1 files changed, 121 insertions, 77 deletions

diff --git a/block/bsg.c b/block/bsg.c
index 53a09a52d154..6d139d20ec99 100644
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -103,8 +103,8 @@ struct bsg_command {
 	struct request *rq;
 	struct bio *bio;
 	int err;
-	struct sg_io_hdr hdr;
-	struct sg_io_hdr __user *uhdr;
+	struct sg_io_v4 hdr;
+	struct sg_io_v4 __user *uhdr;
 	char sense[SCSI_SENSE_BUFFERSIZE];
 };
 
@@ -235,57 +235,82 @@ static struct bsg_command *bsg_get_command(struct bsg_device *bd)
 	return bc;
 }
 
+static int blk_fill_sgv4_hdr_rq(request_queue_t *q, struct request *rq,
+				struct sg_io_v4 *hdr, int has_write_perm)
+{
+	memset(rq->cmd, 0, BLK_MAX_CDB); /* ATAPI hates garbage after CDB */
+
+	if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
+			   hdr->request_len))
+		return -EFAULT;
+	if (blk_verify_command(rq->cmd, has_write_perm))
+		return -EPERM;
+
+	/*
+	 * fill in request structure
+	 */
+	rq->cmd_len = hdr->request_len;
+	rq->cmd_type = REQ_TYPE_BLOCK_PC;
+
+	rq->timeout = (hdr->timeout * HZ) / 1000;
+	if (!rq->timeout)
+		rq->timeout = q->sg_timeout;
+	if (!rq->timeout)
+		rq->timeout = BLK_DEFAULT_SG_TIMEOUT;
+
+	return 0;
+}
+
 /*
- * Check if sg_io_hdr from user is allowed and valid
+ * Check if sg_io_v4 from user is allowed and valid
  */
 static int
-bsg_validate_sghdr(request_queue_t *q, struct sg_io_hdr *hdr, int *rw)
+bsg_validate_sgv4_hdr(request_queue_t *q, struct sg_io_v4 *hdr, int *rw)
 {
-	if (hdr->interface_id != 'S')
+	if (hdr->guard != 'Q')
 		return -EINVAL;
-	if (hdr->cmd_len > BLK_MAX_CDB)
+	if (hdr->request_len > BLK_MAX_CDB)
 		return -EINVAL;
-	if (hdr->dxfer_len > (q->max_sectors << 9))
+	if (hdr->dout_xfer_len > (q->max_sectors << 9) ||
+	    hdr->din_xfer_len > (q->max_sectors << 9))
 		return -EIO;
 
+	/* not supported currently */
+	if (hdr->protocol || hdr->subprotocol)
+		return -EINVAL;
+
 	/*
 	 * looks sane, if no data then it should be fine from our POV
 	 */
-	if (!hdr->dxfer_len)
+	if (!hdr->dout_xfer_len && !hdr->din_xfer_len)
 		return 0;
 
-	switch (hdr->dxfer_direction) {
-		case SG_DXFER_TO_FROM_DEV:
-		case SG_DXFER_FROM_DEV:
-			*rw = READ;
-			break;
-		case SG_DXFER_TO_DEV:
-			*rw = WRITE;
-			break;
-		default:
-			return -EINVAL;
-	}
+	/* not supported currently */
+	if (hdr->dout_xfer_len && hdr->din_xfer_len)
+		return -EINVAL;
+
+	*rw = hdr->dout_xfer_len ? WRITE : READ;
 
 	return 0;
 }
 
 /*
- * map sg_io_hdr to a request. for scatter-gather sg_io_hdr, we map
- * each segment to a bio and string multiple bio's to the request
+ * map sg_io_v4 to a request.
  */
 static struct request *
-bsg_map_hdr(struct bsg_device *bd, int rw, struct sg_io_hdr *hdr)
+bsg_map_hdr(struct bsg_device *bd, struct sg_io_v4 *hdr)
 {
 	request_queue_t *q = bd->queue;
-	struct sg_iovec iov;
-	struct sg_iovec __user *u_iov;
 	struct request *rq;
-	int ret, i = 0;
+	int ret, rw;
+	unsigned int dxfer_len;
+	void *dxferp = NULL;
 
-	dprintk("map hdr %p/%d/%d\n", hdr->dxferp, hdr->dxfer_len,
-					hdr->iovec_count);
+	dprintk("map hdr %llx/%u %llx/%u\n", (unsigned long long) hdr->dout_xferp,
+		hdr->dout_xfer_len, (unsigned long long) hdr->din_xferp,
+		hdr->din_xfer_len);
 
-	ret = bsg_validate_sghdr(q, hdr, &rw);
+	ret = bsg_validate_sgv4_hdr(q, hdr, &rw);
 	if (ret)
 		return ERR_PTR(ret);
 
@@ -293,44 +318,29 @@ bsg_map_hdr(struct bsg_device *bd, int rw, struct sg_io_hdr *hdr)
 	 * map scatter-gather elements seperately and string them to request
 	 */
 	rq = blk_get_request(q, rw, GFP_KERNEL);
-	ret = blk_fill_sghdr_rq(q, rq, hdr, test_bit(BSG_F_WRITE_PERM,
-				&bd->flags));
+	ret = blk_fill_sgv4_hdr_rq(q, rq, hdr, test_bit(BSG_F_WRITE_PERM,
+						       &bd->flags));
 	if (ret) {
 		blk_put_request(rq);
 		return ERR_PTR(ret);
 	}
 
-	if (!hdr->iovec_count) {
-		ret = blk_rq_map_user(q, rq, hdr->dxferp, hdr->dxfer_len);
-		if (ret)
-			goto out;
-	}
-
-	u_iov = hdr->dxferp;
-	for (ret = 0, i = 0; i < hdr->iovec_count; i++, u_iov++) {
-		if (copy_from_user(&iov, u_iov, sizeof(iov))) {
-			ret = -EFAULT;
-			break;
-		}
-
-		if (!iov.iov_len || !iov.iov_base) {
-			ret = -EINVAL;
-			break;
+	if (hdr->dout_xfer_len) {
+		dxfer_len = hdr->dout_xfer_len;
+		dxferp = (void*)(unsigned long)hdr->dout_xferp;
+	} else if (hdr->din_xfer_len) {
+		dxfer_len = hdr->din_xfer_len;
+		dxferp = (void*)(unsigned long)hdr->din_xferp;
+	} else
+		dxfer_len = 0;
+
+	if (dxfer_len) {
+		ret = blk_rq_map_user(q, rq, dxferp, dxfer_len);
+		if (ret) {
+			dprintk("failed map at %d\n", ret);
+			blk_put_request(rq);
+			rq = ERR_PTR(ret);
 		}
-
-		ret = blk_rq_map_user(q, rq, iov.iov_base, iov.iov_len);
-		if (ret)
-			break;
-	}
-
-	/*
-	 * bugger, cleanup
-	 */
-	if (ret) {
-out:
-		dprintk("failed map at %d: %d\n", i, ret);
-		blk_unmap_sghdr_rq(rq, hdr);
-		rq = ERR_PTR(ret);
 	}
 
 	return rq;
@@ -346,7 +356,7 @@ static void bsg_rq_end_io(struct request *rq, int uptodate)
 	struct bsg_device *bd = bc->bd;
 	unsigned long flags;
 
-	dprintk("%s: finished rq %p bc %p, bio %p offset %d stat %d\n",
+	dprintk("%s: finished rq %p bc %p, bio %p offset %Zd stat %d\n",
 		bd->name, rq, bc, bc->bio, bc - bd->cmd_map, uptodate);
 
 	bc->hdr.duration = jiffies_to_msecs(jiffies - bc->hdr.duration);
@@ -434,6 +444,42 @@ bsg_get_done_cmd_nosignals(struct bsg_device *bd)
 	return __bsg_get_done_cmd(bd, TASK_UNINTERRUPTIBLE);
 }
 
+static int blk_complete_sgv4_hdr_rq(struct request *rq, struct sg_io_v4 *hdr,
+				    struct bio *bio)
+{
+	int ret = 0;
+
+	dprintk("rq %p bio %p %u\n", rq, bio, rq->errors);
+	/*
+	 * fill in all the output members
+	 */
+	hdr->device_status = status_byte(rq->errors);
+	hdr->transport_status = host_byte(rq->errors);
+	hdr->driver_status = driver_byte(rq->errors);
+	hdr->info = 0;
+	if (hdr->device_status || hdr->transport_status || hdr->driver_status)
+		hdr->info |= SG_INFO_CHECK;
+	hdr->din_resid = rq->data_len;
+	hdr->response_len = 0;
+
+	if (rq->sense_len && hdr->response) {
+		int len = min((unsigned int) hdr->max_response_len,
+			      rq->sense_len);
+
+		ret = copy_to_user((void*)(unsigned long)hdr->response,
+				   rq->sense, len);
+		if (!ret)
+			hdr->response_len = len;
+		else
+			ret = -EFAULT;
+	}
+
+	blk_rq_unmap_user(bio);
+	blk_put_request(rq);
+
+	return ret;
+}
+
 static int bsg_complete_all_commands(struct bsg_device *bd)
 {
 	struct bsg_command *bc;
@@ -476,7 +522,7 @@ static int bsg_complete_all_commands(struct bsg_device *bd)
 			break;
 		}
 
-		tret = blk_complete_sghdr_rq(bc->rq, &bc->hdr, bc->bio);
+		tret = blk_complete_sgv4_hdr_rq(bc->rq, &bc->hdr, bc->bio);
 		if (!ret)
 			ret = tret;
 
@@ -495,11 +541,11 @@ __bsg_read(char __user *buf, size_t count, bsg_command_callback get_bc,
 	struct bsg_command *bc;
 	int nr_commands, ret;
 
-	if (count % sizeof(struct sg_io_hdr))
+	if (count % sizeof(struct sg_io_v4))
 		return -EINVAL;
 
 	ret = 0;
-	nr_commands = count / sizeof(struct sg_io_hdr);
+	nr_commands = count / sizeof(struct sg_io_v4);
 	while (nr_commands) {
 		bc = get_bc(bd, iov);
 		if (IS_ERR(bc)) {
@@ -512,7 +558,7 @@ __bsg_read(char __user *buf, size_t count, bsg_command_callback get_bc,
 		 * after completing the request. so do that here,
 		 * bsg_complete_work() cannot do that for us
 		 */
-		ret = blk_complete_sghdr_rq(bc->rq, &bc->hdr, bc->bio);
+		ret = blk_complete_sgv4_hdr_rq(bc->rq, &bc->hdr, bc->bio);
 
 		if (copy_to_user(buf, (char *) &bc->hdr, sizeof(bc->hdr)))
 			ret = -EFAULT;
@@ -522,8 +568,8 @@ __bsg_read(char __user *buf, size_t count, bsg_command_callback get_bc,
 		if (ret)
 			break;
 
-		buf += sizeof(struct sg_io_hdr);
-		*bytes_read += sizeof(struct sg_io_hdr);
+		buf += sizeof(struct sg_io_v4);
+		*bytes_read += sizeof(struct sg_io_v4);
 		nr_commands--;
 	}
 
@@ -582,16 +628,15 @@ static ssize_t __bsg_write(struct bsg_device *bd, const char __user *buf,
 	struct request *rq;
 	int ret, nr_commands;
 
-	if (count % sizeof(struct sg_io_hdr))
+	if (count % sizeof(struct sg_io_v4))
 		return -EINVAL;
 
-	nr_commands = count / sizeof(struct sg_io_hdr);
+	nr_commands = count / sizeof(struct sg_io_v4);
 	rq = NULL;
 	bc = NULL;
 	ret = 0;
 	while (nr_commands) {
 		request_queue_t *q = bd->queue;
-		int rw = READ;
 
 		bc = bsg_get_command(bd);
 		if (!bc)
@@ -602,7 +647,7 @@ static ssize_t __bsg_write(struct bsg_device *bd, const char __user *buf,
 			break;
 		}
 
-		bc->uhdr = (struct sg_io_hdr __user *) buf;
+		bc->uhdr = (struct sg_io_v4 __user *) buf;
 		if (copy_from_user(&bc->hdr, buf, sizeof(bc->hdr))) {
 			ret = -EFAULT;
 			break;
@@ -611,7 +656,7 @@ static ssize_t __bsg_write(struct bsg_device *bd, const char __user *buf,
 		/*
 		 * get a request, fill in the blanks, and add to request queue
 		 */
-		rq = bsg_map_hdr(bd, rw, &bc->hdr);
+		rq = bsg_map_hdr(bd, &bc->hdr);
 		if (IS_ERR(rq)) {
 			ret = PTR_ERR(rq);
 			rq = NULL;
@@ -622,12 +667,10 @@ static ssize_t __bsg_write(struct bsg_device *bd, const char __user *buf,
 		bc = NULL;
 		rq = NULL;
 		nr_commands--;
-		buf += sizeof(struct sg_io_hdr);
-		*bytes_read += sizeof(struct sg_io_hdr);
+		buf += sizeof(struct sg_io_v4);
+		*bytes_read += sizeof(struct sg_io_v4);
 	}
 
-	if (rq)
-		blk_unmap_sghdr_rq(rq, &bc->hdr);
 	if (bc)
 		bsg_free_command(bc);
 
@@ -898,11 +941,12 @@ bsg_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 	case SG_GET_RESERVED_SIZE:
 	case SG_SET_RESERVED_SIZE:
 	case SG_EMULATED_HOST:
-	case SG_IO:
 	case SCSI_IOCTL_SEND_COMMAND: {
 		void __user *uarg = (void __user *) arg;
 		return scsi_cmd_ioctl(file, bd->disk, cmd, uarg);
 	}
+	case SG_IO:
+		return -EINVAL;
 	/*
 	 * block device ioctls
 	 */