_hdr(&hdr, arg))
814 err = -EFAULT;
815 break;
816 }
817 case CDROM_SEND_PACKET:
818 err = scsi_cdrom_send_packet(q, bd_disk, mode, arg);
819 break;
820
821 /*
822 * old junk scsi send command ioctl
823 */
824 case SCSI_IOCTL_SEND_COMMAND:
825 printk(KERN_WARNING "program %s is using a deprecated SCSI ioctl, please convert it to SG_IO\n", current->comm);
826 err = -EINVAL;
827 if (!arg)
828 break;
829
830 err = sg_scsi_ioctl(q, bd_disk, mode, arg);
831 break;
832 case CDROMCLOSETRAY:
833 err = blk_send_start_stop(q, bd_disk, 0x03);
834 break;
835 case CDROMEJECT:
836 err = blk_send_start_stop(q, bd_disk, 0x02);
837 break;
838 default:
839 err = -ENOTTY;
840 }
841
842 return err;
843 }
844 EXPORT_SYMBOL(scsi_cmd_ioctl);
845
scsi_verify_blk_ioctl(struct block_device * bd,unsigned int cmd)846 int scsi_verify_blk_ioctl(struct block_device *bd, unsigned int cmd)
847 {
848 if (bd && !bdev_is_partition(bd))
849 return 0;
850
851 if (capable(CAP_SYS_RAWIO))
852 return 0;
853
854 return -ENOIOCTLCMD;
855 }
856 EXPORT_SYMBOL(scsi_verify_blk_ioctl);
857
scsi_cmd_blk_ioctl(struct block_device * bd,fmode_t mode,unsigned int cmd,void __user * arg)858 int scsi_cmd_blk_ioctl(struct block_device *bd, fmode_t mode,
859 unsigned int cmd, void __user *arg)
860 {
861 int ret;
862
863 ret = scsi_verify_blk_ioctl(bd, cmd);
864 if (ret < 0)
865 return ret;
866
867 return scsi_cmd_ioctl(bd->bd_disk->queue, bd->bd_disk, mode, cmd, arg);
868 }
869 EXPORT_SYMBOL(scsi_cmd_blk_ioctl);
870
871 /**
872 * scsi_req_init - initialize certain fields of a scsi_request structure
873 * @req: Pointer to a scsi_request structure.
874 * Initializes .__cmd[], .cmd, .cmd_len and .sense_len but no other members
875 * of struct scsi_request.
876 */
scsi_req_init(struct scsi_request * req)877 void scsi_req_init(struct scsi_request *req)
878 {
879 memset(req->__cmd, 0, sizeof(req->__cmd));
880 req->cmd = req->__cmd;
881 req->cmd_len = BLK_MAX_CDB;
882 req->sense_len = 0;
883 }
884 EXPORT_SYMBOL(scsi_req_init);
885
blk_scsi_ioctl_init(void)886 static int __init blk_scsi_ioctl_init(void)
887 {
888 blk_set_cmd_filter_defaults(&blk_default_cmd_filter);
889 return 0;
890 }
891 fs_initcall(blk_scsi_ioctl_init);
892