File: /usr/src/linux/drivers/scsi/sg.c

1     /*
2      *  History:
3      *  Started: Aug 9 by Lawrence Foard (entropy@world.std.com),
4      *           to allow user process control of SCSI devices.
5      *  Development Sponsored by Killy Corp. NY NY
6      *
7      * Original driver (sg.c):
8      *        Copyright (C) 1992 Lawrence Foard
9      * Version 2 and 3 extensions to driver:
10      *        Copyright (C) 1998 - 2001 Douglas Gilbert
11      *
12      *  Modified  19-JAN-1998  Richard Gooch <rgooch@atnf.csiro.au>  Devfs support
13      *
14      * This program is free software; you can redistribute it and/or modify
15      * it under the terms of the GNU General Public License as published by
16      * the Free Software Foundation; either version 2, or (at your option)
17      * any later version.
18      *
19      */
20     #include <linux/config.h>
21     #ifdef CONFIG_PROC_FS
22      static char sg_version_str[] = "Version: 3.1.20 (20010814)";
23     #endif
24      static int sg_version_num = 30120; /* 2 digits for each component */
25     /*
26      *  D. P. Gilbert (dgilbert@interlog.com, dougg@triode.net.au), notes:
27      *      - scsi logging is available via SCSI_LOG_TIMEOUT macros. First
28      *        the kernel/module needs to be built with CONFIG_SCSI_LOGGING
29      *        (otherwise the macros compile to empty statements).
30      *        Then before running the program to be debugged enter:
31      *          # echo "scsi log timeout 7" > /proc/scsi/scsi
32      *        This will send copious output to the console and the log which
33      *        is usually /var/log/messages. To turn off debugging enter:
34      *          # echo "scsi log timeout 0" > /proc/scsi/scsi
35      *        The 'timeout' token was chosen because it is relatively unused.
36      *        The token 'hlcomplete' should be used but that triggers too
37      *        much output from the sd device driver. To dump the current
38      *        state of the SCSI mid level data structures enter:
39      *          # echo "scsi dump 1" > /proc/scsi/scsi
40      *        To dump the state of sg's data structures use:
41      *          # cat /proc/scsi/sg/debug
42      *
43      */
44     #include <linux/module.h>
45     
46     #include <linux/fs.h>
47     #include <linux/kernel.h>
48     #include <linux/sched.h>
49     #include <linux/string.h>
50     #include <linux/mm.h>
51     #include <linux/errno.h>
52     #include <linux/mtio.h>
53     #include <linux/ioctl.h>
54     #include <linux/fcntl.h>
55     #include <linux/init.h>
56     #include <linux/poll.h>
57     #include <linux/smp_lock.h>
58     
59     #include <asm/io.h>
60     #include <asm/uaccess.h>
61     #include <asm/system.h>
62     
63     #include <linux/blk.h>
64     #include "scsi.h"
65     #include "hosts.h"
66     #include <scsi/scsi_ioctl.h>
67     #include <scsi/sg.h>
68     
69     #ifdef CONFIG_PROC_FS
70     #include <linux/proc_fs.h>
71     static int sg_proc_init(void);
72     static void sg_proc_cleanup(void);
73     #endif
74     
75     #ifndef LINUX_VERSION_CODE
76     #include <linux/version.h>
77     #endif /* LINUX_VERSION_CODE */
78     
79     #define SG_ALLOW_DIO_DEF 0
80     #define SG_ALLOW_DIO_CODE	/* compile out be commenting this define */
81     #ifdef SG_ALLOW_DIO_CODE
82     #include <linux/iobuf.h>
83     #endif
84     
85     int sg_big_buff = SG_DEF_RESERVED_SIZE;
86     /* N.B. This variable is readable and writeable via
87        /proc/scsi/sg/def_reserved_size . Each time sg_open() is called a buffer
88        of this size (or less if there is not enough memory) will be reserved
89        for use by this file descriptor. [Deprecated usage: this variable is also
90        readable via /proc/sys/kernel/sg-big-buff if the sg driver is built into
91        the kernel (i.e. it is not a module).] */
92     static int def_reserved_size = -1;      /* picks up init parameter */
93     static int sg_allow_dio = SG_ALLOW_DIO_DEF;
94     
95     #define SG_SECTOR_SZ 512
96     #define SG_SECTOR_MSK (SG_SECTOR_SZ - 1)
97     
98     #define SG_LOW_POOL_THRESHHOLD 30
99     #define SG_MAX_POOL_SECTORS 320  /* Max. number of pool sectors to take */
100     
101     static int sg_pool_secs_avail = SG_MAX_POOL_SECTORS;
102     
103     #define SG_HEAP_PAGE 1  /* heap from kernel via get_free_pages() */
104     #define SG_HEAP_KMAL 2  /* heap from kernel via kmalloc() */
105     #define SG_HEAP_POOL 3  /* heap from scsi dma pool (mid-level) */
106     #define SG_USER_MEM 4   /* memory belongs to user space */
107     
108     #define SG_DEV_ARR_LUMP 6 /* amount to over allocate sg_dev_arr by */
109     
110     
111     static int sg_init(void);
112     static int sg_attach(Scsi_Device *);
113     static void sg_finish(void);
114     static int sg_detect(Scsi_Device *);
115     static void sg_detach(Scsi_Device *);
116     
117     static Scsi_Request * dummy_cmdp;	/* only used for sizeof */
118     
119     static rwlock_t sg_dev_arr_lock = RW_LOCK_UNLOCKED;  /* Also used to lock
120     			file descriptor list for device */
121     
122     static struct Scsi_Device_Template sg_template =
123     {
124           tag:"sg",
125           scsi_type:0xff,
126           major:SCSI_GENERIC_MAJOR,
127           detect:sg_detect,
128           init:sg_init,
129           finish:sg_finish,
130           attach:sg_attach,
131           detach:sg_detach
132     };
133     
134     
135     typedef struct sg_scatter_hold  /* holding area for scsi scatter gather info */
136     {
137         unsigned short k_use_sg;    /* Count of kernel scatter-gather pieces */
138         unsigned short sglist_len;  /* size of malloc'd scatter-gather list */
139         unsigned bufflen;           /* Size of (aggregate) data buffer */
140         unsigned b_malloc_len;      /* actual len malloc'ed in buffer */
141         void * buffer;              /* Data buffer or scatter list,12 bytes each*/
142         struct kiobuf * kiobp;      /* for direct IO information */
143         char mapped;                /* indicates kiobp has locked pages */
144         char buffer_mem_src;        /* heap whereabouts of 'buffer' */
145         unsigned char cmd_opcode;   /* first byte of command */
146     } Sg_scatter_hold;    /* 24 bytes long on i386 */
147     
148     struct sg_device;               /* forward declarations */
149     struct sg_fd;
150     
151     typedef struct sg_request  /* SG_MAX_QUEUE requests outstanding per file */
152     {
153         Scsi_Request * my_cmdp;     /* != 0  when request with lower levels */
154         struct sg_request * nextrp; /* NULL -> tail request (slist) */
155         struct sg_fd * parentfp;    /* NULL -> not in use */
156         Sg_scatter_hold data;       /* hold buffer, perhaps scatter list */
157         sg_io_hdr_t header;         /* scsi command+info, see <scsi/sg.h> */
158         unsigned char sense_b[sizeof(dummy_cmdp->sr_sense_buffer)];
159         char res_used;              /* 1 -> using reserve buffer, 0 -> not ... */
160         char orphan;                /* 1 -> drop on sight, 0 -> normal */
161         char sg_io_owned;           /* 1 -> packet belongs to SG_IO */
162         volatile char done;         /* 0->before bh, 1->before read, 2->read */
163     } Sg_request; /* 168 bytes long on i386 */
164     
165     typedef struct sg_fd /* holds the state of a file descriptor */
166     {
167         struct sg_fd * nextfp; /* NULL when last opened fd on this device */
168         struct sg_device * parentdp;     /* owning device */
169         wait_queue_head_t read_wait;     /* queue read until command done */
170         rwlock_t rq_list_lock;	     /* protect access to list in req_arr */
171         int timeout;                     /* defaults to SG_DEFAULT_TIMEOUT */
172         Sg_scatter_hold reserve;  /* buffer held for this file descriptor */
173         unsigned save_scat_len;   /* original length of trunc. scat. element */
174         Sg_request * headrp;      /* head of request slist, NULL->empty */
175         struct fasync_struct * async_qp; /* used by asynchronous notification */
176         Sg_request req_arr[SG_MAX_QUEUE]; /* used as singly-linked list */
177         char low_dma;       /* as in parent but possibly overridden to 1 */
178         char force_packid;  /* 1 -> pack_id input to read(), 0 -> ignored */
179         volatile char closed; /* 1 -> fd closed but request(s) outstanding */
180         char fd_mem_src;    /* heap whereabouts of this Sg_fd object */
181         char cmd_q;         /* 1 -> allow command queuing, 0 -> don't */
182         char next_cmd_len;  /* 0 -> automatic (def), >0 -> use on next write() */
183         char keep_orphan;   /* 0 -> drop orphan (def), 1 -> keep for read() */
184     } Sg_fd; /* 2760 bytes long on i386 */
185     
186     typedef struct sg_device /* holds the state of each scsi generic device */
187     {
188         Scsi_Device * device;
189         wait_queue_head_t o_excl_wait;   /* queue open() when O_EXCL in use */
190         int sg_tablesize;   /* adapter's max scatter-gather table size */
191         Sg_fd * headfp;     /* first open fd belonging to this device */
192         devfs_handle_t de;
193         kdev_t i_rdev;      /* holds device major+minor number */
194         volatile char detached;  /* 0->attached, 1->detached pending removal */
195         volatile char exclude;   /* opened for exclusive access */
196         char sgdebug;       /* 0->off, 1->sense, 9->dump dev, 10-> all devs */
197     } Sg_device; /* 36 bytes long on i386 */
198     
199     
200     static int sg_fasync(int fd, struct file * filp, int mode);
201     static void sg_cmd_done_bh(Scsi_Cmnd * SCpnt);
202     static int sg_start_req(Sg_request * srp);
203     static void sg_finish_rem_req(Sg_request * srp);
204     static int sg_build_indi(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size);
205     static int sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp);
206     static ssize_t sg_new_read(Sg_fd * sfp, char * buf, size_t count,
207     			   Sg_request * srp);
208     static ssize_t sg_new_write(Sg_fd * sfp, const char * buf, size_t count,
209     			int blocking, int read_only, Sg_request ** o_srp);
210     static int sg_common_write(Sg_fd * sfp, Sg_request * srp,
211     			   unsigned char * cmnd, int timeout, int blocking);
212     static int sg_u_iovec(sg_io_hdr_t * hp, int sg_num, int ind,
213     		      int wr_xf, int * countp, unsigned char ** up);
214     static int sg_write_xfer(Sg_request * srp);
215     static int sg_read_xfer(Sg_request * srp);
216     static void sg_read_oxfer(Sg_request * srp, char * outp, int num_read_xfer);
217     static void sg_remove_scat(Sg_scatter_hold * schp);
218     static char * sg_get_sgat_msa(Sg_scatter_hold * schp);
219     static void sg_build_reserve(Sg_fd * sfp, int req_size);
220     static void sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size);
221     static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp);
222     static char * sg_malloc(const Sg_fd * sfp, int size, int * retSzp,
223                             int * mem_srcp);
224     static void sg_free(char * buff, int size, int mem_src);
225     static char * sg_low_malloc(int rqSz, int lowDma, int mem_src,
226                                 int * retSzp);
227     static void sg_low_free(char * buff, int size, int mem_src);
228     static Sg_fd * sg_add_sfp(Sg_device * sdp, int dev);
229     static int sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp);
230     static void __sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp);
231     static Sg_request * sg_get_rq_mark(Sg_fd * sfp, int pack_id);
232     static Sg_request * sg_add_request(Sg_fd * sfp);
233     static int sg_remove_request(Sg_fd * sfp, Sg_request * srp);
234     static int sg_res_in_use(Sg_fd * sfp);
235     static void sg_clr_srpnt(Scsi_Request * SRpnt);
236     static int sg_ms_to_jif(unsigned int msecs);
237     static unsigned sg_jif_to_ms(int jifs);
238     static int sg_allow_access(unsigned char opcode, char dev_type);
239     static int sg_build_dir(Sg_request * srp, Sg_fd * sfp, int dxfer_len);
240     static void sg_unmap_and(Sg_scatter_hold * schp, int free_also);
241     static Sg_device * sg_get_dev(int dev);
242     #ifdef CONFIG_PROC_FS
243     static int sg_last_dev(void);
244     #endif
245     
246     static Sg_device ** sg_dev_arr = NULL;
247     
248     #define SZ_SG_HEADER sizeof(struct sg_header)
249     #define SZ_SG_IO_HDR sizeof(sg_io_hdr_t)
250     #define SZ_SG_IOVEC sizeof(sg_iovec_t)
251     #define SZ_SG_REQ_INFO sizeof(sg_req_info_t)
252     
253     
254     static int sg_open(struct inode * inode, struct file * filp)
255     {
256         int dev = MINOR(inode->i_rdev);
257         int flags = filp->f_flags;
258         Sg_device * sdp;
259         Sg_fd * sfp;
260         int res;
261         int retval = -EBUSY;
262     
263         SCSI_LOG_TIMEOUT(3, printk("sg_open: dev=%d, flags=0x%x\n", dev, flags));
264         sdp = sg_get_dev(dev);
265         if ((! sdp) || (! sdp->device))
266             return -ENXIO;
267         if (sdp->detached)
268         	return -ENODEV;
269     
270          /* This driver's module count bumped by fops_get in <linux/fs.h> */
271          /* Prevent the device driver from vanishing while we sleep */
272          if (sdp->device->host->hostt->module)
273             __MOD_INC_USE_COUNT(sdp->device->host->hostt->module);
274         sdp->device->access_count++;
275     
276         if (! ((flags & O_NONBLOCK) ||
277     	   scsi_block_when_processing_errors(sdp->device))) {
278             retval = -ENXIO;
279     	/* we are in error recovery for this device */
280     	goto error_out;
281         }
282     
283         if (flags & O_EXCL) {
284             if (O_RDONLY == (flags & O_ACCMODE))  {
285                 retval = -EACCES;   /* Can't lock it with read only access */
286     	    goto error_out;
287     	}
288     	if (sdp->headfp && (flags & O_NONBLOCK))
289                 goto error_out;
290             res = 0; 
291     	__wait_event_interruptible(sdp->o_excl_wait,
292     	       ((sdp->headfp || sdp->exclude) ? 0 : (sdp->exclude = 1)),
293                                        res);
294             if (res) {
295                 retval = res; /* -ERESTARTSYS because signal hit process */
296     	    goto error_out;
297             }
298         }
299         else if (sdp->exclude) { /* some other fd has an exclusive lock on dev */
300             if (flags & O_NONBLOCK)
301                 goto error_out;
302             res = 0; 
303             __wait_event_interruptible(sdp->o_excl_wait, (! sdp->exclude), res);
304             if (res) {
305                 retval = res; /* -ERESTARTSYS because signal hit process */
306     	    goto error_out;
307             }
308         }
309         if (sdp->detached) {
310         	retval = -ENODEV;
311     	goto error_out;
312         }
313         if (! sdp->headfp) { /* no existing opens on this device */
314             sdp->sgdebug = 0;
315             sdp->sg_tablesize = sdp->device->host->sg_tablesize;
316         }
317         if ((sfp = sg_add_sfp(sdp, dev)))
318             filp->private_data = sfp;
319         else {
320             if (flags & O_EXCL) sdp->exclude = 0; /* undo if error */
321             retval = -ENOMEM;
322     	goto error_out;
323         }
324         return 0;
325     
326     error_out:
327         sdp->device->access_count--;
328         if ((! sdp->detached) && sdp->device->host->hostt->module)
329             __MOD_DEC_USE_COUNT(sdp->device->host->hostt->module);
330         return retval;
331     }
332     
333     /* Following function was formerly called 'sg_close' */
334     static int sg_release(struct inode * inode, struct file * filp)
335     {
336         Sg_device * sdp;
337         Sg_fd * sfp;
338     
339         lock_kernel();
340         if ((! (sfp = (Sg_fd *)filp->private_data)) || (! (sdp = sfp->parentdp))) {
341     	unlock_kernel();
342             return -ENXIO;
343         }
344         SCSI_LOG_TIMEOUT(3, printk("sg_release: dev=%d\n", MINOR(sdp->i_rdev)));
345         sg_fasync(-1, filp, 0);   /* remove filp from async notification list */
346         if (0 == sg_remove_sfp(sdp, sfp)) { /* Returns 1 when sdp gone */
347             if (! sdp->detached) {
348                 sdp->device->access_count--;
349                 if (sdp->device->host->hostt->module)
350                     __MOD_DEC_USE_COUNT(sdp->device->host->hostt->module);
351             }
352     	sdp->exclude = 0;
353     	wake_up_interruptible(&sdp->o_excl_wait);
354         }
355         unlock_kernel();
356         return 0;
357     }
358     
359     static ssize_t sg_read(struct file * filp, char * buf,
360                            size_t count, loff_t *ppos)
361     {
362         int k, res;
363         Sg_device * sdp;
364         Sg_fd * sfp;
365         Sg_request * srp;
366         int req_pack_id = -1;
367         struct sg_header old_hdr;
368         sg_io_hdr_t new_hdr;
369         sg_io_hdr_t * hp;
370     
371         if ((! (sfp = (Sg_fd *)filp->private_data)) || (! (sdp = sfp->parentdp)))
372             return -ENXIO;
373         SCSI_LOG_TIMEOUT(3, printk("sg_read: dev=%d, count=%d\n",
374                                    MINOR(sdp->i_rdev), (int)count));
375         if (ppos != &filp->f_pos)
376             ; /* FIXME: Hmm.  Seek to the right place, or fail?  */
377         if ((k = verify_area(VERIFY_WRITE, buf, count)))
378             return k;
379         if (sfp->force_packid && (count >= SZ_SG_HEADER)) {
380     	__copy_from_user(&old_hdr, buf, SZ_SG_HEADER);
381     	if (old_hdr.reply_len < 0) {
382     	    if (count >= SZ_SG_IO_HDR) {
383     		__copy_from_user(&new_hdr, buf, SZ_SG_IO_HDR);
384     		req_pack_id = new_hdr.pack_id;
385     	    }
386     	}
387     	else
388     	    req_pack_id = old_hdr.pack_id;
389         }
390         srp = sg_get_rq_mark(sfp, req_pack_id);
391         if (! srp) { /* now wait on packet to arrive */
392     	if (sdp->detached)
393     	    return -ENODEV;
394             if (filp->f_flags & O_NONBLOCK)
395                 return -EAGAIN;
396     	while (1) {
397     	    res = 0;  /* following is a macro that beats race condition */
398     	    __wait_event_interruptible(sfp->read_wait, (sdp->detached || 
399     		    (srp = sg_get_rq_mark(sfp, req_pack_id))), res);
400     	    if (sdp->detached)
401     		return -ENODEV;
402     	    if (0 == res)
403     		break;
404     	    return res; /* -ERESTARTSYS because signal hit process */
405     	}
406         }
407         if (srp->header.interface_id != '\0')
408     	return sg_new_read(sfp, buf, count, srp);
409     
410         hp = &srp->header;
411         memset(&old_hdr, 0, SZ_SG_HEADER);
412         old_hdr.reply_len = (int)hp->timeout;
413         old_hdr.pack_len = old_hdr.reply_len;   /* very old, strange behaviour */
414         old_hdr.pack_id = hp->pack_id;
415         old_hdr.twelve_byte =
416     	    ((srp->data.cmd_opcode >= 0xc0) && (12 == hp->cmd_len)) ? 1 : 0;
417         old_hdr.target_status = hp->masked_status;
418         old_hdr.host_status = hp->host_status;
419         old_hdr.driver_status = hp->driver_status;
420         if ((CHECK_CONDITION & hp->masked_status) ||
421     	(DRIVER_SENSE & hp->driver_status))
422     	memcpy(old_hdr.sense_buffer, srp->sense_b,
423     	       sizeof(old_hdr.sense_buffer));
424         switch (hp->host_status)
425         { /* This setup of 'result' is for backward compatibility and is best
426     	 ignored by the user who should use target, host + driver status */
427     	case DID_OK:
428     	case DID_PASSTHROUGH:
429     	case DID_SOFT_ERROR:
430     	    old_hdr.result = 0;
431     	    break;
432     	case DID_NO_CONNECT:
433     	case DID_BUS_BUSY:
434     	case DID_TIME_OUT:
435     	    old_hdr.result = EBUSY;
436     	    break;
437     	case DID_BAD_TARGET:
438     	case DID_ABORT:
439     	case DID_PARITY:
440     	case DID_RESET:
441     	case DID_BAD_INTR:
442     	    old_hdr.result = EIO;
443     	    break;
444     	case DID_ERROR:
445     	    old_hdr.result =
446     	      (srp->sense_b[0] == 0 && hp->masked_status == GOOD) ? 0 : EIO;
447     	    break;
448     	default:
449     	    old_hdr.result = EIO;
450     	    break;
451         }
452     
453         /* Now copy the result back to the user buffer.  */
454         if (count >= SZ_SG_HEADER) {
455     	__copy_to_user(buf, &old_hdr, SZ_SG_HEADER);
456             buf += SZ_SG_HEADER;
457     	if (count > old_hdr.reply_len)
458     	    count = old_hdr.reply_len;
459     	if (count > SZ_SG_HEADER)
460     	    sg_read_oxfer(srp, buf, count - SZ_SG_HEADER);
461         }
462         else
463     	count = (old_hdr.result == 0) ? 0 : -EIO;
464         sg_finish_rem_req(srp);
465         return count;
466     }
467     
468     static ssize_t sg_new_read(Sg_fd * sfp, char * buf, size_t count,
469     			   Sg_request * srp)
470     {
471         sg_io_hdr_t * hp = &srp->header;
472         int err = 0;
473         int len;
474     
475         if (count < SZ_SG_IO_HDR) {
476     	err = -EINVAL;
477         	goto err_out;
478         }
479         hp->sb_len_wr = 0;
480         if ((hp->mx_sb_len > 0) && hp->sbp) {
481     	if ((CHECK_CONDITION & hp->masked_status) ||
482     	    (DRIVER_SENSE & hp->driver_status)) {
483     	    int sb_len = sizeof(dummy_cmdp->sr_sense_buffer);
484     	    sb_len = (hp->mx_sb_len > sb_len) ? sb_len : hp->mx_sb_len;
485     	    len = 8 + (int)srp->sense_b[7]; /* Additional sense length field */
486     	    len = (len > sb_len) ? sb_len : len;
487     	    if ((err = verify_area(VERIFY_WRITE, hp->sbp, len)))
488     		goto err_out;
489     	    __copy_to_user(hp->sbp, srp->sense_b, len);
490     	    hp->sb_len_wr = len;
491     	}
492         }
493         if (hp->masked_status || hp->host_status || hp->driver_status)
494     	hp->info |= SG_INFO_CHECK;
495         copy_to_user(buf, hp, SZ_SG_IO_HDR);
496         err = sg_read_xfer(srp);
497     err_out:
498         sg_finish_rem_req(srp);
499         return (0 == err) ? count : err;
500     }
501     
502     
503     static ssize_t sg_write(struct file * filp, const char * buf,
504                             size_t count, loff_t *ppos)
505     {
506         int                   mxsize, cmd_size, k;
507         int                   input_size, blocking;
508         unsigned char         opcode;
509         Sg_device           * sdp;
510         Sg_fd               * sfp;
511         Sg_request          * srp;
512         struct sg_header      old_hdr;
513         sg_io_hdr_t         * hp;
514         unsigned char         cmnd[sizeof(dummy_cmdp->sr_cmnd)];
515     
516         if ((! (sfp = (Sg_fd *)filp->private_data)) || (! (sdp = sfp->parentdp)))
517             return -ENXIO;
518         SCSI_LOG_TIMEOUT(3, printk("sg_write: dev=%d, count=%d\n",
519                                    MINOR(sdp->i_rdev), (int)count));
520         if (sdp->detached)
521         	return -ENODEV;
522         if (! ((filp->f_flags & O_NONBLOCK) ||
523                scsi_block_when_processing_errors(sdp->device)))
524             return -ENXIO;
525         if (ppos != &filp->f_pos)
526             ; /* FIXME: Hmm.  Seek to the right place, or fail?  */
527     
528         if ((k = verify_area(VERIFY_READ, buf, count)))
529             return k;  /* protects following copy_from_user()s + get_user()s */
530         if (count < SZ_SG_HEADER)
531     	return -EIO;
532         __copy_from_user(&old_hdr, buf, SZ_SG_HEADER);
533         blocking = !(filp->f_flags & O_NONBLOCK);
534         if (old_hdr.reply_len < 0)
535     	return sg_new_write(sfp, buf, count, blocking, 0, NULL);
536         if (count < (SZ_SG_HEADER + 6))
537     	return -EIO;   /* The minimum scsi command length is 6 bytes. */
538     
539         if (! (srp = sg_add_request(sfp))) {
540     	SCSI_LOG_TIMEOUT(1, printk("sg_write: queue full\n"));
541     	return -EDOM;
542         }
543         buf += SZ_SG_HEADER;
544         __get_user(opcode, buf);
545         if (sfp->next_cmd_len > 0) {
546             if (sfp->next_cmd_len > MAX_COMMAND_SIZE) {
547                 SCSI_LOG_TIMEOUT(1, printk("sg_write: command length too long\n"));
548                 sfp->next_cmd_len = 0;
549     	    sg_remove_request(sfp, srp);
550                 return -EIO;
551             }
552             cmd_size = sfp->next_cmd_len;
553             sfp->next_cmd_len = 0; /* reset so only this write() effected */
554         }
555         else {
556             cmd_size = COMMAND_SIZE(opcode); /* based on SCSI command group */
557     	if ((opcode >= 0xc0) && old_hdr.twelve_byte)
558                 cmd_size = 12;
559         }
560         SCSI_LOG_TIMEOUT(4, printk("sg_write:   scsi opcode=0x%02x, cmd_size=%d\n",
561                                    (int)opcode, cmd_size));
562     /* Determine buffer size.  */
563         input_size = count - cmd_size;
564         mxsize = (input_size > old_hdr.reply_len) ? input_size :
565     						old_hdr.reply_len;
566         mxsize -= SZ_SG_HEADER;
567         input_size -= SZ_SG_HEADER;
568         if (input_size < 0) {
569             sg_remove_request(sfp, srp);
570             return -EIO; /* User did not pass enough bytes for this command. */
571         }
572         hp = &srp->header;
573         hp->interface_id = '\0'; /* indicator of old interface tunnelled */
574         hp->cmd_len = (unsigned char)cmd_size;
575         hp->iovec_count = 0;
576         hp->mx_sb_len = 0;
577         if (input_size > 0)
578     	hp->dxfer_direction = ((old_hdr.reply_len - SZ_SG_HEADER) > 0) ?
579     			      SG_DXFER_TO_FROM_DEV : SG_DXFER_TO_DEV;
580         else
581     	hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV :
582     					     SG_DXFER_NONE;
583         hp->dxfer_len = mxsize;
584         hp->dxferp = (unsigned char *)buf + cmd_size;
585         hp->sbp = NULL;
586         hp->timeout = old_hdr.reply_len;    /* structure abuse ... */
587         hp->flags = input_size;             /* structure abuse ... */
588         hp->pack_id = old_hdr.pack_id;
589         hp->usr_ptr = NULL;
590         __copy_from_user(cmnd, buf, cmd_size);
591         k = sg_common_write(sfp, srp, cmnd, sfp->timeout, blocking);
592         return (k < 0) ? k : count;
593     }
594     
595     static ssize_t sg_new_write(Sg_fd * sfp, const char * buf, size_t count,
596     			    int blocking, int read_only, Sg_request ** o_srp)
597     {
598         int                   k;
599         Sg_request          * srp;
600         sg_io_hdr_t         * hp;
601         unsigned char         cmnd[sizeof(dummy_cmdp->sr_cmnd)];
602         int                   timeout;
603     
604         if (count < SZ_SG_IO_HDR)
605     	return -EINVAL;
606         if ((k = verify_area(VERIFY_READ, buf, count)))
607     	return k;  /* protects following copy_from_user()s + get_user()s */
608     
609         sfp->cmd_q = 1;  /* when sg_io_hdr seen, set command queuing on */
610         if (! (srp = sg_add_request(sfp))) {
611     	SCSI_LOG_TIMEOUT(1, printk("sg_new_write: queue full\n"));
612     	return -EDOM;
613         }
614         hp = &srp->header;
615         __copy_from_user(hp, buf, SZ_SG_IO_HDR);
616         if (hp->interface_id != 'S') {
617     	sg_remove_request(sfp, srp);
618     	return -ENOSYS;
619         }
620         timeout = sg_ms_to_jif(srp->header.timeout);
621         if ((! hp->cmdp) || (hp->cmd_len < 6) || (hp->cmd_len > sizeof(cmnd))) {
622     	sg_remove_request(sfp, srp);
623     	return -EMSGSIZE;
624         }
625         if ((k = verify_area(VERIFY_READ, hp->cmdp, hp->cmd_len))) {
626     	sg_remove_request(sfp, srp);
627     	return k;  /* protects following copy_from_user()s + get_user()s */
628         }
629         __copy_from_user(cmnd, hp->cmdp, hp->cmd_len);
630         if (read_only &&
631     	(! sg_allow_access(cmnd[0], sfp->parentdp->device->type))) {
632     	sg_remove_request(sfp, srp);
633     	return -EACCES;
634         }
635         k = sg_common_write(sfp, srp, cmnd, timeout, blocking);
636         if (k < 0) return k;
637         if (o_srp) *o_srp = srp;
638         return count;
639     }
640     
641     static int sg_common_write(Sg_fd * sfp, Sg_request * srp,
642     			   unsigned char * cmnd, int timeout, int blocking)
643     {
644         int                   k;
645         Scsi_Request        * SRpnt;
646         Sg_device           * sdp = sfp->parentdp;
647         sg_io_hdr_t         * hp = &srp->header;
648         request_queue_t	* q;
649     
650         srp->data.cmd_opcode = cmnd[0];  /* hold opcode of command */
651         hp->status = 0;
652         hp->masked_status = 0;
653         hp->msg_status = 0;
654         hp->info = 0;
655         hp->host_status = 0;
656         hp->driver_status = 0;
657         hp->resid = 0;
658         SCSI_LOG_TIMEOUT(4,
659     	printk("sg_common_write:  scsi opcode=0x%02x, cmd_size=%d\n",
660     	       (int)cmnd[0], (int)hp->cmd_len));
661     
662         if ((k = sg_start_req(srp))) {
663     	SCSI_LOG_TIMEOUT(1, printk("sg_write: start_req err=%d\n", k));
664     	sg_finish_rem_req(srp);
665             return k;    /* probably out of space --> ENOMEM */
666         }
667         if ((k = sg_write_xfer(srp))) {
668     	SCSI_LOG_TIMEOUT(1, printk("sg_write: write_xfer, bad address\n"));
669     	sg_finish_rem_req(srp);
670     	return k;
671         }
672         if (sdp->detached) {
673         	sg_finish_rem_req(srp);
674         	return -ENODEV;
675         }
676         SRpnt = scsi_allocate_request(sdp->device);
677         if(SRpnt == NULL) {
678         	SCSI_LOG_TIMEOUT(1, printk("sg_write: no mem\n"));
679         	sg_finish_rem_req(srp);
680         	return -ENOMEM;
681         }
682     
683         srp->my_cmdp = SRpnt;
684         q = &SRpnt->sr_device->request_queue;
685         SRpnt->sr_request.rq_dev = sdp->i_rdev;
686         SRpnt->sr_request.rq_status = RQ_ACTIVE;
687         SRpnt->sr_sense_buffer[0] = 0;
688         SRpnt->sr_cmd_len = hp->cmd_len;
689         if (! (hp->flags & SG_FLAG_LUN_INHIBIT)) {
690     	if (sdp->device->scsi_level <= SCSI_2)
691     	    cmnd[1] = (cmnd[1] & 0x1f) | (sdp->device->lun << 5);
692         }
693         SRpnt->sr_use_sg = srp->data.k_use_sg;
694         SRpnt->sr_sglist_len = srp->data.sglist_len;
695         SRpnt->sr_bufflen = srp->data.bufflen;
696         SRpnt->sr_underflow = 0;
697         SRpnt->sr_buffer = srp->data.buffer;
698         switch (hp->dxfer_direction) {
699         case SG_DXFER_TO_FROM_DEV:
700         case SG_DXFER_FROM_DEV:
701     	SRpnt->sr_data_direction = SCSI_DATA_READ; break;
702         case SG_DXFER_TO_DEV:
703     	SRpnt->sr_data_direction = SCSI_DATA_WRITE; break;
704         case SG_DXFER_UNKNOWN:
705     	SRpnt->sr_data_direction = SCSI_DATA_UNKNOWN; break;
706         default:
707     	SRpnt->sr_data_direction = SCSI_DATA_NONE; break;
708         }
709         srp->data.k_use_sg = 0;
710         srp->data.sglist_len = 0;
711         srp->data.bufflen = 0;
712         srp->data.buffer = NULL;
713         hp->duration = jiffies;	/* unit jiffies now, millisecs after done */
714     /* Now send everything of to mid-level. The next time we hear about this
715        packet is when sg_cmd_done_bh() is called (i.e. a callback). */
716         scsi_do_req(SRpnt, (void *)cmnd,
717     		(void *)SRpnt->sr_buffer, hp->dxfer_len,
718     		sg_cmd_done_bh, timeout, SG_DEFAULT_RETRIES);
719         /* dxfer_len overwrites SRpnt->sr_bufflen, hence need for b_malloc_len */
720         generic_unplug_device(q);
721         return 0;
722     }
723     
724     static int sg_ioctl(struct inode * inode, struct file * filp,
725                         unsigned int cmd_in, unsigned long arg)
726     {
727         int result, val, read_only;
728         Sg_device * sdp;
729         Sg_fd * sfp;
730         Sg_request * srp;
731         unsigned long iflags;
732     
733         if ((! (sfp = (Sg_fd *)filp->private_data)) || (! (sdp = sfp->parentdp)))
734             return -ENXIO;
735         SCSI_LOG_TIMEOUT(3, printk("sg_ioctl: dev=%d, cmd=0x%x\n",
736                                    MINOR(sdp->i_rdev), (int)cmd_in));
737         read_only = (O_RDWR != (filp->f_flags & O_ACCMODE));
738     
739         switch(cmd_in)
740         {
741         case SG_IO:
742     	{
743     	    int blocking = 1;   /* ignore O_NONBLOCK flag */
744     
745     	    if (sdp->detached)
746     		return -ENODEV;
747     	    if(! scsi_block_when_processing_errors(sdp->device) )
748     		return -ENXIO;
749     	    result = verify_area(VERIFY_WRITE, (void *)arg, SZ_SG_IO_HDR);
750     	    if (result) return result;
751     	    result = sg_new_write(sfp, (const char *)arg, SZ_SG_IO_HDR,
752     				  blocking, read_only, &srp);
753     	    if (result < 0) return result;
754     	    srp->sg_io_owned = 1;
755     	    while (1) {
756     		result = 0;  /* following macro to beat race condition */
757     		__wait_event_interruptible(sfp->read_wait,
758     		       (sdp->detached || sfp->closed || srp->done), result);
759     		if (sdp->detached)
760     		    return -ENODEV;
761     		if (sfp->closed)
762     		    return 0;       /* request packet dropped already */
763     		if (0 == result)
764     		    break;
765     		srp->orphan = 1;
766     		return result; /* -ERESTARTSYS because signal hit process */
767     	    }
768     	    srp->done = 2;
769     	    result = sg_new_read(sfp, (char *)arg, SZ_SG_IO_HDR, srp);
770     	    return (result < 0) ? result : 0;
771     	}
772         case SG_SET_TIMEOUT:
773             result =  get_user(val, (int *)arg);
774             if (result) return result;
775             if (val < 0)
776                 return -EIO;
777             sfp->timeout = val;
778             return 0;
779         case SG_GET_TIMEOUT:  /* N.B. User receives timeout as return value */
780             return sfp->timeout; /* strange ..., for backward compatibility */
781         case SG_SET_FORCE_LOW_DMA:
782             result = get_user(val, (int *)arg);
783             if (result) return result;
784             if (val) {
785                 sfp->low_dma = 1;
786                 if ((0 == sfp->low_dma) && (0 == sg_res_in_use(sfp))) {
787                     val = (int)sfp->reserve.bufflen;
788                     sg_remove_scat(&sfp->reserve);
789                     sg_build_reserve(sfp, val);
790                 }
791             }
792             else {
793     	    if (sdp->detached)
794     		return -ENODEV;
795                 sfp->low_dma = sdp->device->host->unchecked_isa_dma;
796     	}
797             return 0;
798         case SG_GET_LOW_DMA:
799             return put_user((int)sfp->low_dma, (int *)arg);
800         case SG_GET_SCSI_ID:
801     	result = verify_area(VERIFY_WRITE, (void *)arg, sizeof(sg_scsi_id_t));
802             if (result) return result;
803             else {
804     	    sg_scsi_id_t * sg_idp = (sg_scsi_id_t *)arg;
805     
806     	    if (sdp->detached)
807     		return -ENODEV;
808                 __put_user((int)sdp->device->host->host_no, &sg_idp->host_no);
809                 __put_user((int)sdp->device->channel, &sg_idp->channel);
810                 __put_user((int)sdp->device->id, &sg_idp->scsi_id);
811                 __put_user((int)sdp->device->lun, &sg_idp->lun);
812                 __put_user((int)sdp->device->type, &sg_idp->scsi_type);
813     	    __put_user((short)sdp->device->host->cmd_per_lun,
814                            &sg_idp->h_cmd_per_lun);
815     	    __put_user((short)sdp->device->queue_depth,
816                            &sg_idp->d_queue_depth);
817     	    __put_user(0, &sg_idp->unused[0]);
818     	    __put_user(0, &sg_idp->unused[1]);
819                 return 0;
820             }
821         case SG_SET_FORCE_PACK_ID:
822             result = get_user(val, (int *)arg);
823             if (result) return result;
824             sfp->force_packid = val ? 1 : 0;
825             return 0;
826         case SG_GET_PACK_ID:
827             result = verify_area(VERIFY_WRITE, (void *) arg, sizeof(int));
828             if (result) return result;
829     	read_lock_irqsave(&sfp->rq_list_lock, iflags);
830     	for (srp = sfp->headrp; srp; srp = srp->nextrp) {
831     	    if ((1 == srp->done) && (! srp->sg_io_owned)) {
832     		read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
833                     __put_user(srp->header.pack_id, (int *)arg);
834                     return 0;
835                 }
836             }
837     	read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
838             __put_user(-1, (int *)arg);
839             return 0;
840         case SG_GET_NUM_WAITING:
841     	read_lock_irqsave(&sfp->rq_list_lock, iflags);
842             for (val = 0, srp = sfp->headrp; srp; srp = srp->nextrp) {
843     	    if ((1 == srp->done) && (! srp->sg_io_owned))
844                     ++val;
845             }
846     	read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
847             return put_user(val, (int *)arg);
848         case SG_GET_SG_TABLESIZE:
849             return put_user(sdp->sg_tablesize, (int *)arg);
850         case SG_SET_RESERVED_SIZE:
851             result = get_user(val, (int *)arg);
852             if (result) return result;
853             if (val != sfp->reserve.bufflen) {
854                 if (sg_res_in_use(sfp))
855                     return -EBUSY;
856                 sg_remove_scat(&sfp->reserve);
857                 sg_build_reserve(sfp, val);
858             }
859             return 0;
860         case SG_GET_RESERVED_SIZE:
861             val = (int)sfp->reserve.bufflen;
862             return put_user(val, (int *)arg);
863         case SG_SET_COMMAND_Q:
864             result = get_user(val, (int *)arg);
865             if (result) return result;
866             sfp->cmd_q = val ? 1 : 0;
867             return 0;
868         case SG_GET_COMMAND_Q:
869             return put_user((int)sfp->cmd_q, (int *)arg);
870         case SG_SET_KEEP_ORPHAN:
871             result = get_user(val, (int *)arg);
872             if (result) return result;
873     	sfp->keep_orphan = val;
874             return 0;
875         case SG_GET_KEEP_ORPHAN:
876     	return put_user((int)sfp->keep_orphan, (int *)arg);
877         case SG_NEXT_CMD_LEN:
878             result = get_user(val, (int *)arg);
879             if (result) return result;
880             sfp->next_cmd_len = (val > 0) ? val : 0;
881             return 0;
882         case SG_GET_VERSION_NUM:
883             return put_user(sg_version_num, (int *)arg);
884         case SG_GET_ACCESS_COUNT:
885         	val = (sdp->device ? sdp->device->access_count : 0);
886     	return put_user(val, (int *)arg);
887         case SG_GET_REQUEST_TABLE:
888     	result = verify_area(VERIFY_WRITE, (void *) arg,
889     			     SZ_SG_REQ_INFO * SG_MAX_QUEUE);
890     	if (result) return result;
891     	else {
892     	    sg_req_info_t rinfo[SG_MAX_QUEUE];
893     	    Sg_request * srp;
894     	    read_lock_irqsave(&sfp->rq_list_lock, iflags);
895     	    for (srp = sfp->headrp, val = 0; val < SG_MAX_QUEUE;
896     		 ++val, srp = srp ? srp->nextrp : srp) {
897     		memset(&rinfo[val], 0, SZ_SG_REQ_INFO);
898     		if (srp) {
899     		    rinfo[val].req_state = srp->done + 1;
900     		    rinfo[val].problem = srp->header.masked_status &
901     			srp->header.host_status & srp->header.driver_status;
902     		    rinfo[val].duration = srp->done ?
903     			    srp->header.duration :
904     			    sg_jif_to_ms(jiffies - srp->header.duration);
905     		    rinfo[val].orphan = srp->orphan;
906     		    rinfo[val].sg_io_owned = srp->sg_io_owned;
907     		    rinfo[val].pack_id = srp->header.pack_id;
908     		    rinfo[val].usr_ptr = srp->header.usr_ptr;
909     		}
910     	    }
911     	    read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
912     	    __copy_to_user((void *)arg, rinfo, SZ_SG_REQ_INFO * SG_MAX_QUEUE);
913     	    return 0;
914     	}
915         case SG_EMULATED_HOST:
916     	if (sdp->detached)
917     	    return -ENODEV;
918             return put_user(sdp->device->host->hostt->emulated, (int *)arg);
919         case SG_SCSI_RESET:
920     	if (sdp->detached)
921     	    return -ENODEV;
922             if (filp->f_flags & O_NONBLOCK) {
923     	    if (sdp->device->host->in_recovery)
924     		return -EBUSY;
925     	}
926     	else if (! scsi_block_when_processing_errors(sdp->device))
927                 return -EBUSY;
928             result = get_user(val, (int *)arg);
929             if (result) return result;
930     	if (SG_SCSI_RESET_NOTHING == val)
931     	    return 0;
932     #ifdef SCSI_TRY_RESET_DEVICE
933     	switch (val)
934     	{
935     	case SG_SCSI_RESET_DEVICE:
936     	    val = SCSI_TRY_RESET_DEVICE;
937     	    break;
938     	case SG_SCSI_RESET_BUS:
939     	    val = SCSI_TRY_RESET_BUS;
940     	    break;
941     	case SG_SCSI_RESET_HOST:
942     	    val = SCSI_TRY_RESET_HOST;
943     	    break;
944     	default:
945     	    return -EINVAL;
946     	}
947     	if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
948     	    return -EACCES;
949     	return (scsi_reset_provider(sdp->device, val) == SUCCESS) ? 0 : -EIO;
950     #else
951     	SCSI_LOG_TIMEOUT(1, printk("sg_ioctl: SG_RESET_SCSI not supported\n"));
952     	result = -EINVAL;
953     #endif
954         case SCSI_IOCTL_SEND_COMMAND:
955     	if (sdp->detached)
956     	    return -ENODEV;
957     	if (read_only) {
958     	    unsigned char opcode = WRITE_6;
959     	    Scsi_Ioctl_Command * siocp = (void *)arg;
960     
961     	    copy_from_user(&opcode, siocp->data, 1);
962     	    if (! sg_allow_access(opcode, sdp->device->type))
963     		return -EACCES;
964     	}
965             return scsi_ioctl_send_command(sdp->device, (void *)arg);
966         case SG_SET_DEBUG:
967             result = get_user(val, (int *)arg);
968             if (result) return result;
969             sdp->sgdebug = (char)val;
970             return 0;
971         case SCSI_IOCTL_GET_IDLUN:
972         case SCSI_IOCTL_GET_BUS_NUMBER:
973         case SCSI_IOCTL_PROBE_HOST:
974         case SG_GET_TRANSFORM:
975     	if (sdp->detached)
976     	    return -ENODEV;
977             return scsi_ioctl(sdp->device, cmd_in, (void *)arg);
978         default:
979     	if (read_only)
980                 return -EACCES; /* don't know so take safe approach */
981             return scsi_ioctl(sdp->device, cmd_in, (void *)arg);
982         }
983     }
984     
985     static unsigned int sg_poll(struct file * filp, poll_table * wait)
986     {
987         unsigned int res = 0;
988         Sg_device * sdp;
989         Sg_fd * sfp;
990         Sg_request * srp;
991         int count = 0;
992         unsigned long iflags;
993     
994         if ((! (sfp = (Sg_fd *)filp->private_data)) || (! (sdp = sfp->parentdp))
995         	|| sfp->closed)
996             return POLLERR;
997         poll_wait(filp, &sfp->read_wait, wait);
998         read_lock_irqsave(&sfp->rq_list_lock, iflags);
999         for (srp = sfp->headrp; srp; srp = srp->nextrp) {   
1000         	/* if any read waiting, flag it */
1001     	if ((0 == res) && (1 == srp->done) && (! srp->sg_io_owned))
1002                 res = POLLIN | POLLRDNORM;
1003             ++count;
1004         }
1005         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
1006     
1007         if (sdp->detached)
1008     	res |= POLLHUP;
1009         else if (! sfp->cmd_q) {
1010             if (0 == count)
1011                 res |= POLLOUT | POLLWRNORM;
1012         }
1013         else if (count < SG_MAX_QUEUE)
1014             res |= POLLOUT | POLLWRNORM;
1015         SCSI_LOG_TIMEOUT(3, printk("sg_poll: dev=%d, res=0x%x\n",
1016                             MINOR(sdp->i_rdev), (int)res));
1017         return res;
1018     }
1019     
1020     static int sg_fasync(int fd, struct file * filp, int mode)
1021     {
1022         int retval;
1023         Sg_device * sdp;
1024         Sg_fd * sfp;
1025     
1026         if ((! (sfp = (Sg_fd *)filp->private_data)) || (! (sdp = sfp->parentdp)))
1027             return -ENXIO;
1028         SCSI_LOG_TIMEOUT(3, printk("sg_fasync: dev=%d, mode=%d\n",
1029                                    MINOR(sdp->i_rdev), mode));
1030     
1031         retval = fasync_helper(fd, filp, mode, &sfp->async_qp);
1032         return (retval < 0) ? retval : 0;
1033     }
1034     
1035     /* This function is a "bottom half" handler that is called by the
1036      * mid level when a command is completed (or has failed). */
1037     static void sg_cmd_done_bh(Scsi_Cmnd * SCpnt)
1038     {
1039         Scsi_Request * SRpnt = SCpnt->sc_request;
1040         int dev = MINOR(SRpnt->sr_request.rq_dev);
1041         Sg_device * sdp = NULL;
1042         Sg_fd * sfp;
1043         Sg_request * srp = NULL;
1044     
1045         read_lock(&sg_dev_arr_lock);
1046         if (sg_dev_arr && (dev >= 0)) {
1047     	if (dev < sg_template.dev_max)
1048     	    sdp = sg_dev_arr[dev];
1049         }
1050         if ((NULL == sdp) || sdp->detached) {
1051     	read_unlock(&sg_dev_arr_lock);
1052     	SCSI_LOG_TIMEOUT(1, printk("sg...bh: dev=%d gone\n", dev));
1053             scsi_release_request(SRpnt);
1054             SRpnt = NULL;
1055             return;
1056         }
1057         sfp = sdp->headfp;
1058         while (sfp) {
1059     	read_lock(&sfp->rq_list_lock);
1060     	for (srp = sfp->headrp; srp; srp = srp->nextrp) {
1061                 if (SRpnt == srp->my_cmdp)
1062                     break;
1063             }
1064     	read_unlock(&sfp->rq_list_lock);
1065             if (srp)
1066                 break;
1067             sfp = sfp->nextfp;
1068         }
1069         if (! srp) {
1070     	read_unlock(&sg_dev_arr_lock);
1071     	SCSI_LOG_TIMEOUT(1, printk("sg...bh: req missing, dev=%d\n", dev));
1072             scsi_release_request(SRpnt);
1073             SRpnt = NULL;
1074             return;
1075         }
1076         /* First transfer ownership of data buffers to sg_device object. */
1077         srp->data.k_use_sg = SRpnt->sr_use_sg;
1078         srp->data.sglist_len = SRpnt->sr_sglist_len;
1079         srp->data.bufflen = SRpnt->sr_bufflen;
1080         srp->data.buffer = SRpnt->sr_buffer;
1081         sg_clr_srpnt(SRpnt);
1082         srp->my_cmdp = NULL;
1083         srp->done = 1;
1084         read_unlock(&sg_dev_arr_lock);
1085     
1086         SCSI_LOG_TIMEOUT(4, printk("sg...bh: dev=%d, pack_id=%d, res=0x%x\n",
1087     		     dev, srp->header.pack_id, (int)SRpnt->sr_result));
1088         srp->header.resid = SCpnt->resid;
1089         /* sg_unmap_and(&srp->data, 0); */     /* unmap locked pages a.s.a.p. */
1090         /* N.B. unit of duration changes here from jiffies to millisecs */
1091         srp->header.duration = sg_jif_to_ms(jiffies - (int)srp->header.duration);
1092         if (0 != SRpnt->sr_result) {
1093     	memcpy(srp->sense_b, SRpnt->sr_sense_buffer, sizeof(srp->sense_b));
1094     	srp->header.status = 0xff & SRpnt->sr_result;
1095     	srp->header.masked_status  = status_byte(SRpnt->sr_result);
1096     	srp->header.msg_status  = msg_byte(SRpnt->sr_result);
1097     	srp->header.host_status = host_byte(SRpnt->sr_result);
1098     	srp->header.driver_status = driver_byte(SRpnt->sr_result);
1099     	if ((sdp->sgdebug > 0) &&
1100     	    ((CHECK_CONDITION == srp->header.masked_status) ||
1101     	     (COMMAND_TERMINATED == srp->header.masked_status)))
1102     	    print_req_sense("sg_cmd_done_bh", SRpnt);
1103     
1104     	/* Following if statement is a patch supplied by Eric Youngdale */
1105     	if (driver_byte(SRpnt->sr_result) != 0
1106     	    && (SRpnt->sr_sense_buffer[0] & 0x7f) == 0x70
1107     	    && (SRpnt->sr_sense_buffer[2] & 0xf) == UNIT_ATTENTION
1108     	    && sdp->device->removable) {
1109     	    /* Detected disc change. Set the bit - this may be used if */
1110     	    /* there are filesystems using this device. */
1111     	    sdp->device->changed = 1;
1112     	}
1113         }
1114         /* Rely on write phase to clean out srp status values, so no "else" */
1115     
1116         scsi_release_request(SRpnt);
1117         SRpnt = NULL;
1118         if (sfp->closed) { /* whoops this fd already released, cleanup */
1119             SCSI_LOG_TIMEOUT(1,
1120     	       printk("sg...bh: already closed, freeing ...\n"));
1121     	sg_finish_rem_req(srp);
1122     	srp = NULL;
1123     	if (NULL == sfp->headrp) {
1124                 SCSI_LOG_TIMEOUT(1,
1125     		printk("sg...bh: already closed, final cleanup\n"));
1126                 sg_remove_sfp(sdp, sfp);
1127     	    sfp = NULL;
1128             }
1129     	sdp->device->access_count--;
1130     	if (sg_template.module)
1131     		__MOD_DEC_USE_COUNT(sg_template.module);
1132     	if (sdp->device->host->hostt->module)
1133     	    __MOD_DEC_USE_COUNT(sdp->device->host->hostt->module);
1134         }
1135         else if (srp && srp->orphan) {
1136     	if (sfp->keep_orphan)
1137     	    srp->sg_io_owned = 0;
1138     	else {
1139     	    sg_finish_rem_req(srp);
1140     	    srp = NULL;
1141             }
1142         }
1143         if (sfp && srp) {
1144     	/* Now wake up any sg_read() that is waiting for this packet. */
1145     	wake_up_interruptible(&sfp->read_wait);
1146     	kill_fasync(&sfp->async_qp, SIGPOLL, POLL_IN);
1147         }
1148     }
1149     
1150     static struct file_operations sg_fops = {
1151     	owner:		THIS_MODULE,
1152     	read:		sg_read,
1153     	write:		sg_write,
1154     	poll:		sg_poll,
1155     	ioctl:		sg_ioctl,
1156     	open:		sg_open,
1157     	release:	sg_release,
1158     	fasync:		sg_fasync,
1159     };
1160     
1161     
1162     static int sg_detect(Scsi_Device * scsidp)
1163     {
1164         sg_template.dev_noticed++;
1165         return 1;
1166     }
1167     
1168     /* Driver initialization */
1169     static int sg_init()
1170     {
1171         static int sg_registered = 0;
1172         unsigned long iflags;
1173     
1174         if ((sg_template.dev_noticed == 0) || sg_dev_arr)
1175         	return 0;
1176     
1177         write_lock_irqsave(&sg_dev_arr_lock, iflags);
1178         if(!sg_registered) {
1179     	if (devfs_register_chrdev(SCSI_GENERIC_MAJOR,"sg",&sg_fops))
1180             {
1181                 printk("Unable to get major %d for generic SCSI device\n",
1182                        SCSI_GENERIC_MAJOR);
1183     	    write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
1184                 return 1;
1185             }
1186             sg_registered++;
1187         }
1188     
1189         SCSI_LOG_TIMEOUT(3, printk("sg_init\n"));
1190         sg_template.dev_max = sg_template.dev_noticed + SG_DEV_ARR_LUMP;
1191         sg_dev_arr = (Sg_device **)kmalloc(sg_template.dev_max * 
1192         					sizeof(Sg_device *), GFP_ATOMIC);
1193         if (NULL == sg_dev_arr) {
1194             printk("sg_init: no space for sg_dev_arr\n");
1195     	write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
1196             return 1;
1197         }
1198         memset(sg_dev_arr, 0, sg_template.dev_max * sizeof(Sg_device *));
1199         write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
1200     #ifdef CONFIG_PROC_FS
1201         sg_proc_init();
1202     #endif  /* CONFIG_PROC_FS */
1203         return 0;
1204     }
1205     
1206     #ifndef MODULE
1207     static int __init sg_def_reserved_size_setup(char *str)
1208     {
1209         int tmp;
1210     
1211         if (get_option(&str, &tmp) == 1) {
1212     	def_reserved_size = tmp;
1213     	if (tmp >= 0)
1214     	    sg_big_buff = tmp;
1215     	return 1;
1216         } else {
1217     	printk("sg_def_reserved_size : usage sg_def_reserved_size=n "
1218     	       "(n could be 65536, 131072 or 262144)\n");
1219     	return 0;
1220         }
1221     }
1222     
1223     __setup("sg_def_reserved_size=", sg_def_reserved_size_setup);
1224     #endif
1225     
1226     
1227     static int sg_attach(Scsi_Device * scsidp)
1228     {
1229         Sg_device * sdp;
1230         unsigned long iflags;
1231         int k;
1232     
1233         write_lock_irqsave(&sg_dev_arr_lock, iflags);
1234         if (sg_template.nr_dev >= sg_template.dev_max) { /* try to resize */
1235         	Sg_device ** tmp_da;
1236     	int tmp_dev_max = sg_template.nr_dev + SG_DEV_ARR_LUMP;
1237     
1238     	tmp_da = (Sg_device **)kmalloc(tmp_dev_max * 
1239         					sizeof(Sg_device *), GFP_ATOMIC);
1240     	if (NULL == tmp_da) {
1241     	    scsidp->attached--;
1242     	    write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
1243     	    printk("sg_attach: device array cannot be resized\n");
1244     	    return 1;
1245     	}
1246     	memset(tmp_da, 0, tmp_dev_max * sizeof(Sg_device *));
1247     	memcpy(tmp_da, sg_dev_arr, sg_template.dev_max * sizeof(Sg_device *));
1248     	kfree((char *)sg_dev_arr);
1249     	sg_dev_arr = tmp_da;
1250     	sg_template.dev_max = tmp_dev_max;
1251         }
1252     
1253         for(k = 0; k < sg_template.dev_max; k++)
1254             if(! sg_dev_arr[k]) break;
1255         if (k > MINORMASK) {
1256     	scsidp->attached--;
1257     	write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
1258     	printk("Unable to attach sg device <%d, %d, %d, %d>"
1259     	       " type=%d, minor number exceed %d\n", scsidp->host->host_no, 
1260     	       scsidp->channel, scsidp->id, scsidp->lun, scsidp->type,
1261     	       MINORMASK);
1262     	return 1;
1263         }
1264         if(k < sg_template.dev_max)
1265         	sdp = (Sg_device *)kmalloc(sizeof(Sg_device), GFP_ATOMIC);
1266         else
1267         	sdp = NULL;
1268         if (NULL == sdp) {
1269     	scsidp->attached--;
1270     	write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
1271     	printk("sg_attach: Sg_device cannot be allocated\n");
1272     	return 1;
1273         }
1274     
1275         SCSI_LOG_TIMEOUT(3, printk("sg_attach: dev=%d \n", k));
1276         sdp->device = scsidp;
1277         init_waitqueue_head(&sdp->o_excl_wait);
1278         sdp->headfp= NULL;
1279         sdp->exclude = 0;
1280         sdp->sgdebug = 0;
1281         sdp->detached = 0;
1282         sdp->sg_tablesize = scsidp->host ? scsidp->host->sg_tablesize : 0;
1283         sdp->i_rdev = MKDEV(SCSI_GENERIC_MAJOR, k);
1284         sdp->de = devfs_register (scsidp->de, "generic", DEVFS_FL_DEFAULT,
1285                                  SCSI_GENERIC_MAJOR, k,
1286                                  S_IFCHR | S_IRUSR | S_IWUSR | S_IRGRP,
1287                                  &sg_fops, sdp);
1288         sg_template.nr_dev++;
1289         sg_dev_arr[k] = sdp;
1290         write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
1291         switch (scsidp->type) {
1292     	case TYPE_DISK:
1293     	case TYPE_MOD:
1294     	case TYPE_ROM:
1295     	case TYPE_WORM:
1296     	case TYPE_TAPE: break;
1297     	default:
1298     	    printk("Attached scsi generic sg%d at scsi%d, channel %d, id %d,"
1299     		   " lun %d,  type %d\n", k, scsidp->host->host_no, 
1300     		   scsidp->channel, scsidp->id, scsidp->lun, scsidp->type);
1301         }
1302         return 0;
1303     }
1304     
1305     /* Called at 'finish' of init process, after all attaches */
1306     static void sg_finish(void)
1307     { }
1308     
1309     static void sg_detach(Scsi_Device * scsidp)
1310     {
1311         Sg_device * sdp;
1312         unsigned long iflags;
1313         Sg_fd * sfp;
1314         Sg_fd * tsfp;
1315         Sg_request * srp;
1316         Sg_request * tsrp;
1317         int k, delay;
1318     
1319         if (NULL == sg_dev_arr)
1320         	return;
1321         delay = 0;
1322         write_lock_irqsave(&sg_dev_arr_lock, iflags);
1323         for (k = 0; k < sg_template.dev_max; k++) {
1324         	sdp = sg_dev_arr[k];
1325             if ((NULL == sdp) || (sdp->device != scsidp))
1326                 continue;   /* dirty but lowers nesting */
1327             if (sdp->headfp) {
1328     	    sdp->detached = 1;
1329     	    for (sfp = sdp->headfp; sfp; sfp = tsfp) {
1330     	    	tsfp = sfp->nextfp;
1331     		for (srp = sfp->headrp; srp; srp = tsrp) {
1332     		    tsrp = srp->nextrp;
1333     		    if (sfp->closed || (0 == srp->done))
1334     			sg_finish_rem_req(srp);
1335     		}
1336     		if (sfp->closed) {
1337     		    sdp->device->access_count--;
1338     		    if (sg_template.module)
1339     			__MOD_DEC_USE_COUNT(sg_template.module);
1340     		    if (sdp->device->host->hostt->module)
1341     			__MOD_DEC_USE_COUNT(sdp->device->host->hostt->module);
1342     		    __sg_remove_sfp(sdp, sfp);
1343     		}
1344     		else {
1345     		    delay = 1;
1346     		    wake_up_interruptible(&sfp->read_wait);
1347     		    kill_fasync(&sfp->async_qp, SIGPOLL, POLL_HUP);
1348     		}
1349                 }
1350     	    SCSI_LOG_TIMEOUT(3, printk("sg_detach: dev=%d, dirty\n", k));
1351     	    devfs_unregister (sdp->de);
1352     	    sdp->de = NULL;
1353     	    if (NULL == sdp->headfp) {
1354     		kfree((char *)sdp);
1355     		sg_dev_arr[k] = NULL;
1356     	    }
1357             }
1358             else { /* nothing active, simple case */
1359                 SCSI_LOG_TIMEOUT(3, printk("sg_detach: dev=%d\n", k));
1360     	    devfs_unregister (sdp->de);
1361     	    kfree((char *)sdp);
1362     	    sg_dev_arr[k] = NULL;
1363             }
1364             scsidp->attached--;
1365             sg_template.nr_dev--;
1366             sg_template.dev_noticed--;	/* from <dan@lectra.fr> */
1367             break;
1368         }
1369         write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
1370         if (delay)
1371     	scsi_sleep(2);	/* dirty detach so delay device destruction */
1372     }
1373     
1374     MODULE_AUTHOR("Douglas Gilbert");
1375     MODULE_DESCRIPTION("SCSI generic (sg) driver");
1376     MODULE_PARM(def_reserved_size, "i");
1377     MODULE_PARM_DESC(def_reserved_size, "size of buffer reserved for each fd");
1378     
1379     static int __init init_sg(void) {
1380         if (def_reserved_size >= 0)
1381     	sg_big_buff = def_reserved_size;
1382         sg_template.module = THIS_MODULE;
1383         return scsi_register_module(MODULE_SCSI_DEV, &sg_template);
1384     }
1385     
1386     static void __exit exit_sg( void)
1387     {
1388     #ifdef CONFIG_PROC_FS
1389         sg_proc_cleanup();
1390     #endif  /* CONFIG_PROC_FS */
1391         scsi_unregister_module(MODULE_SCSI_DEV, &sg_template);
1392         devfs_unregister_chrdev(SCSI_GENERIC_MAJOR, "sg");
1393         if(sg_dev_arr != NULL) {
1394     	kfree((char *)sg_dev_arr);
1395             sg_dev_arr = NULL;
1396         }
1397         sg_template.dev_max = 0;
1398     }
1399     
1400     
1401     static int sg_start_req(Sg_request * srp)
1402     {
1403         int res;
1404         Sg_fd * sfp = srp->parentfp;
1405         sg_io_hdr_t * hp = &srp->header;
1406         int dxfer_len = (int)hp->dxfer_len;
1407         int dxfer_dir = hp->dxfer_direction;
1408         Sg_scatter_hold * req_schp = &srp->data;
1409         Sg_scatter_hold * rsv_schp = &sfp->reserve;
1410     
1411         SCSI_LOG_TIMEOUT(4, printk("sg_start_req: dxfer_len=%d\n", dxfer_len));
1412         if ((dxfer_len <= 0) || (dxfer_dir == SG_DXFER_NONE))
1413         	return 0;
1414         if (sg_allow_dio && (hp->flags & SG_FLAG_DIRECT_IO) && 
1415     	(dxfer_dir != SG_DXFER_UNKNOWN) && (0 == hp->iovec_count) &&
1416     	(! sfp->parentdp->device->host->unchecked_isa_dma)) {
1417     	res = sg_build_dir(srp, sfp, dxfer_len);
1418     	if (res <= 0)   /* -ve -> error, 0 -> done, 1 -> try indirect */
1419     	    return res;
1420         }
1421         if ((! sg_res_in_use(sfp)) && (dxfer_len <= rsv_schp->bufflen)) {
1422     	sg_link_reserve(sfp, srp, dxfer_len);
1423         }
1424         else {
1425     	res = sg_build_indi(req_schp, sfp, dxfer_len);
1426             if (res) {
1427                 sg_remove_scat(req_schp);
1428                 return res;
1429             }
1430         }
1431         return 0;
1432     }
1433     
1434     static void sg_finish_rem_req(Sg_request * srp)
1435     {
1436         Sg_fd * sfp = srp->parentfp;
1437         Sg_scatter_hold * req_schp = &srp->data;
1438     
1439         SCSI_LOG_TIMEOUT(4, printk("sg_finish_rem_req: res_used=%d\n",
1440     			       (int)srp->res_used));
1441         sg_unmap_and(&srp->data, 1);
1442         if (srp->res_used)
1443             sg_unlink_reserve(sfp, srp);
1444         else
1445             sg_remove_scat(req_schp);
1446         sg_remove_request(sfp, srp);
1447     }
1448     
1449     static int sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp)
1450     {
1451         int mem_src, ret_sz;
1452         int sg_bufflen = PAGE_SIZE;
1453         int elem_sz = sizeof(struct scatterlist) + sizeof(char);
1454         int mx_sc_elems = (sg_bufflen / elem_sz) - 1;
1455     
1456         mem_src = SG_HEAP_KMAL;
1457         schp->buffer = (struct scatterlist *)sg_malloc(sfp, sg_bufflen,
1458     						   &ret_sz, &mem_src);
1459         schp->buffer_mem_src = (char)mem_src;
1460         if (! schp->buffer)
1461     	return -ENOMEM;
1462         else if (ret_sz != sg_bufflen) {
1463     	sg_bufflen = ret_sz;
1464     	mx_sc_elems = (sg_bufflen / elem_sz) - 1;
1465         }
1466         schp->sglist_len = sg_bufflen;
1467         memset(schp->buffer, 0, sg_bufflen);
1468         return mx_sc_elems; /* number of scat_gath elements allocated */
1469     }
1470     
1471     static void sg_unmap_and(Sg_scatter_hold * schp, int free_also)
1472     {
1473     #ifdef SG_ALLOW_DIO_CODE
1474         if (schp && schp->kiobp) {
1475     	if (schp->mapped) {
1476     	    unmap_kiobuf(schp->kiobp);
1477     	    schp->mapped = 0;
1478     	}
1479     	if (free_also) {
1480     	    free_kiovec(1, &schp->kiobp);
1481     	    schp->kiobp = NULL;
1482     	}
1483         }
1484     #endif
1485     }
1486     
1487     static int sg_build_dir(Sg_request * srp, Sg_fd * sfp, int dxfer_len)
1488     {
1489     #ifdef SG_ALLOW_DIO_CODE
1490         int res, k, split, offset, num, mx_sc_elems, rem_sz;
1491         struct kiobuf * kp;
1492         char * mem_src_arr;
1493         struct scatterlist * sclp;
1494         unsigned long addr, prev_addr;
1495         sg_io_hdr_t * hp = &srp->header;
1496         Sg_scatter_hold * schp = &srp->data;
1497         int sg_tablesize = sfp->parentdp->sg_tablesize;
1498     
1499         res = alloc_kiovec(1, &schp->kiobp);
1500         if (0 != res) {
1501     	SCSI_LOG_TIMEOUT(5, printk("sg_build_dir: alloc_kiovec res=%d\n", res));
1502     	return 1;
1503         }
1504         res = map_user_kiobuf((SG_DXFER_TO_DEV == hp->dxfer_direction) ? 1 : 0,
1505     			  schp->kiobp, (unsigned long)hp->dxferp, dxfer_len);
1506         if (0 != res) {
1507     	SCSI_LOG_TIMEOUT(5,
1508     		printk("sg_build_dir: map_user_kiobuf res=%d\n", res));
1509     	sg_unmap_and(schp, 1);
1510     	return 1;
1511         }
1512         schp->mapped = 1;
1513         kp = schp->kiobp;
1514         prev_addr = (unsigned long) page_address(kp->maplist[0]);
1515         for (k = 1, split = 0; k < kp->nr_pages; ++k, prev_addr = addr) {
1516     	addr = (unsigned long) page_address(kp->maplist[k]);
1517     	if ((prev_addr + PAGE_SIZE) != addr) {
1518     	    split = k;
1519     	    break;
1520     	}
1521         }
1522         if (! split) {
1523     	schp->k_use_sg = 0;
1524     	schp->buffer = page_address(kp->maplist[0]) + kp->offset;
1525     	schp->bufflen = dxfer_len;
1526     	schp->buffer_mem_src = SG_USER_MEM;
1527     	schp->b_malloc_len = dxfer_len;
1528     	hp->info |= SG_INFO_DIRECT_IO;
1529     	return 0;
1530         }
1531         mx_sc_elems = sg_build_sgat(schp, sfp);
1532         if (mx_sc_elems <= 1) {
1533     	sg_unmap_and(schp, 1);
1534     	sg_remove_scat(schp);
1535     	return 1;
1536         }
1537         mem_src_arr = schp->buffer + (mx_sc_elems * sizeof(struct scatterlist));
1538         for (k = 0, sclp = schp->buffer, rem_sz = dxfer_len;
1539     	 (k < sg_tablesize) && (rem_sz > 0) && (k < mx_sc_elems);
1540     	 ++k, ++sclp) {
1541     	offset = (0 == k) ? kp->offset : 0;
1542     	num = (rem_sz > (PAGE_SIZE - offset)) ? (PAGE_SIZE - offset) :
1543     						rem_sz;
1544     	sclp->address = page_address(kp->maplist[k]) + offset;
1545     	sclp->length = num;
1546     	mem_src_arr[k] = SG_USER_MEM;
1547     	rem_sz -= num;
1548     	SCSI_LOG_TIMEOUT(5,
1549     	    printk("sg_build_dir: k=%d, a=0x%p, len=%d, ms=%d\n",
1550     	    k, sclp->address, num, mem_src_arr[k]));
1551         }
1552         schp->k_use_sg = k;
1553         SCSI_LOG_TIMEOUT(5,
1554     	printk("sg_build_dir: k_use_sg=%d, rem_sz=%d\n", k, rem_sz));
1555         schp->bufflen = dxfer_len;
1556         if (rem_sz > 0) {   /* must have failed */
1557     	sg_unmap_and(schp, 1);
1558     	sg_remove_scat(schp);
1559     	return 1;   /* out of scatter gather elements, try indirect */
1560         }
1561         hp->info |= SG_INFO_DIRECT_IO;
1562         return 0;
1563     #else
1564         return 1;
1565     #endif /* SG_ALLOW_DIO_CODE */
1566     }
1567     
1568     static int sg_build_indi(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
1569     {
1570         int ret_sz, mem_src;
1571         int blk_size = buff_size;
1572         char * p = NULL;
1573     
1574         if ((blk_size < 0) || (! sfp))
1575             return -EFAULT;
1576         if (0 == blk_size)
1577             ++blk_size;             /* don't know why */
1578     /* round request up to next highest SG_SECTOR_SZ byte boundary */
1579         blk_size = (blk_size + SG_SECTOR_MSK) & (~SG_SECTOR_MSK);
1580         SCSI_LOG_TIMEOUT(4, printk("sg_build_indi: buff_size=%d, blk_size=%d\n",
1581                                    buff_size, blk_size));
1582         if (blk_size <= SG_SCATTER_SZ) {
1583             mem_src = SG_HEAP_PAGE;
1584             p = sg_malloc(sfp, blk_size, &ret_sz, &mem_src);
1585             if (! p)
1586                 return -ENOMEM;
1587             if (blk_size == ret_sz) { /* got it on the first attempt */
1588     	    schp->k_use_sg = 0;
1589                 schp->buffer = p;
1590                 schp->bufflen = blk_size;
1591     	    schp->buffer_mem_src = (char)mem_src;
1592                 schp->b_malloc_len = blk_size;
1593                 return 0;
1594             }
1595         }
1596         else {
1597             mem_src = SG_HEAP_PAGE;
1598             p = sg_malloc(sfp, SG_SCATTER_SZ, &ret_sz, &mem_src);
1599             if (! p)
1600                 return -ENOMEM;
1601         }
1602     /* Want some local declarations, so start new block ... */
1603         {   /* lets try and build a scatter gather list */
1604             struct scatterlist * sclp;
1605     	int k, rem_sz, num;
1606     	int mx_sc_elems;
1607             int sg_tablesize = sfp->parentdp->sg_tablesize;
1608             int first = 1;
1609     	char * mem_src_arr;
1610     
1611             /* N.B. ret_sz and mem_src carried into this block ... */
1612     	mx_sc_elems = sg_build_sgat(schp, sfp);
1613     	if (mx_sc_elems < 0)
1614     	    return mx_sc_elems; /* most likely -ENOMEM */
1615     	mem_src_arr = schp->buffer +
1616     		      (mx_sc_elems * sizeof(struct scatterlist));
1617     
1618     	for (k = 0, sclp = schp->buffer, rem_sz = blk_size;
1619     	     (k < sg_tablesize) && (rem_sz > 0) && (k < mx_sc_elems);
1620                  ++k, rem_sz -= ret_sz, ++sclp) {
1621     	    if (first)
1622                     first = 0;
1623                 else {
1624                     num = (rem_sz > SG_SCATTER_SZ) ? SG_SCATTER_SZ : rem_sz;
1625                     mem_src = SG_HEAP_PAGE;
1626                     p = sg_malloc(sfp, num, &ret_sz, &mem_src);
1627                     if (! p)
1628                         break;
1629                 }
1630                 sclp->address = p;
1631                 sclp->length = ret_sz;
1632     	    mem_src_arr[k] = mem_src;
1633     
1634     	    SCSI_LOG_TIMEOUT(5,
1635     		printk("sg_build_build: k=%d, a=0x%p, len=%d, ms=%d\n",
1636                     k, sclp->address, ret_sz, mem_src));
1637             } /* end of for loop */
1638     	schp->k_use_sg = k;
1639     	SCSI_LOG_TIMEOUT(5,
1640     	    printk("sg_build_indi: k_use_sg=%d, rem_sz=%d\n", k, rem_sz));
1641             schp->bufflen = blk_size;
1642             if (rem_sz > 0)   /* must have failed */
1643                 return -ENOMEM;
1644         }
1645         return 0;
1646     }
1647     
1648     static int sg_write_xfer(Sg_request * srp)
1649     {
1650         sg_io_hdr_t * hp = &srp->header;
1651         Sg_scatter_hold * schp = &srp->data;
1652         int num_xfer = 0;
1653         int j, k, onum, usglen, ksglen, res, ok;
1654         int iovec_count = (int)hp->iovec_count;
1655         int dxfer_dir = hp->dxfer_direction;
1656         unsigned char * p;
1657         unsigned char * up;
1658         int new_interface = ('\0' == hp->interface_id) ? 0 : 1;
1659     
1660         if ((SG_DXFER_UNKNOWN == dxfer_dir) || (SG_DXFER_TO_DEV == dxfer_dir) ||
1661     	(SG_DXFER_TO_FROM_DEV == dxfer_dir)) {
1662     	num_xfer = (int)(new_interface ?  hp->dxfer_len : hp->flags);
1663     	if (schp->bufflen < num_xfer)
1664     	    num_xfer = schp->bufflen;
1665         }
1666         if ((num_xfer <= 0) || (new_interface && (SG_FLAG_NO_DXFER & hp->flags)))
1667     	return 0;
1668     
1669         SCSI_LOG_TIMEOUT(4,
1670     	 printk("sg_write_xfer: num_xfer=%d, iovec_count=%d, k_use_sg=%d\n",
1671     		num_xfer, iovec_count, schp->k_use_sg));
1672         if (iovec_count) {
1673     	onum = iovec_count;
1674     	if ((k = verify_area(VERIFY_READ, hp->dxferp,
1675     			     SZ_SG_IOVEC * onum)))
1676     	    return k;
1677         }
1678         else
1679     	onum = 1;
1680     
1681         if (0 == schp->k_use_sg) {  /* kernel has single buffer */
1682     	if (SG_USER_MEM != schp->buffer_mem_src) { /* else nothing to do */
1683     
1684     	    for (j = 0, p = schp->buffer; j < onum; ++j) {
1685     		res = sg_u_iovec(hp, iovec_count, j, 1, &usglen, &up);
1686     		if (res) return res;
1687     		usglen = (num_xfer > usglen) ? usglen : num_xfer;
1688     		__copy_from_user(p, up, usglen);
1689     		p += usglen;
1690     		num_xfer -= usglen;
1691     		if (num_xfer <= 0)
1692     		    return 0;
1693                 }
1694     	}
1695         }
1696         else {      /* kernel using scatter gather list */
1697     	struct scatterlist * sclp = (struct scatterlist *)schp->buffer;
1698     	char * mem_src_arr = sg_get_sgat_msa(schp);
1699     	ksglen = (int)sclp->length;
1700     	p = sclp->address;
1701     
1702     	for (j = 0, k = 0; j < onum; ++j) {
1703     	    res = sg_u_iovec(hp, iovec_count, j, 1, &usglen, &up);
1704     	    if (res) return res;
1705     
1706     	    for (; (k < schp->k_use_sg) && p;
1707     		 ++k, ++sclp, ksglen = (int)sclp->length, p = sclp->address) {
1708     		ok = (SG_USER_MEM != mem_src_arr[k]);
1709     		if (usglen <= 0)
1710     		    break;
1711     		if (ksglen > usglen) {
1712     		    if (usglen >= num_xfer) {
1713     			if (ok) __copy_from_user(p, up, num_xfer);
1714     			return 0;
1715     		    }
1716     		    if (ok) __copy_from_user(p, up, usglen);
1717     		    p += usglen;
1718     		    ksglen -= usglen;
1719                         break;
1720     		}
1721     		else {
1722     		    if (ksglen >= num_xfer) {
1723     			if (ok) __copy_from_user(p, up, num_xfer);
1724     			return 0;
1725     		    }
1726     		    if (ok) __copy_from_user(p, up, ksglen);
1727     		    up += ksglen;
1728     		    usglen -= ksglen;
1729     		}
1730                 }
1731             }
1732         }
1733         return 0;
1734     }
1735     
1736     static int sg_u_iovec(sg_io_hdr_t * hp, int sg_num, int ind,
1737     		      int wr_xf, int * countp, unsigned char ** up)
1738     {
1739         int num_xfer = (int)hp->dxfer_len;
1740         unsigned char * p;
1741         int count, k;
1742         sg_iovec_t u_iovec;
1743     
1744         if (0 == sg_num) {
1745     	p = (unsigned char *)hp->dxferp;
1746     	if (wr_xf && ('\0' == hp->interface_id))
1747     	    count = (int)hp->flags; /* holds "old" input_size */
1748     	else
1749     	    count = num_xfer;
1750         }
1751         else {
1752     	__copy_from_user(&u_iovec,
1753     			 (unsigned char *)hp->dxferp + (ind * SZ_SG_IOVEC),
1754     			 SZ_SG_IOVEC);
1755     	p = (unsigned char *)u_iovec.iov_base;
1756     	count = (int)u_iovec.iov_len;
1757         }
1758         if ((k = verify_area(wr_xf ? VERIFY_READ : VERIFY_WRITE, p, count)))
1759     	return k;
1760         if (up) *up = p;
1761         if (countp) *countp = count;
1762         return 0;
1763     }
1764     
1765     static char * sg_get_sgat_msa(Sg_scatter_hold * schp)
1766     {
1767         int elem_sz = sizeof(struct scatterlist) + sizeof(char);
1768         int mx_sc_elems = (schp->sglist_len / elem_sz) - 1;
1769         return schp->buffer + (sizeof(struct scatterlist) * mx_sc_elems);
1770     }
1771     
1772     static void sg_remove_scat(Sg_scatter_hold * schp)
1773     {
1774         SCSI_LOG_TIMEOUT(4, printk("sg_remove_scat: k_use_sg=%d\n",
1775     			       schp->k_use_sg));
1776         if (schp->buffer && schp->sglist_len) {
1777             int k, mem_src;
1778             struct scatterlist * sclp = (struct scatterlist *)schp->buffer;
1779     	char * mem_src_arr = sg_get_sgat_msa(schp);
1780     
1781     	for (k = 0; (k < schp->k_use_sg) && sclp->address; ++k, ++sclp) {
1782     	    mem_src = mem_src_arr[k];
1783     	    SCSI_LOG_TIMEOUT(5,
1784     		printk("sg_remove_scat: k=%d, a=0x%p, len=%d, ms=%d\n",
1785                            k, sclp->address, sclp->length, mem_src));
1786                 sg_free(sclp->address, sclp->length, mem_src);
1787                 sclp->address = NULL;
1788                 sclp->length = 0;
1789             }
1790     	sg_free(schp->buffer, schp->sglist_len, schp->buffer_mem_src);
1791         }
1792         else if (schp->buffer)
1793     	sg_free(schp->buffer, schp->b_malloc_len, schp->buffer_mem_src);
1794         memset(schp, 0, sizeof(*schp));
1795     }
1796     
1797     static int sg_read_xfer(Sg_request * srp)
1798     {
1799         sg_io_hdr_t * hp = &srp->header;
1800         Sg_scatter_hold * schp = &srp->data;
1801         int num_xfer = 0;
1802         int j, k, onum, usglen, ksglen, res, ok;
1803         int iovec_count = (int)hp->iovec_count;
1804         int dxfer_dir = hp->dxfer_direction;
1805         unsigned char * p;
1806         unsigned char * up;
1807         int new_interface = ('\0' == hp->interface_id) ? 0 : 1;
1808     
1809         if ((SG_DXFER_UNKNOWN == dxfer_dir) || (SG_DXFER_FROM_DEV == dxfer_dir) ||
1810     	(SG_DXFER_TO_FROM_DEV == dxfer_dir)) {
1811     	num_xfer =  hp->dxfer_len;
1812     	if (schp->bufflen < num_xfer)
1813     	    num_xfer = schp->bufflen;
1814         }
1815         if ((num_xfer <= 0) || (new_interface && (SG_FLAG_NO_DXFER & hp->flags)))
1816     	return 0;
1817     
1818         SCSI_LOG_TIMEOUT(4,
1819     	 printk("sg_read_xfer: num_xfer=%d, iovec_count=%d, k_use_sg=%d\n",
1820     		num_xfer, iovec_count, schp->k_use_sg));
1821         if (iovec_count) {
1822     	onum = iovec_count;
1823     	if ((k = verify_area(VERIFY_READ, hp->dxferp,
1824     			     SZ_SG_IOVEC * onum)))
1825     	    return k;
1826         }
1827         else
1828     	onum = 1;
1829     
1830         if (0 == schp->k_use_sg) {  /* kernel has single buffer */
1831     	if (SG_USER_MEM != schp->buffer_mem_src) { /* else nothing to do */
1832     
1833     	    for (j = 0, p = schp->buffer; j < onum; ++j) {
1834     		res = sg_u_iovec(hp, iovec_count, j, 0, &usglen, &up);
1835     		if (res) return res;
1836     		usglen = (num_xfer > usglen) ? usglen : num_xfer;
1837     		__copy_to_user(up, p, usglen);
1838     		p += usglen;
1839     		num_xfer -= usglen;
1840     		if (num_xfer <= 0)
1841     		    return 0;
1842     	    }
1843     	}
1844         }
1845         else {      /* kernel using scatter gather list */
1846     	struct scatterlist * sclp = (struct scatterlist *)schp->buffer;
1847     	char * mem_src_arr = sg_get_sgat_msa(schp);
1848     	ksglen = (int)sclp->length;
1849     	p = sclp->address;
1850     
1851     	for (j = 0, k = 0; j < onum; ++j) {
1852     	    res = sg_u_iovec(hp, iovec_count, j, 0, &usglen, &up);
1853     	    if (res) return res;
1854     
1855     	    for (; (k < schp->k_use_sg) && p;
1856     		 ++k, ++sclp, ksglen = (int)sclp->length, p = sclp->address) {
1857     		ok = (SG_USER_MEM != mem_src_arr[k]);
1858     		if (usglen <= 0)
1859     		    break;
1860     		if (ksglen > usglen) {
1861     		    if (usglen >= num_xfer) {
1862     			if (ok) __copy_to_user(up, p, num_xfer);
1863     			return 0;
1864     		    }
1865     		    if (ok) __copy_to_user(up, p, usglen);
1866     		    p += usglen;
1867     		    ksglen -= usglen;
1868     		    break;
1869     		}
1870     		else {
1871     		    if (ksglen >= num_xfer) {
1872     			if (ok) __copy_to_user(up, p, num_xfer);
1873     			return 0;
1874     		    }
1875     		    if (ok) __copy_to_user(up, p, ksglen);
1876     		    up += ksglen;
1877     		    usglen -= ksglen;
1878     		}
1879     	    }
1880     	}
1881         }
1882         return 0;
1883     }
1884     
1885     static void sg_read_oxfer(Sg_request * srp, char * outp, int num_read_xfer)
1886     {
1887         Sg_scatter_hold * schp = &srp->data;
1888     
1889         SCSI_LOG_TIMEOUT(4, printk("sg_read_oxfer: num_read_xfer=%d\n",
1890     			       num_read_xfer));
1891         if ((! outp) || (num_read_xfer <= 0))
1892             return;
1893         if(schp->k_use_sg > 0) {
1894             int k, num;
1895             struct scatterlist * sclp = (struct scatterlist *)schp->buffer;
1896     
1897     	for (k = 0; (k < schp->k_use_sg) && sclp->address; ++k, ++sclp) {
1898                 num = (int)sclp->length;
1899                 if (num > num_read_xfer) {
1900                     __copy_to_user(outp, sclp->address, num_read_xfer);
1901                     break;
1902                 }
1903                 else {
1904                     __copy_to_user(outp, sclp->address, num);
1905                     num_read_xfer -= num;
1906                     if (num_read_xfer <= 0)
1907                         break;
1908                     outp += num;
1909                 }
1910             }
1911         }
1912         else
1913             __copy_to_user(outp, schp->buffer, num_read_xfer);
1914     }
1915     
1916     static void sg_build_reserve(Sg_fd * sfp, int req_size)
1917     {
1918         Sg_scatter_hold * schp = &sfp->reserve;
1919     
1920         SCSI_LOG_TIMEOUT(4, printk("sg_build_reserve: req_size=%d\n", req_size));
1921         do {
1922             if (req_size < PAGE_SIZE)
1923                 req_size = PAGE_SIZE;
1924     	if (0 == sg_build_indi(schp, sfp, req_size))
1925                 return;
1926             else
1927                 sg_remove_scat(schp);
1928             req_size >>= 1; /* divide by 2 */
1929         } while (req_size >  (PAGE_SIZE / 2));
1930     }
1931     
1932     static void sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size)
1933     {
1934         Sg_scatter_hold * req_schp = &srp->data;
1935         Sg_scatter_hold * rsv_schp = &sfp->reserve;
1936     
1937         srp->res_used = 1;
1938         SCSI_LOG_TIMEOUT(4, printk("sg_link_reserve: size=%d\n", size));
1939         size = (size + 1) & (~1);    /* round to even for aha1542 */
1940         if (rsv_schp->k_use_sg > 0) {
1941             int k, num;
1942             int rem = size;
1943             struct scatterlist * sclp = (struct scatterlist *)rsv_schp->buffer;
1944     
1945     	for (k = 0; k < rsv_schp->k_use_sg; ++k, ++sclp) {
1946                 num = (int)sclp->length;
1947                 if (rem <= num) {
1948     		if (0 == k) {
1949     		    req_schp->k_use_sg = 0;
1950     		    req_schp->buffer = sclp->address;
1951     		}
1952     		else {
1953         		    sfp->save_scat_len = num;
1954         		    sclp->length = (unsigned)rem;
1955         		    req_schp->k_use_sg = k + 1;
1956         		    req_schp->sglist_len = rsv_schp->sglist_len;
1957         		    req_schp->buffer = rsv_schp->buffer;
1958     		}
1959     		req_schp->bufflen = size;
1960     		req_schp->buffer_mem_src = rsv_schp->buffer_mem_src;
1961     		req_schp->b_malloc_len = rsv_schp->b_malloc_len;
1962     		break;
1963                 }
1964                 else
1965                     rem -= num;
1966             }
1967     	if (k >= rsv_schp->k_use_sg)
1968     	    SCSI_LOG_TIMEOUT(1, printk("sg_link_reserve: BAD size\n"));
1969         }
1970         else {
1971     	req_schp->k_use_sg = 0;
1972             req_schp->bufflen = size;
1973             req_schp->buffer = rsv_schp->buffer;
1974     	req_schp->buffer_mem_src = rsv_schp->buffer_mem_src;
1975             req_schp->b_malloc_len = rsv_schp->b_malloc_len;
1976         }
1977     }
1978     
1979     static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp)
1980     {
1981         Sg_scatter_hold * req_schp = &srp->data;
1982         Sg_scatter_hold * rsv_schp = &sfp->reserve;
1983     
1984         SCSI_LOG_TIMEOUT(4, printk("sg_unlink_reserve: req->k_use_sg=%d\n",
1985     			       (int)req_schp->k_use_sg));
1986         if ((rsv_schp->k_use_sg > 0) && (req_schp->k_use_sg > 0)) {
1987             struct scatterlist * sclp = (struct scatterlist *)rsv_schp->buffer;
1988     
1989     	if (sfp->save_scat_len > 0)
1990     	    (sclp + (req_schp->k_use_sg - 1))->length =
1991                                             (unsigned)sfp->save_scat_len;
1992             else
1993                 SCSI_LOG_TIMEOUT(1, printk(
1994     			"sg_unlink_reserve: BAD save_scat_len\n"));
1995         }
1996         req_schp->k_use_sg = 0;
1997         req_schp->bufflen = 0;
1998         req_schp->buffer = NULL;
1999         req_schp->sglist_len = 0;
2000         sfp->save_scat_len = 0;
2001         srp->res_used = 0;
2002     }
2003     
2004     static Sg_request * sg_get_rq_mark(Sg_fd * sfp, int pack_id)
2005     {
2006         Sg_request * resp;
2007         unsigned long iflags;
2008     
2009         write_lock_irqsave(&sfp->rq_list_lock, iflags);
2010         for (resp = sfp->headrp; resp; resp = resp->nextrp) { 
2011     	/* look for requests that are ready + not SG_IO owned */
2012     	if ((1 == resp->done) && (! resp->sg_io_owned) &&
2013                 ((-1 == pack_id) || (resp->header.pack_id == pack_id))) {
2014     	    resp->done = 2;   /* guard against other readers */
2015                 break;
2016     	}
2017         }
2018         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2019         return resp;
2020     }
2021     
2022     #ifdef CONFIG_PROC_FS
2023     static Sg_request * sg_get_nth_request(Sg_fd * sfp, int nth)
2024     {
2025         Sg_request * resp;
2026         unsigned long iflags;
2027         int k;
2028     
2029         read_lock_irqsave(&sfp->rq_list_lock, iflags);
2030         for (k = 0, resp = sfp->headrp; resp && (k < nth); 
2031     	 ++k, resp = resp->nextrp)
2032     	;
2033         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2034         return resp;
2035     }
2036     #endif
2037     
2038     /* always adds to end of list */
2039     static Sg_request * sg_add_request(Sg_fd * sfp)
2040     {
2041         int k;
2042         unsigned long iflags;
2043         Sg_request * resp;
2044         Sg_request * rp =  sfp->req_arr;
2045     
2046         write_lock_irqsave(&sfp->rq_list_lock, iflags);
2047         resp = sfp->headrp;
2048         if (! resp) {
2049     	memset(rp, 0, sizeof(Sg_request));
2050     	rp->parentfp = sfp;
2051     	resp = rp;
2052     	sfp->headrp = resp;
2053         }
2054         else {
2055             if (0 == sfp->cmd_q)
2056                 resp = NULL;   /* command queuing disallowed */
2057             else {
2058                 for (k = 0; k < SG_MAX_QUEUE; ++k, ++rp) {
2059                     if (! rp->parentfp)
2060                         break;
2061                 }
2062                 if (k < SG_MAX_QUEUE) {
2063     		memset(rp, 0, sizeof(Sg_request));
2064     		rp->parentfp = sfp;
2065     		while (resp->nextrp) 
2066     		    resp = resp->nextrp;
2067     		resp->nextrp = rp;
2068     		resp = rp;
2069                 }
2070                 else
2071                     resp = NULL;
2072             }
2073         }
2074         if (resp) {
2075             resp->nextrp = NULL;
2076     	resp->header.duration = jiffies;
2077             resp->my_cmdp = NULL;
2078     	resp->data.kiobp = NULL;
2079         }
2080         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2081         return resp;
2082     }
2083     
2084     /* Return of 1 for found; 0 for not found */
2085     static int sg_remove_request(Sg_fd * sfp, Sg_request * srp)
2086     {
2087         Sg_request * prev_rp;
2088         Sg_request * rp;
2089         unsigned long iflags;
2090         int res = 0;
2091     
2092         if ((! sfp) || (! srp) || (! sfp->headrp))
2093             return res;
2094         write_lock_irqsave(&sfp->rq_list_lock, iflags);
2095         prev_rp = sfp->headrp;
2096         if (srp == prev_rp) {
2097             sfp->headrp = prev_rp->nextrp;
2098             prev_rp->parentfp = NULL;
2099             res = 1;
2100         }
2101         else {
2102     	while ((rp = prev_rp->nextrp)) {
2103     	    if (srp == rp) {
2104     		prev_rp->nextrp = rp->nextrp;
2105     		rp->parentfp = NULL;
2106     		res = 1;
2107     		break;
2108     	    }
2109     	    prev_rp = rp;
2110     	}
2111         }
2112         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2113         return res;
2114     }
2115     
2116     #ifdef CONFIG_PROC_FS
2117     static Sg_fd * sg_get_nth_sfp(Sg_device * sdp, int nth)
2118     {
2119         Sg_fd * resp;
2120         unsigned long iflags;
2121         int k;
2122     
2123         read_lock_irqsave(&sg_dev_arr_lock, iflags);
2124         for (k = 0, resp = sdp->headfp; resp && (k < nth); 
2125     	 ++k, resp = resp->nextfp)
2126     	;
2127         read_unlock_irqrestore(&sg_dev_arr_lock, iflags);
2128         return resp;
2129     }
2130     #endif
2131     
2132     static Sg_fd * sg_add_sfp(Sg_device * sdp, int dev)
2133     {
2134         Sg_fd * sfp;
2135         unsigned long iflags;
2136     
2137         sfp = (Sg_fd *)sg_low_malloc(sizeof(Sg_fd), 0, SG_HEAP_KMAL, 0);
2138         if (! sfp)
2139             return NULL;
2140         memset(sfp, 0, sizeof(Sg_fd));
2141         sfp->fd_mem_src = SG_HEAP_KMAL;
2142         init_waitqueue_head(&sfp->read_wait);
2143         sfp->rq_list_lock = RW_LOCK_UNLOCKED;
2144     
2145         sfp->timeout = SG_DEFAULT_TIMEOUT;
2146         sfp->force_packid = SG_DEF_FORCE_PACK_ID;
2147         sfp->low_dma = (SG_DEF_FORCE_LOW_DMA == 0) ?
2148                        sdp->device->host->unchecked_isa_dma : 1;
2149         sfp->cmd_q = SG_DEF_COMMAND_Q;
2150         sfp->keep_orphan = SG_DEF_KEEP_ORPHAN;
2151         sfp->parentdp = sdp;
2152         write_lock_irqsave(&sg_dev_arr_lock, iflags);
2153         if (! sdp->headfp)
2154             sdp->headfp = sfp;
2155         else {    /* add to tail of existing list */
2156     	Sg_fd * pfp = sdp->headfp;
2157     	while (pfp->nextfp)
2158     	    pfp = pfp->nextfp;
2159     	pfp->nextfp = sfp;
2160         }
2161         write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
2162         SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp: sfp=0x%p, m_s=%d\n",
2163     			       sfp, (int)sfp->fd_mem_src));
2164         sg_build_reserve(sfp, sg_big_buff);
2165         SCSI_LOG_TIMEOUT(3, printk("sg_add_sfp:   bufflen=%d, k_use_sg=%d\n",
2166     			   sfp->reserve.bufflen, sfp->reserve.k_use_sg));
2167         return sfp;
2168     }
2169     
2170     static void __sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp)
2171     {
2172         Sg_fd * fp;
2173         Sg_fd * prev_fp;
2174     
2175         prev_fp =  sdp->headfp;
2176         if (sfp == prev_fp)
2177     	sdp->headfp = prev_fp->nextfp;
2178         else {
2179     	while ((fp = prev_fp->nextfp)) {
2180     	    if (sfp == fp) {
2181     		prev_fp->nextfp = fp->nextfp;
2182     		break;
2183     	    }
2184     	    prev_fp = fp;
2185     	}
2186         }
2187         if (sfp->reserve.bufflen > 0) {
2188         SCSI_LOG_TIMEOUT(6, printk("__sg_remove_sfp:    bufflen=%d, k_use_sg=%d\n",
2189     	     (int)sfp->reserve.bufflen, (int)sfp->reserve.k_use_sg));
2190     	sg_remove_scat(&sfp->reserve);
2191         }
2192         sfp->parentdp = NULL;
2193         SCSI_LOG_TIMEOUT(6, printk("__sg_remove_sfp:    sfp=0x%p\n", sfp));
2194         sg_low_free((char *)sfp, sizeof(Sg_fd), sfp->fd_mem_src);
2195     }
2196     
2197     /* Returns 0 in normal case, 1 when detached and sdp object removed */
2198     static int sg_remove_sfp(Sg_device * sdp, Sg_fd * sfp)
2199     {
2200         Sg_request * srp;
2201         Sg_request * tsrp;
2202         int dirty = 0;
2203         int res = 0;
2204     
2205         for (srp = sfp->headrp; srp; srp = tsrp) {
2206     	tsrp = srp->nextrp;
2207     	if (srp->done)
2208     	    sg_finish_rem_req(srp);
2209     	else
2210     	    ++dirty;
2211         }
2212         if (0 == dirty) {
2213     	unsigned long iflags;
2214     
2215     	write_lock_irqsave(&sg_dev_arr_lock, iflags);
2216     	__sg_remove_sfp(sdp, sfp);
2217     	if (sdp->detached && (NULL == sdp->headfp)) {
2218     	    int k, maxd;
2219     
2220     	    maxd = sg_template.dev_max;
2221     	    for (k = 0; k < maxd; ++k) {
2222     	    	if (sdp == sg_dev_arr[k])
2223     		    break;
2224     	    }
2225     	    if (k < maxd)
2226     		sg_dev_arr[k] = NULL;
2227     	    kfree((char *)sdp);
2228     	    res = 1;
2229     	}
2230     	write_unlock_irqrestore(&sg_dev_arr_lock, iflags);
2231         }
2232         else {
2233             sfp->closed = 1; /* flag dirty state on this fd */
2234     	sdp->device->access_count++;
2235     	/* MOD_INC's to inhibit unloading sg and associated adapter driver */
2236     	if (sg_template.module)
2237     	    __MOD_INC_USE_COUNT(sg_template.module);
2238     	 if (sdp->device->host->hostt->module)
2239     	    __MOD_INC_USE_COUNT(sdp->device->host->hostt->module);
2240             SCSI_LOG_TIMEOUT(1, printk(
2241               "sg_remove_sfp: worrisome, %d writes pending\n", dirty));
2242         }
2243         return res;
2244     }
2245     
2246     static int sg_res_in_use(Sg_fd * sfp)
2247     {
2248         const Sg_request * srp;
2249         unsigned long iflags;
2250     
2251         read_lock_irqsave(&sfp->rq_list_lock, iflags);
2252         for (srp = sfp->headrp; srp; srp = srp->nextrp)
2253             if (srp->res_used) break;
2254         read_unlock_irqrestore(&sfp->rq_list_lock, iflags);
2255         return srp ? 1 : 0;
2256     }
2257     
2258     /* If retSzp==NULL want exact size or fail */
2259     static char * sg_low_malloc(int rqSz, int lowDma, int mem_src, int * retSzp)
2260     {
2261         char * resp = NULL;
2262         int page_mask = lowDma ? (GFP_ATOMIC | GFP_DMA) : GFP_ATOMIC;
2263     
2264         if (rqSz <= 0)
2265             return resp;
2266         if (SG_HEAP_KMAL == mem_src) {
2267             resp = kmalloc(rqSz, page_mask);
2268             if (resp && retSzp) *retSzp = rqSz;
2269             return resp;
2270         }
2271         if (SG_HEAP_POOL == mem_src) {
2272             int num_sect = rqSz / SG_SECTOR_SZ;
2273     
2274             if (0 != (rqSz & SG_SECTOR_MSK)) {
2275                 if (! retSzp)
2276                     return resp;
2277                 ++num_sect;
2278                 rqSz = num_sect * SG_SECTOR_SZ;
2279             }
2280             while (num_sect > 0) {
2281                 if ((num_sect <= sg_pool_secs_avail) &&
2282                     (scsi_dma_free_sectors > (SG_LOW_POOL_THRESHHOLD + num_sect))) {
2283                     resp = scsi_malloc(rqSz);
2284                     if (resp) {
2285                         if (retSzp) *retSzp = rqSz;
2286                         sg_pool_secs_avail -= num_sect;
2287                         return resp;
2288                     }
2289                 }
2290                 if (! retSzp)
2291                     return resp;
2292                 num_sect /= 2;      /* try half as many */
2293                 rqSz = num_sect * SG_SECTOR_SZ;
2294             }
2295         }
2296         else if (SG_HEAP_PAGE == mem_src) {
2297             int order, a_size;
2298             int resSz = rqSz;
2299     
2300             for (order = 0, a_size = PAGE_SIZE;
2301                  a_size < rqSz; order++, a_size <<= 1)
2302                 ;
2303             resp = (char *)__get_free_pages(page_mask, order);
2304             while ((! resp) && order && retSzp) {
2305                 --order;
2306                 a_size >>= 1;   /* divide by 2, until PAGE_SIZE */
2307                 resp = (char *)__get_free_pages(page_mask, order); /* try half */
2308                 resSz = a_size;
2309             }
2310             if (retSzp) *retSzp = resSz;
2311         }
2312         else
2313             printk("sg_low_malloc: bad mem_src=%d, rqSz=%df\n", mem_src, rqSz);
2314         return resp;
2315     }
2316     
2317     static char * sg_malloc(const Sg_fd * sfp, int size, int * retSzp,
2318                             int * mem_srcp)
2319     {
2320         char * resp = NULL;
2321     
2322         if (retSzp) *retSzp = size;
2323         if (size <= 0)
2324             ;
2325         else {
2326             int low_dma = sfp->low_dma;
2327             int l_ms = -1;  /* invalid value */
2328     
2329     	switch (*mem_srcp)
2330             {
2331             case SG_HEAP_PAGE:
2332                 l_ms = (size < PAGE_SIZE) ? SG_HEAP_POOL : SG_HEAP_PAGE;
2333                 resp = sg_low_malloc(size, low_dma, l_ms, 0);
2334                 if (resp)
2335                     break;
2336                 resp = sg_low_malloc(size, low_dma, l_ms, &size);
2337                 if (! resp) {
2338                     l_ms = (SG_HEAP_POOL == l_ms) ? SG_HEAP_PAGE : SG_HEAP_POOL;
2339                     resp = sg_low_malloc(size, low_dma, l_ms, &size);
2340                     if (! resp) {
2341                         l_ms = SG_HEAP_KMAL;
2342                         resp = sg_low_malloc(size, low_dma, l_ms, &size);
2343                     }
2344                 }
2345                 if (resp && retSzp) *retSzp = size;
2346                 break;
2347             case SG_HEAP_KMAL:
2348                 l_ms = SG_HEAP_PAGE;
2349                 resp = sg_low_malloc(size, low_dma, l_ms, 0);
2350                 if (resp)
2351                     break;
2352                 l_ms = SG_HEAP_POOL;
2353                 resp = sg_low_malloc(size, low_dma, l_ms, &size);
2354                 if (resp && retSzp) *retSzp = size;
2355                 break;
2356             default:
2357                 SCSI_LOG_TIMEOUT(1, printk("sg_malloc: bad ms=%d\n", *mem_srcp));
2358                 break;
2359             }
2360             if (resp) *mem_srcp = l_ms;
2361         }
2362         SCSI_LOG_TIMEOUT(6, printk("sg_malloc: size=%d, ms=%d, ret=0x%p\n",
2363                                    size, *mem_srcp, resp));
2364         return resp;
2365     }
2366     
2367     static void sg_low_free(char * buff, int size, int mem_src)
2368     {
2369         if (! buff) return;
2370         switch (mem_src) {
2371         case SG_HEAP_POOL:
2372     	{
2373     	    int num_sect = size / SG_SECTOR_SZ;
2374     
2375     	    scsi_free(buff, size);
2376     	    sg_pool_secs_avail += num_sect;
2377     	}
2378     	break;
2379         case SG_HEAP_KMAL:
2380     	kfree(buff);    /* size not used */
2381     	break;
2382         case SG_HEAP_PAGE:
2383     	{
2384     	    int order, a_size;
2385     	    for (order = 0, a_size = PAGE_SIZE;
2386     		 a_size < size; order++, a_size <<= 1)
2387     		;
2388     	    free_pages((unsigned long)buff, order);
2389     	}
2390     	break;
2391         case SG_USER_MEM:
2392     	break; /* nothing to do */
2393         default:
2394     	printk("sg_low_free: bad mem_src=%d, buff=0x%p, rqSz=%d\n",
2395                    mem_src, buff, size);
2396     	break;
2397         }
2398     }
2399     
2400     static void sg_free(char * buff, int size, int mem_src)
2401     {
2402         SCSI_LOG_TIMEOUT(6,
2403             printk("sg_free: buff=0x%p, size=%d\n", buff, size));
2404         if ((! buff) || (size <= 0))
2405             ;
2406         else
2407             sg_low_free(buff, size, mem_src);
2408     }
2409     
2410     static void sg_clr_srpnt(Scsi_Request * SRpnt)
2411     {
2412         SRpnt->sr_use_sg = 0;
2413         SRpnt->sr_sglist_len = 0;
2414         SRpnt->sr_bufflen = 0;
2415         SRpnt->sr_buffer = NULL;
2416         SRpnt->sr_underflow = 0;
2417         SRpnt->sr_request.rq_dev = MKDEV(0, 0);  /* "sg" _disowns_ command blk */
2418     }
2419     
2420     static int sg_ms_to_jif(unsigned int msecs)
2421     {
2422         if ((UINT_MAX / 2U) < msecs)
2423     	return INT_MAX;      /* special case, set largest possible */
2424         else
2425     	return ((int)msecs < (INT_MAX / 1000)) ? (((int)msecs * HZ) / 1000)
2426     					       : (((int)msecs / 1000) * HZ);
2427     }
2428     
2429     static unsigned sg_jif_to_ms(int jifs)
2430     {
2431         if (jifs <= 0)
2432     	return 0U;
2433         else {
2434     	unsigned int j = (unsigned int)jifs;
2435     	return (j < (UINT_MAX / 1000)) ? ((j * 1000) / HZ) : ((j / HZ) * 1000);
2436         }
2437     }
2438     
2439     static unsigned char allow_ops[] = {TEST_UNIT_READY, INQUIRY,
2440     READ_CAPACITY, READ_BUFFER, READ_6, READ_10, READ_12,
2441     MODE_SENSE, MODE_SENSE_10};
2442     
2443     static int sg_allow_access(unsigned char opcode, char dev_type)
2444     {
2445         int k;
2446     
2447         if (TYPE_SCANNER == dev_type) /* TYPE_ROM maybe burner */
2448     	return 1;
2449         for (k = 0; k < sizeof(allow_ops); ++k) {
2450     	if (opcode == allow_ops[k])
2451     	    return 1;
2452         }
2453         return 0;
2454     }
2455     
2456     
2457     #ifdef CONFIG_PROC_FS
2458     static int sg_last_dev()
2459     {
2460         int k;
2461         unsigned long iflags;
2462     
2463         read_lock_irqsave(&sg_dev_arr_lock, iflags);
2464         for (k = sg_template.dev_max - 1; k >= 0; --k)
2465     	if (sg_dev_arr[k] && sg_dev_arr[k]->device) break;
2466         read_unlock_irqrestore(&sg_dev_arr_lock, iflags);
2467         return k + 1;   /* origin 1 */
2468     }
2469     #endif
2470     
2471     static Sg_device * sg_get_dev(int dev)
2472     {
2473         Sg_device * sdp = NULL;
2474         unsigned long iflags;
2475     
2476         if (sg_dev_arr && (dev >= 0))
2477         {
2478     	read_lock_irqsave(&sg_dev_arr_lock, iflags);
2479         if (dev < sg_template.dev_max)
2480         	sdp = sg_dev_arr[dev];
2481     	read_unlock_irqrestore(&sg_dev_arr_lock, iflags);
2482         }
2483         return sdp;
2484     }
2485     
2486     #ifdef CONFIG_PROC_FS
2487     
2488     static struct proc_dir_entry * sg_proc_sgp = NULL;
2489     
2490     static char sg_proc_sg_dirname[] = "sg";
2491     static const char * sg_proc_leaf_names[] = {"allow_dio", "def_reserved_size",
2492     		"debug", "devices", "device_hdr", "device_strs",
2493     		"hosts", "host_hdr", "host_strs", "version"};
2494     
2495     static int sg_proc_adio_read(char * buffer, char ** start, off_t offset,
2496     			     int size, int * eof, void * data);
2497     static int sg_proc_adio_info(char * buffer, int * len, off_t * begin,
2498     			     off_t offset, int size);
2499     static int sg_proc_adio_write(struct file * filp, const char * buffer,
2500     			      unsigned long count, void * data);
2501     static int sg_proc_dressz_read(char * buffer, char ** start, off_t offset,
2502     			       int size, int * eof, void * data);
2503     static int sg_proc_dressz_info(char * buffer, int * len, off_t * begin,
2504     			       off_t offset, int size);
2505     static int sg_proc_dressz_write(struct file * filp, const char * buffer,
2506     				unsigned long count, void * data);
2507     static int sg_proc_debug_read(char * buffer, char ** start, off_t offset,
2508     			      int size, int * eof, void * data);
2509     static int sg_proc_debug_info(char * buffer, int * len, off_t * begin,
2510     			      off_t offset, int size);
2511     static int sg_proc_dev_read(char * buffer, char ** start, off_t offset,
2512     			    int size, int * eof, void * data);
2513     static int sg_proc_dev_info(char * buffer, int * len, off_t * begin,
2514     			    off_t offset, int size);
2515     static int sg_proc_devhdr_read(char * buffer, char ** start, off_t offset,
2516     			       int size, int * eof, void * data);
2517     static int sg_proc_devhdr_info(char * buffer, int * len, off_t * begin,
2518     			       off_t offset, int size);
2519     static int sg_proc_devstrs_read(char * buffer, char ** start, off_t offset,
2520     				int size, int * eof, void * data);
2521     static int sg_proc_devstrs_info(char * buffer, int * len, off_t * begin,
2522     				off_t offset, int size);
2523     static int sg_proc_host_read(char * buffer, char ** start, off_t offset,
2524     			     int size, int * eof, void * data);
2525     static int sg_proc_host_info(char * buffer, int * len, off_t * begin,
2526     			     off_t offset, int size);
2527     static int sg_proc_hosthdr_read(char * buffer, char ** start, off_t offset,
2528     				int size, int * eof, void * data);
2529     static int sg_proc_hosthdr_info(char * buffer, int * len, off_t * begin,
2530     				off_t offset, int size);
2531     static int sg_proc_hoststrs_read(char * buffer, char ** start, off_t offset,
2532     				 int size, int * eof, void * data);
2533     static int sg_proc_hoststrs_info(char * buffer, int * len, off_t * begin,
2534     				 off_t offset, int size);
2535     static int sg_proc_version_read(char * buffer, char ** start, off_t offset,
2536     				int size, int * eof, void * data);
2537     static int sg_proc_version_info(char * buffer, int * len, off_t * begin,
2538     				off_t offset, int size);
2539     static read_proc_t * sg_proc_leaf_reads[] = {
2540     	     sg_proc_adio_read, sg_proc_dressz_read, sg_proc_debug_read,
2541     	     sg_proc_dev_read, sg_proc_devhdr_read, sg_proc_devstrs_read,
2542     	     sg_proc_host_read, sg_proc_hosthdr_read, sg_proc_hoststrs_read,
2543     	     sg_proc_version_read};
2544     static write_proc_t * sg_proc_leaf_writes[] = {
2545     	     sg_proc_adio_write, sg_proc_dressz_write, 0, 0, 0, 0, 0, 0, 0, 0};
2546     
2547     #define PRINT_PROC(fmt,args...)                                 \
2548         do {                                                        \
2549     	*len += sprintf(buffer + *len, fmt, ##args);            \
2550     	if (*begin + *len > offset + size)                      \
2551     	    return 0;                                           \
2552     	if (*begin + *len < offset) {                           \
2553     	    *begin += *len;                                     \
2554     	    *len = 0;                                           \
2555     	}                                                       \
2556         } while(0)
2557     
2558     #define SG_PROC_READ_FN(infofp)                                 \
2559         do {                                                        \
2560     	int len = 0;                                            \
2561     	off_t begin = 0;                                        \
2562     	*eof = infofp(buffer, &len, &begin, offset, size);      \
2563     	if (offset >= (begin + len))                            \
2564     	    return 0;                                           \
2565     	*start = buffer + offset - begin;			\
2566     	return (size < (begin + len - offset)) ?                \
2567     				size : begin + len - offset;    \
2568         } while(0)
2569     
2570     
2571     static int sg_proc_init()
2572     {
2573         int k, mask;
2574         int leaves = sizeof(sg_proc_leaf_names) / sizeof(sg_proc_leaf_names[0]);
2575         struct proc_dir_entry * pdep;
2576     
2577         if (! proc_scsi)
2578     	return 1;
2579         sg_proc_sgp = create_proc_entry(sg_proc_sg_dirname,
2580     				    S_IFDIR | S_IRUGO | S_IXUGO, proc_scsi);
2581         if (! sg_proc_sgp)
2582     	return 1;
2583         for (k = 0; k < leaves; ++k) {
2584     	mask = sg_proc_leaf_writes[k] ? S_IRUGO | S_IWUSR : S_IRUGO;
2585     	pdep = create_proc_entry(sg_proc_leaf_names[k], mask, sg_proc_sgp);
2586     	if (pdep) {
2587     	    pdep->read_proc = sg_proc_leaf_reads[k];
2588     	    if (sg_proc_leaf_writes[k])
2589     		pdep->write_proc = sg_proc_leaf_writes[k];
2590     	}
2591         }
2592         return 0;
2593     }
2594     
2595     static void sg_proc_cleanup()
2596     {
2597         int k;
2598         int leaves = sizeof(sg_proc_leaf_names) / sizeof(sg_proc_leaf_names[0]);
2599     
2600         if ((! proc_scsi) || (! sg_proc_sgp))
2601     	return;
2602         for (k = 0; k < leaves; ++k)
2603     	remove_proc_entry(sg_proc_leaf_names[k], sg_proc_sgp);
2604         remove_proc_entry(sg_proc_sg_dirname, proc_scsi);
2605     }
2606     
2607     static int sg_proc_adio_read(char * buffer, char ** start, off_t offset,
2608     			       int size, int * eof, void * data)
2609     { SG_PROC_READ_FN(sg_proc_adio_info); }
2610     
2611     static int sg_proc_adio_info(char * buffer, int * len, off_t * begin,
2612     			     off_t offset, int size)
2613     {
2614         PRINT_PROC("%d\n", sg_allow_dio);
2615         return 1;
2616     }
2617     
2618     static int sg_proc_adio_write(struct file * filp, const char * buffer,
2619     			      unsigned long count, void * data)
2620     {
2621         int num;
2622         char buff[11];
2623     
2624         if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
2625     	return -EACCES;
2626         num = (count < 10) ? count : 10;
2627         copy_from_user(buff, buffer, num);
2628         buff[num] = '\0';
2629         sg_allow_dio = simple_strtoul(buff, 0, 10) ? 1 : 0;
2630         return count;
2631     }
2632     
2633     static int sg_proc_dressz_read(char * buffer, char ** start, off_t offset,
2634     			       int size, int * eof, void * data)
2635     { SG_PROC_READ_FN(sg_proc_dressz_info); }
2636     
2637     static int sg_proc_dressz_info(char * buffer, int * len, off_t * begin,
2638     			       off_t offset, int size)
2639     {
2640         PRINT_PROC("%d\n", sg_big_buff);
2641         return 1;
2642     }
2643     
2644     static int sg_proc_dressz_write(struct file * filp, const char * buffer,
2645     				unsigned long count, void * data)
2646     {
2647         int num;
2648         unsigned long k = ULONG_MAX;
2649         char buff[11];
2650     
2651         if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
2652     	return -EACCES;
2653         num = (count < 10) ? count : 10;
2654         copy_from_user(buff, buffer, num);
2655         buff[num] = '\0';
2656         k = simple_strtoul(buff, 0, 10);
2657         if (k <= 1048576) {
2658     	sg_big_buff = k;
2659     	return count;
2660         }
2661         return -ERANGE;
2662     }
2663     
2664     static int sg_proc_debug_read(char * buffer, char ** start, off_t offset,
2665     			      int size, int * eof, void * data)
2666     { SG_PROC_READ_FN(sg_proc_debug_info); }
2667     
2668     static int sg_proc_debug_info(char * buffer, int * len, off_t * begin,
2669     			      off_t offset, int size)
2670     {
2671         Sg_device * sdp;
2672         const sg_io_hdr_t * hp;
2673         int j, max_dev;
2674     
2675         if (NULL == sg_dev_arr) {
2676     	PRINT_PROC("sg_dev_arr NULL, driver not initialized\n");
2677     	return 1;
2678         }
2679         max_dev = sg_last_dev();
2680         PRINT_PROC("dev_max(currently)=%d max_active_device=%d (origin 1)\n",
2681     	       sg_template.dev_max, max_dev);
2682         PRINT_PROC(" scsi_dma_free_sectors=%u sg_pool_secs_aval=%d "
2683     	       "def_reserved_size=%d\n",
2684     	       scsi_dma_free_sectors, sg_pool_secs_avail, sg_big_buff);
2685         for (j = 0; j < max_dev; ++j) {
2686     	if ((sdp = sg_get_dev(j))) {
2687     	    Sg_fd * fp;
2688     	    Sg_request * srp;
2689     	    struct scsi_device * scsidp;
2690     	    int dev, k, m, blen, usg;
2691      
2692     	    scsidp = sdp->device;
2693     	    if (NULL == scsidp) {
2694     		PRINT_PROC("device %d detached ??\n", j);
2695     		continue;
2696     	    }
2697     	    dev = MINOR(sdp->i_rdev);
2698     
2699     	    if (sg_get_nth_sfp(sdp, 0)) {
2700     		PRINT_PROC(" >>> device=sg%d ", dev);
2701     		if (sdp->detached)
2702     		    PRINT_PROC("detached pending close ");
2703     		else
2704     		    PRINT_PROC("scsi%d chan=%d id=%d lun=%d   em=%d",
2705     		       scsidp->host->host_no, scsidp->channel,
2706     		       scsidp->id, scsidp->lun, scsidp->host->hostt->emulated);
2707     		PRINT_PROC(" sg_tablesize=%d excl=%d\n", sdp->sg_tablesize, 
2708     			   sdp->exclude);
2709     	    }
2710     	    for (k = 0; (fp = sg_get_nth_sfp(sdp, k)); ++k) {
2711     		PRINT_PROC("   FD(%d): timeout=%dms bufflen=%d "
2712     			   "(res)sgat=%d low_dma=%d\n", k + 1,
2713     			   sg_jif_to_ms(fp->timeout), fp->reserve.bufflen,
2714     			   (int)fp->reserve.k_use_sg, (int)fp->low_dma);
2715     		PRINT_PROC("   cmd_q=%d f_packid=%d k_orphan=%d closed=%d\n",
2716     			   (int)fp->cmd_q, (int)fp->force_packid,
2717     			   (int)fp->keep_orphan, (int)fp->closed);
2718     		for (m = 0; (srp = sg_get_nth_request(fp, m)); ++m) {
2719     		    hp = &srp->header;
2720     /* stop indenting so far ... */
2721     	PRINT_PROC(srp->res_used ? "     rb>> " :
2722     	    ((SG_INFO_DIRECT_IO_MASK & hp->info) ? "     dio>> " : "     "));
2723     	blen = srp->my_cmdp ? srp->my_cmdp->sr_bufflen : srp->data.bufflen;
2724     	usg = srp->my_cmdp ? srp->my_cmdp->sr_use_sg : srp->data.k_use_sg;
2725     	PRINT_PROC(srp->done ? ((1 == srp->done) ? "rcv:" : "fin:") 
2726     			     : (srp->my_cmdp ? "act:" : "prior:"));
2727     	PRINT_PROC(" id=%d blen=%d", srp->header.pack_id, blen);
2728     	if (srp->done)
2729     	    PRINT_PROC(" dur=%d", hp->duration);
2730     	else
2731     	    PRINT_PROC(" t_o/elap=%d/%d", ((hp->interface_id == '\0') ?
2732     			sg_jif_to_ms(fp->timeout) : hp->timeout),
2733     		  sg_jif_to_ms(hp->duration ? (jiffies - hp->duration) : 0));
2734     	PRINT_PROC("ms sgat=%d op=0x%02x\n", usg, (int)srp->data.cmd_opcode);
2735     /* reset indenting */
2736     		}
2737     		if (0 == m)
2738     		    PRINT_PROC("     No requests active\n");
2739     	    }
2740     	}
2741         }
2742         return 1;
2743     }
2744     
2745     static int sg_proc_dev_read(char * buffer, char ** start, off_t offset,
2746     			    int size, int * eof, void * data)
2747     { SG_PROC_READ_FN(sg_proc_dev_info); }
2748     
2749     static int sg_proc_dev_info(char * buffer, int * len, off_t * begin,
2750     			    off_t offset, int size)
2751     {
2752         Sg_device * sdp;
2753         int j, max_dev;
2754         struct scsi_device * scsidp;
2755     
2756         max_dev = sg_last_dev();
2757         for (j = 0; j < max_dev; ++j) {
2758     	sdp = sg_get_dev(j);
2759     	if (sdp && (scsidp = sdp->device) && (! sdp->detached))
2760     	    PRINT_PROC("%d\t%d\t%d\t%d\t%d\t%d\t%d\t%d\t%d\n",
2761     	       scsidp->host->host_no, scsidp->channel, scsidp->id,
2762     	       scsidp->lun, (int)scsidp->type, (int)scsidp->access_count,
2763     	       (int)scsidp->queue_depth, (int)scsidp->device_busy,
2764     	       (int)scsidp->online);
2765     	else
2766     	    PRINT_PROC("-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\t-1\n");
2767         }
2768         return 1;
2769     }
2770     
2771     static int sg_proc_devhdr_read(char * buffer, char ** start, off_t offset,
2772     			       int size, int * eof, void * data)
2773     { SG_PROC_READ_FN(sg_proc_devhdr_info); }
2774     
2775     static int sg_proc_devhdr_info(char * buffer, int * len, off_t * begin,
2776     			       off_t offset, int size)
2777     {
2778         PRINT_PROC("host\tchan\tid\tlun\ttype\topens\tqdepth\tbusy\tonline\n");
2779         return 1;
2780     }
2781     
2782     static int sg_proc_devstrs_read(char * buffer, char ** start, off_t offset,
2783     				int size, int * eof, void * data)
2784     { SG_PROC_READ_FN(sg_proc_devstrs_info); }
2785     
2786     static int sg_proc_devstrs_info(char * buffer, int * len, off_t * begin,
2787     				off_t offset, int size)
2788     {
2789         Sg_device * sdp;
2790         int j, max_dev;
2791         struct scsi_device * scsidp;
2792     
2793         max_dev = sg_last_dev();
2794         for (j = 0; j < max_dev; ++j) {
2795     	sdp = sg_get_dev(j);
2796     	if (sdp && (scsidp = sdp->device) && (! sdp->detached))
2797     	    PRINT_PROC("%8.8s\t%16.16s\t%4.4s\n",
2798     		       scsidp->vendor, scsidp->model, scsidp->rev);
2799     	else
2800     	    PRINT_PROC("<no active device>\n");
2801         }
2802         return 1;
2803     }
2804     
2805     static int sg_proc_host_read(char * buffer, char ** start, off_t offset,
2806     			     int size, int * eof, void * data)
2807     { SG_PROC_READ_FN(sg_proc_host_info); }
2808     
2809     static int sg_proc_host_info(char * buffer, int * len, off_t * begin,
2810     			     off_t offset, int size)
2811     {
2812         struct Scsi_Host * shp;
2813         int k;
2814     
2815         for (k = 0, shp = scsi_hostlist; shp; shp = shp->next, ++k) {
2816         	for ( ; k < shp->host_no; ++k)
2817     	    PRINT_PROC("-1\t-1\t-1\t-1\t-1\t-1\n");
2818     	PRINT_PROC("%u\t%hu\t%hd\t%hu\t%d\t%d\n",
2819     		   shp->unique_id, shp->host_busy, shp->cmd_per_lun,
2820     		   shp->sg_tablesize, (int)shp->unchecked_isa_dma,
2821     		   (int)shp->hostt->emulated);
2822         }
2823         return 1;
2824     }
2825     
2826     static int sg_proc_hosthdr_read(char * buffer, char ** start, off_t offset,
2827     				int size, int * eof, void * data)
2828     { SG_PROC_READ_FN(sg_proc_hosthdr_info); }
2829     
2830     static int sg_proc_hosthdr_info(char * buffer, int * len, off_t * begin,
2831     				off_t offset, int size)
2832     {
2833         PRINT_PROC("uid\tbusy\tcpl\tscatg\tisa\temul\n");
2834         return 1;
2835     }
2836     
2837     static int sg_proc_hoststrs_read(char * buffer, char ** start, off_t offset,
2838     				 int size, int * eof, void * data)
2839     { SG_PROC_READ_FN(sg_proc_hoststrs_info); }
2840     
2841     static int sg_proc_hoststrs_info(char * buffer, int * len, off_t * begin,
2842     				 off_t offset, int size)
2843     {
2844         struct Scsi_Host * shp;
2845         int k;
2846     
2847         for (k = 0, shp = scsi_hostlist; shp; shp = shp->next, ++k) {
2848         	for ( ; k < shp->host_no; ++k)
2849     	    PRINT_PROC("<no active host>\n");
2850     	PRINT_PROC("%s\n", shp->hostt->info ? shp->hostt->info(shp) :
2851     		    (shp->hostt->name ? shp->hostt->name : "<no name>"));
2852         }
2853         return 1;
2854     }
2855     
2856     static int sg_proc_version_read(char * buffer, char ** start, off_t offset,
2857     				int size, int * eof, void * data)
2858     { SG_PROC_READ_FN(sg_proc_version_info); }
2859     
2860     static int sg_proc_version_info(char * buffer, int * len, off_t * begin,
2861     				off_t offset, int size)
2862     {
2863         PRINT_PROC("%d\t%s\n", sg_version_num, sg_version_str);
2864         return 1;
2865     }
2866     #endif  /* CONFIG_PROC_FS */
2867     
2868     
2869     module_init(init_sg);
2870     module_exit(exit_sg);
2871