drivers/scsi/sg.c

   1 /*
   2  *  History:
   3  *  Started: Aug 9 by Lawrence Foard (entropy@world.std.com),
   4  *           to allow user process control of SCSI devices.
   5  *  Development Sponsored by Killy Corp. NY NY
   6  *
   7  * Original driver (sg.c):
   8  *        Copyright (C) 1992 Lawrence Foard
   9  * Version 2 and 3 extensions to driver:
  10  *        Copyright (C) 1998 - 2005 Douglas Gilbert
  11  *
  12  *  Modified  19-JAN-1998  Richard Gooch <rgooch@atnf.csiro.au>  Devfs support
  13  *
  14  * This program is free software; you can redistribute it and/or modify
  15  * it under the terms of the GNU General Public License as published by
  16  * the Free Software Foundation; either version 2, or (at your option)
  17  * any later version.
  18  *
  19  */
  20
  21 static int sg_version_num = 30534;      /* 2 digits for each component */
  22 #define SG_VERSION_STR "3.5.34"
  23
  24 /*
  25  *  D. P. Gilbert (dgilbert@interlog.com, dougg@triode.net.au), notes:
  26  *      - scsi logging is available via SCSI_LOG_TIMEOUT macros. First
  27  *        the kernel/module needs to be built with CONFIG_SCSI_LOGGING
  28  *        (otherwise the macros compile to empty statements).
  29  *
  30  */
  31 #include <linux/module.h>
  32
  33 #include <linux/fs.h>
  34 #include <linux/kernel.h>
  35 #include <linux/sched.h>
  36 #include <linux/string.h>
  37 #include <linux/mm.h>
  38 #include <linux/errno.h>
  39 #include <linux/mtio.h>
  40 #include <linux/ioctl.h>
  41 #include <linux/fcntl.h>
  42 #include <linux/init.h>
  43 #include <linux/poll.h>
  44 #include <linux/moduleparam.h>
  45 #include <linux/cdev.h>
  46 #include <linux/idr.h>
  47 #include <linux/seq_file.h>
  48 #include <linux/blkdev.h>
  49 #include <linux/delay.h>
  50 #include <linux/scatterlist.h>
  51 #include <linux/blktrace_api.h>
  52 #include <linux/smp_lock.h>
  53
  54 #include "scsi.h"
  55 #include <scsi/scsi_dbg.h>
  56 #include <scsi/scsi_host.h>
  57 #include <scsi/scsi_driver.h>
  58 #include <scsi/scsi_ioctl.h>
  59 #include <scsi/sg.h>
  60
  61 #include "scsi_logging.h"
  62
  63 #ifdef CONFIG_SCSI_PROC_FS
  64 #include <linux/proc_fs.h>
  65 static char *sg_version_date = "20061027";
  66
  67 static int sg_proc_init(void);
  68 static void sg_proc_cleanup(void);
  69 #endif
  70
  71 #define SG_ALLOW_DIO_DEF 0
  72 #define SG_ALLOW_DIO_CODE /* compile out by commenting this define */
  73
  74 #define SG_MAX_DEVS 32768
  75
  76 /*
  77  * Suppose you want to calculate the formula muldiv(x,m,d)=int(x * m / d)
  78  * Then when using 32 bit integers x * m may overflow during the calculation.
  79  * Replacing muldiv(x) by muldiv(x)=((x % d) * m) / d + int(x / d) * m
  80  * calculates the same, but prevents the overflow when both m and d
  81  * are "small" numbers (like HZ and USER_HZ).
  82  * Of course an overflow is inavoidable if the result of muldiv doesn't fit
  83  * in 32 bits.
  84  */
  85 #define MULDIV(X,MUL,DIV) ((((X % DIV) * MUL) / DIV) + ((X / DIV) * MUL))
  86
  87 #define SG_DEFAULT_TIMEOUT MULDIV(SG_DEFAULT_TIMEOUT_USER, HZ, USER_HZ)
  88
  89 int sg_big_buff = SG_DEF_RESERVED_SIZE;
  90 /* N.B. This variable is readable and writeable via
  91    /proc/scsi/sg/def_reserved_size . Each time sg_open() is called a buffer
  92    of this size (or less if there is not enough memory) will be reserved
  93    for use by this file descriptor. [Deprecated usage: this variable is also
  94    readable via /proc/sys/kernel/sg-big-buff if the sg driver is built into
  95    the kernel (i.e. it is not a module).] */
  96 static int def_reserved_size = -1;      /* picks up init parameter */
  97 static int sg_allow_dio = SG_ALLOW_DIO_DEF;
  98
  99 static int scatter_elem_sz = SG_SCATTER_SZ;
 100 static int scatter_elem_sz_prev = SG_SCATTER_SZ;
 101
 102 #define SG_SECTOR_SZ 512
 103 #define SG_SECTOR_MSK (SG_SECTOR_SZ - 1)
 104
 105 static int sg_add(struct device *, struct class_interface *);
 106 static void sg_remove(struct device *, struct class_interface *);
 107
 108 static DEFINE_IDR(sg_index_idr);
 109 static DEFINE_RWLOCK(sg_index_lock);    /* Also used to lock
 110                                                            file descriptor list for device */
 111
 112 static struct class_interface sg_interface = {
 113         .add_dev        = sg_add,
 114         .remove_dev     = sg_remove,
 115 };
 116
 117 typedef struct sg_scatter_hold { /* holding area for scsi scatter gather info */
 118         unsigned short k_use_sg; /* Count of kernel scatter-gather pieces */
 119         unsigned sglist_len; /* size of malloc'd scatter-gather list ++ */
 120         unsigned bufflen;       /* Size of (aggregate) data buffer */
 121         unsigned b_malloc_len;  /* actual len malloc'ed in buffer */
 122         struct scatterlist *buffer;/* scatter list */
 123         char dio_in_use;        /* 0->indirect IO (or mmap), 1->dio */
 124         unsigned char cmd_opcode; /* first byte of command */
 125 } Sg_scatter_hold;
 126
 127 struct sg_device;               /* forward declarations */
 128 struct sg_fd;
 129
 130 typedef struct sg_request {     /* SG_MAX_QUEUE requests outstanding per file */
 131         struct sg_request *nextrp;      /* NULL -> tail request (slist) */
 132         struct sg_fd *parentfp; /* NULL -> not in use */
 133         Sg_scatter_hold data;   /* hold buffer, perhaps scatter list */
 134         sg_io_hdr_t header;     /* scsi command+info, see <scsi/sg.h> */
 135         unsigned char sense_b[SCSI_SENSE_BUFFERSIZE];
 136         char res_used;          /* 1 -> using reserve buffer, 0 -> not ... */
 137         char orphan;            /* 1 -> drop on sight, 0 -> normal */
 138         char sg_io_owned;       /* 1 -> packet belongs to SG_IO */
 139         volatile char done;     /* 0->before bh, 1->before read, 2->read */
 140         struct request *rq;
 141 } Sg_request;
 142
 143 typedef struct sg_fd {          /* holds the state of a file descriptor */
 144         struct sg_fd *nextfp;   /* NULL when last opened fd on this device */
 145         struct sg_device *parentdp;     /* owning device */
 146         wait_queue_head_t read_wait;    /* queue read until command done */
 147         rwlock_t rq_list_lock;  /* protect access to list in req_arr */
 148         int timeout;            /* defaults to SG_DEFAULT_TIMEOUT      */
 149         int timeout_user;       /* defaults to SG_DEFAULT_TIMEOUT_USER */
 150         Sg_scatter_hold reserve;        /* buffer held for this file descriptor */
 151         unsigned save_scat_len; /* original length of trunc. scat. element */
 152         Sg_request *headrp;     /* head of request slist, NULL->empty */
 153         struct fasync_struct *async_qp; /* used by asynchronous notification */
 154         Sg_request req_arr[SG_MAX_QUEUE];       /* used as singly-linked list */
 155         char low_dma;           /* as in parent but possibly overridden to 1 */
 156         char force_packid;      /* 1 -> pack_id input to read(), 0 -> ignored */
 157         volatile char closed;   /* 1 -> fd closed but request(s) outstanding */
 158         char cmd_q;             /* 1 -> allow command queuing, 0 -> don't */
 159         char next_cmd_len;      /* 0 -> automatic (def), >0 -> use on next write() */
 160         char keep_orphan;       /* 0 -> drop orphan (def), 1 -> keep for read() */
 161         char mmap_called;       /* 0 -> mmap() never called on this fd */
 162 } Sg_fd;
 163
 164 typedef struct sg_device { /* holds the state of each scsi generic device */
 165         struct scsi_device *device;
 166         wait_queue_head_t o_excl_wait;  /* queue open() when O_EXCL in use */
 167         int sg_tablesize;       /* adapter's max scatter-gather table size */
 168         u32 index;              /* device index number */
 169         Sg_fd *headfp;          /* first open fd belonging to this device */
 170         volatile char detached; /* 0->attached, 1->detached pending removal */
 171         volatile char exclude;  /* opened for exclusive access */
 172         char sgdebug;           /* 0->off, 1->sense, 9->dump dev, 10-> all devs */
 173         struct gendisk *disk;
 174         struct cdev * cdev;     /* char_dev [sysfs: /sys/cdev/major/sg<n>] */
 175 } Sg_device;
 176
 177 static int sg_fasync(int fd, struct file *filp, int mode);
 178 /* tasklet or soft irq callback */
 179 static void sg_cmd_done(void *data, char *sense, int result, int resid);
 180 static int sg_start_req(Sg_request *srp, unsigned char *cmd);
 181 static void sg_finish_rem_req(Sg_request * srp);
 182 static int sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size);
 183 static int sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp,
 184                          int tablesize);
 185 static ssize_t sg_new_read(Sg_fd * sfp, char __user *buf, size_t count,
 186                            Sg_request * srp);
 187 static ssize_t sg_new_write(Sg_fd *sfp, struct file *file,
 188                         const char __user *buf, size_t count, int blocking,
 189                         int read_only, Sg_request **o_srp);
 190 static int sg_common_write(Sg_fd * sfp, Sg_request * srp,
 191                            unsigned char *cmnd, int timeout, int blocking);
 192 static int sg_u_iovec(sg_io_hdr_t * hp, int sg_num, int ind,
 193                       int wr_xf, int *countp, unsigned char __user **up);
 194 static int sg_write_xfer(Sg_request * srp);
 195 static int sg_read_xfer(Sg_request * srp);
 196 static int sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer);
 197 static void sg_remove_scat(Sg_scatter_hold * schp);
 198 static void sg_build_reserve(Sg_fd * sfp, int req_size);
 199 static void sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size);
 200 static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp);
 201 static struct page *sg_page_malloc(int rqSz, int lowDma, int *retSzp);
 202 static void sg_page_free(struct page *page, int size);
 203 static Sg_fd *sg_add_sfp(Sg_device * sdp, int dev);
 204 static int sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp);
 205 static void __sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp);
 206 static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id);
 207 static Sg_request *sg_add_request(Sg_fd * sfp);
 208 static int sg_remove_request(Sg_fd * sfp, Sg_request * srp);
 209 static int sg_res_in_use(Sg_fd * sfp);
 210 static int sg_build_direct(Sg_request * srp, Sg_fd * sfp, int dxfer_len);
 211 static Sg_device *sg_get_dev(int dev);
 212 #ifdef CONFIG_SCSI_PROC_FS
 213 static int sg_last_dev(void);
 214 #endif
 215
 216 #define SZ_SG_HEADER sizeof(struct sg_header)
 217 #define SZ_SG_IO_HDR sizeof(sg_io_hdr_t)
 218 #define SZ_SG_IOVEC sizeof(sg_iovec_t)
 219 #define SZ_SG_REQ_INFO sizeof(sg_req_info_t)
 220
 221 static int sg_allow_access(struct file *filp, unsigned char *cmd)
 222 {
 223         struct sg_fd *sfp = (struct sg_fd *)filp->private_data;
 224         struct request_queue *q = sfp->parentdp->device->request_queue;
 225
 226         if (sfp->parentdp->device->type == TYPE_SCANNER)
 227                 return 0;
 228
 229         return blk_verify_command(&q->cmd_filter,
 230                                   cmd, filp->f_mode & FMODE_WRITE);
 231 }
 232
 233 static void sg_rq_end_io(struct request *rq, int uptodate)
 234 {
 235         sg_cmd_done(rq->end_io_data, rq->sense, rq->errors, rq->data_len);
 236 }
 237
 238 static int
 239 sg_open(struct inode *inode, struct file *filp)
 240 {
 241         int dev = iminor(inode);
 242         int flags = filp->f_flags;
 243         struct request_queue *q;
 244         Sg_device *sdp;
 245         Sg_fd *sfp;
 246         int res;
 247         int retval;
 248
 249         lock_kernel();
 250         nonseekable_open(inode, filp);
 251         SCSI_LOG_TIMEOUT(3, printk("sg_open: dev=%d, flags=0x%x\n", dev, flags));
 252         sdp = sg_get_dev(dev);
 253         if ((!sdp) || (!sdp->device)) {
 254                 unlock_kernel();
 255                 return -ENXIO;
 256         }
 257         if (sdp->detached) {
 258                 unlock_kernel();
 259                 return -ENODEV;
 260         }
 261
 262         /* This driver's module count bumped by fops_get in <linux/fs.h> */
 263         /* Prevent the device driver from vanishing while we sleep */
 264         retval = scsi_device_get(sdp->device);
 265         if (retval) {
 266                 unlock_kernel();
 267                 return retval;
 268         }
 269
 270         if (!((flags & O_NONBLOCK) ||
 271               scsi_block_when_processing_errors(sdp->device))) {
 272                 retval = -ENXIO;
 273                 /* we are in error recovery for this device */
 274                 goto error_out;
 275         }
 276
 277         if (flags & O_EXCL) {
 278                 if (O_RDONLY == (flags & O_ACCMODE)) {
 279                         retval = -EPERM; /* Can't lock it with read only access */
 280                         goto error_out;
 281                 }
 282                 if (sdp->headfp && (flags & O_NONBLOCK)) {
 283                         retval = -EBUSY;
 284                         goto error_out;
 285                 }
 286                 res = 0;
 287                 __wait_event_interruptible(sdp->o_excl_wait,
 288                         ((sdp->headfp || sdp->exclude) ? 0 : (sdp->exclude = 1)), res);
 289                 if (res) {
 290                         retval = res;   /* -ERESTARTSYS because signal hit process */
 291                         goto error_out;
 292                 }
 293         } else if (sdp->exclude) {      /* some other fd has an exclusive lock on dev */
 294                 if (flags & O_NONBLOCK) {
 295                         retval = -EBUSY;
 296                         goto error_out;
 297                 }
 298                 res = 0;
 299                 __wait_event_interruptible(sdp->o_excl_wait, (!sdp->exclude),
 300                                            res);
 301                 if (res) {
 302                         retval = res;   /* -ERESTARTSYS because signal hit process */
 303                         goto error_out;
 304                 }
 305         }
 306         if (sdp->detached) {
 307                 retval = -ENODEV;
 308                 goto error_out;
 309         }
 310         if (!sdp->headfp) {     /* no existing opens on this device */
 311                 sdp->sgdebug = 0;
 312                 q = sdp->device->request_queue;
 313                 sdp->sg_tablesize = min(q->max_hw_segments,
 314                                         q->max_phys_segments);
 315         }
 316         if ((sfp = sg_add_sfp(sdp, dev)))
 317                 filp->private_data = sfp;
 318         else {
 319                 if (flags & O_EXCL)
 320                         sdp->exclude = 0;       /* undo if error */
 321                 retval = -ENOMEM;
 322                 goto error_out;
 323         }
 324         unlock_kernel();
 325         return 0;
 326
 327       error_out:
 328         scsi_device_put(sdp->device);
 329         unlock_kernel();
 330         return retval;
 331 }
 332
 333 /* Following function was formerly called 'sg_close' */
 334 static int
 335 sg_release(struct inode *inode, struct file *filp)
 336 {
 337         Sg_device *sdp;
 338         Sg_fd *sfp;
 339
 340         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
 341                 return -ENXIO;
 342         SCSI_LOG_TIMEOUT(3, printk("sg_release: %s\n", sdp->disk->disk_name));
 343         sg_fasync(-1, filp, 0); /* remove filp from async notification list */
 344         if (0 == sg_remove_sfp(sdp, sfp)) {     /* Returns 1 when sdp gone */
 345                 if (!sdp->detached) {
 346                         scsi_device_put(sdp->device);
 347                 }
 348                 sdp->exclude = 0;
 349                 wake_up_interruptible(&sdp->o_excl_wait);
 350         }
 351         return 0;
 352 }
 353
 354 static ssize_t
 355 sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
 356 {
 357         Sg_device *sdp;
 358         Sg_fd *sfp;
 359         Sg_request *srp;
 360         int req_pack_id = -1;
 361         sg_io_hdr_t *hp;
 362         struct sg_header *old_hdr = NULL;
 363         int retval = 0;
 364
 365         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
 366                 return -ENXIO;
 367         SCSI_LOG_TIMEOUT(3, printk("sg_read: %s, count=%d\n",
 368                                    sdp->disk->disk_name, (int) count));
 369
 370         if (!access_ok(VERIFY_WRITE, buf, count))
 371                 return -EFAULT;
 372         if (sfp->force_packid && (count >= SZ_SG_HEADER)) {
 373                 old_hdr = kmalloc(SZ_SG_HEADER, GFP_KERNEL);
 374                 if (!old_hdr)
 375                         return -ENOMEM;
 376                 if (__copy_from_user(old_hdr, buf, SZ_SG_HEADER)) {
 377                         retval = -EFAULT;
 378                         goto free_old_hdr;
 379                 }
 380                 if (old_hdr->reply_len < 0) {
 381                         if (count >= SZ_SG_IO_HDR) {
 382                                 sg_io_hdr_t *new_hdr;
 383                                 new_hdr = kmalloc(SZ_SG_IO_HDR, GFP_KERNEL);
 384                                 if (!new_hdr) {
 385                                         retval = -ENOMEM;
 386                                         goto free_old_hdr;
 387                                 }
 388                                 retval =__copy_from_user
 389                                     (new_hdr, buf, SZ_SG_IO_HDR);
 390                                 req_pack_id = new_hdr->pack_id;
 391                                 kfree(new_hdr);
 392                                 if (retval) {
 393                                         retval = -EFAULT;
 394                                         goto free_old_hdr;
 395                                 }
 396                         }
 397                 } else
 398                         req_pack_id = old_hdr->pack_id;
 399         }
 400         srp = sg_get_rq_mark(sfp, req_pack_id);
 401         if (!srp) {             /* now wait on packet to arrive */
 402                 if (sdp->detached) {
 403                         retval = -ENODEV;
 404                         goto free_old_hdr;
 405                 }
 406                 if (filp->f_flags & O_NONBLOCK) {
 407                         retval = -EAGAIN;
 408                         goto free_old_hdr;
 409                 }
 410                 while (1) {
 411                         retval = 0; /* following macro beats race condition */
 412                         __wait_event_interruptible(sfp->read_wait,
 413                                 (sdp->detached ||
 414                                 (srp = sg_get_rq_mark(sfp, req_pack_id))),
 415                                 retval);
 416                         if (sdp->detached) {
 417                                 retval = -ENODEV;
 418                                 goto free_old_hdr;
 419                         }
 420                         if (0 == retval)
 421                                 break;
 422
 423                         /* -ERESTARTSYS as signal hit process */
 424                         goto free_old_hdr;
 425                 }
 426         }
 427         if (srp->header.interface_id != '\0') {
 428                 retval = sg_new_read(sfp, buf, count, srp);
 429                 goto free_old_hdr;
 430         }
 431
 432         hp = &srp->header;
 433         if (old_hdr == NULL) {
 434                 old_hdr = kmalloc(SZ_SG_HEADER, GFP_KERNEL);
 435                 if (! old_hdr) {
 436                         retval = -ENOMEM;
 437                         goto free_old_hdr;
 438                 }
 439         }
 440         memset(old_hdr, 0, SZ_SG_HEADER);
 441         old_hdr->reply_len = (int) hp->timeout;
 442         old_hdr->pack_len = old_hdr->reply_len; /* old, strange behaviour */
 443         old_hdr->pack_id = hp->pack_id;
 444         old_hdr->twelve_byte =
 445             ((srp->data.cmd_opcode >= 0xc0) && (12 == hp->cmd_len)) ? 1 : 0;
 446         old_hdr->target_status = hp->masked_status;
 447         old_hdr->host_status = hp->host_status;
 448         old_hdr->driver_status = hp->driver_status;
 449         if ((CHECK_CONDITION & hp->masked_status) ||
 450             (DRIVER_SENSE & hp->driver_status))
 451                 memcpy(old_hdr->sense_buffer, srp->sense_b,
 452                        sizeof (old_hdr->sense_buffer));
 453         switch (hp->host_status) {
 454         /* This setup of 'result' is for backward compatibility and is best
 455            ignored by the user who should use target, host + driver status */
 456         case DID_OK:
 457         case DID_PASSTHROUGH:
 458         case DID_SOFT_ERROR:
 459                 old_hdr->result = 0;
 460                 break;
 461         case DID_NO_CONNECT:
 462         case DID_BUS_BUSY:
 463         case DID_TIME_OUT:
 464                 old_hdr->result = EBUSY;
 465                 break;
 466         case DID_BAD_TARGET:
 467         case DID_ABORT:
 468         case DID_PARITY:
 469         case DID_RESET:
 470         case DID_BAD_INTR:
 471                 old_hdr->result = EIO;
 472                 break;
 473         case DID_ERROR:
 474                 old_hdr->result = (srp->sense_b[0] == 0 &&
 475                                   hp->masked_status == GOOD) ? 0 : EIO;
 476                 break;
 477         default:
 478                 old_hdr->result = EIO;
 479                 break;
 480         }
 481
 482         /* Now copy the result back to the user buffer.  */
 483         if (count >= SZ_SG_HEADER) {
 484                 if (__copy_to_user(buf, old_hdr, SZ_SG_HEADER)) {
 485                         retval = -EFAULT;
 486                         goto free_old_hdr;
 487                 }
 488                 buf += SZ_SG_HEADER;
 489                 if (count > old_hdr->reply_len)
 490                         count = old_hdr->reply_len;
 491                 if (count > SZ_SG_HEADER) {
 492                         if (sg_read_oxfer(srp, buf, count - SZ_SG_HEADER)) {
 493                                 retval = -EFAULT;
 494                                 goto free_old_hdr;
 495                         }
 496                 }
 497         } else
 498                 count = (old_hdr->result == 0) ? 0 : -EIO;
 499         sg_finish_rem_req(srp);
 500         retval = count;
 501 free_old_hdr:
 502         kfree(old_hdr);
 503         return retval;
 504 }
 505
 506 static ssize_t
 507 sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
 508 {
 509         sg_io_hdr_t *hp = &srp->header;
 510         int err = 0;
 511         int len;
 512
 513         if (count < SZ_SG_IO_HDR) {
 514                 err = -EINVAL;
 515                 goto err_out;
 516         }
 517         hp->sb_len_wr = 0;
 518         if ((hp->mx_sb_len > 0) && hp->sbp) {
 519                 if ((CHECK_CONDITION & hp->masked_status) ||
 520                     (DRIVER_SENSE & hp->driver_status)) {
 521                         int sb_len = SCSI_SENSE_BUFFERSIZE;
 522                         sb_len = (hp->mx_sb_len > sb_len) ? sb_len : hp->mx_sb_len;
 523                         len = 8 + (int) srp->sense_b[7];        /* Additional sense length field */
 524                         len = (len > sb_len) ? sb_len : len;
 525                         if (copy_to_user(hp->sbp, srp->sense_b, len)) {
 526                                 err = -EFAULT;
 527                                 goto err_out;
 528                         }
 529                         hp->sb_len_wr = len;
 530                 }
 531         }
 532         if (hp->masked_status || hp->host_status || hp->driver_status)
 533                 hp->info |= SG_INFO_CHECK;
 534         if (copy_to_user(buf, hp, SZ_SG_IO_HDR)) {
 535                 err = -EFAULT;
 536                 goto err_out;
 537         }
 538         err = sg_read_xfer(srp);
 539       err_out:
 540         sg_finish_rem_req(srp);
 541         return (0 == err) ? count : err;
 542 }
 543
 544 static ssize_t
 545 sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
 546 {
 547         int mxsize, cmd_size, k;
 548         int input_size, blocking;
 549         unsigned char opcode;
 550         Sg_device *sdp;
 551         Sg_fd *sfp;
 552         Sg_request *srp;
 553         struct sg_header old_hdr;
 554         sg_io_hdr_t *hp;
 555         unsigned char cmnd[MAX_COMMAND_SIZE];
 556
 557         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
 558                 return -ENXIO;
 559         SCSI_LOG_TIMEOUT(3, printk("sg_write: %s, count=%d\n",
 560                                    sdp->disk->disk_name, (int) count));
 561         if (sdp->detached)
 562                 return -ENODEV;
 563         if (!((filp->f_flags & O_NONBLOCK) ||
 564               scsi_block_when_processing_errors(sdp->device)))
 565                 return -ENXIO;
 566
 567         if (!access_ok(VERIFY_READ, buf, count))
 568                 return -EFAULT; /* protects following copy_from_user()s + get_user()s */
 569         if (count < SZ_SG_HEADER)
 570                 return -EIO;
 571         if (__copy_from_user(&old_hdr, buf, SZ_SG_HEADER))
 572                 return -EFAULT;
 573         blocking = !(filp->f_flags & O_NONBLOCK);
 574         if (old_hdr.reply_len < 0)
 575                 return sg_new_write(sfp, filp, buf, count, blocking, 0, NULL);
 576         if (count < (SZ_SG_HEADER + 6))
 577                 return -EIO;    /* The minimum scsi command length is 6 bytes. */
 578
 579         if (!(srp = sg_add_request(sfp))) {
 580                 SCSI_LOG_TIMEOUT(1, printk("sg_write: queue full\n"));
 581                 return -EDOM;
 582         }
 583         buf += SZ_SG_HEADER;
 584         __get_user(opcode, buf);
 585         if (sfp->next_cmd_len > 0) {
 586                 if (sfp->next_cmd_len > MAX_COMMAND_SIZE) {
 587                         SCSI_LOG_TIMEOUT(1, printk("sg_write: command length too long\n"));
 588                         sfp->next_cmd_len = 0;
 589                         sg_remove_request(sfp, srp);
 590                         return -EIO;
 591                 }
 592                 cmd_size = sfp->next_cmd_len;
 593                 sfp->next_cmd_len = 0;  /* reset so only this write() effected */
 594         } else {
 595                 cmd_size = COMMAND_SIZE(opcode);        /* based on SCSI command group */
 596                 if ((opcode >= 0xc0) && old_hdr.twelve_byte)
 597                         cmd_size = 12;
 598         }
 599         SCSI_LOG_TIMEOUT(4, printk(
 600                 "sg_write:   scsi opcode=0x%02x, cmd_size=%d\n", (int) opcode, cmd_size));
 601 /* Determine buffer size.  */
 602         input_size = count - cmd_size;
 603         mxsize = (input_size > old_hdr.reply_len) ? input_size : old_hdr.reply_len;
 604         mxsize -= SZ_SG_HEADER;
 605         input_size -= SZ_SG_HEADER;
 606         if (input_size < 0) {
 607                 sg_remove_request(sfp, srp);
 608                 return -EIO;    /* User did not pass enough bytes for this command. */
 609         }
 610         hp = &srp->header;
 611         hp->interface_id = '\0';        /* indicator of old interface tunnelled */
 612         hp->cmd_len = (unsigned char) cmd_size;
 613         hp->iovec_count = 0;
 614         hp->mx_sb_len = 0;
 615         if (input_size > 0)
 616                 hp->dxfer_direction = (old_hdr.reply_len > SZ_SG_HEADER) ?
 617                     SG_DXFER_TO_FROM_DEV : SG_DXFER_TO_DEV;
 618         else
 619                 hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE;
 620         hp->dxfer_len = mxsize;
 621         hp->dxferp = (char __user *)buf + cmd_size;
 622         hp->sbp = NULL;
 623         hp->timeout = old_hdr.reply_len;        /* structure abuse ... */
 624         hp->flags = input_size; /* structure abuse ... */
 625         hp->pack_id = old_hdr.pack_id;
 626         hp->usr_ptr = NULL;
 627         if (__copy_from_user(cmnd, buf, cmd_size))
 628                 return -EFAULT;
 629         /*
 630          * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV,
 631          * but is is possible that the app intended SG_DXFER_TO_DEV, because there
 632          * is a non-zero input_size, so emit a warning.
 633          */
 634         if (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV) {
 635                 static char cmd[TASK_COMM_LEN];
 636                 if (strcmp(current->comm, cmd) && printk_ratelimit()) {
 637                         printk(KERN_WARNING
 638                                "sg_write: data in/out %d/%d bytes for SCSI command 0x%x--"
 639                                "guessing data in;\n" KERN_WARNING "   "
 640                                "program %s not setting count and/or reply_len properly\n",
 641                                old_hdr.reply_len - (int)SZ_SG_HEADER,
 642                                input_size, (unsigned int) cmnd[0],
 643                                current->comm);
 644                         strcpy(cmd, current->comm);
 645                 }
 646         }
 647         k = sg_common_write(sfp, srp, cmnd, sfp->timeout, blocking);
 648         return (k < 0) ? k : count;
 649 }
 650
 651 static ssize_t
 652 sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
 653                  size_t count, int blocking, int read_only,
 654                  Sg_request **o_srp)
 655 {
 656         int k;
 657         Sg_request *srp;
 658         sg_io_hdr_t *hp;
 659         unsigned char cmnd[MAX_COMMAND_SIZE];
 660         int timeout;
 661         unsigned long ul_timeout;
 662
 663         if (count < SZ_SG_IO_HDR)
 664                 return -EINVAL;
 665         if (!access_ok(VERIFY_READ, buf, count))
 666                 return -EFAULT; /* protects following copy_from_user()s + get_user()s */
 667
 668         sfp->cmd_q = 1; /* when sg_io_hdr seen, set command queuing on */
 669         if (!(srp = sg_add_request(sfp))) {
 670                 SCSI_LOG_TIMEOUT(1, printk("sg_new_write: queue full\n"));
 671                 return -EDOM;
 672         }
 673         hp = &srp->header;
 674         if (__copy_from_user(hp, buf, SZ_SG_IO_HDR)) {
 675                 sg_remove_request(sfp, srp);
 676                 return -EFAULT;
 677         }
 678         if (hp->interface_id != 'S') {
 679                 sg_remove_request(sfp, srp);
 680                 return -ENOSYS;
 681         }
 682         if (hp->flags & SG_FLAG_MMAP_IO) {
 683                 if (hp->dxfer_len > sfp->reserve.bufflen) {
 684                         sg_remove_request(sfp, srp);
 685                         return -ENOMEM; /* MMAP_IO size must fit in reserve buffer */
 686                 }
 687                 if (hp->flags & SG_FLAG_DIRECT_IO) {
 688                         sg_remove_request(sfp, srp);
 689                         return -EINVAL; /* either MMAP_IO or DIRECT_IO (not both) */
 690                 }
 691                 if (sg_res_in_use(sfp)) {
 692                         sg_remove_request(sfp, srp);
 693                         return -EBUSY;  /* reserve buffer already being used */
 694                 }
 695         }
 696         ul_timeout = msecs_to_jiffies(srp->header.timeout);
 697         timeout = (ul_timeout < INT_MAX) ? ul_timeout : INT_MAX;
 698         if ((!hp->cmdp) || (hp->cmd_len < 6) || (hp->cmd_len > sizeof (cmnd))) {
 699                 sg_remove_request(sfp, srp);
 700                 return -EMSGSIZE;
 701         }
 702         if (!access_ok(VERIFY_READ, hp->cmdp, hp->cmd_len)) {
 703                 sg_remove_request(sfp, srp);
 704                 return -EFAULT; /* protects following copy_from_user()s + get_user()s */
 705         }
 706         if (__copy_from_user(cmnd, hp->cmdp, hp->cmd_len)) {
 707                 sg_remove_request(sfp, srp);
 708                 return -EFAULT;
 709         }
 710         if (read_only && sg_allow_access(file, cmnd)) {
 711                 sg_remove_request(sfp, srp);
 712                 return -EPERM;
 713         }
 714         k = sg_common_write(sfp, srp, cmnd, timeout, blocking);
 715         if (k < 0)
 716                 return k;
 717         if (o_srp)
 718                 *o_srp = srp;
 719         return count;
 720 }
 721
 722 static int
 723 sg_common_write(Sg_fd * sfp, Sg_request * srp,
 724                 unsigned char *cmnd, int timeout, int blocking)
 725 {
 726         int k, data_dir;
 727         Sg_device *sdp = sfp->parentdp;
 728         sg_io_hdr_t *hp = &srp->header;
 729
 730         srp->data.cmd_opcode = cmnd[0]; /* hold opcode of command */
 731         hp->status = 0;
 732         hp->masked_status = 0;
 733         hp->msg_status = 0;
 734         hp->info = 0;
 735         hp->host_status = 0;
 736         hp->driver_status = 0;
 737         hp->resid = 0;
 738         SCSI_LOG_TIMEOUT(4, printk("sg_common_write:  scsi opcode=0x%02x, cmd_size=%d\n",
 739                           (int) cmnd[0], (int) hp->cmd_len));
 740
 741         k = sg_start_req(srp, cmnd);
 742         if (k) {
 743                 SCSI_LOG_TIMEOUT(1, printk("sg_common_write: start_req err=%d\n", k));
 744                 sg_finish_rem_req(srp);
 745                 return k;       /* probably out of space --> ENOMEM */
 746         }
 747         if ((k = sg_write_xfer(srp))) {
 748                 SCSI_LOG_TIMEOUT(1, printk("sg_common_write: write_xfer, bad address\n"));
 749                 sg_finish_rem_req(srp);
 750                 return k;
 751         }
 752         if (sdp->detached) {
 753                 sg_finish_rem_req(srp);
 754                 return -ENODEV;
 755         }
 756
 757         switch (hp->dxfer_direction) {
 758         case SG_DXFER_TO_FROM_DEV:
 759         case SG_DXFER_FROM_DEV:
 760                 data_dir = DMA_FROM_DEVICE;
 761                 break;
 762         case SG_DXFER_TO_DEV:
 763                 data_dir = DMA_TO_DEVICE;
 764                 break;
 765         case SG_DXFER_UNKNOWN:
 766                 data_dir = DMA_BIDIRECTIONAL;
 767                 break;
 768         default:
 769                 data_dir = DMA_NONE;
 770                 break;
 771         }
 772         hp->duration = jiffies_to_msecs(jiffies);
 773 /* Now send everything of to mid-level. The next time we hear about this
 774    packet is when sg_cmd_done() is called (i.e. a callback). */
 775         if (srp->rq) {
 776                 srp->rq->timeout = timeout;
 777                 blk_execute_rq_nowait(sdp->device->request_queue, sdp->disk,
 778                                       srp->rq, 1, sg_rq_end_io);
 779                 return 0;
 780         }
 781         if (scsi_execute_async(sdp->device, cmnd, hp->cmd_len, data_dir, srp->data.buffer,
 782                                 hp->dxfer_len, srp->data.k_use_sg, timeout,
 783                                 SG_DEFAULT_RETRIES, srp, sg_cmd_done,
 784                                 GFP_ATOMIC)) {
 785                 SCSI_LOG_TIMEOUT(1, printk("sg_common_write: scsi_execute_async failed\n"));
 786                 /*
 787                  * most likely out of mem, but could also be a bad map
 788                  */
 789                 sg_finish_rem_req(srp);
 790                 return -ENOMEM;
 791         } else
 792                 return 0;
 793 }
 794
 795 static int
 796 sg_srp_done(Sg_request *srp, Sg_fd *sfp)
 797 {
 798         unsigned long iflags;
 799         int done;
 800
 801         read_lock_irqsave(&sfp->rq_list_lock, iflags);
 802         done = srp->done;
 803         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
 804         return done;
 805 }
 806
 807 static int
 808 sg_ioctl(struct inode *inode, struct file *filp,
 809          unsigned int cmd_in, unsigned long arg)
 810 {
 811         void __user *p = (void __user *)arg;
 812         int __user *ip = p;
 813         int result, val, read_only;
 814         Sg_device *sdp;
 815         Sg_fd *sfp;
 816         Sg_request *srp;
 817         unsigned long iflags;
 818
 819         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
 820                 return -ENXIO;
 821
 822         SCSI_LOG_TIMEOUT(3, printk("sg_ioctl: %s, cmd=0x%x\n",
 823                                    sdp->disk->disk_name, (int) cmd_in));
 824         read_only = (O_RDWR != (filp->f_flags & O_ACCMODE));
 825
 826         switch (cmd_in) {
 827         case SG_IO:
 828                 {
 829                         int blocking = 1;       /* ignore O_NONBLOCK flag */
 830
 831                         if (sdp->detached)
 832                                 return -ENODEV;
 833                         if (!scsi_block_when_processing_errors(sdp->device))
 834                                 return -ENXIO;
 835                         if (!access_ok(VERIFY_WRITE, p, SZ_SG_IO_HDR))
 836                                 return -EFAULT;
 837                         result =
 838                             sg_new_write(sfp, filp, p, SZ_SG_IO_HDR,
 839                                          blocking, read_only, &srp);
 840                         if (result < 0)
 841                                 return result;
 842                         srp->sg_io_owned = 1;
 843                         while (1) {
 844                                 result = 0;     /* following macro to beat race condition */
 845                                 __wait_event_interruptible(sfp->read_wait,
 846                                         (sdp->detached || sfp->closed || sg_srp_done(srp, sfp)),
 847                                                            result);
 848                                 if (sdp->detached)
 849                                         return -ENODEV;
 850                                 if (sfp->closed)
 851                                         return 0;       /* request packet dropped already */
 852                                 if (0 == result)
 853                                         break;
 854                                 srp->orphan = 1;
 855                                 return result;  /* -ERESTARTSYS because signal hit process */
 856                         }
 857                         write_lock_irqsave(&sfp->rq_list_lock, iflags);
 858                         srp->done = 2;
 859                         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
 860                         result = sg_new_read(sfp, p, SZ_SG_IO_HDR, srp);
 861                         return (result < 0) ? result : 0;
 862                 }
 863         case SG_SET_TIMEOUT:
 864                 result = get_user(val, ip);
 865                 if (result)
 866                         return result;
 867                 if (val < 0)
 868                         return -EIO;
 869                 if (val >= MULDIV (INT_MAX, USER_HZ, HZ))
 870                     val = MULDIV (INT_MAX, USER_HZ, HZ);
 871                 sfp->timeout_user = val;
 872                 sfp->timeout = MULDIV (val, HZ, USER_HZ);
 873
 874                 return 0;
 875         case SG_GET_TIMEOUT:    /* N.B. User receives timeout as return value */
 876                                 /* strange ..., for backward compatibility */
 877                 return sfp->timeout_user;
 878         case SG_SET_FORCE_LOW_DMA:
 879                 result = get_user(val, ip);
 880                 if (result)
 881                         return result;
 882                 if (val) {
 883                         sfp->low_dma = 1;
 884                         if ((0 == sfp->low_dma) && (0 == sg_res_in_use(sfp))) {
 885                                 val = (int) sfp->reserve.bufflen;
 886                                 sg_remove_scat(&sfp->reserve);
 887                                 sg_build_reserve(sfp, val);
 888                         }
 889                 } else {
 890                         if (sdp->detached)
 891                                 return -ENODEV;
 892                         sfp->low_dma = sdp->device->host->unchecked_isa_dma;
 893                 }
 894                 return 0;
 895         case SG_GET_LOW_DMA:
 896                 return put_user((int) sfp->low_dma, ip);
 897         case SG_GET_SCSI_ID:
 898                 if (!access_ok(VERIFY_WRITE, p, sizeof (sg_scsi_id_t)))
 899                         return -EFAULT;
 900                 else {
 901                         sg_scsi_id_t __user *sg_idp = p;
 902
 903                         if (sdp->detached)
 904                                 return -ENODEV;
 905                         __put_user((int) sdp->device->host->host_no,
 906                                    &sg_idp->host_no);
 907                         __put_user((int) sdp->device->channel,
 908                                    &sg_idp->channel);
 909                         __put_user((int) sdp->device->id, &sg_idp->scsi_id);
 910                         __put_user((int) sdp->device->lun, &sg_idp->lun);
 911                         __put_user((int) sdp->device->type, &sg_idp->scsi_type);
 912                         __put_user((short) sdp->device->host->cmd_per_lun,
 913                                    &sg_idp->h_cmd_per_lun);
 914                         __put_user((short) sdp->device->queue_depth,
 915                                    &sg_idp->d_queue_depth);
 916                         __put_user(0, &sg_idp->unused[0]);
 917                         __put_user(0, &sg_idp->unused[1]);
 918                         return 0;
 919                 }
 920         case SG_SET_FORCE_PACK_ID:
 921                 result = get_user(val, ip);
 922                 if (result)
 923                         return result;
 924                 sfp->force_packid = val ? 1 : 0;
 925                 return 0;
 926         case SG_GET_PACK_ID:
 927                 if (!access_ok(VERIFY_WRITE, ip, sizeof (int)))
 928                         return -EFAULT;
 929                 read_lock_irqsave(&sfp->rq_list_lock, iflags);
 930                 for (srp = sfp->headrp; srp; srp = srp->nextrp) {
 931                         if ((1 == srp->done) && (!srp->sg_io_owned)) {
 932                                 read_unlock_irqrestore(&sfp->rq_list_lock,
 933                                                        iflags);
 934                                 __put_user(srp->header.pack_id, ip);
 935                                 return 0;
 936                         }
 937                 }
 938                 read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
 939                 __put_user(-1, ip);
 940                 return 0;
 941         case SG_GET_NUM_WAITING:
 942                 read_lock_irqsave(&sfp->rq_list_lock, iflags);
 943                 for (val = 0, srp = sfp->headrp; srp; srp = srp->nextrp) {
 944                         if ((1 == srp->done) && (!srp->sg_io_owned))
 945                                 ++val;
 946                 }
 947                 read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
 948                 return put_user(val, ip);
 949         case SG_GET_SG_TABLESIZE:
 950                 return put_user(sdp->sg_tablesize, ip);
 951         case SG_SET_RESERVED_SIZE:
 952                 result = get_user(val, ip);
 953                 if (result)
 954                         return result;
 955                 if (val < 0)
 956                         return -EINVAL;
 957                 val = min_t(int, val,
 958                                 sdp->device->request_queue->max_sectors * 512);
 959                 if (val != sfp->reserve.bufflen) {
 960                         if (sg_res_in_use(sfp) || sfp->mmap_called)
 961                                 return -EBUSY;
 962                         sg_remove_scat(&sfp->reserve);
 963                         sg_build_reserve(sfp, val);
 964                 }
 965                 return 0;
 966         case SG_GET_RESERVED_SIZE:
 967                 val = min_t(int, sfp->reserve.bufflen,
 968                                 sdp->device->request_queue->max_sectors * 512);
 969                 return put_user(val, ip);
 970         case SG_SET_COMMAND_Q:
 971                 result = get_user(val, ip);
 972                 if (result)
 973                         return result;
 974                 sfp->cmd_q = val ? 1 : 0;
 975                 return 0;
 976         case SG_GET_COMMAND_Q:
 977                 return put_user((int) sfp->cmd_q, ip);
 978         case SG_SET_KEEP_ORPHAN:
 979                 result = get_user(val, ip);
 980                 if (result)
 981                         return result;
 982                 sfp->keep_orphan = val;
 983                 return 0;
 984         case SG_GET_KEEP_ORPHAN:
 985                 return put_user((int) sfp->keep_orphan, ip);
 986         case SG_NEXT_CMD_LEN:
 987                 result = get_user(val, ip);
 988                 if (result)
 989                         return result;
 990                 sfp->next_cmd_len = (val > 0) ? val : 0;
 991                 return 0;
 992         case SG_GET_VERSION_NUM:
 993                 return put_user(sg_version_num, ip);
 994         case SG_GET_ACCESS_COUNT:
 995                 /* faked - we don't have a real access count anymore */
 996                 val = (sdp->device ? 1 : 0);
 997                 return put_user(val, ip);
 998         case SG_GET_REQUEST_TABLE:
 999                 if (!access_ok(VERIFY_WRITE, p, SZ_SG_REQ_INFO * SG_MAX_QUEUE))
1000                         return -EFAULT;
1001                 else {
1002                         sg_req_info_t *rinfo;
1003                         unsigned int ms;
1004
1005                         rinfo = kmalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
1006                                                                 GFP_KERNEL);
1007                         if (!rinfo)
1008                                 return -ENOMEM;
1009                         read_lock_irqsave(&sfp->rq_list_lock, iflags);
1010                         for (srp = sfp->headrp, val = 0; val < SG_MAX_QUEUE;
1011                              ++val, srp = srp ? srp->nextrp : srp) {
1012                                 memset(&rinfo[val], 0, SZ_SG_REQ_INFO);
1013                                 if (srp) {
1014                                         rinfo[val].req_state = srp->done + 1;
1015                                         rinfo[val].problem =
1016                                             srp->header.masked_status &
1017                                             srp->header.host_status &
1018                                             srp->header.driver_status;
1019                                         if (srp->done)
1020                                                 rinfo[val].duration =
1021                                                         srp->header.duration;
1022                                         else {
1023                                                 ms = jiffies_to_msecs(jiffies);
1024                                                 rinfo[val].duration =
1025                                                     (ms > srp->header.duration) ?
1026                                                     (ms - srp->header.duration) : 0;
1027                                         }
1028                                         rinfo[val].orphan = srp->orphan;
1029                                         rinfo[val].sg_io_owned =
1030                                                         srp->sg_io_owned;
1031                                         rinfo[val].pack_id =
1032                                                         srp->header.pack_id;
1033                                         rinfo[val].usr_ptr =
1034                                                         srp->header.usr_ptr;
1035                                 }
1036                         }
1037                         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
1038                         result = __copy_to_user(p, rinfo,
1039                                                 SZ_SG_REQ_INFO * SG_MAX_QUEUE);
1040                         result = result ? -EFAULT : 0;
1041                         kfree(rinfo);
1042                         return result;
1043                 }
1044         case SG_EMULATED_HOST:
1045                 if (sdp->detached)
1046                         return -ENODEV;
1047                 return put_user(sdp->device->host->hostt->emulated, ip);
1048         case SG_SCSI_RESET:
1049                 if (sdp->detached)
1050                         return -ENODEV;
1051                 if (filp->f_flags & O_NONBLOCK) {
1052                         if (scsi_host_in_recovery(sdp->device->host))
1053                                 return -EBUSY;
1054                 } else if (!scsi_block_when_processing_errors(sdp->device))
1055                         return -EBUSY;
1056                 result = get_user(val, ip);
1057                 if (result)
1058                         return result;
1059                 if (SG_SCSI_RESET_NOTHING == val)
1060                         return 0;
1061                 switch (val) {
1062                 case SG_SCSI_RESET_DEVICE:
1063                         val = SCSI_TRY_RESET_DEVICE;
1064                         break;
1065                 case SG_SCSI_RESET_TARGET:
1066                         val = SCSI_TRY_RESET_TARGET;
1067                         break;
1068                 case SG_SCSI_RESET_BUS:
1069                         val = SCSI_TRY_RESET_BUS;
1070                         break;
1071                 case SG_SCSI_RESET_HOST:
1072                         val = SCSI_TRY_RESET_HOST;
1073                         break;
1074                 default:
1075                         return -EINVAL;
1076                 }
1077                 if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
1078                         return -EACCES;
1079                 return (scsi_reset_provider(sdp->device, val) ==
1080                         SUCCESS) ? 0 : -EIO;
1081         case SCSI_IOCTL_SEND_COMMAND:
1082                 if (sdp->detached)
1083                         return -ENODEV;
1084                 if (read_only) {
1085                         unsigned char opcode = WRITE_6;
1086                         Scsi_Ioctl_Command __user *siocp = p;
1087
1088                         if (copy_from_user(&opcode, siocp->data, 1))
1089                                 return -EFAULT;
1090                         if (sg_allow_access(filp, &opcode))
1091                                 return -EPERM;
1092                 }
1093                 return sg_scsi_ioctl(filp, sdp->device->request_queue, NULL, p);
1094         case SG_SET_DEBUG:
1095                 result = get_user(val, ip);
1096                 if (result)
1097                         return result;
1098                 sdp->sgdebug = (char) val;
1099                 return 0;
1100         case SCSI_IOCTL_GET_IDLUN:
1101         case SCSI_IOCTL_GET_BUS_NUMBER:
1102         case SCSI_IOCTL_PROBE_HOST:
1103         case SG_GET_TRANSFORM:
1104                 if (sdp->detached)
1105                         return -ENODEV;
1106                 return scsi_ioctl(sdp->device, cmd_in, p);
1107         case BLKSECTGET:
1108                 return put_user(sdp->device->request_queue->max_sectors * 512,
1109                                 ip);
1110         case BLKTRACESETUP:
1111                 return blk_trace_setup(sdp->device->request_queue,
1112                                        sdp->disk->disk_name,
1113                                        sdp->device->sdev_gendev.devt,
1114                                        (char *)arg);
1115         case BLKTRACESTART:
1116                 return blk_trace_startstop(sdp->device->request_queue, 1);
1117         case BLKTRACESTOP:
1118                 return blk_trace_startstop(sdp->device->request_queue, 0);
1119         case BLKTRACETEARDOWN:
1120                 return blk_trace_remove(sdp->device->request_queue);
1121         default:
1122                 if (read_only)
1123                         return -EPERM;  /* don't know so take safe approach */
1124                 return scsi_ioctl(sdp->device, cmd_in, p);
1125         }
1126 }
1127
1128 #ifdef CONFIG_COMPAT
1129 static long sg_compat_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
1130 {
1131         Sg_device *sdp;
1132         Sg_fd *sfp;
1133         struct scsi_device *sdev;
1134
1135         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
1136                 return -ENXIO;
1137
1138         sdev = sdp->device;
1139         if (sdev->host->hostt->compat_ioctl) {
1140                 int ret;
1141
1142                 ret = sdev->host->hostt->compat_ioctl(sdev, cmd_in, (void __user *)arg);
1143
1144                 return ret;
1145         }
1146
1147         return -ENOIOCTLCMD;
1148 }
1149 #endif
1150
1151 static unsigned int
1152 sg_poll(struct file *filp, poll_table * wait)
1153 {
1154         unsigned int res = 0;
1155         Sg_device *sdp;
1156         Sg_fd *sfp;
1157         Sg_request *srp;
1158         int count = 0;
1159         unsigned long iflags;
1160
1161         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp))
1162             || sfp->closed)
1163                 return POLLERR;
1164         poll_wait(filp, &sfp->read_wait, wait);
1165         read_lock_irqsave(&sfp->rq_list_lock, iflags);
1166         for (srp = sfp->headrp; srp; srp = srp->nextrp) {
1167                 /* if any read waiting, flag it */
1168                 if ((0 == res) && (1 == srp->done) && (!srp->sg_io_owned))
1169                         res = POLLIN | POLLRDNORM;
1170                 ++count;
1171         }
1172         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
1173
1174         if (sdp->detached)
1175                 res |= POLLHUP;
1176         else if (!sfp->cmd_q) {
1177                 if (0 == count)
1178                         res |= POLLOUT | POLLWRNORM;
1179         } else if (count < SG_MAX_QUEUE)
1180                 res |= POLLOUT | POLLWRNORM;
1181         SCSI_LOG_TIMEOUT(3, printk("sg_poll: %s, res=0x%x\n",
1182                                    sdp->disk->disk_name, (int) res));
1183         return res;
1184 }
1185
1186 static int
1187 sg_fasync(int fd, struct file *filp, int mode)
1188 {
1189         int retval;
1190         Sg_device *sdp;
1191         Sg_fd *sfp;
1192
1193         if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
1194                 return -ENXIO;
1195         SCSI_LOG_TIMEOUT(3, printk("sg_fasync: %s, mode=%d\n",
1196                                    sdp->disk->disk_name, mode));
1197
1198         retval = fasync_helper(fd, filp, mode, &sfp->async_qp);
1199         return (retval < 0) ? retval : 0;
1200 }
1201
1202 static int
1203 sg_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
1204 {
1205         Sg_fd *sfp;
1206         unsigned long offset, len, sa;
1207         Sg_scatter_hold *rsv_schp;
1208         struct scatterlist *sg;
1209         int k;
1210
1211         if ((NULL == vma) || (!(sfp = (Sg_fd *) vma->vm_private_data)))
1212                 return VM_FAULT_SIGBUS;
1213         rsv_schp = &sfp->reserve;
1214         offset = vmf->pgoff << PAGE_SHIFT;
1215         if (offset >= rsv_schp->bufflen)
1216                 return VM_FAULT_SIGBUS;
1217         SCSI_LOG_TIMEOUT(3, printk("sg_vma_fault: offset=%lu, scatg=%d\n",
1218                                    offset, rsv_schp->k_use_sg));
1219         sg = rsv_schp->buffer;
1220         sa = vma->vm_start;
1221         for (k = 0; (k < rsv_schp->k_use_sg) && (sa < vma->vm_end);
1222              ++k, sg = sg_next(sg)) {
1223                 len = vma->vm_end - sa;
1224                 len = (len < sg->length) ? len : sg->length;
1225                 if (offset < len) {
1226                         struct page *page;
1227                         page = virt_to_page(page_address(sg_page(sg)) + offset);
1228                         get_page(page); /* increment page count */
1229                         vmf->page = page;
1230                         return 0; /* success */
1231                 }
1232                 sa += len;
1233                 offset -= len;
1234         }
1235
1236         return VM_FAULT_SIGBUS;
1237 }
1238
1239 static struct vm_operations_struct sg_mmap_vm_ops = {
1240         .fault = sg_vma_fault,
1241 };
1242
1243 static int
1244 sg_mmap(struct file *filp, struct vm_area_struct *vma)
1245 {
1246         Sg_fd *sfp;
1247         unsigned long req_sz, len, sa;
1248         Sg_scatter_hold *rsv_schp;
1249         int k;
1250         struct scatterlist *sg;
1251
1252         if ((!filp) || (!vma) || (!(sfp = (Sg_fd *) filp->private_data)))
1253                 return -ENXIO;
1254         req_sz = vma->vm_end - vma->vm_start;
1255         SCSI_LOG_TIMEOUT(3, printk("sg_mmap starting, vm_start=%p, len=%d\n",
1256                                    (void *) vma->vm_start, (int) req_sz));
1257         if (vma->vm_pgoff)
1258                 return -EINVAL; /* want no offset */
1259         rsv_schp = &sfp->reserve;
1260         if (req_sz > rsv_schp->bufflen)
1261                 return -ENOMEM; /* cannot map more than reserved buffer */
1262
1263         sa = vma->vm_start;
1264         sg = rsv_schp->buffer;
1265         for (k = 0; (k < rsv_schp->k_use_sg) && (sa < vma->vm_end);
1266              ++k, sg = sg_next(sg)) {
1267                 len = vma->vm_end - sa;
1268                 len = (len < sg->length) ? len : sg->length;
1269                 sa += len;
1270         }
1271
1272         sfp->mmap_called = 1;
1273         vma->vm_flags |= VM_RESERVED;
1274         vma->vm_private_data = sfp;
1275         vma->vm_ops = &sg_mmap_vm_ops;
1276         return 0;
1277 }
1278
1279 /* This function is a "bottom half" handler that is called by the
1280  * mid level when a command is completed (or has failed). */
1281 static void
1282 sg_cmd_done(void *data, char *sense, int result, int resid)
1283 {
1284         Sg_request *srp = data;
1285         Sg_device *sdp = NULL;
1286         Sg_fd *sfp;
1287         unsigned long iflags;
1288         unsigned int ms;
1289
1290         if (NULL == srp) {
1291                 printk(KERN_ERR "sg_cmd_done: NULL request\n");
1292                 return;
1293         }
1294         sfp = srp->parentfp;
1295         if (sfp)
1296                 sdp = sfp->parentdp;
1297         if ((NULL == sdp) || sdp->detached) {
1298                 printk(KERN_INFO "sg_cmd_done: device detached\n");
1299                 return;
1300         }
1301
1302
1303         SCSI_LOG_TIMEOUT(4, printk("sg_cmd_done: %s, pack_id=%d, res=0x%x\n",
1304                 sdp->disk->disk_name, srp->header.pack_id, result));
1305         srp->header.resid = resid;
1306         ms = jiffies_to_msecs(jiffies);
1307         srp->header.duration = (ms > srp->header.duration) ?
1308                                 (ms - srp->header.duration) : 0;
1309         if (0 != result) {
1310                 struct scsi_sense_hdr sshdr;
1311
1312                 memcpy(srp->sense_b, sense, sizeof (srp->sense_b));
1313                 srp->header.status = 0xff & result;
1314                 srp->header.masked_status = status_byte(result);
1315                 srp->header.msg_status = msg_byte(result);
1316                 srp->header.host_status = host_byte(result);
1317                 srp->header.driver_status = driver_byte(result);
1318                 if ((sdp->sgdebug > 0) &&
1319                     ((CHECK_CONDITION == srp->header.masked_status) ||
1320                      (COMMAND_TERMINATED == srp->header.masked_status)))
1321                         __scsi_print_sense("sg_cmd_done", sense,
1322                                            SCSI_SENSE_BUFFERSIZE);
1323
1324                 /* Following if statement is a patch supplied by Eric Youngdale */
1325                 if (driver_byte(result) != 0
1326                     && scsi_normalize_sense(sense, SCSI_SENSE_BUFFERSIZE, &sshdr)
1327                     && !scsi_sense_is_deferred(&sshdr)
1328                     && sshdr.sense_key == UNIT_ATTENTION
1329                     && sdp->device->removable) {
1330                         /* Detected possible disc change. Set the bit - this */
1331                         /* may be used if there are filesystems using this device */
1332                         sdp->device->changed = 1;
1333                 }
1334         }
1335         /* Rely on write phase to clean out srp status values, so no "else" */
1336
1337         if (sfp->closed) {      /* whoops this fd already released, cleanup */
1338                 SCSI_LOG_TIMEOUT(1, printk("sg_cmd_done: already closed, freeing ...\n"));
1339                 sg_finish_rem_req(srp);
1340                 srp = NULL;
1341                 if (NULL == sfp->headrp) {
1342                         SCSI_LOG_TIMEOUT(1, printk("sg_cmd_done: already closed, final cleanup\n"));
1343                         if (0 == sg_remove_sfp(sdp, sfp)) {     /* device still present */
1344                                 scsi_device_put(sdp->device);
1345                         }
1346                         sfp = NULL;
1347                 }
1348         } else if (srp && srp->orphan) {
1349                 if (sfp->keep_orphan)
1350                         srp->sg_io_owned = 0;
1351                 else {
1352                         sg_finish_rem_req(srp);
1353                         srp = NULL;
1354                 }
1355         }
1356         if (sfp && srp) {
1357                 /* Now wake up any sg_read() that is waiting for this packet. */
1358                 kill_fasync(&sfp->async_qp, SIGPOLL, POLL_IN);
1359                 write_lock_irqsave(&sfp->rq_list_lock, iflags);
1360                 srp->done = 1;
1361                 wake_up_interruptible(&sfp->read_wait);
1362                 write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
1363         }
1364 }
1365
1366 static struct file_operations sg_fops = {
1367         .owner = THIS_MODULE,
1368         .read = sg_read,
1369         .write = sg_write,
1370         .poll = sg_poll,
1371         .ioctl = sg_ioctl,
1372 #ifdef CONFIG_COMPAT
1373         .compat_ioctl = sg_compat_ioctl,
1374 #endif
1375         .open = sg_open,
1376         .mmap = sg_mmap,
1377         .release = sg_release,
1378         .fasync = sg_fasync,
1379 };
1380
1381 static struct class *sg_sysfs_class;
1382
1383 static int sg_sysfs_valid = 0;
1384
1385 static Sg_device *sg_alloc(struct gendisk *disk, struct scsi_device *scsidp)
1386 {
1387         struct request_queue *q = scsidp->request_queue;
1388         Sg_device *sdp;
1389         unsigned long iflags;
1390         int error;
1391         u32 k;
1392
1393         sdp = kzalloc(sizeof(Sg_device), GFP_KERNEL);
1394         if (!sdp) {
1395                 printk(KERN_WARNING "kmalloc Sg_device failure\n");
1396                 return ERR_PTR(-ENOMEM);
1397         }
1398         error = -ENOMEM;
1399         if (!idr_pre_get(&sg_index_idr, GFP_KERNEL)) {
1400                 printk(KERN_WARNING "idr expansion Sg_device failure\n");
1401                 goto out;
1402         }
1403
1404         write_lock_irqsave(&sg_index_lock, iflags);
1405         error = idr_get_new(&sg_index_idr, sdp, &k);
1406         write_unlock_irqrestore(&sg_index_lock, iflags);
1407
1408         if (error) {
1409                 printk(KERN_WARNING "idr allocation Sg_device failure: %d\n",
1410                        error);
1411                 goto out;
1412         }
1413
1414         if (unlikely(k >= SG_MAX_DEVS))
1415                 goto overflow;
1416
1417         SCSI_LOG_TIMEOUT(3, printk("sg_alloc: dev=%d \n", k));
1418         sprintf(disk->disk_name, "sg%d", k);
1419         disk->first_minor = k;
1420         sdp->disk = disk;
1421         sdp->device = scsidp;
1422         init_waitqueue_head(&sdp->o_excl_wait);
1423         sdp->sg_tablesize = min(q->max_hw_segments, q->max_phys_segments);
1424         sdp->index = k;
1425
1426         error = 0;
1427  out:
1428         if (error) {
1429                 kfree(sdp);
1430                 return ERR_PTR(error);
1431         }
1432         return sdp;
1433
1434  overflow:
1435         sdev_printk(KERN_WARNING, scsidp,
1436                     "Unable to attach sg device type=%d, minor "
1437                     "number exceeds %d\n", scsidp->type, SG_MAX_DEVS - 1);
1438         error = -ENODEV;
1439         goto out;
1440 }
1441
1442 static int
1443 sg_add(struct device *cl_dev, struct class_interface *cl_intf)
1444 {
1445         struct scsi_device *scsidp = to_scsi_device(cl_dev->parent);
1446         struct gendisk *disk;
1447         Sg_device *sdp = NULL;
1448         struct cdev * cdev = NULL;
1449         int error;
1450         unsigned long iflags;
1451
1452         disk = alloc_disk(1);
1453         if (!disk) {
1454                 printk(KERN_WARNING "alloc_disk failed\n");
1455                 return -ENOMEM;
1456         }
1457         disk->major = SCSI_GENERIC_MAJOR;
1458
1459         error = -ENOMEM;
1460         cdev = cdev_alloc();
1461         if (!cdev) {
1462                 printk(KERN_WARNING "cdev_alloc failed\n");
1463                 goto out;
1464         }
1465         cdev->owner = THIS_MODULE;
1466         cdev->ops = &sg_fops;
1467
1468         sdp = sg_alloc(disk, scsidp);
1469         if (IS_ERR(sdp)) {
1470                 printk(KERN_WARNING "sg_alloc failed\n");
1471                 error = PTR_ERR(sdp);
1472                 goto out;
1473         }
1474
1475         error = cdev_add(cdev, MKDEV(SCSI_GENERIC_MAJOR, sdp->index), 1);
1476         if (error)
1477                 goto cdev_add_err;
1478
1479         sdp->cdev = cdev;
1480         if (sg_sysfs_valid) {
1481                 struct device *sg_class_member;
1482
1483                 sg_class_member = device_create_drvdata(sg_sysfs_class,
1484                                                         cl_dev->parent,
1485                                                         MKDEV(SCSI_GENERIC_MAJOR,
1486                                                               sdp->index),
1487                                                         sdp,
1488                                                         "%s", disk->disk_name);
1489                 if (IS_ERR(sg_class_member)) {
1490                         printk(KERN_ERR "sg_add: "
1491                                "device_create failed\n");
1492                         error = PTR_ERR(sg_class_member);
1493                         goto cdev_add_err;
1494                 }
1495                 error = sysfs_create_link(&scsidp->sdev_gendev.kobj,
1496                                           &sg_class_member->kobj, "generic");
1497                 if (error)
1498                         printk(KERN_ERR "sg_add: unable to make symlink "
1499                                         "'generic' back to sg%d\n", sdp->index);
1500         } else
1501                 printk(KERN_WARNING "sg_add: sg_sys Invalid\n");
1502
1503         sdev_printk(KERN_NOTICE, scsidp,
1504                     "Attached scsi generic sg%d type %d\n", sdp->index,
1505                     scsidp->type);
1506
1507         dev_set_drvdata(cl_dev, sdp);
1508
1509         return 0;
1510
1511 cdev_add_err:
1512         write_lock_irqsave(&sg_index_lock, iflags);
1513         idr_remove(&sg_index_idr, sdp->index);
1514         write_unlock_irqrestore(&sg_index_lock, iflags);
1515         kfree(sdp);
1516
1517 out:
1518         put_disk(disk);
1519         if (cdev)
1520                 cdev_del(cdev);
1521         return error;
1522 }
1523
1524 static void
1525 sg_remove(struct device *cl_dev, struct class_interface *cl_intf)
1526 {
1527         struct scsi_device *scsidp = to_scsi_device(cl_dev->parent);
1528         Sg_device *sdp = dev_get_drvdata(cl_dev);
1529         unsigned long iflags;
1530         Sg_fd *sfp;
1531         Sg_fd *tsfp;
1532         Sg_request *srp;
1533         Sg_request *tsrp;
1534         int delay;
1535
1536         if (!sdp)
1537                 return;
1538
1539         delay = 0;
1540         write_lock_irqsave(&sg_index_lock, iflags);
1541         if (sdp->headfp) {
1542                 sdp->detached = 1;
1543                 for (sfp = sdp->headfp; sfp; sfp = tsfp) {
1544                         tsfp = sfp->nextfp;
1545                         for (srp = sfp->headrp; srp; srp = tsrp) {
1546                                 tsrp = srp->nextrp;
1547                                 if (sfp->closed || (0 == sg_srp_done(srp, sfp)))
1548                                         sg_finish_rem_req(srp);
1549                         }
1550                         if (sfp->closed) {
1551                                 scsi_device_put(sdp->device);
1552                                 __sg_remove_sfp(sdp, sfp);
1553                         } else {
1554                                 delay = 1;
1555                                 wake_up_interruptible(&sfp->read_wait);
1556                                 kill_fasync(&sfp->async_qp, SIGPOLL,
1557                                             POLL_HUP);
1558                         }
1559                 }
1560                 SCSI_LOG_TIMEOUT(3, printk("sg_remove: dev=%d, dirty\n", sdp->index));
1561                 if (NULL == sdp->headfp) {
1562                         idr_remove(&sg_index_idr, sdp->index);
1563                 }
1564         } else {        /* nothing active, simple case */
1565                 SCSI_LOG_TIMEOUT(3, printk("sg_remove: dev=%d\n", sdp->index));
1566                 idr_remove(&sg_index_idr, sdp->index);
1567         }
1568         write_unlock_irqrestore(&sg_index_lock, iflags);
1569
1570         sysfs_remove_link(&scsidp->sdev_gendev.kobj, "generic");
1571         device_destroy(sg_sysfs_class, MKDEV(SCSI_GENERIC_MAJOR, sdp->index));
1572         cdev_del(sdp->cdev);
1573         sdp->cdev = NULL;
1574         put_disk(sdp->disk);
1575         sdp->disk = NULL;
1576         if (NULL == sdp->headfp)
1577                 kfree(sdp);
1578
1579         if (delay)
1580                 msleep(10);     /* dirty detach so delay device destruction */
1581 }
1582
1583 module_param_named(scatter_elem_sz, scatter_elem_sz, int, S_IRUGO | S_IWUSR);
1584 module_param_named(def_reserved_size, def_reserved_size, int,
1585                    S_IRUGO | S_IWUSR);
1586 module_param_named(allow_dio, sg_allow_dio, int, S_IRUGO | S_IWUSR);
1587
1588 MODULE_AUTHOR("Douglas Gilbert");
1589 MODULE_DESCRIPTION("SCSI generic (sg) driver");
1590 MODULE_LICENSE("GPL");
1591 MODULE_VERSION(SG_VERSION_STR);
1592 MODULE_ALIAS_CHARDEV_MAJOR(SCSI_GENERIC_MAJOR);
1593
1594 MODULE_PARM_DESC(scatter_elem_sz, "scatter gather element "
1595                 "size (default: max(SG_SCATTER_SZ, PAGE_SIZE))");
1596 MODULE_PARM_DESC(def_reserved_size, "size of buffer reserved for each fd");
1597 MODULE_PARM_DESC(allow_dio, "allow direct I/O (default: 0 (disallow))");
1598
1599 static int __init
1600 init_sg(void)
1601 {
1602         int rc;
1603
1604         if (scatter_elem_sz < PAGE_SIZE) {
1605                 scatter_elem_sz = PAGE_SIZE;
1606                 scatter_elem_sz_prev = scatter_elem_sz;
1607         }
1608         if (def_reserved_size >= 0)
1609                 sg_big_buff = def_reserved_size;
1610         else
1611                 def_reserved_size = sg_big_buff;
1612
1613         rc = register_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0),
1614                                     SG_MAX_DEVS, "sg");
1615         if (rc)
1616                 return rc;
1617         sg_sysfs_class = class_create(THIS_MODULE, "scsi_generic");
1618         if ( IS_ERR(sg_sysfs_class) ) {
1619                 rc = PTR_ERR(sg_sysfs_class);
1620                 goto err_out;
1621         }
1622         sg_sysfs_valid = 1;
1623         rc = scsi_register_interface(&sg_interface);
1624         if (0 == rc) {
1625 #ifdef CONFIG_SCSI_PROC_FS
1626                 sg_proc_init();
1627 #endif                          /* CONFIG_SCSI_PROC_FS */
1628                 return 0;
1629         }
1630         class_destroy(sg_sysfs_class);
1631 err_out:
1632         unregister_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0), SG_MAX_DEVS);
1633         return rc;
1634 }
1635
1636 static void __exit
1637 exit_sg(void)
1638 {
1639 #ifdef CONFIG_SCSI_PROC_FS
1640         sg_proc_cleanup();
1641 #endif                          /* CONFIG_SCSI_PROC_FS */
1642         scsi_unregister_interface(&sg_interface);
1643         class_destroy(sg_sysfs_class);
1644         sg_sysfs_valid = 0;
1645         unregister_chrdev_region(MKDEV(SCSI_GENERIC_MAJOR, 0),
1646                                  SG_MAX_DEVS);
1647         idr_destroy(&sg_index_idr);
1648 }
1649
1650 static int __sg_start_req(struct sg_request *srp, struct sg_io_hdr *hp,
1651                           unsigned char *cmd)
1652 {
1653         struct sg_fd *sfp = srp->parentfp;
1654         struct request_queue *q = sfp->parentdp->device->request_queue;
1655         struct request *rq;
1656         int rw = hp->dxfer_direction == SG_DXFER_TO_DEV ? WRITE : READ;
1657
1658         rq = blk_get_request(q, rw, GFP_ATOMIC);
1659         if (!rq)
1660                 return -ENOMEM;
1661
1662         memcpy(rq->cmd, cmd, hp->cmd_len);
1663
1664         rq->cmd_len = hp->cmd_len;
1665         rq->cmd_type = REQ_TYPE_BLOCK_PC;
1666
1667         srp->rq = rq;
1668         rq->end_io_data = srp;
1669         rq->sense = srp->sense_b;
1670         rq->retries = SG_DEFAULT_RETRIES;
1671
1672         return 0;
1673 }
1674
1675 static int sg_start_req(Sg_request *srp, unsigned char *cmd)
1676 {
1677         int res;
1678         Sg_fd *sfp = srp->parentfp;
1679         sg_io_hdr_t *hp = &srp->header;
1680         int dxfer_len = (int) hp->dxfer_len;
1681         int dxfer_dir = hp->dxfer_direction;
1682         Sg_scatter_hold *req_schp = &srp->data;
1683         Sg_scatter_hold *rsv_schp = &sfp->reserve;
1684
1685         SCSI_LOG_TIMEOUT(4, printk("sg_start_req: dxfer_len=%d\n", dxfer_len));
1686
1687         if ((dxfer_len <= 0) || (dxfer_dir == SG_DXFER_NONE))
1688                 return __sg_start_req(srp, hp, cmd);
1689
1690         if (sg_allow_dio && (hp->flags & SG_FLAG_DIRECT_IO) &&
1691             (dxfer_dir != SG_DXFER_UNKNOWN) && (0 == hp->iovec_count) &&
1692             (!sfp->parentdp->device->host->unchecked_isa_dma)) {
1693                 res = sg_build_direct(srp, sfp, dxfer_len);
1694                 if (res <= 0)   /* -ve -> error, 0 -> done, 1 -> try indirect */
1695                         return res;
1696         }
1697         if ((!sg_res_in_use(sfp)) && (dxfer_len <= rsv_schp->bufflen))
1698                 sg_link_reserve(sfp, srp, dxfer_len);
1699         else {
1700                 res = sg_build_indirect(req_schp, sfp, dxfer_len);
1701                 if (res) {
1702                         sg_remove_scat(req_schp);
1703                         return res;
1704                 }
1705         }
1706         return 0;
1707 }
1708
1709 static void
1710 sg_finish_rem_req(Sg_request * srp)
1711 {
1712         Sg_fd *sfp = srp->parentfp;
1713         Sg_scatter_hold *req_schp = &srp->data;
1714
1715         SCSI_LOG_TIMEOUT(4, printk("sg_finish_rem_req: res_used=%d\n", (int) srp->res_used));
1716         if (srp->res_used)
1717                 sg_unlink_reserve(sfp, srp);
1718         else
1719                 sg_remove_scat(req_schp);
1720
1721         if (srp->rq)
1722                 blk_put_request(srp->rq);
1723
1724         sg_remove_request(sfp, srp);
1725 }
1726
1727 static int
1728 sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp, int tablesize)
1729 {
1730         int sg_bufflen = tablesize * sizeof(struct scatterlist);
1731         gfp_t gfp_flags = GFP_ATOMIC | __GFP_NOWARN;
1732
1733         /*
1734          * TODO: test without low_dma, we should not need it since
1735          * the block layer will bounce the buffer for us
1736          *
1737          * XXX(hch): we shouldn't need GFP_DMA for the actual S/G list.
1738          */
1739         if (sfp->low_dma)
1740                  gfp_flags |= GFP_DMA;
1741         schp->buffer = kzalloc(sg_bufflen, gfp_flags);
1742         if (!schp->buffer)
1743                 return -ENOMEM;
1744         sg_init_table(schp->buffer, tablesize);
1745         schp->sglist_len = sg_bufflen;
1746         return tablesize;       /* number of scat_gath elements allocated */
1747 }
1748
1749 #ifdef SG_ALLOW_DIO_CODE
1750 /* vvvvvvvv  following code borrowed from st driver's direct IO vvvvvvvvv */
1751         /* TODO: hopefully we can use the generic block layer code */
1752
1753 /* Pin down user pages and put them into a scatter gather list. Returns <= 0 if
1754    - mapping of all pages not successful
1755    (i.e., either completely successful or fails)
1756 */
1757 static int
1758 st_map_user_pages(struct scatterlist *sgl, const unsigned int max_pages,
1759                   unsigned long uaddr, size_t count, int rw)
1760 {
1761         unsigned long end = (uaddr + count + PAGE_SIZE - 1) >> PAGE_SHIFT;
1762         unsigned long start = uaddr >> PAGE_SHIFT;
1763         const int nr_pages = end - start;
1764         int res, i, j;
1765         struct page **pages;
1766
1767         /* User attempted Overflow! */
1768         if ((uaddr + count) < uaddr)
1769                 return -EINVAL;
1770
1771         /* Too big */
1772         if (nr_pages > max_pages)
1773                 return -ENOMEM;
1774
1775         /* Hmm? */
1776         if (count == 0)
1777                 return 0;
1778
1779         if ((pages = kmalloc(max_pages * sizeof(*pages), GFP_ATOMIC)) == NULL)
1780                 return -ENOMEM;
1781
1782         /* Try to fault in all of the necessary pages */
1783         down_read(&current->mm->mmap_sem);
1784         /* rw==READ means read from drive, write into memory area */
1785         res = get_user_pages(
1786                 current,
1787                 current->mm,
1788                 uaddr,
1789                 nr_pages,
1790                 rw == READ,
1791                 0, /* don't force */
1792                 pages,
1793                 NULL);
1794         up_read(&current->mm->mmap_sem);
1795
1796         /* Errors and no page mapped should return here */
1797         if (res < nr_pages)
1798                 goto out_unmap;
1799
1800         for (i=0; i < nr_pages; i++) {
1801                 /* FIXME: flush superflous for rw==READ,
1802                  * probably wrong function for rw==WRITE
1803                  */
1804                 flush_dcache_page(pages[i]);
1805                 /* ?? Is locking needed? I don't think so */
1806                 /* if (!trylock_page(pages[i]))
1807                    goto out_unlock; */
1808         }
1809
1810         sg_set_page(sgl, pages[0], 0, uaddr & ~PAGE_MASK);
1811         if (nr_pages > 1) {
1812                 sgl[0].length = PAGE_SIZE - sgl[0].offset;
1813                 count -= sgl[0].length;
1814                 for (i=1; i < nr_pages ; i++)
1815                         sg_set_page(&sgl[i], pages[i], count < PAGE_SIZE ? count : PAGE_SIZE, 0);
1816         }
1817         else {
1818                 sgl[0].length = count;
1819         }
1820
1821         kfree(pages);
1822         return nr_pages;
1823
1824  out_unmap:
1825         if (res > 0) {
1826                 for (j=0; j < res; j++)
1827                         page_cache_release(pages[j]);
1828                 res = 0;
1829         }
1830         kfree(pages);
1831         return res;
1832 }
1833
1834
1835 /* And unmap them... */
1836 static int
1837 st_unmap_user_pages(struct scatterlist *sgl, const unsigned int nr_pages,
1838                     int dirtied)
1839 {
1840         int i;
1841
1842         for (i=0; i < nr_pages; i++) {
1843                 struct page *page = sg_page(&sgl[i]);
1844
1845                 if (dirtied)
1846                         SetPageDirty(page);
1847                 /* unlock_page(page); */
1848                 /* FIXME: cache flush missing for rw==READ
1849                  * FIXME: call the correct reference counting function
1850                  */
1851                 page_cache_release(page);
1852         }
1853
1854         return 0;
1855 }
1856
1857 /* ^^^^^^^^  above code borrowed from st driver's direct IO ^^^^^^^^^ */
1858 #endif
1859
1860
1861 /* Returns: -ve -> error, 0 -> done, 1 -> try indirect */
1862 static int
1863 sg_build_direct(Sg_request * srp, Sg_fd * sfp, int dxfer_len)
1864 {
1865 #ifdef SG_ALLOW_DIO_CODE
1866         sg_io_hdr_t *hp = &srp->header;
1867         Sg_scatter_hold *schp = &srp->data;
1868         int sg_tablesize = sfp->parentdp->sg_tablesize;
1869         int mx_sc_elems, res;
1870         struct scsi_device *sdev = sfp->parentdp->device;
1871
1872         if (((unsigned long)hp->dxferp &
1873                         queue_dma_alignment(sdev->request_queue)) != 0)
1874                 return 1;
1875
1876         mx_sc_elems = sg_build_sgat(schp, sfp, sg_tablesize);
1877         if (mx_sc_elems <= 0) {
1878                 return 1;
1879         }
1880         res = st_map_user_pages(schp->buffer, mx_sc_elems,
1881                                 (unsigned long)hp->dxferp, dxfer_len,
1882                                 (SG_DXFER_TO_DEV == hp->dxfer_direction) ? 1 : 0);
1883         if (res <= 0) {
1884                 sg_remove_scat(schp);
1885                 return 1;
1886         }
1887         schp->k_use_sg = res;
1888         schp->dio_in_use = 1;
1889         hp->info |= SG_INFO_DIRECT_IO;
1890         return 0;
1891 #else
1892         return 1;
1893 #endif
1894 }
1895
1896 static int
1897 sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
1898 {
1899         struct scatterlist *sg;
1900         int ret_sz = 0, k, rem_sz, num, mx_sc_elems;
1901         int sg_tablesize = sfp->parentdp->sg_tablesize;
1902         int blk_size = buff_size;
1903         struct page *p = NULL;
1904
1905         if (blk_size < 0)
1906                 return -EFAULT;
1907         if (0 == blk_size)
1908                 ++blk_size;     /* don't know why */
1909 /* round request up to next highest SG_SECTOR_SZ byte boundary */
1910         blk_size = (blk_size + SG_SECTOR_MSK) & (~SG_SECTOR_MSK);
1911         SCSI_LOG_TIMEOUT(4, printk("sg_build_indirect: buff_size=%d, blk_size=%d\n",
1912                                    buff_size, blk_size));
1913
1914         /* N.B. ret_sz carried into this block ... */
1915         mx_sc_elems = sg_build_sgat(schp, sfp, sg_tablesize);
1916         if (mx_sc_elems < 0)
1917                 return mx_sc_elems;     /* most likely -ENOMEM */
1918
1919         num = scatter_elem_sz;
1920         if (unlikely(num != scatter_elem_sz_prev)) {
1921                 if (num < PAGE_SIZE) {
1922                         scatter_elem_sz = PAGE_SIZE;
1923                         scatter_elem_sz_prev = PAGE_SIZE;
1924                 } else
1925                         scatter_elem_sz_prev = num;
1926         }
1927         for (k = 0, sg = schp->buffer, rem_sz = blk_size;
1928              (rem_sz > 0) && (k < mx_sc_elems);
1929              ++k, rem_sz -= ret_sz, sg = sg_next(sg)) {
1930
1931                 num = (rem_sz > scatter_elem_sz_prev) ?
1932                       scatter_elem_sz_prev : rem_sz;
1933                 p = sg_page_malloc(num, sfp->low_dma, &ret_sz);
1934                 if (!p)
1935                         return -ENOMEM;
1936
1937                 if (num == scatter_elem_sz_prev) {
1938                         if (unlikely(ret_sz > scatter_elem_sz_prev)) {
1939                                 scatter_elem_sz = ret_sz;
1940                                 scatter_elem_sz_prev = ret_sz;
1941                         }
1942                 }
1943                 sg_set_page(sg, p, (ret_sz > num) ? num : ret_sz, 0);
1944
1945                 SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k=%d, num=%d, "
1946                                  "ret_sz=%d\n", k, num, ret_sz));
1947         }               /* end of for loop */
1948
1949         schp->k_use_sg = k;
1950         SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k_use_sg=%d, "
1951                          "rem_sz=%d\n", k, rem_sz));
1952
1953         schp->bufflen = blk_size;
1954         if (rem_sz > 0) /* must have failed */
1955                 return -ENOMEM;
1956
1957         return 0;
1958 }
1959
1960 static int
1961 sg_write_xfer(Sg_request * srp)
1962 {
1963         sg_io_hdr_t *hp = &srp->header;
1964         Sg_scatter_hold *schp = &srp->data;
1965         struct scatterlist *sg = schp->buffer;
1966         int num_xfer = 0;
1967         int j, k, onum, usglen, ksglen, res;
1968         int iovec_count = (int) hp->iovec_count;
1969         int dxfer_dir = hp->dxfer_direction;
1970         unsigned char *p;
1971         unsigned char __user *up;
1972         int new_interface = ('\0' == hp->interface_id) ? 0 : 1;
1973
1974         if ((SG_DXFER_UNKNOWN == dxfer_dir) || (SG_DXFER_TO_DEV == dxfer_dir) ||
1975             (SG_DXFER_TO_FROM_DEV == dxfer_dir)) {
1976                 num_xfer = (int) (new_interface ? hp->dxfer_len : hp->flags);
1977                 if (schp->bufflen < num_xfer)
1978                         num_xfer = schp->bufflen;
1979         }
1980         if ((num_xfer <= 0) || (schp->dio_in_use) ||
1981             (new_interface
1982              && ((SG_FLAG_NO_DXFER | SG_FLAG_MMAP_IO) & hp->flags)))
1983                 return 0;
1984
1985         SCSI_LOG_TIMEOUT(4, printk("sg_write_xfer: num_xfer=%d, iovec_count=%d, k_use_sg=%d\n",
1986                           num_xfer, iovec_count, schp->k_use_sg));
1987         if (iovec_count) {
1988                 onum = iovec_count;
1989                 if (!access_ok(VERIFY_READ, hp->dxferp, SZ_SG_IOVEC * onum))
1990                         return -EFAULT;
1991         } else
1992                 onum = 1;
1993
1994         ksglen = sg->length;
1995         p = page_address(sg_page(sg));
1996         for (j = 0, k = 0; j < onum; ++j) {
1997                 res = sg_u_iovec(hp, iovec_count, j, 1, &usglen, &up);
1998                 if (res)
1999                         return res;
2000
2001                 for (; p; sg = sg_next(sg), ksglen = sg->length,
2002                      p = page_address(sg_page(sg))) {
2003                         if (usglen <= 0)
2004                                 break;
2005                         if (ksglen > usglen) {
2006                                 if (usglen >= num_xfer) {
2007                                         if (__copy_from_user(p, up, num_xfer))
2008                                                 return -EFAULT;
2009                                         return 0;
2010                                 }
2011                                 if (__copy_from_user(p, up, usglen))
2012                                         return -EFAULT;
2013                                 p += usglen;
2014                                 ksglen -= usglen;
2015                                 break;
2016                         } else {
2017                                 if (ksglen >= num_xfer) {
2018                                         if (__copy_from_user(p, up, num_xfer))
2019                                                 return -EFAULT;
2020                                         return 0;
2021                                 }
2022                                 if (__copy_from_user(p, up, ksglen))
2023                                         return -EFAULT;
2024                                 up += ksglen;
2025                                 usglen -= ksglen;
2026                         }
2027                         ++k;
2028                         if (k >= schp->k_use_sg)
2029                                 return 0;
2030                 }
2031         }
2032
2033         return 0;
2034 }
2035
2036 static int
2037 sg_u_iovec(sg_io_hdr_t * hp, int sg_num, int ind,
2038            int wr_xf, int *countp, unsigned char __user **up)
2039 {
2040         int num_xfer = (int) hp->dxfer_len;
2041         unsigned char __user *p = hp->dxferp;
2042         int count;
2043
2044         if (0 == sg_num) {
2045                 if (wr_xf && ('\0' == hp->interface_id))
2046                         count = (int) hp->flags;        /* holds "old" input_size */
2047                 else
2048                         count = num_xfer;
2049         } else {
2050                 sg_iovec_t iovec;
2051                 if (__copy_from_user(&iovec, p + ind*SZ_SG_IOVEC, SZ_SG_IOVEC))
2052                         return -EFAULT;
2053                 p = iovec.iov_base;
2054                 count = (int) iovec.iov_len;
2055         }
2056         if (!access_ok(wr_xf ? VERIFY_READ : VERIFY_WRITE, p, count))
2057                 return -EFAULT;
2058         if (up)
2059                 *up = p;
2060         if (countp)
2061                 *countp = count;
2062         return 0;
2063 }
2064
2065 static void
2066 sg_remove_scat(Sg_scatter_hold * schp)
2067 {
2068         SCSI_LOG_TIMEOUT(4, printk("sg_remove_scat: k_use_sg=%d\n", schp->k_use_sg));
2069         if (schp->buffer && (schp->sglist_len > 0)) {
2070                 struct scatterlist *sg = schp->buffer;
2071
2072                 if (schp->dio_in_use) {
2073 #ifdef SG_ALLOW_DIO_CODE
2074                         st_unmap_user_pages(sg, schp->k_use_sg, TRUE);
2075 #endif
2076                 } else {
2077                         int k;
2078
2079                         for (k = 0; (k < schp->k_use_sg) && sg_page(sg);
2080                              ++k, sg = sg_next(sg)) {
2081                                 SCSI_LOG_TIMEOUT(5, printk(
2082                                     "sg_remove_scat: k=%d, pg=0x%p, len=%d\n",
2083                                     k, sg_page(sg), sg->length));
2084                                 sg_page_free(sg_page(sg), sg->length);
2085                         }
2086                 }
2087                 kfree(schp->buffer);
2088         }
2089         memset(schp, 0, sizeof (*schp));
2090 }
2091
2092 static int
2093 sg_read_xfer(Sg_request * srp)
2094 {
2095         sg_io_hdr_t *hp = &srp->header;
2096         Sg_scatter_hold *schp = &srp->data;
2097         struct scatterlist *sg = schp->buffer;
2098         int num_xfer = 0;
2099         int j, k, onum, usglen, ksglen, res;
2100         int iovec_count = (int) hp->iovec_count;
2101         int dxfer_dir = hp->dxfer_direction;
2102         unsigned char *p;
2103         unsigned char __user *up;
2104         int new_interface = ('\0' == hp->interface_id) ? 0 : 1;
2105
2106         if ((SG_DXFER_UNKNOWN == dxfer_dir) || (SG_DXFER_FROM_DEV == dxfer_dir)
2107             || (SG_DXFER_TO_FROM_DEV == dxfer_dir)) {
2108                 num_xfer = hp->dxfer_len;
2109                 if (schp->bufflen < num_xfer)
2110                         num_xfer = schp->bufflen;
2111         }
2112         if ((num_xfer <= 0) || (schp->dio_in_use) ||
2113             (new_interface
2114              && ((SG_FLAG_NO_DXFER | SG_FLAG_MMAP_IO) & hp->flags)))
2115                 return 0;
2116
2117         SCSI_LOG_TIMEOUT(4, printk("sg_read_xfer: num_xfer=%d, iovec_count=%d, k_use_sg=%d\n",
2118                           num_xfer, iovec_count, schp->k_use_sg));
2119         if (iovec_count) {
2120                 onum = iovec_count;
2121                 if (!access_ok(VERIFY_READ, hp->dxferp, SZ_SG_IOVEC * onum))
2122                         return -EFAULT;
2123         } else
2124                 onum = 1;
2125
2126         p = page_address(sg_page(sg));
2127         ksglen = sg->length;
2128         for (j = 0, k = 0; j < onum; ++j) {
2129                 res = sg_u_iovec(hp, iovec_count, j, 0, &usglen, &up);
2130                 if (res)
2131                         return res;
2132
2133                 for (; p; sg = sg_next(sg), ksglen = sg->length,
2134                      p = page_address(sg_page(sg))) {
2135                         if (usglen <= 0)
2136                                 break;
2137                         if (ksglen > usglen) {
2138                                 if (usglen >= num_xfer) {
2139                                         if (__copy_to_user(up, p, num_xfer))
2140                                                 return -EFAULT;
2141                                         return 0;
2142                                 }
2143                                 if (__copy_to_user(up, p, usglen))
2144                                         return -EFAULT;
2145                                 p += usglen;
2146                                 ksglen -= usglen;
2147                                 break;
2148                         } else {
2149                                 if (ksglen >= num_xfer) {
2150                                         if (__copy_to_user(up, p, num_xfer))
2151                                                 return -EFAULT;
2152                                         return 0;
2153                                 }
2154                                 if (__copy_to_user(up, p, ksglen))
2155                                         return -EFAULT;
2156                                 up += ksglen;
2157                                 usglen -= ksglen;
2158                         }
2159                         ++k;
2160                         if (k >= schp->k_use_sg)
2161                                 return 0;
2162                 }
2163         }
2164
2165         return 0;
2166 }
2167
2168 static int
2169 sg_read_oxfer(Sg_request * srp, char __user *outp, int num_read_xfer)
2170 {
2171         Sg_scatter_hold *schp = &srp->data;
2172         struct scatterlist *sg = schp->buffer;
2173         int k, num;
2174
2175         SCSI_LOG_TIMEOUT(4, printk("sg_read_oxfer: num_read_xfer=%d\n",
2176                                    num_read_xfer));
2177         if ((!outp) || (num_read_xfer <= 0))
2178                 return 0;
2179
2180         for (k = 0; (k < schp->k_use_sg) && sg_page(sg); ++k, sg = sg_next(sg)) {
2181                 num = sg->length;
2182                 if (num > num_read_xfer) {
2183                         if (__copy_to_user(outp, page_address(sg_page(sg)),
2184                                            num_read_xfer))
2185                                 return -EFAULT;
2186                         break;
2187                 } else {
2188                         if (__copy_to_user(outp, page_address(sg_page(sg)),
2189                                            num))
2190                                 return -EFAULT;
2191                         num_read_xfer -= num;
2192                         if (num_read_xfer <= 0)
2193                                 break;
2194                         outp += num;
2195                 }
2196         }
2197
2198         return 0;
2199 }
2200
2201 static void
2202 sg_build_reserve(Sg_fd * sfp, int req_size)
2203 {
2204         Sg_scatter_hold *schp = &sfp->reserve;
2205
2206         SCSI_LOG_TIMEOUT(4, printk("sg_build_reserve: req_size=%d\n", req_size));
2207         do {
2208                 if (req_size < PAGE_SIZE)
2209                         req_size = PAGE_SIZE;
2210                 if (0 == sg_build_indirect(schp, sfp, req_size))
2211                         return;
2212                 else
2213                         sg_remove_scat(schp);
2214                 req_size >>= 1; /* divide by 2 */
2215         } while (req_size > (PAGE_SIZE / 2));
2216 }
2217
2218 static void
2219 sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size)
2220 {
2221         Sg_scatter_hold *req_schp = &srp->data;
2222         Sg_scatter_hold *rsv_schp = &sfp->reserve;
2223         struct scatterlist *sg = rsv_schp->buffer;
2224         int k, num, rem;
2225
2226         srp->res_used = 1;
2227         SCSI_LOG_TIMEOUT(4, printk("sg_link_reserve: size=%d\n", size));
2228         rem = size;
2229
2230         for (k = 0; k < rsv_schp->k_use_sg; ++k, sg = sg_next(sg)) {
2231                 num = sg->length;
2232                 if (rem <= num) {
2233                         sfp->save_scat_len = num;
2234                         sg->length = rem;
2235                         req_schp->k_use_sg = k + 1;
2236                         req_schp->sglist_len = rsv_schp->sglist_len;
2237                         req_schp->buffer = rsv_schp->buffer;
2238
2239                         req_schp->bufflen = size;
2240                         req_schp->b_malloc_len = rsv_schp->b_malloc_len;
2241                         break;
2242                 } else
2243                         rem -= num;
2244         }
2245
2246         if (k >= rsv_schp->k_use_sg)
2247                 SCSI_LOG_TIMEOUT(1, printk("sg_link_reserve: BAD size\n"));
2248 }
2249
2250 static void
2251 sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp)
2252 {
2253         Sg_scatter_hold *req_schp = &srp->data;
2254         Sg_scatter_hold *rsv_schp = &sfp->reserve;
2255
2256         SCSI_LOG_TIMEOUT(4, printk("sg_unlink_reserve: req->k_use_sg=%d\n",
2257                                    (int) req_schp->k_use_sg));
2258         if ((rsv_schp->k_use_sg > 0) && (req_schp->k_use_sg > 0)) {
2259                 struct scatterlist *sg = rsv_schp->buffer;
2260
2261                 if (sfp->save_scat_len > 0)
2262                         (sg + (req_schp->k_use_sg - 1))->length =
2263                             (unsigned) sfp->save_scat_len;
2264                 else
2265                         SCSI_LOG_TIMEOUT(1, printk ("sg_unlink_reserve: BAD save_scat_len\n"));
2266         }
2267         req_schp->k_use_sg = 0;
2268         req_schp->bufflen = 0;
2269         req_schp->buffer = NULL;
2270         req_schp->sglist_len = 0;
2271         sfp->save_scat_len = 0;
2272         srp->res_used = 0;
2273 }
2274
2275 static Sg_request *
2276 sg_get_rq_mark(Sg_fd * sfp, int pack_id)
2277 {
2278         Sg_request *resp;
2279         unsigned long iflags;
2280
2281         write_lock_irqsave(&sfp->rq_list_lock, iflags);
2282         for (resp = sfp->headrp; resp; resp = resp->nextrp) {
2283                 /* look for requests that are ready + not SG_IO owned */
2284                 if ((1 == resp->done) && (!resp->sg_io_owned) &&
2285                     ((-1 == pack_id) || (resp->header.pack_id == pack_id))) {
2286                         resp->done = 2; /* guard against other readers */
2287                         break;
2288                 }
2289         }
2290         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2291         return resp;
2292 }
2293
2294 #ifdef CONFIG_SCSI_PROC_FS
2295 static Sg_request *
2296 sg_get_nth_request(Sg_fd * sfp, int nth)
2297 {
2298         Sg_request *resp;
2299         unsigned long iflags;
2300         int k;
2301
2302         read_lock_irqsave(&sfp->rq_list_lock, iflags);
2303         for (k = 0, resp = sfp->headrp; resp && (k < nth);
2304              ++k, resp = resp->nextrp) ;
2305         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2306         return resp;
2307 }
2308 #endif
2309
2310 /* always adds to end of list */
2311 static Sg_request *
2312 sg_add_request(Sg_fd * sfp)
2313 {
2314         int k;
2315         unsigned long iflags;
2316         Sg_request *resp;
2317         Sg_request *rp = sfp->req_arr;
2318
2319         write_lock_irqsave(&sfp->rq_list_lock, iflags);
2320         resp = sfp->headrp;
2321         if (!resp) {
2322                 memset(rp, 0, sizeof (Sg_request));
2323                 rp->parentfp = sfp;
2324                 resp = rp;
2325                 sfp->headrp = resp;
2326         } else {
2327                 if (0 == sfp->cmd_q)
2328                         resp = NULL;    /* command queuing disallowed */
2329                 else {
2330                         for (k = 0; k < SG_MAX_QUEUE; ++k, ++rp) {
2331                                 if (!rp->parentfp)
2332                                         break;
2333                         }
2334                         if (k < SG_MAX_QUEUE) {
2335                                 memset(rp, 0, sizeof (Sg_request));
2336                                 rp->parentfp = sfp;
2337                                 while (resp->nextrp)
2338                                         resp = resp->nextrp;
2339                                 resp->nextrp = rp;
2340                                 resp = rp;
2341                         } else
2342                                 resp = NULL;
2343                 }
2344         }
2345         if (resp) {
2346                 resp->nextrp = NULL;
2347                 resp->header.duration = jiffies_to_msecs(jiffies);
2348         }
2349         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2350         return resp;
2351 }
2352
2353 /* Return of 1 for found; 0 for not found */
2354 static int
2355 sg_remove_request(Sg_fd * sfp, Sg_request * srp)
2356 {
2357         Sg_request *prev_rp;
2358         Sg_request *rp;
2359         unsigned long iflags;
2360         int res = 0;
2361
2362         if ((!sfp) || (!srp) || (!sfp->headrp))
2363                 return res;
2364         write_lock_irqsave(&sfp->rq_list_lock, iflags);
2365         prev_rp = sfp->headrp;
2366         if (srp == prev_rp) {
2367                 sfp->headrp = prev_rp->nextrp;
2368                 prev_rp->parentfp = NULL;
2369                 res = 1;
2370         } else {
2371                 while ((rp = prev_rp->nextrp)) {
2372                         if (srp == rp) {
2373                                 prev_rp->nextrp = rp->nextrp;
2374                                 rp->parentfp = NULL;
2375                                 res = 1;
2376                                 break;
2377                         }
2378                         prev_rp = rp;
2379                 }
2380         }
2381         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2382         return res;
2383 }
2384
2385 #ifdef CONFIG_SCSI_PROC_FS
2386 static Sg_fd *
2387 sg_get_nth_sfp(Sg_device * sdp, int nth)
2388 {
2389         Sg_fd *resp;
2390         unsigned long iflags;
2391         int k;
2392
2393         read_lock_irqsave(&sg_index_lock, iflags);
2394         for (k = 0, resp = sdp->headfp; resp && (k < nth);
2395              ++k, resp = resp->nextfp) ;
2396         read_unlock_irqrestore(&sg_index_lock, iflags);
2397         return resp;
2398 }
2399 #endif
2400
2401 static Sg_fd *
2402 sg_add_sfp(Sg_device * sdp, int dev)
2403 {
2404         Sg_fd *sfp;
2405         unsigned long iflags;
2406         int bufflen;
2407
2408         sfp = kzalloc(sizeof(*sfp), GFP_ATOMIC | __GFP_NOWARN);
2409         if (!sfp)
2410                 return NULL;
2411
2412         init_waitqueue_head(&sfp->read_wait);
2413         rwlock_init(&sfp->rq_list_lock);
2414
2415         sfp->timeout = SG_DEFAULT_TIMEOUT;
2416         sfp->timeout_user = SG_DEFAULT_TIMEOUT_USER;
2417         sfp->force_packid = SG_DEF_FORCE_PACK_ID;
2418         sfp->low_dma = (SG_DEF_FORCE_LOW_DMA == 0) ?
2419             sdp->device->host->unchecked_isa_dma : 1;
2420         sfp->cmd_q = SG_DEF_COMMAND_Q;
2421         sfp->keep_orphan = SG_DEF_KEEP_ORPHAN;
2422         sfp->parentdp = sdp;
2423         write_lock_irqsave(&sg_index_lock, iflags);
2424         if (!sdp->headfp)
2425                 sdp->headfp = sfp;
2426         else {                  /* add to tail of existing list */
2427                 Sg_fd *pfp = sdp->headfp;
2428                 while (pfp->nextfp)
2429                         pfp = pfp->nextfp;
2430                 pfp->nextfp = sfp;
2431         }
2432         write_unlock_irqrestore(&sg_index_lock, iflags);
2433         SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp: sfp=0x%p\n", sfp));
2434         if (unlikely(sg_big_buff != def_reserved_size))
2435                 sg_big_buff = def_reserved_size;
2436
2437         bufflen = min_t(int, sg_big_buff,
2438                         sdp->device->request_queue->max_sectors * 512);
2439         sg_build_reserve(sfp, bufflen);
2440         SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp:   bufflen=%d, k_use_sg=%d\n",
2441                            sfp->reserve.bufflen, sfp->reserve.k_use_sg));
2442         return sfp;
2443 }
2444
2445 static void
2446 __sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp)
2447 {
2448         Sg_fd *fp;
2449         Sg_fd *prev_fp;
2450
2451         prev_fp = sdp->headfp;
2452         if (sfp == prev_fp)
2453                 sdp->headfp = prev_fp->nextfp;
2454         else {
2455                 while ((fp = prev_fp->nextfp)) {
2456                         if (sfp == fp) {
2457                                 prev_fp->nextfp = fp->nextfp;
2458                                 break;
2459                         }
2460                         prev_fp = fp;
2461                 }
2462         }
2463         if (sfp->reserve.bufflen > 0) {
2464                 SCSI_LOG_TIMEOUT(6,
2465                         printk("__sg_remove_sfp:    bufflen=%d, k_use_sg=%d\n",
2466                         (int) sfp->reserve.bufflen, (int) sfp->reserve.k_use_sg));
2467                 sg_remove_scat(&sfp->reserve);
2468         }
2469         sfp->parentdp = NULL;
2470         SCSI_LOG_TIMEOUT(6, printk("__sg_remove_sfp:    sfp=0x%p\n", sfp));
2471         kfree(sfp);
2472 }
2473
2474 /* Returns 0 in normal case, 1 when detached and sdp object removed */
2475 static int
2476 sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp)
2477 {
2478         Sg_request *srp;
2479         Sg_request *tsrp;
2480         int dirty = 0;
2481         int res = 0;
2482
2483         for (srp = sfp->headrp; srp; srp = tsrp) {
2484                 tsrp = srp->nextrp;
2485                 if (sg_srp_done(srp, sfp))
2486                         sg_finish_rem_req(srp);
2487                 else
2488                         ++dirty;
2489         }
2490         if (0 == dirty) {
2491                 unsigned long iflags;
2492
2493                 write_lock_irqsave(&sg_index_lock, iflags);
2494                 __sg_remove_sfp(sdp, sfp);
2495                 if (sdp->detached && (NULL == sdp->headfp)) {
2496                         idr_remove(&sg_index_idr, sdp->index);
2497                         kfree(sdp);
2498                         res = 1;
2499                 }
2500                 write_unlock_irqrestore(&sg_index_lock, iflags);
2501         } else {
2502                 /* MOD_INC's to inhibit unloading sg and associated adapter driver */
2503                 /* only bump the access_count if we actually succeeded in
2504                  * throwing another counter on the host module */
2505                 scsi_device_get(sdp->device);   /* XXX: retval ignored? */
2506                 sfp->closed = 1;        /* flag dirty state on this fd */
2507                 SCSI_LOG_TIMEOUT(1, printk("sg_remove_sfp: worrisome, %d writes pending\n",
2508                                   dirty));
2509         }
2510         return res;
2511 }
2512
2513 static int
2514 sg_res_in_use(Sg_fd * sfp)
2515 {
2516         const Sg_request *srp;
2517         unsigned long iflags;
2518
2519         read_lock_irqsave(&sfp->rq_list_lock, iflags);
2520         for (srp = sfp->headrp; srp; srp = srp->nextrp)
2521                 if (srp->res_used)
2522                         break;
2523         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2524         return srp ? 1 : 0;
2525 }
2526
2527 /* The size fetched (value output via retSzp) set when non-NULL return */
2528 static struct page *
2529 sg_page_malloc(int rqSz, int lowDma, int *retSzp)
2530 {
2531         struct page *resp = NULL;
2532         gfp_t page_mask;
2533         int order, a_size;
2534         int resSz;
2535
2536         if ((rqSz <= 0) || (NULL == retSzp))
2537                 return resp;
2538
2539         if (lowDma)
2540                 page_mask = GFP_ATOMIC | GFP_DMA | __GFP_COMP | __GFP_NOWARN;
2541         else
2542                 page_mask = GFP_ATOMIC | __GFP_COMP | __GFP_NOWARN;
2543
2544         for (order = 0, a_size = PAGE_SIZE; a_size < rqSz;
2545              order++, a_size <<= 1) ;
2546         resSz = a_size;         /* rounded up if necessary */
2547         resp = alloc_pages(page_mask, order);
2548         while ((!resp) && order) {
2549                 --order;
2550                 a_size >>= 1;   /* divide by 2, until PAGE_SIZE */
2551                 resp =  alloc_pages(page_mask, order);  /* try half */
2552                 resSz = a_size;
2553         }
2554         if (resp) {
2555                 if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
2556                         memset(page_address(resp), 0, resSz);
2557                 *retSzp = resSz;
2558         }
2559         return resp;
2560 }
2561
2562 static void
2563 sg_page_free(struct page *page, int size)
2564 {
2565         int order, a_size;
2566
2567         if (!page)
2568                 return;
2569         for (order = 0, a_size = PAGE_SIZE; a_size < size;
2570              order++, a_size <<= 1) ;
2571         __free_pages(page, order);
2572 }
2573
2574 #ifdef CONFIG_SCSI_PROC_FS
2575 static int
2576 sg_idr_max_id(int id, void *p, void *data)
2577 {
2578         int *k = data;
2579
2580         if (*k < id)
2581                 *k = id;
2582
2583         return 0;
2584 }
2585
2586 static int
2587 sg_last_dev(void)
2588 {
2589         int k = -1;
2590         unsigned long iflags;
2591
2592         read_lock_irqsave(&sg_index_lock, iflags);
2593         idr_for_each(&sg_index_idr, sg_idr_max_id, &k);
2594         read_unlock_irqrestore(&sg_index_lock, iflags);
2595         return k + 1;           /* origin 1 */
2596 }
2597 #endif
2598
2599 static Sg_device *
2600 sg_get_dev(int dev)
2601 {
2602         Sg_device *sdp;
2603         unsigned long iflags;
2604
2605         read_lock_irqsave(&sg_index_lock, iflags);
2606         sdp = idr_find(&sg_index_idr, dev);
2607         read_unlock_irqrestore(&sg_index_lock, iflags);
2608
2609         return sdp;
2610 }
2611
2612 #ifdef CONFIG_SCSI_PROC_FS
2613
2614 static struct proc_dir_entry *sg_proc_sgp = NULL;
2615
2616 static char sg_proc_sg_dirname[] = "scsi/sg";
2617
2618 static int sg_proc_seq_show_int(struct seq_file *s, void *v);
2619
2620 static int sg_proc_single_open_adio(struct inode *inode, struct file *file);
2621 static ssize_t sg_proc_write_adio(struct file *filp, const char __user *buffer,
2622                                   size_t count, loff_t *off);
2623 static struct file_operations adio_fops = {
2624         /* .owner, .read and .llseek added in sg_proc_init() */
2625         .open = sg_proc_single_open_adio,
2626         .write = sg_proc_write_adio,
2627         .release = single_release,
2628 };
2629
2630 static int sg_proc_single_open_dressz(struct inode *inode, struct file *file);
2631 static ssize_t sg_proc_write_dressz(struct file *filp,
2632                 const char __user *buffer, size_t count, loff_t *off);
2633 static struct file_operations dressz_fops = {
2634         .open = sg_proc_single_open_dressz,
2635         .write = sg_proc_write_dressz,
2636         .release = single_release,
2637 };
2638
2639 static int sg_proc_seq_show_version(struct seq_file *s, void *v);
2640 static int sg_proc_single_open_version(struct inode *inode, struct file *file);
2641 static struct file_operations version_fops = {
2642         .open = sg_proc_single_open_version,
2643         .release = single_release,
2644 };
2645
2646 static int sg_proc_seq_show_devhdr(struct seq_file *s, void *v);
2647 static int sg_proc_single_open_devhdr(struct inode *inode, struct file *file);
2648 static struct file_operations devhdr_fops = {
2649         .open = sg_proc_single_open_devhdr,
2650         .release = single_release,
2651 };
2652
2653 static int sg_proc_seq_show_dev(struct seq_file *s, void *v);
2654 static int sg_proc_open_dev(struct inode *inode, struct file *file);
2655 static void * dev_seq_start(struct seq_file *s, loff_t *pos);
2656 static void * dev_seq_next(struct seq_file *s, void *v, loff_t *pos);
2657 static void dev_seq_stop(struct seq_file *s, void *v);
2658 static struct file_operations dev_fops = {
2659         .open = sg_proc_open_dev,
2660         .release = seq_release,
2661 };
2662 static struct seq_operations dev_seq_ops = {
2663         .start = dev_seq_start,
2664         .next  = dev_seq_next,
2665         .stop  = dev_seq_stop,
2666         .show  = sg_proc_seq_show_dev,
2667 };
2668
2669 static int sg_proc_seq_show_devstrs(struct seq_file *s, void *v);
2670 static int sg_proc_open_devstrs(struct inode *inode, struct file *file);
2671 static struct file_operations devstrs_fops = {
2672         .open = sg_proc_open_devstrs,
2673         .release = seq_release,
2674 };
2675 static struct seq_operations devstrs_seq_ops = {
2676         .start = dev_seq_start,
2677         .next  = dev_seq_next,
2678         .stop  = dev_seq_stop,
2679         .show  = sg_proc_seq_show_devstrs,
2680 };
2681
2682 static int sg_proc_seq_show_debug(struct seq_file *s, void *v);
2683 static int sg_proc_open_debug(struct inode *inode, struct file *file);
2684 static struct file_operations debug_fops = {
2685         .open = sg_proc_open_debug,
2686         .release = seq_release,
2687 };
2688 static struct seq_operations debug_seq_ops = {
2689         .start = dev_seq_start,
2690         .next  = dev_seq_next,
2691         .stop  = dev_seq_stop,
2692         .show  = sg_proc_seq_show_debug,
2693 };
2694
2695
2696 struct sg_proc_leaf {
2697         const char * name;
2698         struct file_operations * fops;
2699 };
2700
2701 static struct sg_proc_leaf sg_proc_leaf_arr[] = {
2702         {"allow_dio", &adio_fops},
2703         {"debug", &debug_fops},
2704         {"def_reserved_size", &dressz_fops},
2705         {"device_hdr", &devhdr_fops},
2706         {"devices", &dev_fops},
2707         {"device_strs", &devstrs_fops},
2708         {"version", &version_fops}
2709 };
2710
2711 static int
2712 sg_proc_init(void)
2713 {
2714         int k, mask;
2715         int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
2716         struct sg_proc_leaf * leaf;
2717
2718         sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
2719         if (!sg_proc_sgp)
2720                 return 1;
2721         for (k = 0; k < num_leaves; ++k) {
2722                 leaf = &sg_proc_leaf_arr[k];
2723                 mask = leaf->fops->write ? S_IRUGO | S_IWUSR : S_IRUGO;
2724                 leaf->fops->owner = THIS_MODULE;
2725                 leaf->fops->read = seq_read;
2726                 leaf->fops->llseek = seq_lseek;
2727                 proc_create(leaf->name, mask, sg_proc_sgp, leaf->fops);
2728         }
2729         return 0;
2730 }
2731
2732 static void
2733 sg_proc_cleanup(void)
2734 {
2735         int k;
2736         int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
2737
2738         if (!sg_proc_sgp)
2739                 return;
2740         for (k = 0; k < num_leaves; ++k)
2741                 remove_proc_entry(sg_proc_leaf_arr[k].name, sg_proc_sgp);
2742         remove_proc_entry(sg_proc_sg_dirname, NULL);
2743 }
2744
2745
2746 static int sg_proc_seq_show_int(struct seq_file *s, void *v)
2747 {
2748         seq_printf(s, "%d\n", *((int *)s->private));
2749         return 0;
2750 }
2751
2752 static int sg_proc_single_open_adio(struct inode *inode, struct file *file)
2753 {
2754         return single_open(file, sg_proc_seq_show_int, &sg_allow_dio);
2755 }
2756
2757 static ssize_t
2758 sg_proc_write_adio(struct file *filp, const char __user *buffer,
2759                    size_t count, loff_t *off)
2760 {
2761         int num;
2762         char buff[11];
2763
2764         if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
2765                 return -EACCES;
2766         num = (count < 10) ? count : 10;
2767         if (copy_from_user(buff, buffer, num))
2768                 return -EFAULT;
2769         buff[num] = '\0';
2770         sg_allow_dio = simple_strtoul(buff, NULL, 10) ? 1 : 0;
2771         return count;
2772 }
2773
2774 static int sg_proc_single_open_dressz(struct inode *inode, struct file *file)
2775 {
2776         return single_open(file, sg_proc_seq_show_int, &sg_big_buff);
2777 }
2778
2779 static ssize_t
2780 sg_proc_write_dressz(struct file *filp, const char __user *buffer,
2781                      size_t count, loff_t *off)
2782 {
2783         int num;
2784         unsigned long k = ULONG_MAX;
2785         char buff[11];
2786
2787         if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
2788                 return -EACCES;
2789         num = (count < 10) ? count : 10;
2790         if (copy_from_user(buff, buffer, num))
2791                 return -EFAULT;
2792         buff[num] = '\0';
2793         k = simple_strtoul(buff, NULL, 10);
2794         if (k <= 1048576) {     /* limit "big buff" to 1 MB */
2795                 sg_big_buff = k;
2796                 return count;
2797         }
2798         return -ERANGE;
2799 }
2800
2801 static int sg_proc_seq_show_version(struct seq_file *s, void *v)
2802 {
2803         seq_printf(s, "%d\t%s [%s]\n", sg_version_num, SG_VERSION_STR,
2804                    sg_version_date);
2805         return 0;
2806 }
2807
2808 static int sg_proc_single_open_version(struct inode *inode, struct file *file)
2809 {
2810         return single_open(file, sg_proc_seq_show_version, NULL);
2811 }
2812
2813 static int sg_proc_seq_show_devhdr(struct seq_file *s, void *v)
2814 {
2815         seq_printf(s, "host\tchan\tid\tlun\ttype\topens\tqdepth\tbusy\t"
2816                    "online\n");
2817         return 0;
2818 }
2819
2820 static int sg_proc_single_open_devhdr(struct inode *inode, struct file *file)
2821 {
2822         return single_open(file, sg_proc_seq_show_devhdr, NULL);
2823 }
2824
2825 struct sg_proc_deviter {
2826         loff_t  index;
2827         size_t  max;
2828 };
2829
2830 static void * dev_seq_start(struct seq_file *s, loff_t *pos)
2831 {
2832         struct sg_proc_deviter * it = kmalloc(sizeof(*it), GFP_KERNEL);
2833
2834         s->private = it;
2835         if (! it)
2836                 return NULL;
2837
2838         it->index = *pos;
2839         it->max = sg_last_dev();
2840         if (it->index >= it->max)
2841                 return NULL;
2842         return it;
2843 }
2844
2845 static void * dev_seq_next(struct seq_file *s, void *v, loff_t *pos)
2846 {
2847         struct sg_proc_deviter * it = s->private;
2848
2849         *pos = ++it->index;
2850         return (it->index < it->max) ? it : NULL;
2851 }
2852
2853 static void dev_seq_stop(struct seq_file *s, void *v)
2854 {
2855         kfree(s->private);
2856 }
2857
2858 static int sg_proc_open_dev(struct inode *inode, struct file *file)
2859 {
2860         return seq_open(file, &dev_seq_ops);
2861 }
2862
2863 static int sg_proc_seq_show_dev(struct seq_file *s, void *v)
2864 {
2865         struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
2866         Sg_device *sdp;
2867         struct scsi_device *scsidp;
2868
2869         sdp = it ? sg_get_dev(it->index) : NULL;
2870         if (sdp && (scsidp = sdp->device) && (!sdp->detached))
2871                 seq_printf(s, "%d\t%d\t%d\t%d\t%d\t%d\t%d\t%d\t%d\n",
2872                               scsidp->host->host_no, scsidp->channel,
2873                               scsidp->id, scsidp->lun, (int) scsidp->type,
2874                               1,
2875                               (int) scsidp->queue_depth,
2876                               (int) scsidp->device_busy,
2877                               (int) scsi_device_online(scsidp));
2878         else
2879                 seq_printf(s, "-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\n");
2880         return 0;
2881 }
2882
2883 static int sg_proc_open_devstrs(struct inode *inode, struct file *file)
2884 {
2885         return seq_open(file, &devstrs_seq_ops);
2886 }
2887
2888 static int sg_proc_seq_show_devstrs(struct seq_file *s, void *v)
2889 {
2890         struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
2891         Sg_device *sdp;
2892         struct scsi_device *scsidp;
2893
2894         sdp = it ? sg_get_dev(it->index) : NULL;
2895         if (sdp && (scsidp = sdp->device) && (!sdp->detached))
2896                 seq_printf(s, "%8.8s\t%16.16s\t%4.4s\n",
2897                            scsidp->vendor, scsidp->model, scsidp->rev);
2898         else
2899                 seq_printf(s, "<no active device>\n");
2900         return 0;
2901 }
2902
2903 static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp)
2904 {
2905         int k, m, new_interface, blen, usg;
2906         Sg_request *srp;
2907         Sg_fd *fp;
2908         const sg_io_hdr_t *hp;
2909         const char * cp;
2910         unsigned int ms;
2911
2912         for (k = 0; (fp = sg_get_nth_sfp(sdp, k)); ++k) {
2913                 seq_printf(s, "   FD(%d): timeout=%dms bufflen=%d "
2914                            "(res)sgat=%d low_dma=%d\n", k + 1,
2915                            jiffies_to_msecs(fp->timeout),
2916                            fp->reserve.bufflen,
2917                            (int) fp->reserve.k_use_sg,
2918                            (int) fp->low_dma);
2919                 seq_printf(s, "   cmd_q=%d f_packid=%d k_orphan=%d closed=%d\n",
2920                            (int) fp->cmd_q, (int) fp->force_packid,
2921                            (int) fp->keep_orphan, (int) fp->closed);
2922                 for (m = 0; (srp = sg_get_nth_request(fp, m)); ++m) {
2923                         hp = &srp->header;
2924                         new_interface = (hp->interface_id == '\0') ? 0 : 1;
2925                         if (srp->res_used) {
2926                                 if (new_interface &&
2927                                     (SG_FLAG_MMAP_IO & hp->flags))
2928                                         cp = "     mmap>> ";
2929                                 else
2930                                         cp = "     rb>> ";
2931                         } else {
2932                                 if (SG_INFO_DIRECT_IO_MASK & hp->info)
2933                                         cp = "     dio>> ";
2934                                 else
2935                                         cp = "     ";
2936                         }
2937                         seq_printf(s, cp);
2938                         blen = srp->data.bufflen;
2939                         usg = srp->data.k_use_sg;
2940                         seq_printf(s, srp->done ?
2941                                    ((1 == srp->done) ?  "rcv:" : "fin:")
2942                                    : "act:");
2943                         seq_printf(s, " id=%d blen=%d",
2944                                    srp->header.pack_id, blen);
2945                         if (srp->done)
2946                                 seq_printf(s, " dur=%d", hp->duration);
2947                         else {
2948                                 ms = jiffies_to_msecs(jiffies);
2949                                 seq_printf(s, " t_o/elap=%d/%d",
2950                                         (new_interface ? hp->timeout :
2951                                                   jiffies_to_msecs(fp->timeout)),
2952                                         (ms > hp->duration ? ms - hp->duration : 0));
2953                         }
2954                         seq_printf(s, "ms sgat=%d op=0x%02x\n", usg,
2955                                    (int) srp->data.cmd_opcode);
2956                 }
2957                 if (0 == m)
2958                         seq_printf(s, "     No requests active\n");
2959         }
2960 }
2961
2962 static int sg_proc_open_debug(struct inode *inode, struct file *file)
2963 {
2964         return seq_open(file, &debug_seq_ops);
2965 }
2966
2967 static int sg_proc_seq_show_debug(struct seq_file *s, void *v)
2968 {
2969         struct sg_proc_deviter * it = (struct sg_proc_deviter *) v;
2970         Sg_device *sdp;
2971
2972         if (it && (0 == it->index)) {
2973                 seq_printf(s, "max_active_device=%d(origin 1)\n",
2974                            (int)it->max);
2975                 seq_printf(s, " def_reserved_size=%d\n", sg_big_buff);
2976         }
2977         sdp = it ? sg_get_dev(it->index) : NULL;
2978         if (sdp) {
2979                 struct scsi_device *scsidp = sdp->device;
2980
2981                 if (NULL == scsidp) {
2982                         seq_printf(s, "device %d detached ??\n",
2983                                    (int)it->index);
2984                         return 0;
2985                 }
2986
2987                 if (sg_get_nth_sfp(sdp, 0)) {
2988                         seq_printf(s, " >>> device=%s ",
2989                                 sdp->disk->disk_name);
2990                         if (sdp->detached)
2991                                 seq_printf(s, "detached pending close ");
2992                         else
2993                                 seq_printf
2994                                     (s, "scsi%d chan=%d id=%d lun=%d   em=%d",
2995                                      scsidp->host->host_no,
2996                                      scsidp->channel, scsidp->id,
2997                                      scsidp->lun,
2998                                      scsidp->host->hostt->emulated);
2999                         seq_printf(s, " sg_tablesize=%d excl=%d\n",
3000                                    sdp->sg_tablesize, sdp->exclude);
3001                 }
3002                 sg_proc_debug_helper(s, sdp);
3003         }
3004         return 0;
3005 }
3006
3007 #endif                          /* CONFIG_SCSI_PROC_FS */
3008
3009 module_init(init_sg);
3010 module_exit(exit_sg);