xref: /linux/drivers/ata/libata-scsi.c (revision 512b6fb1c14d4c34f23a3419b0789ad01914a899)
1 /*
2  *  libata-scsi.c - helper library for ATA
3  *
4  *  Maintained by:  Jeff Garzik <jgarzik@pobox.com>
5  *    		    Please ALWAYS copy linux-ide@vger.kernel.org
6  *		    on emails.
7  *
8  *  Copyright 2003-2004 Red Hat, Inc.  All rights reserved.
9  *  Copyright 2003-2004 Jeff Garzik
10  *
11  *
12  *  This program is free software; you can redistribute it and/or modify
13  *  it under the terms of the GNU General Public License as published by
14  *  the Free Software Foundation; either version 2, or (at your option)
15  *  any later version.
16  *
17  *  This program is distributed in the hope that it will be useful,
18  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
19  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20  *  GNU General Public License for more details.
21  *
22  *  You should have received a copy of the GNU General Public License
23  *  along with this program; see the file COPYING.  If not, write to
24  *  the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
25  *
26  *
27  *  libata documentation is available via 'make {ps|pdf}docs',
28  *  as Documentation/DocBook/libata.*
29  *
30  *  Hardware documentation available from
31  *  - http://www.t10.org/
32  *  - http://www.t13.org/
33  *
34  */
35 
36 #include <linux/kernel.h>
37 #include <linux/blkdev.h>
38 #include <linux/spinlock.h>
39 #include <scsi/scsi.h>
40 #include <scsi/scsi_host.h>
41 #include <scsi/scsi_cmnd.h>
42 #include <scsi/scsi_eh.h>
43 #include <scsi/scsi_device.h>
44 #include <scsi/scsi_tcq.h>
45 #include <scsi/scsi_transport.h>
46 #include <linux/libata.h>
47 #include <linux/hdreg.h>
48 #include <asm/uaccess.h>
49 
50 #include "libata.h"
51 
52 #define SECTOR_SIZE	512
53 
54 typedef unsigned int (*ata_xlat_func_t)(struct ata_queued_cmd *qc);
55 
56 static struct ata_device * __ata_scsi_find_dev(struct ata_port *ap,
57 					const struct scsi_device *scsidev);
58 static struct ata_device * ata_scsi_find_dev(struct ata_port *ap,
59 					    const struct scsi_device *scsidev);
60 static int ata_scsi_user_scan(struct Scsi_Host *shost, unsigned int channel,
61 			      unsigned int id, unsigned int lun);
62 
63 
64 #define RW_RECOVERY_MPAGE 0x1
65 #define RW_RECOVERY_MPAGE_LEN 12
66 #define CACHE_MPAGE 0x8
67 #define CACHE_MPAGE_LEN 20
68 #define CONTROL_MPAGE 0xa
69 #define CONTROL_MPAGE_LEN 12
70 #define ALL_MPAGES 0x3f
71 #define ALL_SUB_MPAGES 0xff
72 
73 
74 static const u8 def_rw_recovery_mpage[RW_RECOVERY_MPAGE_LEN] = {
75 	RW_RECOVERY_MPAGE,
76 	RW_RECOVERY_MPAGE_LEN - 2,
77 	(1 << 7),	/* AWRE */
78 	0,		/* read retry count */
79 	0, 0, 0, 0,
80 	0,		/* write retry count */
81 	0, 0, 0
82 };
83 
84 static const u8 def_cache_mpage[CACHE_MPAGE_LEN] = {
85 	CACHE_MPAGE,
86 	CACHE_MPAGE_LEN - 2,
87 	0,		/* contains WCE, needs to be 0 for logic */
88 	0, 0, 0, 0, 0, 0, 0, 0, 0,
89 	0,		/* contains DRA, needs to be 0 for logic */
90 	0, 0, 0, 0, 0, 0, 0
91 };
92 
93 static const u8 def_control_mpage[CONTROL_MPAGE_LEN] = {
94 	CONTROL_MPAGE,
95 	CONTROL_MPAGE_LEN - 2,
96 	2,	/* DSENSE=0, GLTSD=1 */
97 	0,	/* [QAM+QERR may be 1, see 05-359r1] */
98 	0, 0, 0, 0, 0xff, 0xff,
99 	0, 30	/* extended self test time, see 05-359r1 */
100 };
101 
102 /*
103  * libata transport template.  libata doesn't do real transport stuff.
104  * It just needs the eh_timed_out hook.
105  */
106 static struct scsi_transport_template ata_scsi_transport_template = {
107 	.eh_strategy_handler	= ata_scsi_error,
108 	.eh_timed_out		= ata_scsi_timed_out,
109 	.user_scan		= ata_scsi_user_scan,
110 };
111 
112 
113 static void ata_scsi_invalid_field(struct scsi_cmnd *cmd,
114 				   void (*done)(struct scsi_cmnd *))
115 {
116 	ata_scsi_set_sense(cmd, ILLEGAL_REQUEST, 0x24, 0x0);
117 	/* "Invalid field in cbd" */
118 	done(cmd);
119 }
120 
121 /**
122  *	ata_std_bios_param - generic bios head/sector/cylinder calculator used by sd.
123  *	@sdev: SCSI device for which BIOS geometry is to be determined
124  *	@bdev: block device associated with @sdev
125  *	@capacity: capacity of SCSI device
126  *	@geom: location to which geometry will be output
127  *
128  *	Generic bios head/sector/cylinder calculator
129  *	used by sd. Most BIOSes nowadays expect a XXX/255/16  (CHS)
130  *	mapping. Some situations may arise where the disk is not
131  *	bootable if this is not used.
132  *
133  *	LOCKING:
134  *	Defined by the SCSI layer.  We don't really care.
135  *
136  *	RETURNS:
137  *	Zero.
138  */
139 int ata_std_bios_param(struct scsi_device *sdev, struct block_device *bdev,
140 		       sector_t capacity, int geom[])
141 {
142 	geom[0] = 255;
143 	geom[1] = 63;
144 	sector_div(capacity, 255*63);
145 	geom[2] = capacity;
146 
147 	return 0;
148 }
149 
150 /**
151  *	ata_get_identity - Handler for HDIO_GET_IDENTITY ioctl
152  *	@sdev: SCSI device to get identify data for
153  *	@arg: User buffer area for identify data
154  *
155  *	LOCKING:
156  *	Defined by the SCSI layer.  We don't really care.
157  *
158  *	RETURNS:
159  *	Zero on success, negative errno on error.
160  */
161 static int ata_get_identity(struct scsi_device *sdev, void __user *arg)
162 {
163 	struct ata_port *ap = ata_shost_to_port(sdev->host);
164 	struct ata_device *dev = ata_scsi_find_dev(ap, sdev);
165 	u16 __user *dst = arg;
166 	char buf[40];
167 
168 	if (!dev)
169 		return -ENOMSG;
170 
171 	if (copy_to_user(dst, dev->id, ATA_ID_WORDS * sizeof(u16)))
172 		return -EFAULT;
173 
174 	ata_id_string(dev->id, buf, ATA_ID_PROD, ATA_ID_PROD_LEN);
175 	if (copy_to_user(dst + ATA_ID_PROD, buf, ATA_ID_PROD_LEN))
176 		return -EFAULT;
177 
178 	ata_id_string(dev->id, buf, ATA_ID_FW_REV, ATA_ID_FW_REV_LEN);
179 	if (copy_to_user(dst + ATA_ID_FW_REV, buf, ATA_ID_FW_REV_LEN))
180 		return -EFAULT;
181 
182 	ata_id_string(dev->id, buf, ATA_ID_SERNO, ATA_ID_SERNO_LEN);
183 	if (copy_to_user(dst + ATA_ID_SERNO, buf, ATA_ID_SERNO_LEN))
184 		return -EFAULT;
185 
186 	return 0;
187 }
188 
189 /**
190  *	ata_cmd_ioctl - Handler for HDIO_DRIVE_CMD ioctl
191  *	@scsidev: Device to which we are issuing command
192  *	@arg: User provided data for issuing command
193  *
194  *	LOCKING:
195  *	Defined by the SCSI layer.  We don't really care.
196  *
197  *	RETURNS:
198  *	Zero on success, negative errno on error.
199  */
200 int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg)
201 {
202 	int rc = 0;
203 	u8 scsi_cmd[MAX_COMMAND_SIZE];
204 	u8 args[4], *argbuf = NULL, *sensebuf = NULL;
205 	int argsize = 0;
206 	enum dma_data_direction data_dir;
207 	int cmd_result;
208 
209 	if (arg == NULL)
210 		return -EINVAL;
211 
212 	if (copy_from_user(args, arg, sizeof(args)))
213 		return -EFAULT;
214 
215 	sensebuf = kzalloc(SCSI_SENSE_BUFFERSIZE, GFP_NOIO);
216 	if (!sensebuf)
217 		return -ENOMEM;
218 
219 	memset(scsi_cmd, 0, sizeof(scsi_cmd));
220 
221 	if (args[3]) {
222 		argsize = SECTOR_SIZE * args[3];
223 		argbuf = kmalloc(argsize, GFP_KERNEL);
224 		if (argbuf == NULL) {
225 			rc = -ENOMEM;
226 			goto error;
227 		}
228 
229 		scsi_cmd[1]  = (4 << 1); /* PIO Data-in */
230 		scsi_cmd[2]  = 0x0e;     /* no off.line or cc, read from dev,
231 		                            block count in sector count field */
232 		data_dir = DMA_FROM_DEVICE;
233 	} else {
234 		scsi_cmd[1]  = (3 << 1); /* Non-data */
235 		scsi_cmd[2]  = 0x20;     /* cc but no off.line or data xfer */
236 		data_dir = DMA_NONE;
237 	}
238 
239 	scsi_cmd[0] = ATA_16;
240 
241 	scsi_cmd[4] = args[2];
242 	if (args[0] == WIN_SMART) { /* hack -- ide driver does this too... */
243 		scsi_cmd[6]  = args[3];
244 		scsi_cmd[8]  = args[1];
245 		scsi_cmd[10] = 0x4f;
246 		scsi_cmd[12] = 0xc2;
247 	} else {
248 		scsi_cmd[6]  = args[1];
249 	}
250 	scsi_cmd[14] = args[0];
251 
252 	/* Good values for timeout and retries?  Values below
253 	   from scsi_ioctl_send_command() for default case... */
254 	cmd_result = scsi_execute(scsidev, scsi_cmd, data_dir, argbuf, argsize,
255 	                          sensebuf, (10*HZ), 5, 0);
256 
257 	if (driver_byte(cmd_result) == DRIVER_SENSE) {/* sense data available */
258 		u8 *desc = sensebuf + 8;
259 		cmd_result &= ~(0xFF<<24); /* DRIVER_SENSE is not an error */
260 
261 		/* If we set cc then ATA pass-through will cause a
262 		 * check condition even if no error. Filter that. */
263 		if (cmd_result & SAM_STAT_CHECK_CONDITION) {
264 			struct scsi_sense_hdr sshdr;
265 			scsi_normalize_sense(sensebuf, SCSI_SENSE_BUFFERSIZE,
266 			                      &sshdr);
267 			if (sshdr.sense_key==0 &&
268 			    sshdr.asc==0 && sshdr.ascq==0)
269 				cmd_result &= ~SAM_STAT_CHECK_CONDITION;
270 		}
271 
272 		/* Send userspace a few ATA registers (same as drivers/ide) */
273 		if (sensebuf[0] == 0x72 &&     /* format is "descriptor" */
274 		    desc[0] == 0x09 ) {        /* code is "ATA Descriptor" */
275 			args[0] = desc[13];    /* status */
276 			args[1] = desc[3];     /* error */
277 			args[2] = desc[5];     /* sector count (0:7) */
278 			if (copy_to_user(arg, args, sizeof(args)))
279 				rc = -EFAULT;
280 		}
281 	}
282 
283 
284 	if (cmd_result) {
285 		rc = -EIO;
286 		goto error;
287 	}
288 
289 	if ((argbuf)
290 	 && copy_to_user(arg + sizeof(args), argbuf, argsize))
291 		rc = -EFAULT;
292 error:
293 	kfree(sensebuf);
294 	kfree(argbuf);
295 	return rc;
296 }
297 
298 /**
299  *	ata_task_ioctl - Handler for HDIO_DRIVE_TASK ioctl
300  *	@scsidev: Device to which we are issuing command
301  *	@arg: User provided data for issuing command
302  *
303  *	LOCKING:
304  *	Defined by the SCSI layer.  We don't really care.
305  *
306  *	RETURNS:
307  *	Zero on success, negative errno on error.
308  */
309 int ata_task_ioctl(struct scsi_device *scsidev, void __user *arg)
310 {
311 	int rc = 0;
312 	u8 scsi_cmd[MAX_COMMAND_SIZE];
313 	u8 args[7], *sensebuf = NULL;
314 	int cmd_result;
315 
316 	if (arg == NULL)
317 		return -EINVAL;
318 
319 	if (copy_from_user(args, arg, sizeof(args)))
320 		return -EFAULT;
321 
322 	sensebuf = kzalloc(SCSI_SENSE_BUFFERSIZE, GFP_NOIO);
323 	if (!sensebuf)
324 		return -ENOMEM;
325 
326 	memset(scsi_cmd, 0, sizeof(scsi_cmd));
327 	scsi_cmd[0]  = ATA_16;
328 	scsi_cmd[1]  = (3 << 1); /* Non-data */
329 	scsi_cmd[2]  = 0x20;     /* cc but no off.line or data xfer */
330 	scsi_cmd[4]  = args[1];
331 	scsi_cmd[6]  = args[2];
332 	scsi_cmd[8]  = args[3];
333 	scsi_cmd[10] = args[4];
334 	scsi_cmd[12] = args[5];
335 	scsi_cmd[13] = args[6] & 0x4f;
336 	scsi_cmd[14] = args[0];
337 
338 	/* Good values for timeout and retries?  Values below
339 	   from scsi_ioctl_send_command() for default case... */
340 	cmd_result = scsi_execute(scsidev, scsi_cmd, DMA_NONE, NULL, 0,
341 				sensebuf, (10*HZ), 5, 0);
342 
343 	if (driver_byte(cmd_result) == DRIVER_SENSE) {/* sense data available */
344 		u8 *desc = sensebuf + 8;
345 		cmd_result &= ~(0xFF<<24); /* DRIVER_SENSE is not an error */
346 
347 		/* If we set cc then ATA pass-through will cause a
348 		 * check condition even if no error. Filter that. */
349 		if (cmd_result & SAM_STAT_CHECK_CONDITION) {
350 			struct scsi_sense_hdr sshdr;
351 			scsi_normalize_sense(sensebuf, SCSI_SENSE_BUFFERSIZE,
352 						&sshdr);
353 			if (sshdr.sense_key==0 &&
354 				sshdr.asc==0 && sshdr.ascq==0)
355 				cmd_result &= ~SAM_STAT_CHECK_CONDITION;
356 		}
357 
358 		/* Send userspace ATA registers */
359 		if (sensebuf[0] == 0x72 &&	/* format is "descriptor" */
360 				desc[0] == 0x09) {/* code is "ATA Descriptor" */
361 			args[0] = desc[13];	/* status */
362 			args[1] = desc[3];	/* error */
363 			args[2] = desc[5];	/* sector count (0:7) */
364 			args[3] = desc[7];	/* lbal */
365 			args[4] = desc[9];	/* lbam */
366 			args[5] = desc[11];	/* lbah */
367 			args[6] = desc[12];	/* select */
368 			if (copy_to_user(arg, args, sizeof(args)))
369 				rc = -EFAULT;
370 		}
371 	}
372 
373 	if (cmd_result) {
374 		rc = -EIO;
375 		goto error;
376 	}
377 
378  error:
379 	kfree(sensebuf);
380 	return rc;
381 }
382 
383 int ata_scsi_ioctl(struct scsi_device *scsidev, int cmd, void __user *arg)
384 {
385 	int val = -EINVAL, rc = -EINVAL;
386 
387 	switch (cmd) {
388 	case ATA_IOC_GET_IO32:
389 		val = 0;
390 		if (copy_to_user(arg, &val, 1))
391 			return -EFAULT;
392 		return 0;
393 
394 	case ATA_IOC_SET_IO32:
395 		val = (unsigned long) arg;
396 		if (val != 0)
397 			return -EINVAL;
398 		return 0;
399 
400 	case HDIO_GET_IDENTITY:
401 		return ata_get_identity(scsidev, arg);
402 
403 	case HDIO_DRIVE_CMD:
404 		if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
405 			return -EACCES;
406 		return ata_cmd_ioctl(scsidev, arg);
407 
408 	case HDIO_DRIVE_TASK:
409 		if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
410 			return -EACCES;
411 		return ata_task_ioctl(scsidev, arg);
412 
413 	default:
414 		rc = -ENOTTY;
415 		break;
416 	}
417 
418 	return rc;
419 }
420 
421 /**
422  *	ata_scsi_qc_new - acquire new ata_queued_cmd reference
423  *	@dev: ATA device to which the new command is attached
424  *	@cmd: SCSI command that originated this ATA command
425  *	@done: SCSI command completion function
426  *
427  *	Obtain a reference to an unused ata_queued_cmd structure,
428  *	which is the basic libata structure representing a single
429  *	ATA command sent to the hardware.
430  *
431  *	If a command was available, fill in the SCSI-specific
432  *	portions of the structure with information on the
433  *	current command.
434  *
435  *	LOCKING:
436  *	spin_lock_irqsave(host lock)
437  *
438  *	RETURNS:
439  *	Command allocated, or %NULL if none available.
440  */
441 static struct ata_queued_cmd *ata_scsi_qc_new(struct ata_device *dev,
442 					      struct scsi_cmnd *cmd,
443 					      void (*done)(struct scsi_cmnd *))
444 {
445 	struct ata_queued_cmd *qc;
446 
447 	qc = ata_qc_new_init(dev);
448 	if (qc) {
449 		qc->scsicmd = cmd;
450 		qc->scsidone = done;
451 
452 		qc->__sg = scsi_sglist(cmd);
453 		qc->n_elem = scsi_sg_count(cmd);
454 	} else {
455 		cmd->result = (DID_OK << 16) | (QUEUE_FULL << 1);
456 		done(cmd);
457 	}
458 
459 	return qc;
460 }
461 
462 /**
463  *	ata_dump_status - user friendly display of error info
464  *	@id: id of the port in question
465  *	@tf: ptr to filled out taskfile
466  *
467  *	Decode and dump the ATA error/status registers for the user so
468  *	that they have some idea what really happened at the non
469  *	make-believe layer.
470  *
471  *	LOCKING:
472  *	inherited from caller
473  */
474 static void ata_dump_status(unsigned id, struct ata_taskfile *tf)
475 {
476 	u8 stat = tf->command, err = tf->feature;
477 
478 	printk(KERN_WARNING "ata%u: status=0x%02x { ", id, stat);
479 	if (stat & ATA_BUSY) {
480 		printk("Busy }\n");	/* Data is not valid in this case */
481 	} else {
482 		if (stat & 0x40)	printk("DriveReady ");
483 		if (stat & 0x20)	printk("DeviceFault ");
484 		if (stat & 0x10)	printk("SeekComplete ");
485 		if (stat & 0x08)	printk("DataRequest ");
486 		if (stat & 0x04)	printk("CorrectedError ");
487 		if (stat & 0x02)	printk("Index ");
488 		if (stat & 0x01)	printk("Error ");
489 		printk("}\n");
490 
491 		if (err) {
492 			printk(KERN_WARNING "ata%u: error=0x%02x { ", id, err);
493 			if (err & 0x04)		printk("DriveStatusError ");
494 			if (err & 0x80) {
495 				if (err & 0x04)	printk("BadCRC ");
496 				else		printk("Sector ");
497 			}
498 			if (err & 0x40)		printk("UncorrectableError ");
499 			if (err & 0x10)		printk("SectorIdNotFound ");
500 			if (err & 0x02)		printk("TrackZeroNotFound ");
501 			if (err & 0x01)		printk("AddrMarkNotFound ");
502 			printk("}\n");
503 		}
504 	}
505 }
506 
507 /**
508  *	ata_to_sense_error - convert ATA error to SCSI error
509  *	@id: ATA device number
510  *	@drv_stat: value contained in ATA status register
511  *	@drv_err: value contained in ATA error register
512  *	@sk: the sense key we'll fill out
513  *	@asc: the additional sense code we'll fill out
514  *	@ascq: the additional sense code qualifier we'll fill out
515  *	@verbose: be verbose
516  *
517  *	Converts an ATA error into a SCSI error.  Fill out pointers to
518  *	SK, ASC, and ASCQ bytes for later use in fixed or descriptor
519  *	format sense blocks.
520  *
521  *	LOCKING:
522  *	spin_lock_irqsave(host lock)
523  */
524 static void ata_to_sense_error(unsigned id, u8 drv_stat, u8 drv_err, u8 *sk,
525 			       u8 *asc, u8 *ascq, int verbose)
526 {
527 	int i;
528 
529 	/* Based on the 3ware driver translation table */
530 	static const unsigned char sense_table[][4] = {
531 		/* BBD|ECC|ID|MAR */
532 		{0xd1, 		ABORTED_COMMAND, 0x00, 0x00}, 	// Device busy                  Aborted command
533 		/* BBD|ECC|ID */
534 		{0xd0,  	ABORTED_COMMAND, 0x00, 0x00}, 	// Device busy                  Aborted command
535 		/* ECC|MC|MARK */
536 		{0x61, 		HARDWARE_ERROR, 0x00, 0x00}, 	// Device fault                 Hardware error
537 		/* ICRC|ABRT */		/* NB: ICRC & !ABRT is BBD */
538 		{0x84, 		ABORTED_COMMAND, 0x47, 0x00}, 	// Data CRC error               SCSI parity error
539 		/* MC|ID|ABRT|TRK0|MARK */
540 		{0x37, 		NOT_READY, 0x04, 0x00}, 	// Unit offline                 Not ready
541 		/* MCR|MARK */
542 		{0x09, 		NOT_READY, 0x04, 0x00}, 	// Unrecovered disk error       Not ready
543 		/*  Bad address mark */
544 		{0x01, 		MEDIUM_ERROR, 0x13, 0x00}, 	// Address mark not found       Address mark not found for data field
545 		/* TRK0 */
546 		{0x02, 		HARDWARE_ERROR, 0x00, 0x00}, 	// Track 0 not found		  Hardware error
547 		/* Abort & !ICRC */
548 		{0x04, 		ABORTED_COMMAND, 0x00, 0x00}, 	// Aborted command              Aborted command
549 		/* Media change request */
550 		{0x08, 		NOT_READY, 0x04, 0x00}, 	// Media change request	  FIXME: faking offline
551 		/* SRV */
552 		{0x10, 		ABORTED_COMMAND, 0x14, 0x00}, 	// ID not found                 Recorded entity not found
553 		/* Media change */
554 		{0x08,  	NOT_READY, 0x04, 0x00}, 	// Media change		  FIXME: faking offline
555 		/* ECC */
556 		{0x40, 		MEDIUM_ERROR, 0x11, 0x04}, 	// Uncorrectable ECC error      Unrecovered read error
557 		/* BBD - block marked bad */
558 		{0x80, 		MEDIUM_ERROR, 0x11, 0x04}, 	// Block marked bad		  Medium error, unrecovered read error
559 		{0xFF, 0xFF, 0xFF, 0xFF}, // END mark
560 	};
561 	static const unsigned char stat_table[][4] = {
562 		/* Must be first because BUSY means no other bits valid */
563 		{0x80, 		ABORTED_COMMAND, 0x47, 0x00},	// Busy, fake parity for now
564 		{0x20, 		HARDWARE_ERROR,  0x00, 0x00}, 	// Device fault
565 		{0x08, 		ABORTED_COMMAND, 0x47, 0x00},	// Timed out in xfer, fake parity for now
566 		{0x04, 		RECOVERED_ERROR, 0x11, 0x00},	// Recovered ECC error	  Medium error, recovered
567 		{0xFF, 0xFF, 0xFF, 0xFF}, // END mark
568 	};
569 
570 	/*
571 	 *	Is this an error we can process/parse
572 	 */
573 	if (drv_stat & ATA_BUSY) {
574 		drv_err = 0;	/* Ignore the err bits, they're invalid */
575 	}
576 
577 	if (drv_err) {
578 		/* Look for drv_err */
579 		for (i = 0; sense_table[i][0] != 0xFF; i++) {
580 			/* Look for best matches first */
581 			if ((sense_table[i][0] & drv_err) ==
582 			    sense_table[i][0]) {
583 				*sk = sense_table[i][1];
584 				*asc = sense_table[i][2];
585 				*ascq = sense_table[i][3];
586 				goto translate_done;
587 			}
588 		}
589 		/* No immediate match */
590 		if (verbose)
591 			printk(KERN_WARNING "ata%u: no sense translation for "
592 			       "error 0x%02x\n", id, drv_err);
593 	}
594 
595 	/* Fall back to interpreting status bits */
596 	for (i = 0; stat_table[i][0] != 0xFF; i++) {
597 		if (stat_table[i][0] & drv_stat) {
598 			*sk = stat_table[i][1];
599 			*asc = stat_table[i][2];
600 			*ascq = stat_table[i][3];
601 			goto translate_done;
602 		}
603 	}
604 	/* No error?  Undecoded? */
605 	if (verbose)
606 		printk(KERN_WARNING "ata%u: no sense translation for "
607 		       "status: 0x%02x\n", id, drv_stat);
608 
609 	/* We need a sensible error return here, which is tricky, and one
610 	   that won't cause people to do things like return a disk wrongly */
611 	*sk = ABORTED_COMMAND;
612 	*asc = 0x00;
613 	*ascq = 0x00;
614 
615  translate_done:
616 	if (verbose)
617 		printk(KERN_ERR "ata%u: translated ATA stat/err 0x%02x/%02x "
618 		       "to SCSI SK/ASC/ASCQ 0x%x/%02x/%02x\n",
619 		       id, drv_stat, drv_err, *sk, *asc, *ascq);
620 	return;
621 }
622 
623 /*
624  *	ata_gen_passthru_sense - Generate check condition sense block.
625  *	@qc: Command that completed.
626  *
627  *	This function is specific to the ATA descriptor format sense
628  *	block specified for the ATA pass through commands.  Regardless
629  *	of whether the command errored or not, return a sense
630  *	block. Copy all controller registers into the sense
631  *	block. Clear sense key, ASC & ASCQ if there is no error.
632  *
633  *	LOCKING:
634  *	None.
635  */
636 static void ata_gen_passthru_sense(struct ata_queued_cmd *qc)
637 {
638 	struct scsi_cmnd *cmd = qc->scsicmd;
639 	struct ata_taskfile *tf = &qc->result_tf;
640 	unsigned char *sb = cmd->sense_buffer;
641 	unsigned char *desc = sb + 8;
642 	int verbose = qc->ap->ops->error_handler == NULL;
643 
644 	memset(sb, 0, SCSI_SENSE_BUFFERSIZE);
645 
646 	cmd->result = (DRIVER_SENSE << 24) | SAM_STAT_CHECK_CONDITION;
647 
648 	/*
649 	 * Use ata_to_sense_error() to map status register bits
650 	 * onto sense key, asc & ascq.
651 	 */
652 	if (qc->err_mask ||
653 	    tf->command & (ATA_BUSY | ATA_DF | ATA_ERR | ATA_DRQ)) {
654 		ata_to_sense_error(qc->ap->print_id, tf->command, tf->feature,
655 				   &sb[1], &sb[2], &sb[3], verbose);
656 		sb[1] &= 0x0f;
657 	}
658 
659 	/*
660 	 * Sense data is current and format is descriptor.
661 	 */
662 	sb[0] = 0x72;
663 
664 	desc[0] = 0x09;
665 
666 	/* set length of additional sense data */
667 	sb[7] = 14;
668 	desc[1] = 12;
669 
670 	/*
671 	 * Copy registers into sense buffer.
672 	 */
673 	desc[2] = 0x00;
674 	desc[3] = tf->feature;	/* == error reg */
675 	desc[5] = tf->nsect;
676 	desc[7] = tf->lbal;
677 	desc[9] = tf->lbam;
678 	desc[11] = tf->lbah;
679 	desc[12] = tf->device;
680 	desc[13] = tf->command; /* == status reg */
681 
682 	/*
683 	 * Fill in Extend bit, and the high order bytes
684 	 * if applicable.
685 	 */
686 	if (tf->flags & ATA_TFLAG_LBA48) {
687 		desc[2] |= 0x01;
688 		desc[4] = tf->hob_nsect;
689 		desc[6] = tf->hob_lbal;
690 		desc[8] = tf->hob_lbam;
691 		desc[10] = tf->hob_lbah;
692 	}
693 }
694 
695 /**
696  *	ata_gen_ata_sense - generate a SCSI fixed sense block
697  *	@qc: Command that we are erroring out
698  *
699  *	Generate sense block for a failed ATA command @qc.  Descriptor
700  *	format is used to accomodate LBA48 block address.
701  *
702  *	LOCKING:
703  *	None.
704  */
705 static void ata_gen_ata_sense(struct ata_queued_cmd *qc)
706 {
707 	struct ata_device *dev = qc->dev;
708 	struct scsi_cmnd *cmd = qc->scsicmd;
709 	struct ata_taskfile *tf = &qc->result_tf;
710 	unsigned char *sb = cmd->sense_buffer;
711 	unsigned char *desc = sb + 8;
712 	int verbose = qc->ap->ops->error_handler == NULL;
713 	u64 block;
714 
715 	memset(sb, 0, SCSI_SENSE_BUFFERSIZE);
716 
717 	cmd->result = (DRIVER_SENSE << 24) | SAM_STAT_CHECK_CONDITION;
718 
719 	/* sense data is current and format is descriptor */
720 	sb[0] = 0x72;
721 
722 	/* Use ata_to_sense_error() to map status register bits
723 	 * onto sense key, asc & ascq.
724 	 */
725 	if (qc->err_mask ||
726 	    tf->command & (ATA_BUSY | ATA_DF | ATA_ERR | ATA_DRQ)) {
727 		ata_to_sense_error(qc->ap->print_id, tf->command, tf->feature,
728 				   &sb[1], &sb[2], &sb[3], verbose);
729 		sb[1] &= 0x0f;
730 	}
731 
732 	block = ata_tf_read_block(&qc->result_tf, dev);
733 
734 	/* information sense data descriptor */
735 	sb[7] = 12;
736 	desc[0] = 0x00;
737 	desc[1] = 10;
738 
739 	desc[2] |= 0x80;	/* valid */
740 	desc[6] = block >> 40;
741 	desc[7] = block >> 32;
742 	desc[8] = block >> 24;
743 	desc[9] = block >> 16;
744 	desc[10] = block >> 8;
745 	desc[11] = block;
746 }
747 
748 static void ata_scsi_sdev_config(struct scsi_device *sdev)
749 {
750 	sdev->use_10_for_rw = 1;
751 	sdev->use_10_for_ms = 1;
752 
753 	/* Schedule policy is determined by ->qc_defer() callback and
754 	 * it needs to see every deferred qc.  Set dev_blocked to 1 to
755 	 * prevent SCSI midlayer from automatically deferring
756 	 * requests.
757 	 */
758 	sdev->max_device_blocked = 1;
759 }
760 
761 static void ata_scsi_dev_config(struct scsi_device *sdev,
762 				struct ata_device *dev)
763 {
764 	/* configure max sectors */
765 	blk_queue_max_sectors(sdev->request_queue, dev->max_sectors);
766 
767 	/* SATA DMA transfers must be multiples of 4 byte, so
768 	 * we need to pad ATAPI transfers using an extra sg.
769 	 * Decrement max hw segments accordingly.
770 	 */
771 	if (dev->class == ATA_DEV_ATAPI) {
772 		struct request_queue *q = sdev->request_queue;
773 		blk_queue_max_hw_segments(q, q->max_hw_segments - 1);
774 	}
775 
776 	if (dev->flags & ATA_DFLAG_NCQ) {
777 		int depth;
778 
779 		depth = min(sdev->host->can_queue, ata_id_queue_depth(dev->id));
780 		depth = min(ATA_MAX_QUEUE - 1, depth);
781 		scsi_adjust_queue_depth(sdev, MSG_SIMPLE_TAG, depth);
782 	}
783 }
784 
785 /**
786  *	ata_scsi_slave_config - Set SCSI device attributes
787  *	@sdev: SCSI device to examine
788  *
789  *	This is called before we actually start reading
790  *	and writing to the device, to configure certain
791  *	SCSI mid-layer behaviors.
792  *
793  *	LOCKING:
794  *	Defined by SCSI layer.  We don't really care.
795  */
796 
797 int ata_scsi_slave_config(struct scsi_device *sdev)
798 {
799 	struct ata_port *ap = ata_shost_to_port(sdev->host);
800 	struct ata_device *dev = __ata_scsi_find_dev(ap, sdev);
801 
802 	ata_scsi_sdev_config(sdev);
803 
804 	blk_queue_max_phys_segments(sdev->request_queue, LIBATA_MAX_PRD);
805 
806 	sdev->manage_start_stop = 1;
807 
808 	if (dev)
809 		ata_scsi_dev_config(sdev, dev);
810 
811 	return 0;	/* scsi layer doesn't check return value, sigh */
812 }
813 
814 /**
815  *	ata_scsi_slave_destroy - SCSI device is about to be destroyed
816  *	@sdev: SCSI device to be destroyed
817  *
818  *	@sdev is about to be destroyed for hot/warm unplugging.  If
819  *	this unplugging was initiated by libata as indicated by NULL
820  *	dev->sdev, this function doesn't have to do anything.
821  *	Otherwise, SCSI layer initiated warm-unplug is in progress.
822  *	Clear dev->sdev, schedule the device for ATA detach and invoke
823  *	EH.
824  *
825  *	LOCKING:
826  *	Defined by SCSI layer.  We don't really care.
827  */
828 void ata_scsi_slave_destroy(struct scsi_device *sdev)
829 {
830 	struct ata_port *ap = ata_shost_to_port(sdev->host);
831 	unsigned long flags;
832 	struct ata_device *dev;
833 
834 	if (!ap->ops->error_handler)
835 		return;
836 
837 	spin_lock_irqsave(ap->lock, flags);
838 	dev = __ata_scsi_find_dev(ap, sdev);
839 	if (dev && dev->sdev) {
840 		/* SCSI device already in CANCEL state, no need to offline it */
841 		dev->sdev = NULL;
842 		dev->flags |= ATA_DFLAG_DETACH;
843 		ata_port_schedule_eh(ap);
844 	}
845 	spin_unlock_irqrestore(ap->lock, flags);
846 }
847 
848 /**
849  *	ata_scsi_change_queue_depth - SCSI callback for queue depth config
850  *	@sdev: SCSI device to configure queue depth for
851  *	@queue_depth: new queue depth
852  *
853  *	This is libata standard hostt->change_queue_depth callback.
854  *	SCSI will call into this callback when user tries to set queue
855  *	depth via sysfs.
856  *
857  *	LOCKING:
858  *	SCSI layer (we don't care)
859  *
860  *	RETURNS:
861  *	Newly configured queue depth.
862  */
863 int ata_scsi_change_queue_depth(struct scsi_device *sdev, int queue_depth)
864 {
865 	struct ata_port *ap = ata_shost_to_port(sdev->host);
866 	struct ata_device *dev;
867 	unsigned long flags;
868 
869 	if (queue_depth < 1 || queue_depth == sdev->queue_depth)
870 		return sdev->queue_depth;
871 
872 	dev = ata_scsi_find_dev(ap, sdev);
873 	if (!dev || !ata_dev_enabled(dev))
874 		return sdev->queue_depth;
875 
876 	/* NCQ enabled? */
877 	spin_lock_irqsave(ap->lock, flags);
878 	dev->flags &= ~ATA_DFLAG_NCQ_OFF;
879 	if (queue_depth == 1 || !ata_ncq_enabled(dev)) {
880 		dev->flags |= ATA_DFLAG_NCQ_OFF;
881 		queue_depth = 1;
882 	}
883 	spin_unlock_irqrestore(ap->lock, flags);
884 
885 	/* limit and apply queue depth */
886 	queue_depth = min(queue_depth, sdev->host->can_queue);
887 	queue_depth = min(queue_depth, ata_id_queue_depth(dev->id));
888 	queue_depth = min(queue_depth, ATA_MAX_QUEUE - 1);
889 
890 	if (sdev->queue_depth == queue_depth)
891 		return -EINVAL;
892 
893 	scsi_adjust_queue_depth(sdev, MSG_SIMPLE_TAG, queue_depth);
894 	return queue_depth;
895 }
896 
897 /* XXX: for spindown warning */
898 static void ata_delayed_done_timerfn(unsigned long arg)
899 {
900 	struct scsi_cmnd *scmd = (void *)arg;
901 
902 	scmd->scsi_done(scmd);
903 }
904 
905 /* XXX: for spindown warning */
906 static void ata_delayed_done(struct scsi_cmnd *scmd)
907 {
908 	static struct timer_list timer;
909 
910 	setup_timer(&timer, ata_delayed_done_timerfn, (unsigned long)scmd);
911 	mod_timer(&timer, jiffies + 5 * HZ);
912 }
913 
914 /**
915  *	ata_scsi_start_stop_xlat - Translate SCSI START STOP UNIT command
916  *	@qc: Storage for translated ATA taskfile
917  *
918  *	Sets up an ATA taskfile to issue STANDBY (to stop) or READ VERIFY
919  *	(to start). Perhaps these commands should be preceded by
920  *	CHECK POWER MODE to see what power mode the device is already in.
921  *	[See SAT revision 5 at www.t10.org]
922  *
923  *	LOCKING:
924  *	spin_lock_irqsave(host lock)
925  *
926  *	RETURNS:
927  *	Zero on success, non-zero on error.
928  */
929 static unsigned int ata_scsi_start_stop_xlat(struct ata_queued_cmd *qc)
930 {
931 	struct scsi_cmnd *scmd = qc->scsicmd;
932 	struct ata_taskfile *tf = &qc->tf;
933 	const u8 *cdb = scmd->cmnd;
934 
935 	if (scmd->cmd_len < 5)
936 		goto invalid_fld;
937 
938 	tf->flags |= ATA_TFLAG_DEVICE | ATA_TFLAG_ISADDR;
939 	tf->protocol = ATA_PROT_NODATA;
940 	if (cdb[1] & 0x1) {
941 		;	/* ignore IMMED bit, violates sat-r05 */
942 	}
943 	if (cdb[4] & 0x2)
944 		goto invalid_fld;       /* LOEJ bit set not supported */
945 	if (((cdb[4] >> 4) & 0xf) != 0)
946 		goto invalid_fld;       /* power conditions not supported */
947 
948 	if (qc->dev->horkage & ATA_HORKAGE_SKIP_PM) {
949 		/* the device lacks PM support, finish without doing anything */
950 		scmd->result = SAM_STAT_GOOD;
951 		return 1;
952 	}
953 
954 	if (cdb[4] & 0x1) {
955 		tf->nsect = 1;	/* 1 sector, lba=0 */
956 
957 		if (qc->dev->flags & ATA_DFLAG_LBA) {
958 			tf->flags |= ATA_TFLAG_LBA;
959 
960 			tf->lbah = 0x0;
961 			tf->lbam = 0x0;
962 			tf->lbal = 0x0;
963 			tf->device |= ATA_LBA;
964 		} else {
965 			/* CHS */
966 			tf->lbal = 0x1; /* sect */
967 			tf->lbam = 0x0; /* cyl low */
968 			tf->lbah = 0x0; /* cyl high */
969 		}
970 
971 		tf->command = ATA_CMD_VERIFY;	/* READ VERIFY */
972 	} else {
973 		/* XXX: This is for backward compatibility, will be
974 		 * removed.  Read Documentation/feature-removal-schedule.txt
975 		 * for more info.
976 		 */
977 		if ((qc->dev->flags & ATA_DFLAG_SPUNDOWN) &&
978 		    (system_state == SYSTEM_HALT ||
979 		     system_state == SYSTEM_POWER_OFF)) {
980 			static unsigned long warned = 0;
981 
982 			if (!test_and_set_bit(0, &warned)) {
983 				ata_dev_printk(qc->dev, KERN_WARNING,
984 					"DISK MIGHT NOT BE SPUN DOWN PROPERLY. "
985 					"UPDATE SHUTDOWN UTILITY\n");
986 				ata_dev_printk(qc->dev, KERN_WARNING,
987 					"For more info, visit "
988 					"http://linux-ata.org/shutdown.html\n");
989 
990 				/* ->scsi_done is not used, use it for
991 				 * delayed completion.
992 				 */
993 				scmd->scsi_done = qc->scsidone;
994 				qc->scsidone = ata_delayed_done;
995 			}
996 			scmd->result = SAM_STAT_GOOD;
997 			return 1;
998 		}
999 
1000 		/* Issue ATA STANDBY IMMEDIATE command */
1001 		tf->command = ATA_CMD_STANDBYNOW1;
1002 	}
1003 
1004 	/*
1005 	 * Standby and Idle condition timers could be implemented but that
1006 	 * would require libata to implement the Power condition mode page
1007 	 * and allow the user to change it. Changing mode pages requires
1008 	 * MODE SELECT to be implemented.
1009 	 */
1010 
1011 	return 0;
1012 
1013 invalid_fld:
1014 	ata_scsi_set_sense(scmd, ILLEGAL_REQUEST, 0x24, 0x0);
1015 	/* "Invalid field in cbd" */
1016 	return 1;
1017 }
1018 
1019 
1020 /**
1021  *	ata_scsi_flush_xlat - Translate SCSI SYNCHRONIZE CACHE command
1022  *	@qc: Storage for translated ATA taskfile
1023  *
1024  *	Sets up an ATA taskfile to issue FLUSH CACHE or
1025  *	FLUSH CACHE EXT.
1026  *
1027  *	LOCKING:
1028  *	spin_lock_irqsave(host lock)
1029  *
1030  *	RETURNS:
1031  *	Zero on success, non-zero on error.
1032  */
1033 static unsigned int ata_scsi_flush_xlat(struct ata_queued_cmd *qc)
1034 {
1035 	struct ata_taskfile *tf = &qc->tf;
1036 
1037 	tf->flags |= ATA_TFLAG_DEVICE;
1038 	tf->protocol = ATA_PROT_NODATA;
1039 
1040 	if (qc->dev->flags & ATA_DFLAG_FLUSH_EXT)
1041 		tf->command = ATA_CMD_FLUSH_EXT;
1042 	else
1043 		tf->command = ATA_CMD_FLUSH;
1044 
1045 	return 0;
1046 }
1047 
1048 /**
1049  *	scsi_6_lba_len - Get LBA and transfer length
1050  *	@cdb: SCSI command to translate
1051  *
1052  *	Calculate LBA and transfer length for 6-byte commands.
1053  *
1054  *	RETURNS:
1055  *	@plba: the LBA
1056  *	@plen: the transfer length
1057  */
1058 static void scsi_6_lba_len(const u8 *cdb, u64 *plba, u32 *plen)
1059 {
1060 	u64 lba = 0;
1061 	u32 len;
1062 
1063 	VPRINTK("six-byte command\n");
1064 
1065 	lba |= ((u64)(cdb[1] & 0x1f)) << 16;
1066 	lba |= ((u64)cdb[2]) << 8;
1067 	lba |= ((u64)cdb[3]);
1068 
1069 	len = cdb[4];
1070 
1071 	*plba = lba;
1072 	*plen = len;
1073 }
1074 
1075 /**
1076  *	scsi_10_lba_len - Get LBA and transfer length
1077  *	@cdb: SCSI command to translate
1078  *
1079  *	Calculate LBA and transfer length for 10-byte commands.
1080  *
1081  *	RETURNS:
1082  *	@plba: the LBA
1083  *	@plen: the transfer length
1084  */
1085 static void scsi_10_lba_len(const u8 *cdb, u64 *plba, u32 *plen)
1086 {
1087 	u64 lba = 0;
1088 	u32 len = 0;
1089 
1090 	VPRINTK("ten-byte command\n");
1091 
1092 	lba |= ((u64)cdb[2]) << 24;
1093 	lba |= ((u64)cdb[3]) << 16;
1094 	lba |= ((u64)cdb[4]) << 8;
1095 	lba |= ((u64)cdb[5]);
1096 
1097 	len |= ((u32)cdb[7]) << 8;
1098 	len |= ((u32)cdb[8]);
1099 
1100 	*plba = lba;
1101 	*plen = len;
1102 }
1103 
1104 /**
1105  *	scsi_16_lba_len - Get LBA and transfer length
1106  *	@cdb: SCSI command to translate
1107  *
1108  *	Calculate LBA and transfer length for 16-byte commands.
1109  *
1110  *	RETURNS:
1111  *	@plba: the LBA
1112  *	@plen: the transfer length
1113  */
1114 static void scsi_16_lba_len(const u8 *cdb, u64 *plba, u32 *plen)
1115 {
1116 	u64 lba = 0;
1117 	u32 len = 0;
1118 
1119 	VPRINTK("sixteen-byte command\n");
1120 
1121 	lba |= ((u64)cdb[2]) << 56;
1122 	lba |= ((u64)cdb[3]) << 48;
1123 	lba |= ((u64)cdb[4]) << 40;
1124 	lba |= ((u64)cdb[5]) << 32;
1125 	lba |= ((u64)cdb[6]) << 24;
1126 	lba |= ((u64)cdb[7]) << 16;
1127 	lba |= ((u64)cdb[8]) << 8;
1128 	lba |= ((u64)cdb[9]);
1129 
1130 	len |= ((u32)cdb[10]) << 24;
1131 	len |= ((u32)cdb[11]) << 16;
1132 	len |= ((u32)cdb[12]) << 8;
1133 	len |= ((u32)cdb[13]);
1134 
1135 	*plba = lba;
1136 	*plen = len;
1137 }
1138 
1139 /**
1140  *	ata_scsi_verify_xlat - Translate SCSI VERIFY command into an ATA one
1141  *	@qc: Storage for translated ATA taskfile
1142  *
1143  *	Converts SCSI VERIFY command to an ATA READ VERIFY command.
1144  *
1145  *	LOCKING:
1146  *	spin_lock_irqsave(host lock)
1147  *
1148  *	RETURNS:
1149  *	Zero on success, non-zero on error.
1150  */
1151 static unsigned int ata_scsi_verify_xlat(struct ata_queued_cmd *qc)
1152 {
1153 	struct scsi_cmnd *scmd = qc->scsicmd;
1154 	struct ata_taskfile *tf = &qc->tf;
1155 	struct ata_device *dev = qc->dev;
1156 	u64 dev_sectors = qc->dev->n_sectors;
1157 	const u8 *cdb = scmd->cmnd;
1158 	u64 block;
1159 	u32 n_block;
1160 
1161 	tf->flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
1162 	tf->protocol = ATA_PROT_NODATA;
1163 
1164 	if (cdb[0] == VERIFY) {
1165 		if (scmd->cmd_len < 10)
1166 			goto invalid_fld;
1167 		scsi_10_lba_len(cdb, &block, &n_block);
1168 	} else if (cdb[0] == VERIFY_16) {
1169 		if (scmd->cmd_len < 16)
1170 			goto invalid_fld;
1171 		scsi_16_lba_len(cdb, &block, &n_block);
1172 	} else
1173 		goto invalid_fld;
1174 
1175 	if (!n_block)
1176 		goto nothing_to_do;
1177 	if (block >= dev_sectors)
1178 		goto out_of_range;
1179 	if ((block + n_block) > dev_sectors)
1180 		goto out_of_range;
1181 
1182 	if (dev->flags & ATA_DFLAG_LBA) {
1183 		tf->flags |= ATA_TFLAG_LBA;
1184 
1185 		if (lba_28_ok(block, n_block)) {
1186 			/* use LBA28 */
1187 			tf->command = ATA_CMD_VERIFY;
1188 			tf->device |= (block >> 24) & 0xf;
1189 		} else if (lba_48_ok(block, n_block)) {
1190 			if (!(dev->flags & ATA_DFLAG_LBA48))
1191 				goto out_of_range;
1192 
1193 			/* use LBA48 */
1194 			tf->flags |= ATA_TFLAG_LBA48;
1195 			tf->command = ATA_CMD_VERIFY_EXT;
1196 
1197 			tf->hob_nsect = (n_block >> 8) & 0xff;
1198 
1199 			tf->hob_lbah = (block >> 40) & 0xff;
1200 			tf->hob_lbam = (block >> 32) & 0xff;
1201 			tf->hob_lbal = (block >> 24) & 0xff;
1202 		} else
1203 			/* request too large even for LBA48 */
1204 			goto out_of_range;
1205 
1206 		tf->nsect = n_block & 0xff;
1207 
1208 		tf->lbah = (block >> 16) & 0xff;
1209 		tf->lbam = (block >> 8) & 0xff;
1210 		tf->lbal = block & 0xff;
1211 
1212 		tf->device |= ATA_LBA;
1213 	} else {
1214 		/* CHS */
1215 		u32 sect, head, cyl, track;
1216 
1217 		if (!lba_28_ok(block, n_block))
1218 			goto out_of_range;
1219 
1220 		/* Convert LBA to CHS */
1221 		track = (u32)block / dev->sectors;
1222 		cyl   = track / dev->heads;
1223 		head  = track % dev->heads;
1224 		sect  = (u32)block % dev->sectors + 1;
1225 
1226 		DPRINTK("block %u track %u cyl %u head %u sect %u\n",
1227 			(u32)block, track, cyl, head, sect);
1228 
1229 		/* Check whether the converted CHS can fit.
1230 		   Cylinder: 0-65535
1231 		   Head: 0-15
1232 		   Sector: 1-255*/
1233 		if ((cyl >> 16) || (head >> 4) || (sect >> 8) || (!sect))
1234 			goto out_of_range;
1235 
1236 		tf->command = ATA_CMD_VERIFY;
1237 		tf->nsect = n_block & 0xff; /* Sector count 0 means 256 sectors */
1238 		tf->lbal = sect;
1239 		tf->lbam = cyl;
1240 		tf->lbah = cyl >> 8;
1241 		tf->device |= head;
1242 	}
1243 
1244 	return 0;
1245 
1246 invalid_fld:
1247 	ata_scsi_set_sense(scmd, ILLEGAL_REQUEST, 0x24, 0x0);
1248 	/* "Invalid field in cbd" */
1249 	return 1;
1250 
1251 out_of_range:
1252 	ata_scsi_set_sense(scmd, ILLEGAL_REQUEST, 0x21, 0x0);
1253 	/* "Logical Block Address out of range" */
1254 	return 1;
1255 
1256 nothing_to_do:
1257 	scmd->result = SAM_STAT_GOOD;
1258 	return 1;
1259 }
1260 
1261 /**
1262  *	ata_scsi_rw_xlat - Translate SCSI r/w command into an ATA one
1263  *	@qc: Storage for translated ATA taskfile
1264  *
1265  *	Converts any of six SCSI read/write commands into the
1266  *	ATA counterpart, including starting sector (LBA),
1267  *	sector count, and taking into account the device's LBA48
1268  *	support.
1269  *
1270  *	Commands %READ_6, %READ_10, %READ_16, %WRITE_6, %WRITE_10, and
1271  *	%WRITE_16 are currently supported.
1272  *
1273  *	LOCKING:
1274  *	spin_lock_irqsave(host lock)
1275  *
1276  *	RETURNS:
1277  *	Zero on success, non-zero on error.
1278  */
1279 static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
1280 {
1281 	struct scsi_cmnd *scmd = qc->scsicmd;
1282 	const u8 *cdb = scmd->cmnd;
1283 	unsigned int tf_flags = 0;
1284 	u64 block;
1285 	u32 n_block;
1286 	int rc;
1287 
1288 	if (cdb[0] == WRITE_10 || cdb[0] == WRITE_6 || cdb[0] == WRITE_16)
1289 		tf_flags |= ATA_TFLAG_WRITE;
1290 
1291 	/* Calculate the SCSI LBA, transfer length and FUA. */
1292 	switch (cdb[0]) {
1293 	case READ_10:
1294 	case WRITE_10:
1295 		if (unlikely(scmd->cmd_len < 10))
1296 			goto invalid_fld;
1297 		scsi_10_lba_len(cdb, &block, &n_block);
1298 		if (unlikely(cdb[1] & (1 << 3)))
1299 			tf_flags |= ATA_TFLAG_FUA;
1300 		break;
1301 	case READ_6:
1302 	case WRITE_6:
1303 		if (unlikely(scmd->cmd_len < 6))
1304 			goto invalid_fld;
1305 		scsi_6_lba_len(cdb, &block, &n_block);
1306 
1307 		/* for 6-byte r/w commands, transfer length 0
1308 		 * means 256 blocks of data, not 0 block.
1309 		 */
1310 		if (!n_block)
1311 			n_block = 256;
1312 		break;
1313 	case READ_16:
1314 	case WRITE_16:
1315 		if (unlikely(scmd->cmd_len < 16))
1316 			goto invalid_fld;
1317 		scsi_16_lba_len(cdb, &block, &n_block);
1318 		if (unlikely(cdb[1] & (1 << 3)))
1319 			tf_flags |= ATA_TFLAG_FUA;
1320 		break;
1321 	default:
1322 		DPRINTK("no-byte command\n");
1323 		goto invalid_fld;
1324 	}
1325 
1326 	/* Check and compose ATA command */
1327 	if (!n_block)
1328 		/* For 10-byte and 16-byte SCSI R/W commands, transfer
1329 		 * length 0 means transfer 0 block of data.
1330 		 * However, for ATA R/W commands, sector count 0 means
1331 		 * 256 or 65536 sectors, not 0 sectors as in SCSI.
1332 		 *
1333 		 * WARNING: one or two older ATA drives treat 0 as 0...
1334 		 */
1335 		goto nothing_to_do;
1336 
1337 	qc->flags |= ATA_QCFLAG_IO;
1338 	qc->nbytes = n_block * ATA_SECT_SIZE;
1339 
1340 	rc = ata_build_rw_tf(&qc->tf, qc->dev, block, n_block, tf_flags,
1341 			     qc->tag);
1342 	if (likely(rc == 0))
1343 		return 0;
1344 
1345 	if (rc == -ERANGE)
1346 		goto out_of_range;
1347 	/* treat all other errors as -EINVAL, fall through */
1348 invalid_fld:
1349 	ata_scsi_set_sense(scmd, ILLEGAL_REQUEST, 0x24, 0x0);
1350 	/* "Invalid field in cbd" */
1351 	return 1;
1352 
1353 out_of_range:
1354 	ata_scsi_set_sense(scmd, ILLEGAL_REQUEST, 0x21, 0x0);
1355 	/* "Logical Block Address out of range" */
1356 	return 1;
1357 
1358 nothing_to_do:
1359 	scmd->result = SAM_STAT_GOOD;
1360 	return 1;
1361 }
1362 
1363 static void ata_scsi_qc_complete(struct ata_queued_cmd *qc)
1364 {
1365 	struct ata_port *ap = qc->ap;
1366 	struct ata_eh_info *ehi = &qc->dev->link->eh_info;
1367 	struct scsi_cmnd *cmd = qc->scsicmd;
1368 	u8 *cdb = cmd->cmnd;
1369  	int need_sense = (qc->err_mask != 0);
1370 
1371 	/* We snoop the SET_FEATURES - Write Cache ON/OFF command, and
1372 	 * schedule EH_REVALIDATE operation to update the IDENTIFY DEVICE
1373 	 * cache
1374 	 */
1375 	if (ap->ops->error_handler && !need_sense) {
1376 		switch (qc->tf.command) {
1377 		case ATA_CMD_SET_FEATURES:
1378 			if ((qc->tf.feature == SETFEATURES_WC_ON) ||
1379 			    (qc->tf.feature == SETFEATURES_WC_OFF)) {
1380 				ehi->action |= ATA_EH_REVALIDATE;
1381 				ata_port_schedule_eh(ap);
1382 			}
1383 			break;
1384 
1385 		case ATA_CMD_INIT_DEV_PARAMS: /* CHS translation changed */
1386 		case ATA_CMD_SET_MULTI: /* multi_count changed */
1387 			ehi->action |= ATA_EH_REVALIDATE;
1388 			ata_port_schedule_eh(ap);
1389 			break;
1390 		}
1391 	}
1392 
1393 	/* For ATA pass thru (SAT) commands, generate a sense block if
1394 	 * user mandated it or if there's an error.  Note that if we
1395 	 * generate because the user forced us to, a check condition
1396 	 * is generated and the ATA register values are returned
1397 	 * whether the command completed successfully or not. If there
1398 	 * was no error, SK, ASC and ASCQ will all be zero.
1399 	 */
1400 	if (((cdb[0] == ATA_16) || (cdb[0] == ATA_12)) &&
1401  	    ((cdb[2] & 0x20) || need_sense)) {
1402 		ata_gen_passthru_sense(qc);
1403 	} else {
1404 		if (!need_sense) {
1405 			cmd->result = SAM_STAT_GOOD;
1406 		} else {
1407 			/* TODO: decide which descriptor format to use
1408 			 * for 48b LBA devices and call that here
1409 			 * instead of the fixed desc, which is only
1410 			 * good for smaller LBA (and maybe CHS?)
1411 			 * devices.
1412 			 */
1413 			ata_gen_ata_sense(qc);
1414 		}
1415 	}
1416 
1417 	/* XXX: track spindown state for spindown skipping and warning */
1418 	if (unlikely(qc->tf.command == ATA_CMD_STANDBY ||
1419 		     qc->tf.command == ATA_CMD_STANDBYNOW1))
1420 		qc->dev->flags |= ATA_DFLAG_SPUNDOWN;
1421 	else if (likely(system_state != SYSTEM_HALT &&
1422 			system_state != SYSTEM_POWER_OFF))
1423 		qc->dev->flags &= ~ATA_DFLAG_SPUNDOWN;
1424 
1425 	if (need_sense && !ap->ops->error_handler)
1426 		ata_dump_status(ap->print_id, &qc->result_tf);
1427 
1428 	qc->scsidone(cmd);
1429 
1430 	ata_qc_free(qc);
1431 }
1432 
1433 /**
1434  *	ata_scsi_translate - Translate then issue SCSI command to ATA device
1435  *	@dev: ATA device to which the command is addressed
1436  *	@cmd: SCSI command to execute
1437  *	@done: SCSI command completion function
1438  *	@xlat_func: Actor which translates @cmd to an ATA taskfile
1439  *
1440  *	Our ->queuecommand() function has decided that the SCSI
1441  *	command issued can be directly translated into an ATA
1442  *	command, rather than handled internally.
1443  *
1444  *	This function sets up an ata_queued_cmd structure for the
1445  *	SCSI command, and sends that ata_queued_cmd to the hardware.
1446  *
1447  *	The xlat_func argument (actor) returns 0 if ready to execute
1448  *	ATA command, else 1 to finish translation. If 1 is returned
1449  *	then cmd->result (and possibly cmd->sense_buffer) are assumed
1450  *	to be set reflecting an error condition or clean (early)
1451  *	termination.
1452  *
1453  *	LOCKING:
1454  *	spin_lock_irqsave(host lock)
1455  *
1456  *	RETURNS:
1457  *	0 on success, SCSI_ML_QUEUE_DEVICE_BUSY if the command
1458  *	needs to be deferred.
1459  */
1460 static int ata_scsi_translate(struct ata_device *dev, struct scsi_cmnd *cmd,
1461 			      void (*done)(struct scsi_cmnd *),
1462 			      ata_xlat_func_t xlat_func)
1463 {
1464 	struct ata_port *ap = dev->link->ap;
1465 	struct ata_queued_cmd *qc;
1466 	int rc;
1467 
1468 	VPRINTK("ENTER\n");
1469 
1470 	qc = ata_scsi_qc_new(dev, cmd, done);
1471 	if (!qc)
1472 		goto err_mem;
1473 
1474 	/* data is present; dma-map it */
1475 	if (cmd->sc_data_direction == DMA_FROM_DEVICE ||
1476 	    cmd->sc_data_direction == DMA_TO_DEVICE) {
1477 		if (unlikely(scsi_bufflen(cmd) < 1)) {
1478 			ata_dev_printk(dev, KERN_WARNING,
1479 				       "WARNING: zero len r/w req\n");
1480 			goto err_did;
1481 		}
1482 
1483 		ata_sg_init(qc, scsi_sglist(cmd), scsi_sg_count(cmd));
1484 
1485 		qc->dma_dir = cmd->sc_data_direction;
1486 	}
1487 
1488 	qc->complete_fn = ata_scsi_qc_complete;
1489 
1490 	if (xlat_func(qc))
1491 		goto early_finish;
1492 
1493 	if (ap->ops->qc_defer) {
1494 		if ((rc = ap->ops->qc_defer(qc)))
1495 			goto defer;
1496 	}
1497 
1498 	/* select device, send command to hardware */
1499 	ata_qc_issue(qc);
1500 
1501 	VPRINTK("EXIT\n");
1502 	return 0;
1503 
1504 early_finish:
1505         ata_qc_free(qc);
1506 	qc->scsidone(cmd);
1507 	DPRINTK("EXIT - early finish (good or error)\n");
1508 	return 0;
1509 
1510 err_did:
1511 	ata_qc_free(qc);
1512 	cmd->result = (DID_ERROR << 16);
1513 	qc->scsidone(cmd);
1514 err_mem:
1515 	DPRINTK("EXIT - internal\n");
1516 	return 0;
1517 
1518 defer:
1519 	ata_qc_free(qc);
1520 	DPRINTK("EXIT - defer\n");
1521 	if (rc == ATA_DEFER_LINK)
1522 		return SCSI_MLQUEUE_DEVICE_BUSY;
1523 	else
1524 		return SCSI_MLQUEUE_HOST_BUSY;
1525 }
1526 
1527 /**
1528  *	ata_scsi_rbuf_get - Map response buffer.
1529  *	@cmd: SCSI command containing buffer to be mapped.
1530  *	@buf_out: Pointer to mapped area.
1531  *
1532  *	Maps buffer contained within SCSI command @cmd.
1533  *
1534  *	LOCKING:
1535  *	spin_lock_irqsave(host lock)
1536  *
1537  *	RETURNS:
1538  *	Length of response buffer.
1539  */
1540 
1541 static unsigned int ata_scsi_rbuf_get(struct scsi_cmnd *cmd, u8 **buf_out)
1542 {
1543 	u8 *buf;
1544 	unsigned int buflen;
1545 
1546 	struct scatterlist *sg = scsi_sglist(cmd);
1547 
1548 	if (sg) {
1549 		buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
1550 		buflen = sg->length;
1551 	} else {
1552 		buf = NULL;
1553 		buflen = 0;
1554 	}
1555 
1556 	*buf_out = buf;
1557 	return buflen;
1558 }
1559 
1560 /**
1561  *	ata_scsi_rbuf_put - Unmap response buffer.
1562  *	@cmd: SCSI command containing buffer to be unmapped.
1563  *	@buf: buffer to unmap
1564  *
1565  *	Unmaps response buffer contained within @cmd.
1566  *
1567  *	LOCKING:
1568  *	spin_lock_irqsave(host lock)
1569  */
1570 
1571 static inline void ata_scsi_rbuf_put(struct scsi_cmnd *cmd, u8 *buf)
1572 {
1573 	struct scatterlist *sg = scsi_sglist(cmd);
1574 	if (sg)
1575 		kunmap_atomic(buf - sg->offset, KM_IRQ0);
1576 }
1577 
1578 /**
1579  *	ata_scsi_rbuf_fill - wrapper for SCSI command simulators
1580  *	@args: device IDENTIFY data / SCSI command of interest.
1581  *	@actor: Callback hook for desired SCSI command simulator
1582  *
1583  *	Takes care of the hard work of simulating a SCSI command...
1584  *	Mapping the response buffer, calling the command's handler,
1585  *	and handling the handler's return value.  This return value
1586  *	indicates whether the handler wishes the SCSI command to be
1587  *	completed successfully (0), or not (in which case cmd->result
1588  *	and sense buffer are assumed to be set).
1589  *
1590  *	LOCKING:
1591  *	spin_lock_irqsave(host lock)
1592  */
1593 
1594 void ata_scsi_rbuf_fill(struct ata_scsi_args *args,
1595 		        unsigned int (*actor) (struct ata_scsi_args *args,
1596 			     		   u8 *rbuf, unsigned int buflen))
1597 {
1598 	u8 *rbuf;
1599 	unsigned int buflen, rc;
1600 	struct scsi_cmnd *cmd = args->cmd;
1601 
1602 	buflen = ata_scsi_rbuf_get(cmd, &rbuf);
1603 	memset(rbuf, 0, buflen);
1604 	rc = actor(args, rbuf, buflen);
1605 	ata_scsi_rbuf_put(cmd, rbuf);
1606 
1607 	if (rc == 0)
1608 		cmd->result = SAM_STAT_GOOD;
1609 	args->done(cmd);
1610 }
1611 
1612 /**
1613  *	ATA_SCSI_RBUF_SET - helper to set values in SCSI response buffer
1614  *	@idx: byte index into SCSI response buffer
1615  *	@val: value to set
1616  *
1617  *	To be used by SCSI command simulator functions.  This macros
1618  *	expects two local variables, u8 *rbuf and unsigned int buflen,
1619  *	are in scope.
1620  *
1621  *	LOCKING:
1622  *	None.
1623  */
1624 #define ATA_SCSI_RBUF_SET(idx, val) do { \
1625 		if ((idx) < buflen) rbuf[(idx)] = (u8)(val); \
1626 	} while (0)
1627 
1628 /**
1629  *	ata_scsiop_inq_std - Simulate INQUIRY command
1630  *	@args: device IDENTIFY data / SCSI command of interest.
1631  *	@rbuf: Response buffer, to which simulated SCSI cmd output is sent.
1632  *	@buflen: Response buffer length.
1633  *
1634  *	Returns standard device identification data associated
1635  *	with non-VPD INQUIRY command output.
1636  *
1637  *	LOCKING:
1638  *	spin_lock_irqsave(host lock)
1639  */
1640 
1641 unsigned int ata_scsiop_inq_std(struct ata_scsi_args *args, u8 *rbuf,
1642 			       unsigned int buflen)
1643 {
1644 	u8 hdr[] = {
1645 		TYPE_DISK,
1646 		0,
1647 		0x5,	/* claim SPC-3 version compatibility */
1648 		2,
1649 		95 - 4
1650 	};
1651 
1652 	/* set scsi removeable (RMB) bit per ata bit */
1653 	if (ata_id_removeable(args->id))
1654 		hdr[1] |= (1 << 7);
1655 
1656 	VPRINTK("ENTER\n");
1657 
1658 	memcpy(rbuf, hdr, sizeof(hdr));
1659 
1660 	if (buflen > 35) {
1661 		memcpy(&rbuf[8], "ATA     ", 8);
1662 		ata_id_string(args->id, &rbuf[16], ATA_ID_PROD, 16);
1663 		ata_id_string(args->id, &rbuf[32], ATA_ID_FW_REV, 4);
1664 		if (rbuf[32] == 0 || rbuf[32] == ' ')
1665 			memcpy(&rbuf[32], "n/a ", 4);
1666 	}
1667 
1668 	if (buflen > 63) {
1669 		const u8 versions[] = {
1670 			0x60,	/* SAM-3 (no version claimed) */
1671 
1672 			0x03,
1673 			0x20,	/* SBC-2 (no version claimed) */
1674 
1675 			0x02,
1676 			0x60	/* SPC-3 (no version claimed) */
1677 		};
1678 
1679 		memcpy(rbuf + 59, versions, sizeof(versions));
1680 	}
1681 
1682 	return 0;
1683 }
1684 
1685 /**
1686  *	ata_scsiop_inq_00 - Simulate INQUIRY VPD page 0, list of pages
1687  *	@args: device IDENTIFY data / SCSI command of interest.
1688  *	@rbuf: Response buffer, to which simulated SCSI cmd output is sent.
1689  *	@buflen: Response buffer length.
1690  *
1691  *	Returns list of inquiry VPD pages available.
1692  *
1693  *	LOCKING:
1694  *	spin_lock_irqsave(host lock)
1695  */
1696 
1697 unsigned int ata_scsiop_inq_00(struct ata_scsi_args *args, u8 *rbuf,
1698 			      unsigned int buflen)
1699 {
1700 	const u8 pages[] = {
1701 		0x00,	/* page 0x00, this page */
1702 		0x80,	/* page 0x80, unit serial no page */
1703 		0x83	/* page 0x83, device ident page */
1704 	};
1705 	rbuf[3] = sizeof(pages);	/* number of supported VPD pages */
1706 
1707 	if (buflen > 6)
1708 		memcpy(rbuf + 4, pages, sizeof(pages));
1709 
1710 	return 0;
1711 }
1712 
1713 /**
1714  *	ata_scsiop_inq_80 - Simulate INQUIRY VPD page 80, device serial number
1715  *	@args: device IDENTIFY data / SCSI command of interest.
1716  *	@rbuf: Response buffer, to which simulated SCSI cmd output is sent.
1717  *	@buflen: Response buffer length.
1718  *
1719  *	Returns ATA device serial number.
1720  *
1721  *	LOCKING:
1722  *	spin_lock_irqsave(host lock)
1723  */
1724 
1725 unsigned int ata_scsiop_inq_80(struct ata_scsi_args *args, u8 *rbuf,
1726 			      unsigned int buflen)
1727 {
1728 	const u8 hdr[] = {
1729 		0,
1730 		0x80,			/* this page code */
1731 		0,
1732 		ATA_ID_SERNO_LEN,	/* page len */
1733 	};
1734 	memcpy(rbuf, hdr, sizeof(hdr));
1735 
1736 	if (buflen > (ATA_ID_SERNO_LEN + 4 - 1))
1737 		ata_id_string(args->id, (unsigned char *) &rbuf[4],
1738 			      ATA_ID_SERNO, ATA_ID_SERNO_LEN);
1739 
1740 	return 0;
1741 }
1742 
1743 /**
1744  *	ata_scsiop_inq_83 - Simulate INQUIRY VPD page 83, device identity
1745  *	@args: device IDENTIFY data / SCSI command of interest.
1746  *	@rbuf: Response buffer, to which simulated SCSI cmd output is sent.
1747  *	@buflen: Response buffer length.
1748  *
1749  *	Yields two logical unit device identification designators:
1750  *	 - vendor specific ASCII containing the ATA serial number
1751  *	 - SAT defined "t10 vendor id based" containing ASCII vendor
1752  *	   name ("ATA     "), model and serial numbers.
1753  *
1754  *	LOCKING:
1755  *	spin_lock_irqsave(host lock)
1756  */
1757 
1758 unsigned int ata_scsiop_inq_83(struct ata_scsi_args *args, u8 *rbuf,
1759 			      unsigned int buflen)
1760 {
1761 	int num;
1762 	const int sat_model_serial_desc_len = 68;
1763 
1764 	rbuf[1] = 0x83;			/* this page code */
1765 	num = 4;
1766 
1767 	if (buflen > (ATA_ID_SERNO_LEN + num + 3)) {
1768 		/* piv=0, assoc=lu, code_set=ACSII, designator=vendor */
1769 		rbuf[num + 0] = 2;
1770 		rbuf[num + 3] = ATA_ID_SERNO_LEN;
1771 		num += 4;
1772 		ata_id_string(args->id, (unsigned char *) rbuf + num,
1773 			      ATA_ID_SERNO, ATA_ID_SERNO_LEN);
1774 		num += ATA_ID_SERNO_LEN;
1775 	}
1776 	if (buflen > (sat_model_serial_desc_len + num + 3)) {
1777 		/* SAT defined lu model and serial numbers descriptor */
1778 		/* piv=0, assoc=lu, code_set=ACSII, designator=t10 vendor id */
1779 		rbuf[num + 0] = 2;
1780 		rbuf[num + 1] = 1;
1781 		rbuf[num + 3] = sat_model_serial_desc_len;
1782 		num += 4;
1783 		memcpy(rbuf + num, "ATA     ", 8);
1784 		num += 8;
1785 		ata_id_string(args->id, (unsigned char *) rbuf + num,
1786 			      ATA_ID_PROD, ATA_ID_PROD_LEN);
1787 		num += ATA_ID_PROD_LEN;
1788 		ata_id_string(args->id, (unsigned char *) rbuf + num,
1789 			      ATA_ID_SERNO, ATA_ID_SERNO_LEN);
1790 		num += ATA_ID_SERNO_LEN;
1791 	}
1792 	rbuf[3] = num - 4;    /* page len (assume less than 256 bytes) */
1793 	return 0;
1794 }
1795 
1796 /**
1797  *	ata_scsiop_inq_89 - Simulate INQUIRY VPD page 89, ATA info
1798  *	@args: device IDENTIFY data / SCSI command of interest.
1799  *	@rbuf: Response buffer, to which simulated SCSI cmd output is sent.
1800  *	@buflen: Response buffer length.
1801  *
1802  *	Yields SAT-specified ATA VPD page.
1803  *
1804  *	LOCKING:
1805  *	spin_lock_irqsave(host lock)
1806  */
1807 
1808 unsigned int ata_scsiop_inq_89(struct ata_scsi_args *args, u8 *rbuf,
1809 			      unsigned int buflen)
1810 {
1811 	u8 pbuf[60];
1812 	struct ata_taskfile tf;
1813 	unsigned int i;
1814 
1815 	if (!buflen)
1816 		return 0;
1817 
1818 	memset(&pbuf, 0, sizeof(pbuf));
1819 	memset(&tf, 0, sizeof(tf));
1820 
1821 	pbuf[1] = 0x89;			/* our page code */
1822 	pbuf[2] = (0x238 >> 8);		/* page size fixed at 238h */
1823 	pbuf[3] = (0x238 & 0xff);
1824 
1825 	memcpy(&pbuf[8], "linux   ", 8);
1826 	memcpy(&pbuf[16], "libata          ", 16);
1827 	memcpy(&pbuf[32], DRV_VERSION, 4);
1828 	ata_id_string(args->id, &pbuf[32], ATA_ID_FW_REV, 4);
1829 
1830 	/* we don't store the ATA device signature, so we fake it */
1831 
1832 	tf.command = ATA_DRDY;		/* really, this is Status reg */
1833 	tf.lbal = 0x1;
1834 	tf.nsect = 0x1;
1835 
1836 	ata_tf_to_fis(&tf, 0, 1, &pbuf[36]);	/* TODO: PMP? */
1837 	pbuf[36] = 0x34;		/* force D2H Reg FIS (34h) */
1838 
1839 	pbuf[56] = ATA_CMD_ID_ATA;
1840 
1841 	i = min(buflen, 60U);
1842 	memcpy(rbuf, &pbuf[0], i);
1843 	buflen -= i;
1844 
1845 	if (!buflen)
1846 		return 0;
1847 
1848 	memcpy(&rbuf[60], &args->id[0], min(buflen, 512U));
1849 	return 0;
1850 }
1851 
1852 /**
1853  *	ata_scsiop_noop - Command handler that simply returns success.
1854  *	@args: device IDENTIFY data / SCSI command of interest.
1855  *	@rbuf: Response buffer, to which simulated SCSI cmd output is sent.
1856  *	@buflen: Response buffer length.
1857  *
1858  *	No operation.  Simply returns success to caller, to indicate
1859  *	that the caller should successfully complete this SCSI command.
1860  *
1861  *	LOCKING:
1862  *	spin_lock_irqsave(host lock)
1863  */
1864 
1865 unsigned int ata_scsiop_noop(struct ata_scsi_args *args, u8 *rbuf,
1866 			    unsigned int buflen)
1867 {
1868 	VPRINTK("ENTER\n");
1869 	return 0;
1870 }
1871 
1872 /**
1873  *	ata_msense_push - Push data onto MODE SENSE data output buffer
1874  *	@ptr_io: (input/output) Location to store more output data
1875  *	@last: End of output data buffer
1876  *	@buf: Pointer to BLOB being added to output buffer
1877  *	@buflen: Length of BLOB
1878  *
1879  *	Store MODE SENSE data on an output buffer.
1880  *
1881  *	LOCKING:
1882  *	None.
1883  */
1884 
1885 static void ata_msense_push(u8 **ptr_io, const u8 *last,
1886 			    const u8 *buf, unsigned int buflen)
1887 {
1888 	u8 *ptr = *ptr_io;
1889 
1890 	if ((ptr + buflen - 1) > last)
1891 		return;
1892 
1893 	memcpy(ptr, buf, buflen);
1894 
1895 	ptr += buflen;
1896 
1897 	*ptr_io = ptr;
1898 }
1899 
1900 /**
1901  *	ata_msense_caching - Simulate MODE SENSE caching info page
1902  *	@id: device IDENTIFY data
1903  *	@ptr_io: (input/output) Location to store more output data
1904  *	@last: End of output data buffer
1905  *
1906  *	Generate a caching info page, which conditionally indicates
1907  *	write caching to the SCSI layer, depending on device
1908  *	capabilities.
1909  *
1910  *	LOCKING:
1911  *	None.
1912  */
1913 
1914 static unsigned int ata_msense_caching(u16 *id, u8 **ptr_io,
1915 				       const u8 *last)
1916 {
1917 	u8 page[CACHE_MPAGE_LEN];
1918 
1919 	memcpy(page, def_cache_mpage, sizeof(page));
1920 	if (ata_id_wcache_enabled(id))
1921 		page[2] |= (1 << 2);	/* write cache enable */
1922 	if (!ata_id_rahead_enabled(id))
1923 		page[12] |= (1 << 5);	/* disable read ahead */
1924 
1925 	ata_msense_push(ptr_io, last, page, sizeof(page));
1926 	return sizeof(page);
1927 }
1928 
1929 /**
1930  *	ata_msense_ctl_mode - Simulate MODE SENSE control mode page
1931  *	@dev: Device associated with this MODE SENSE command
1932  *	@ptr_io: (input/output) Location to store more output data
1933  *	@last: End of output data buffer
1934  *
1935  *	Generate a generic MODE SENSE control mode page.
1936  *
1937  *	LOCKING:
1938  *	None.
1939  */
1940 
1941 static unsigned int ata_msense_ctl_mode(u8 **ptr_io, const u8 *last)
1942 {
1943 	ata_msense_push(ptr_io, last, def_control_mpage,
1944 			sizeof(def_control_mpage));
1945 	return sizeof(def_control_mpage);
1946 }
1947 
1948 /**
1949  *	ata_msense_rw_recovery - Simulate MODE SENSE r/w error recovery page
1950  *	@dev: Device associated with this MODE SENSE command
1951  *	@ptr_io: (input/output) Location to store more output data
1952  *	@last: End of output data buffer
1953  *
1954  *	Generate a generic MODE SENSE r/w error recovery page.
1955  *
1956  *	LOCKING:
1957  *	None.
1958  */
1959 
1960 static unsigned int ata_msense_rw_recovery(u8 **ptr_io, const u8 *last)
1961 {
1962 
1963 	ata_msense_push(ptr_io, last, def_rw_recovery_mpage,
1964 			sizeof(def_rw_recovery_mpage));
1965 	return sizeof(def_rw_recovery_mpage);
1966 }
1967 
1968 /*
1969  * We can turn this into a real blacklist if it's needed, for now just
1970  * blacklist any Maxtor BANC1G10 revision firmware
1971  */
1972 static int ata_dev_supports_fua(u16 *id)
1973 {
1974 	unsigned char model[ATA_ID_PROD_LEN + 1], fw[ATA_ID_FW_REV_LEN + 1];
1975 
1976 	if (!libata_fua)
1977 		return 0;
1978 	if (!ata_id_has_fua(id))
1979 		return 0;
1980 
1981 	ata_id_c_string(id, model, ATA_ID_PROD, sizeof(model));
1982 	ata_id_c_string(id, fw, ATA_ID_FW_REV, sizeof(fw));
1983 
1984 	if (strcmp(model, "Maxtor"))
1985 		return 1;
1986 	if (strcmp(fw, "BANC1G10"))
1987 		return 1;
1988 
1989 	return 0; /* blacklisted */
1990 }
1991 
1992 /**
1993  *	ata_scsiop_mode_sense - Simulate MODE SENSE 6, 10 commands
1994  *	@args: device IDENTIFY data / SCSI command of interest.
1995  *	@rbuf: Response buffer, to which simulated SCSI cmd output is sent.
1996  *	@buflen: Response buffer length.
1997  *
1998  *	Simulate MODE SENSE commands. Assume this is invoked for direct
1999  *	access devices (e.g. disks) only. There should be no block
2000  *	descriptor for other device types.
2001  *
2002  *	LOCKING:
2003  *	spin_lock_irqsave(host lock)
2004  */
2005 
2006 unsigned int ata_scsiop_mode_sense(struct ata_scsi_args *args, u8 *rbuf,
2007 				  unsigned int buflen)
2008 {
2009 	struct ata_device *dev = args->dev;
2010 	u8 *scsicmd = args->cmd->cmnd, *p, *last;
2011 	const u8 sat_blk_desc[] = {
2012 		0, 0, 0, 0,	/* number of blocks: sat unspecified */
2013 		0,
2014 		0, 0x2, 0x0	/* block length: 512 bytes */
2015 	};
2016 	u8 pg, spg;
2017 	unsigned int ebd, page_control, six_byte, output_len, alloc_len, minlen;
2018 	u8 dpofua;
2019 
2020 	VPRINTK("ENTER\n");
2021 
2022 	six_byte = (scsicmd[0] == MODE_SENSE);
2023 	ebd = !(scsicmd[1] & 0x8);      /* dbd bit inverted == edb */
2024 	/*
2025 	 * LLBA bit in msense(10) ignored (compliant)
2026 	 */
2027 
2028 	page_control = scsicmd[2] >> 6;
2029 	switch (page_control) {
2030 	case 0: /* current */
2031 		break;  /* supported */
2032 	case 3: /* saved */
2033 		goto saving_not_supp;
2034 	case 1: /* changeable */
2035 	case 2: /* defaults */
2036 	default:
2037 		goto invalid_fld;
2038 	}
2039 
2040 	if (six_byte) {
2041 		output_len = 4 + (ebd ? 8 : 0);
2042 		alloc_len = scsicmd[4];
2043 	} else {
2044 		output_len = 8 + (ebd ? 8 : 0);
2045 		alloc_len = (scsicmd[7] << 8) + scsicmd[8];
2046 	}
2047 	minlen = (alloc_len < buflen) ? alloc_len : buflen;
2048 
2049 	p = rbuf + output_len;
2050 	last = rbuf + minlen - 1;
2051 
2052 	pg = scsicmd[2] & 0x3f;
2053 	spg = scsicmd[3];
2054 	/*
2055 	 * No mode subpages supported (yet) but asking for _all_
2056 	 * subpages may be valid
2057 	 */
2058 	if (spg && (spg != ALL_SUB_MPAGES))
2059 		goto invalid_fld;
2060 
2061 	switch(pg) {
2062 	case RW_RECOVERY_MPAGE:
2063 		output_len += ata_msense_rw_recovery(&p, last);
2064 		break;
2065 
2066 	case CACHE_MPAGE:
2067 		output_len += ata_msense_caching(args->id, &p, last);
2068 		break;
2069 
2070 	case CONTROL_MPAGE: {
2071 		output_len += ata_msense_ctl_mode(&p, last);
2072 		break;
2073 		}
2074 
2075 	case ALL_MPAGES:
2076 		output_len += ata_msense_rw_recovery(&p, last);
2077 		output_len += ata_msense_caching(args->id, &p, last);
2078 		output_len += ata_msense_ctl_mode(&p, last);
2079 		break;
2080 
2081 	default:		/* invalid page code */
2082 		goto invalid_fld;
2083 	}
2084 
2085 	if (minlen < 1)
2086 		return 0;
2087 
2088 	dpofua = 0;
2089 	if (ata_dev_supports_fua(args->id) && (dev->flags & ATA_DFLAG_LBA48) &&
2090 	    (!(dev->flags & ATA_DFLAG_PIO) || dev->multi_count))
2091 		dpofua = 1 << 4;
2092 
2093 	if (six_byte) {
2094 		output_len--;
2095 		rbuf[0] = output_len;
2096 		if (minlen > 2)
2097 			rbuf[2] |= dpofua;
2098 		if (ebd) {
2099 			if (minlen > 3)
2100 				rbuf[3] = sizeof(sat_blk_desc);
2101 			if (minlen > 11)
2102 				memcpy(rbuf + 4, sat_blk_desc,
2103 				       sizeof(sat_blk_desc));
2104 		}
2105 	} else {
2106 		output_len -= 2;
2107 		rbuf[0] = output_len >> 8;
2108 		if (minlen > 1)
2109 			rbuf[1] = output_len;
2110 		if (minlen > 3)
2111 			rbuf[3] |= dpofua;
2112 		if (ebd) {
2113 			if (minlen > 7)
2114 				rbuf[7] = sizeof(sat_blk_desc);
2115 			if (minlen > 15)
2116 				memcpy(rbuf + 8, sat_blk_desc,
2117 				       sizeof(sat_blk_desc));
2118 		}
2119 	}
2120 	return 0;
2121 
2122 invalid_fld:
2123 	ata_scsi_set_sense(args->cmd, ILLEGAL_REQUEST, 0x24, 0x0);
2124 	/* "Invalid field in cbd" */
2125 	return 1;
2126 
2127 saving_not_supp:
2128 	ata_scsi_set_sense(args->cmd, ILLEGAL_REQUEST, 0x39, 0x0);
2129 	 /* "Saving parameters not supported" */
2130 	return 1;
2131 }
2132 
2133 /**
2134  *	ata_scsiop_read_cap - Simulate READ CAPACITY[ 16] commands
2135  *	@args: device IDENTIFY data / SCSI command of interest.
2136  *	@rbuf: Response buffer, to which simulated SCSI cmd output is sent.
2137  *	@buflen: Response buffer length.
2138  *
2139  *	Simulate READ CAPACITY commands.
2140  *
2141  *	LOCKING:
2142  *	None.
2143  */
2144 unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf,
2145 			        unsigned int buflen)
2146 {
2147 	u64 last_lba = args->dev->n_sectors - 1; /* LBA of the last block */
2148 
2149 	VPRINTK("ENTER\n");
2150 
2151 	if (args->cmd->cmnd[0] == READ_CAPACITY) {
2152 		if (last_lba >= 0xffffffffULL)
2153 			last_lba = 0xffffffff;
2154 
2155 		/* sector count, 32-bit */
2156 		ATA_SCSI_RBUF_SET(0, last_lba >> (8 * 3));
2157 		ATA_SCSI_RBUF_SET(1, last_lba >> (8 * 2));
2158 		ATA_SCSI_RBUF_SET(2, last_lba >> (8 * 1));
2159 		ATA_SCSI_RBUF_SET(3, last_lba);
2160 
2161 		/* sector size */
2162 		ATA_SCSI_RBUF_SET(6, ATA_SECT_SIZE >> 8);
2163 		ATA_SCSI_RBUF_SET(7, ATA_SECT_SIZE);
2164 	} else {
2165 		/* sector count, 64-bit */
2166 		ATA_SCSI_RBUF_SET(0, last_lba >> (8 * 7));
2167 		ATA_SCSI_RBUF_SET(1, last_lba >> (8 * 6));
2168 		ATA_SCSI_RBUF_SET(2, last_lba >> (8 * 5));
2169 		ATA_SCSI_RBUF_SET(3, last_lba >> (8 * 4));
2170 		ATA_SCSI_RBUF_SET(4, last_lba >> (8 * 3));
2171 		ATA_SCSI_RBUF_SET(5, last_lba >> (8 * 2));
2172 		ATA_SCSI_RBUF_SET(6, last_lba >> (8 * 1));
2173 		ATA_SCSI_RBUF_SET(7, last_lba);
2174 
2175 		/* sector size */
2176 		ATA_SCSI_RBUF_SET(10, ATA_SECT_SIZE >> 8);
2177 		ATA_SCSI_RBUF_SET(11, ATA_SECT_SIZE);
2178 	}
2179 
2180 	return 0;
2181 }
2182 
2183 /**
2184  *	ata_scsiop_report_luns - Simulate REPORT LUNS command
2185  *	@args: device IDENTIFY data / SCSI command of interest.
2186  *	@rbuf: Response buffer, to which simulated SCSI cmd output is sent.
2187  *	@buflen: Response buffer length.
2188  *
2189  *	Simulate REPORT LUNS command.
2190  *
2191  *	LOCKING:
2192  *	spin_lock_irqsave(host lock)
2193  */
2194 
2195 unsigned int ata_scsiop_report_luns(struct ata_scsi_args *args, u8 *rbuf,
2196 				   unsigned int buflen)
2197 {
2198 	VPRINTK("ENTER\n");
2199 	rbuf[3] = 8;	/* just one lun, LUN 0, size 8 bytes */
2200 
2201 	return 0;
2202 }
2203 
2204 /**
2205  *	ata_scsi_set_sense - Set SCSI sense data and status
2206  *	@cmd: SCSI request to be handled
2207  *	@sk: SCSI-defined sense key
2208  *	@asc: SCSI-defined additional sense code
2209  *	@ascq: SCSI-defined additional sense code qualifier
2210  *
2211  *	Helper function that builds a valid fixed format, current
2212  *	response code and the given sense key (sk), additional sense
2213  *	code (asc) and additional sense code qualifier (ascq) with
2214  *	a SCSI command status of %SAM_STAT_CHECK_CONDITION and
2215  *	DRIVER_SENSE set in the upper bits of scsi_cmnd::result .
2216  *
2217  *	LOCKING:
2218  *	Not required
2219  */
2220 
2221 void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq)
2222 {
2223 	cmd->result = (DRIVER_SENSE << 24) | SAM_STAT_CHECK_CONDITION;
2224 
2225 	cmd->sense_buffer[0] = 0x70;	/* fixed format, current */
2226 	cmd->sense_buffer[2] = sk;
2227 	cmd->sense_buffer[7] = 18 - 8;	/* additional sense length */
2228 	cmd->sense_buffer[12] = asc;
2229 	cmd->sense_buffer[13] = ascq;
2230 }
2231 
2232 /**
2233  *	ata_scsi_badcmd - End a SCSI request with an error
2234  *	@cmd: SCSI request to be handled
2235  *	@done: SCSI command completion function
2236  *	@asc: SCSI-defined additional sense code
2237  *	@ascq: SCSI-defined additional sense code qualifier
2238  *
2239  *	Helper function that completes a SCSI command with
2240  *	%SAM_STAT_CHECK_CONDITION, with a sense key %ILLEGAL_REQUEST
2241  *	and the specified additional sense codes.
2242  *
2243  *	LOCKING:
2244  *	spin_lock_irqsave(host lock)
2245  */
2246 
2247 void ata_scsi_badcmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *), u8 asc, u8 ascq)
2248 {
2249 	DPRINTK("ENTER\n");
2250 	ata_scsi_set_sense(cmd, ILLEGAL_REQUEST, asc, ascq);
2251 
2252 	done(cmd);
2253 }
2254 
2255 static void atapi_sense_complete(struct ata_queued_cmd *qc)
2256 {
2257 	if (qc->err_mask && ((qc->err_mask & AC_ERR_DEV) == 0)) {
2258 		/* FIXME: not quite right; we don't want the
2259 		 * translation of taskfile registers into
2260 		 * a sense descriptors, since that's only
2261 		 * correct for ATA, not ATAPI
2262 		 */
2263 		ata_gen_passthru_sense(qc);
2264 	}
2265 
2266 	qc->scsidone(qc->scsicmd);
2267 	ata_qc_free(qc);
2268 }
2269 
2270 /* is it pointless to prefer PIO for "safety reasons"? */
2271 static inline int ata_pio_use_silly(struct ata_port *ap)
2272 {
2273 	return (ap->flags & ATA_FLAG_PIO_DMA);
2274 }
2275 
2276 static void atapi_request_sense(struct ata_queued_cmd *qc)
2277 {
2278 	struct ata_port *ap = qc->ap;
2279 	struct scsi_cmnd *cmd = qc->scsicmd;
2280 
2281 	DPRINTK("ATAPI request sense\n");
2282 
2283 	/* FIXME: is this needed? */
2284 	memset(cmd->sense_buffer, 0, sizeof(cmd->sense_buffer));
2285 
2286 	ap->ops->tf_read(ap, &qc->tf);
2287 
2288 	/* fill these in, for the case where they are -not- overwritten */
2289 	cmd->sense_buffer[0] = 0x70;
2290 	cmd->sense_buffer[2] = qc->tf.feature >> 4;
2291 
2292 	ata_qc_reinit(qc);
2293 
2294 	ata_sg_init_one(qc, cmd->sense_buffer, sizeof(cmd->sense_buffer));
2295 	qc->dma_dir = DMA_FROM_DEVICE;
2296 
2297 	memset(&qc->cdb, 0, qc->dev->cdb_len);
2298 	qc->cdb[0] = REQUEST_SENSE;
2299 	qc->cdb[4] = SCSI_SENSE_BUFFERSIZE;
2300 
2301 	qc->tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
2302 	qc->tf.command = ATA_CMD_PACKET;
2303 
2304 	if (ata_pio_use_silly(ap)) {
2305 		qc->tf.protocol = ATA_PROT_ATAPI_DMA;
2306 		qc->tf.feature |= ATAPI_PKT_DMA;
2307 	} else {
2308 		qc->tf.protocol = ATA_PROT_ATAPI;
2309 		qc->tf.lbam = SCSI_SENSE_BUFFERSIZE;
2310 		qc->tf.lbah = 0;
2311 	}
2312 	qc->nbytes = SCSI_SENSE_BUFFERSIZE;
2313 
2314 	qc->complete_fn = atapi_sense_complete;
2315 
2316 	ata_qc_issue(qc);
2317 
2318 	DPRINTK("EXIT\n");
2319 }
2320 
2321 static void atapi_qc_complete(struct ata_queued_cmd *qc)
2322 {
2323 	struct scsi_cmnd *cmd = qc->scsicmd;
2324 	unsigned int err_mask = qc->err_mask;
2325 
2326 	VPRINTK("ENTER, err_mask 0x%X\n", err_mask);
2327 
2328 	/* handle completion from new EH */
2329 	if (unlikely(qc->ap->ops->error_handler &&
2330 		     (err_mask || qc->flags & ATA_QCFLAG_SENSE_VALID))) {
2331 
2332 		if (!(qc->flags & ATA_QCFLAG_SENSE_VALID)) {
2333 			/* FIXME: not quite right; we don't want the
2334 			 * translation of taskfile registers into a
2335 			 * sense descriptors, since that's only
2336 			 * correct for ATA, not ATAPI
2337 			 */
2338 			ata_gen_passthru_sense(qc);
2339 		}
2340 
2341 		/* SCSI EH automatically locks door if sdev->locked is
2342 		 * set.  Sometimes door lock request continues to
2343 		 * fail, for example, when no media is present.  This
2344 		 * creates a loop - SCSI EH issues door lock which
2345 		 * fails and gets invoked again to acquire sense data
2346 		 * for the failed command.
2347 		 *
2348 		 * If door lock fails, always clear sdev->locked to
2349 		 * avoid this infinite loop.
2350 		 */
2351 		if (qc->cdb[0] == ALLOW_MEDIUM_REMOVAL)
2352 			qc->dev->sdev->locked = 0;
2353 
2354 		qc->scsicmd->result = SAM_STAT_CHECK_CONDITION;
2355 		qc->scsidone(cmd);
2356 		ata_qc_free(qc);
2357 		return;
2358 	}
2359 
2360 	/* successful completion or old EH failure path */
2361 	if (unlikely(err_mask & AC_ERR_DEV)) {
2362 		cmd->result = SAM_STAT_CHECK_CONDITION;
2363 		atapi_request_sense(qc);
2364 		return;
2365 	} else if (unlikely(err_mask)) {
2366 		/* FIXME: not quite right; we don't want the
2367 		 * translation of taskfile registers into
2368 		 * a sense descriptors, since that's only
2369 		 * correct for ATA, not ATAPI
2370 		 */
2371 		ata_gen_passthru_sense(qc);
2372 	} else {
2373 		u8 *scsicmd = cmd->cmnd;
2374 
2375 		if ((scsicmd[0] == INQUIRY) && ((scsicmd[1] & 0x03) == 0)) {
2376 			u8 *buf = NULL;
2377 			unsigned int buflen;
2378 
2379 			buflen = ata_scsi_rbuf_get(cmd, &buf);
2380 
2381 	/* ATAPI devices typically report zero for their SCSI version,
2382 	 * and sometimes deviate from the spec WRT response data
2383 	 * format.  If SCSI version is reported as zero like normal,
2384 	 * then we make the following fixups:  1) Fake MMC-5 version,
2385 	 * to indicate to the Linux scsi midlayer this is a modern
2386 	 * device.  2) Ensure response data format / ATAPI information
2387 	 * are always correct.
2388 	 */
2389 			if (buf[2] == 0) {
2390 				buf[2] = 0x5;
2391 				buf[3] = 0x32;
2392 			}
2393 
2394 			ata_scsi_rbuf_put(cmd, buf);
2395 		}
2396 
2397 		cmd->result = SAM_STAT_GOOD;
2398 	}
2399 
2400 	qc->scsidone(cmd);
2401 	ata_qc_free(qc);
2402 }
2403 /**
2404  *	atapi_xlat - Initialize PACKET taskfile
2405  *	@qc: command structure to be initialized
2406  *
2407  *	LOCKING:
2408  *	spin_lock_irqsave(host lock)
2409  *
2410  *	RETURNS:
2411  *	Zero on success, non-zero on failure.
2412  */
2413 static unsigned int atapi_xlat(struct ata_queued_cmd *qc)
2414 {
2415 	struct scsi_cmnd *scmd = qc->scsicmd;
2416 	struct ata_device *dev = qc->dev;
2417 	int using_pio = (dev->flags & ATA_DFLAG_PIO);
2418 	int nodata = (scmd->sc_data_direction == DMA_NONE);
2419 	unsigned int nbytes;
2420 
2421 	memset(qc->cdb, 0, dev->cdb_len);
2422 	memcpy(qc->cdb, scmd->cmnd, scmd->cmd_len);
2423 
2424 	qc->complete_fn = atapi_qc_complete;
2425 
2426 	qc->tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
2427 	if (scmd->sc_data_direction == DMA_TO_DEVICE) {
2428 		qc->tf.flags |= ATA_TFLAG_WRITE;
2429 		DPRINTK("direction: write\n");
2430 	}
2431 
2432 	qc->tf.command = ATA_CMD_PACKET;
2433 	qc->nbytes = scsi_bufflen(scmd);
2434 
2435 	/* check whether ATAPI DMA is safe */
2436 	if (!using_pio && ata_check_atapi_dma(qc))
2437 		using_pio = 1;
2438 
2439 	/* Some controller variants snoop this value for Packet transfers
2440 	   to do state machine and FIFO management. Thus we want to set it
2441 	   properly, and for DMA where it is effectively meaningless */
2442 	nbytes = min(qc->nbytes, (unsigned int)63 * 1024);
2443 
2444 	qc->tf.lbam = (nbytes & 0xFF);
2445 	qc->tf.lbah = (nbytes >> 8);
2446 
2447 	if (using_pio || nodata) {
2448 		/* no data, or PIO data xfer */
2449 		if (nodata)
2450 			qc->tf.protocol = ATA_PROT_ATAPI_NODATA;
2451 		else
2452 			qc->tf.protocol = ATA_PROT_ATAPI;
2453 	} else {
2454 		/* DMA data xfer */
2455 		qc->tf.protocol = ATA_PROT_ATAPI_DMA;
2456 		qc->tf.feature |= ATAPI_PKT_DMA;
2457 
2458 		if (atapi_dmadir && (scmd->sc_data_direction != DMA_TO_DEVICE))
2459 			/* some SATA bridges need us to indicate data xfer direction */
2460 			qc->tf.feature |= ATAPI_DMADIR;
2461 	}
2462 
2463 
2464 	/* FIXME: We need to translate 0x05 READ_BLOCK_LIMITS to a MODE_SENSE
2465 	   as ATAPI tape drives don't get this right otherwise */
2466 	return 0;
2467 }
2468 
2469 static struct ata_device * ata_find_dev(struct ata_port *ap, int devno)
2470 {
2471 	if (ap->nr_pmp_links == 0) {
2472 		if (likely(devno < ata_link_max_devices(&ap->link)))
2473 			return &ap->link.device[devno];
2474 	} else {
2475 		if (likely(devno < ap->nr_pmp_links))
2476 			return &ap->pmp_link[devno].device[0];
2477 	}
2478 
2479 	return NULL;
2480 }
2481 
2482 static struct ata_device * __ata_scsi_find_dev(struct ata_port *ap,
2483 					const struct scsi_device *scsidev)
2484 {
2485 	int devno;
2486 
2487 	/* skip commands not addressed to targets we simulate */
2488 	if (ap->nr_pmp_links == 0) {
2489 		if (unlikely(scsidev->channel || scsidev->lun))
2490 			return NULL;
2491 		devno = scsidev->id;
2492 	} else {
2493 		if (unlikely(scsidev->id || scsidev->lun))
2494 			return NULL;
2495 		devno = scsidev->channel;
2496 	}
2497 
2498 	return ata_find_dev(ap, devno);
2499 }
2500 
2501 /**
2502  *	ata_scsi_dev_enabled - determine if device is enabled
2503  *	@dev: ATA device
2504  *
2505  *	Determine if commands should be sent to the specified device.
2506  *
2507  *	LOCKING:
2508  *	spin_lock_irqsave(host lock)
2509  *
2510  *	RETURNS:
2511  *	0 if commands are not allowed / 1 if commands are allowed
2512  */
2513 
2514 static int ata_scsi_dev_enabled(struct ata_device *dev)
2515 {
2516 	if (unlikely(!ata_dev_enabled(dev)))
2517 		return 0;
2518 
2519 	if (!atapi_enabled || (dev->link->ap->flags & ATA_FLAG_NO_ATAPI)) {
2520 		if (unlikely(dev->class == ATA_DEV_ATAPI)) {
2521 			ata_dev_printk(dev, KERN_WARNING,
2522 				       "WARNING: ATAPI is %s, device ignored.\n",
2523 				       atapi_enabled ? "not supported with this driver" : "disabled");
2524 			return 0;
2525 		}
2526 	}
2527 
2528 	return 1;
2529 }
2530 
2531 /**
2532  *	ata_scsi_find_dev - lookup ata_device from scsi_cmnd
2533  *	@ap: ATA port to which the device is attached
2534  *	@scsidev: SCSI device from which we derive the ATA device
2535  *
2536  *	Given various information provided in struct scsi_cmnd,
2537  *	map that onto an ATA bus, and using that mapping
2538  *	determine which ata_device is associated with the
2539  *	SCSI command to be sent.
2540  *
2541  *	LOCKING:
2542  *	spin_lock_irqsave(host lock)
2543  *
2544  *	RETURNS:
2545  *	Associated ATA device, or %NULL if not found.
2546  */
2547 static struct ata_device *
2548 ata_scsi_find_dev(struct ata_port *ap, const struct scsi_device *scsidev)
2549 {
2550 	struct ata_device *dev = __ata_scsi_find_dev(ap, scsidev);
2551 
2552 	if (unlikely(!dev || !ata_scsi_dev_enabled(dev)))
2553 		return NULL;
2554 
2555 	return dev;
2556 }
2557 
2558 /*
2559  *	ata_scsi_map_proto - Map pass-thru protocol value to taskfile value.
2560  *	@byte1: Byte 1 from pass-thru CDB.
2561  *
2562  *	RETURNS:
2563  *	ATA_PROT_UNKNOWN if mapping failed/unimplemented, protocol otherwise.
2564  */
2565 static u8
2566 ata_scsi_map_proto(u8 byte1)
2567 {
2568 	switch((byte1 & 0x1e) >> 1) {
2569 		case 3:		/* Non-data */
2570 			return ATA_PROT_NODATA;
2571 
2572 		case 6:		/* DMA */
2573 		case 10:	/* UDMA Data-in */
2574 		case 11:	/* UDMA Data-Out */
2575 			return ATA_PROT_DMA;
2576 
2577 		case 4:		/* PIO Data-in */
2578 		case 5:		/* PIO Data-out */
2579 			return ATA_PROT_PIO;
2580 
2581 		case 0:		/* Hard Reset */
2582 		case 1:		/* SRST */
2583 		case 8:		/* Device Diagnostic */
2584 		case 9:		/* Device Reset */
2585 		case 7:		/* DMA Queued */
2586 		case 12:	/* FPDMA */
2587 		case 15:	/* Return Response Info */
2588 		default:	/* Reserved */
2589 			break;
2590 	}
2591 
2592 	return ATA_PROT_UNKNOWN;
2593 }
2594 
2595 /**
2596  *	ata_scsi_pass_thru - convert ATA pass-thru CDB to taskfile
2597  *	@qc: command structure to be initialized
2598  *
2599  *	Handles either 12 or 16-byte versions of the CDB.
2600  *
2601  *	RETURNS:
2602  *	Zero on success, non-zero on failure.
2603  */
2604 static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
2605 {
2606 	struct ata_taskfile *tf = &(qc->tf);
2607 	struct scsi_cmnd *scmd = qc->scsicmd;
2608 	struct ata_device *dev = qc->dev;
2609 	const u8 *cdb = scmd->cmnd;
2610 
2611 	if ((tf->protocol = ata_scsi_map_proto(cdb[1])) == ATA_PROT_UNKNOWN)
2612 		goto invalid_fld;
2613 
2614 	/* We may not issue DMA commands if no DMA mode is set */
2615 	if (tf->protocol == ATA_PROT_DMA && dev->dma_mode == 0)
2616 		goto invalid_fld;
2617 
2618 	/*
2619 	 * 12 and 16 byte CDBs use different offsets to
2620 	 * provide the various register values.
2621 	 */
2622 	if (cdb[0] == ATA_16) {
2623 		/*
2624 		 * 16-byte CDB - may contain extended commands.
2625 		 *
2626 		 * If that is the case, copy the upper byte register values.
2627 		 */
2628 		if (cdb[1] & 0x01) {
2629 			tf->hob_feature = cdb[3];
2630 			tf->hob_nsect = cdb[5];
2631 			tf->hob_lbal = cdb[7];
2632 			tf->hob_lbam = cdb[9];
2633 			tf->hob_lbah = cdb[11];
2634 			tf->flags |= ATA_TFLAG_LBA48;
2635 		} else
2636 			tf->flags &= ~ATA_TFLAG_LBA48;
2637 
2638 		/*
2639 		 * Always copy low byte, device and command registers.
2640 		 */
2641 		tf->feature = cdb[4];
2642 		tf->nsect = cdb[6];
2643 		tf->lbal = cdb[8];
2644 		tf->lbam = cdb[10];
2645 		tf->lbah = cdb[12];
2646 		tf->device = cdb[13];
2647 		tf->command = cdb[14];
2648 	} else {
2649 		/*
2650 		 * 12-byte CDB - incapable of extended commands.
2651 		 */
2652 		tf->flags &= ~ATA_TFLAG_LBA48;
2653 
2654 		tf->feature = cdb[3];
2655 		tf->nsect = cdb[4];
2656 		tf->lbal = cdb[5];
2657 		tf->lbam = cdb[6];
2658 		tf->lbah = cdb[7];
2659 		tf->device = cdb[8];
2660 		tf->command = cdb[9];
2661 	}
2662 
2663 	/* enforce correct master/slave bit */
2664 	tf->device = dev->devno ?
2665 		tf->device | ATA_DEV1 : tf->device & ~ATA_DEV1;
2666 
2667 	/* sanity check for pio multi commands */
2668 	if ((cdb[1] & 0xe0) && !is_multi_taskfile(tf))
2669 		goto invalid_fld;
2670 
2671 	if (is_multi_taskfile(tf)) {
2672 		unsigned int multi_count = 1 << (cdb[1] >> 5);
2673 
2674 		/* compare the passed through multi_count
2675 		 * with the cached multi_count of libata
2676 		 */
2677 		if (multi_count != dev->multi_count)
2678 			ata_dev_printk(dev, KERN_WARNING,
2679 				       "invalid multi_count %u ignored\n",
2680 				       multi_count);
2681 	}
2682 
2683 	/* READ/WRITE LONG use a non-standard sect_size */
2684 	qc->sect_size = ATA_SECT_SIZE;
2685 	switch (tf->command) {
2686 	case ATA_CMD_READ_LONG:
2687 	case ATA_CMD_READ_LONG_ONCE:
2688 	case ATA_CMD_WRITE_LONG:
2689 	case ATA_CMD_WRITE_LONG_ONCE:
2690 		if (tf->protocol != ATA_PROT_PIO || tf->nsect != 1)
2691 			goto invalid_fld;
2692 		qc->sect_size = scsi_bufflen(scmd);
2693 	}
2694 
2695 	/*
2696 	 * Filter SET_FEATURES - XFER MODE command -- otherwise,
2697 	 * SET_FEATURES - XFER MODE must be preceded/succeeded
2698 	 * by an update to hardware-specific registers for each
2699 	 * controller (i.e. the reason for ->set_piomode(),
2700 	 * ->set_dmamode(), and ->post_set_mode() hooks).
2701 	 */
2702 	if ((tf->command == ATA_CMD_SET_FEATURES)
2703 	 && (tf->feature == SETFEATURES_XFER))
2704 		goto invalid_fld;
2705 
2706 	/*
2707 	 * Set flags so that all registers will be written,
2708 	 * and pass on write indication (used for PIO/DMA
2709 	 * setup.)
2710 	 */
2711 	tf->flags |= (ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE);
2712 
2713 	if (scmd->sc_data_direction == DMA_TO_DEVICE)
2714 		tf->flags |= ATA_TFLAG_WRITE;
2715 
2716 	/*
2717 	 * Set transfer length.
2718 	 *
2719 	 * TODO: find out if we need to do more here to
2720 	 *       cover scatter/gather case.
2721 	 */
2722 	qc->nbytes = scsi_bufflen(scmd);
2723 
2724 	/* request result TF */
2725 	qc->flags |= ATA_QCFLAG_RESULT_TF;
2726 
2727 	return 0;
2728 
2729  invalid_fld:
2730 	ata_scsi_set_sense(scmd, ILLEGAL_REQUEST, 0x24, 0x00);
2731 	/* "Invalid field in cdb" */
2732 	return 1;
2733 }
2734 
2735 /**
2736  *	ata_get_xlat_func - check if SCSI to ATA translation is possible
2737  *	@dev: ATA device
2738  *	@cmd: SCSI command opcode to consider
2739  *
2740  *	Look up the SCSI command given, and determine whether the
2741  *	SCSI command is to be translated or simulated.
2742  *
2743  *	RETURNS:
2744  *	Pointer to translation function if possible, %NULL if not.
2745  */
2746 
2747 static inline ata_xlat_func_t ata_get_xlat_func(struct ata_device *dev, u8 cmd)
2748 {
2749 	switch (cmd) {
2750 	case READ_6:
2751 	case READ_10:
2752 	case READ_16:
2753 
2754 	case WRITE_6:
2755 	case WRITE_10:
2756 	case WRITE_16:
2757 		return ata_scsi_rw_xlat;
2758 
2759 	case SYNCHRONIZE_CACHE:
2760 		if (ata_try_flush_cache(dev))
2761 			return ata_scsi_flush_xlat;
2762 		break;
2763 
2764 	case VERIFY:
2765 	case VERIFY_16:
2766 		return ata_scsi_verify_xlat;
2767 
2768 	case ATA_12:
2769 	case ATA_16:
2770 		return ata_scsi_pass_thru;
2771 
2772 	case START_STOP:
2773 		return ata_scsi_start_stop_xlat;
2774 	}
2775 
2776 	return NULL;
2777 }
2778 
2779 /**
2780  *	ata_scsi_dump_cdb - dump SCSI command contents to dmesg
2781  *	@ap: ATA port to which the command was being sent
2782  *	@cmd: SCSI command to dump
2783  *
2784  *	Prints the contents of a SCSI command via printk().
2785  */
2786 
2787 static inline void ata_scsi_dump_cdb(struct ata_port *ap,
2788 				     struct scsi_cmnd *cmd)
2789 {
2790 #ifdef ATA_DEBUG
2791 	struct scsi_device *scsidev = cmd->device;
2792 	u8 *scsicmd = cmd->cmnd;
2793 
2794 	DPRINTK("CDB (%u:%d,%d,%d) %02x %02x %02x %02x %02x %02x %02x %02x %02x\n",
2795 		ap->print_id,
2796 		scsidev->channel, scsidev->id, scsidev->lun,
2797 		scsicmd[0], scsicmd[1], scsicmd[2], scsicmd[3],
2798 		scsicmd[4], scsicmd[5], scsicmd[6], scsicmd[7],
2799 		scsicmd[8]);
2800 #endif
2801 }
2802 
2803 static inline int __ata_scsi_queuecmd(struct scsi_cmnd *scmd,
2804 				      void (*done)(struct scsi_cmnd *),
2805 				      struct ata_device *dev)
2806 {
2807 	u8 scsi_op = scmd->cmnd[0];
2808 	ata_xlat_func_t xlat_func;
2809 	int rc = 0;
2810 
2811 	if (dev->class == ATA_DEV_ATA) {
2812 		if (unlikely(!scmd->cmd_len || scmd->cmd_len > dev->cdb_len))
2813 			goto bad_cdb_len;
2814 
2815 		xlat_func = ata_get_xlat_func(dev, scsi_op);
2816 	} else {
2817 		if (unlikely(!scmd->cmd_len))
2818 			goto bad_cdb_len;
2819 
2820 		xlat_func = NULL;
2821 		if (likely((scsi_op != ATA_16) || !atapi_passthru16)) {
2822 			/* relay SCSI command to ATAPI device */
2823 			if (unlikely(scmd->cmd_len > dev->cdb_len))
2824 				goto bad_cdb_len;
2825 
2826 			xlat_func = atapi_xlat;
2827 		} else {
2828 			/* ATA_16 passthru, treat as an ATA command */
2829 			if (unlikely(scmd->cmd_len > 16))
2830 				goto bad_cdb_len;
2831 
2832 			xlat_func = ata_get_xlat_func(dev, scsi_op);
2833 		}
2834 	}
2835 
2836 	if (xlat_func)
2837 		rc = ata_scsi_translate(dev, scmd, done, xlat_func);
2838 	else
2839 		ata_scsi_simulate(dev, scmd, done);
2840 
2841 	return rc;
2842 
2843  bad_cdb_len:
2844 	DPRINTK("bad CDB len=%u, scsi_op=0x%02x, max=%u\n",
2845 		scmd->cmd_len, scsi_op, dev->cdb_len);
2846 	scmd->result = DID_ERROR << 16;
2847 	done(scmd);
2848 	return 0;
2849 }
2850 
2851 /**
2852  *	ata_scsi_queuecmd - Issue SCSI cdb to libata-managed device
2853  *	@cmd: SCSI command to be sent
2854  *	@done: Completion function, called when command is complete
2855  *
2856  *	In some cases, this function translates SCSI commands into
2857  *	ATA taskfiles, and queues the taskfiles to be sent to
2858  *	hardware.  In other cases, this function simulates a
2859  *	SCSI device by evaluating and responding to certain
2860  *	SCSI commands.  This creates the overall effect of
2861  *	ATA and ATAPI devices appearing as SCSI devices.
2862  *
2863  *	LOCKING:
2864  *	Releases scsi-layer-held lock, and obtains host lock.
2865  *
2866  *	RETURNS:
2867  *	Return value from __ata_scsi_queuecmd() if @cmd can be queued,
2868  *	0 otherwise.
2869  */
2870 int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
2871 {
2872 	struct ata_port *ap;
2873 	struct ata_device *dev;
2874 	struct scsi_device *scsidev = cmd->device;
2875 	struct Scsi_Host *shost = scsidev->host;
2876 	int rc = 0;
2877 
2878 	ap = ata_shost_to_port(shost);
2879 
2880 	spin_unlock(shost->host_lock);
2881 	spin_lock(ap->lock);
2882 
2883 	ata_scsi_dump_cdb(ap, cmd);
2884 
2885 	dev = ata_scsi_find_dev(ap, scsidev);
2886 	if (likely(dev))
2887 		rc = __ata_scsi_queuecmd(cmd, done, dev);
2888 	else {
2889 		cmd->result = (DID_BAD_TARGET << 16);
2890 		done(cmd);
2891 	}
2892 
2893 	spin_unlock(ap->lock);
2894 	spin_lock(shost->host_lock);
2895 	return rc;
2896 }
2897 
2898 /**
2899  *	ata_scsi_simulate - simulate SCSI command on ATA device
2900  *	@dev: the target device
2901  *	@cmd: SCSI command being sent to device.
2902  *	@done: SCSI command completion function.
2903  *
2904  *	Interprets and directly executes a select list of SCSI commands
2905  *	that can be handled internally.
2906  *
2907  *	LOCKING:
2908  *	spin_lock_irqsave(host lock)
2909  */
2910 
2911 void ata_scsi_simulate(struct ata_device *dev, struct scsi_cmnd *cmd,
2912 		      void (*done)(struct scsi_cmnd *))
2913 {
2914 	struct ata_scsi_args args;
2915 	const u8 *scsicmd = cmd->cmnd;
2916 	u8 tmp8;
2917 
2918 	args.dev = dev;
2919 	args.id = dev->id;
2920 	args.cmd = cmd;
2921 	args.done = done;
2922 
2923 	switch(scsicmd[0]) {
2924 		/* TODO: worth improving? */
2925 		case FORMAT_UNIT:
2926 			ata_scsi_invalid_field(cmd, done);
2927 			break;
2928 
2929 		case INQUIRY:
2930 			if (scsicmd[1] & 2)	           /* is CmdDt set?  */
2931 				ata_scsi_invalid_field(cmd, done);
2932 			else if ((scsicmd[1] & 1) == 0)    /* is EVPD clear? */
2933 				ata_scsi_rbuf_fill(&args, ata_scsiop_inq_std);
2934 			else switch (scsicmd[2]) {
2935 			case 0x00:
2936 				ata_scsi_rbuf_fill(&args, ata_scsiop_inq_00);
2937 				break;
2938 			case 0x80:
2939 				ata_scsi_rbuf_fill(&args, ata_scsiop_inq_80);
2940 				break;
2941 			case 0x83:
2942 				ata_scsi_rbuf_fill(&args, ata_scsiop_inq_83);
2943 				break;
2944 			case 0x89:
2945 				ata_scsi_rbuf_fill(&args, ata_scsiop_inq_89);
2946 				break;
2947 			default:
2948 				ata_scsi_invalid_field(cmd, done);
2949 				break;
2950 			}
2951 			break;
2952 
2953 		case MODE_SENSE:
2954 		case MODE_SENSE_10:
2955 			ata_scsi_rbuf_fill(&args, ata_scsiop_mode_sense);
2956 			break;
2957 
2958 		case MODE_SELECT:	/* unconditionally return */
2959 		case MODE_SELECT_10:	/* bad-field-in-cdb */
2960 			ata_scsi_invalid_field(cmd, done);
2961 			break;
2962 
2963 		case READ_CAPACITY:
2964 			ata_scsi_rbuf_fill(&args, ata_scsiop_read_cap);
2965 			break;
2966 
2967 		case SERVICE_ACTION_IN:
2968 			if ((scsicmd[1] & 0x1f) == SAI_READ_CAPACITY_16)
2969 				ata_scsi_rbuf_fill(&args, ata_scsiop_read_cap);
2970 			else
2971 				ata_scsi_invalid_field(cmd, done);
2972 			break;
2973 
2974 		case REPORT_LUNS:
2975 			ata_scsi_rbuf_fill(&args, ata_scsiop_report_luns);
2976 			break;
2977 
2978 		case REQUEST_SENSE:
2979 			ata_scsi_set_sense(cmd, 0, 0, 0);
2980 			cmd->result = (DRIVER_SENSE << 24);
2981 			done(cmd);
2982 			break;
2983 
2984 		/* if we reach this, then writeback caching is disabled,
2985 		 * turning this into a no-op.
2986 		 */
2987 		case SYNCHRONIZE_CACHE:
2988 			/* fall through */
2989 
2990 		/* no-op's, complete with success */
2991 		case REZERO_UNIT:
2992 		case SEEK_6:
2993 		case SEEK_10:
2994 		case TEST_UNIT_READY:
2995 			ata_scsi_rbuf_fill(&args, ata_scsiop_noop);
2996 			break;
2997 
2998 		case SEND_DIAGNOSTIC:
2999 			tmp8 = scsicmd[1] & ~(1 << 3);
3000 			if ((tmp8 == 0x4) && (!scsicmd[3]) && (!scsicmd[4]))
3001 				ata_scsi_rbuf_fill(&args, ata_scsiop_noop);
3002 			else
3003 				ata_scsi_invalid_field(cmd, done);
3004 			break;
3005 
3006 		/* all other commands */
3007 		default:
3008 			ata_scsi_set_sense(cmd, ILLEGAL_REQUEST, 0x20, 0x0);
3009 			/* "Invalid command operation code" */
3010 			done(cmd);
3011 			break;
3012 	}
3013 }
3014 
3015 int ata_scsi_add_hosts(struct ata_host *host, struct scsi_host_template *sht)
3016 {
3017 	int i, rc;
3018 
3019 	for (i = 0; i < host->n_ports; i++) {
3020 		struct ata_port *ap = host->ports[i];
3021 		struct Scsi_Host *shost;
3022 
3023 		rc = -ENOMEM;
3024 		shost = scsi_host_alloc(sht, sizeof(struct ata_port *));
3025 		if (!shost)
3026 			goto err_alloc;
3027 
3028 		*(struct ata_port **)&shost->hostdata[0] = ap;
3029 		ap->scsi_host = shost;
3030 
3031 		shost->transportt = &ata_scsi_transport_template;
3032 		shost->unique_id = ap->print_id;
3033 		shost->max_id = 16;
3034 		shost->max_lun = 1;
3035 		shost->max_channel = 1;
3036 		shost->max_cmd_len = 16;
3037 
3038 		/* Schedule policy is determined by ->qc_defer()
3039 		 * callback and it needs to see every deferred qc.
3040 		 * Set host_blocked to 1 to prevent SCSI midlayer from
3041 		 * automatically deferring requests.
3042 		 */
3043 		shost->max_host_blocked = 1;
3044 
3045 		rc = scsi_add_host(ap->scsi_host, ap->host->dev);
3046 		if (rc)
3047 			goto err_add;
3048 	}
3049 
3050 	return 0;
3051 
3052  err_add:
3053 	scsi_host_put(host->ports[i]->scsi_host);
3054  err_alloc:
3055 	while (--i >= 0) {
3056 		struct Scsi_Host *shost = host->ports[i]->scsi_host;
3057 
3058 		scsi_remove_host(shost);
3059 		scsi_host_put(shost);
3060 	}
3061 	return rc;
3062 }
3063 
3064 void ata_scsi_scan_host(struct ata_port *ap, int sync)
3065 {
3066 	int tries = 5;
3067 	struct ata_device *last_failed_dev = NULL;
3068 	struct ata_link *link;
3069 	struct ata_device *dev;
3070 
3071 	if (ap->flags & ATA_FLAG_DISABLED)
3072 		return;
3073 
3074  repeat:
3075 	ata_port_for_each_link(link, ap) {
3076 		ata_link_for_each_dev(dev, link) {
3077 			struct scsi_device *sdev;
3078 			int channel = 0, id = 0;
3079 
3080 			if (!ata_dev_enabled(dev) || dev->sdev)
3081 				continue;
3082 
3083 			if (ata_is_host_link(link))
3084 				id = dev->devno;
3085 			else
3086 				channel = link->pmp;
3087 
3088 			sdev = __scsi_add_device(ap->scsi_host, channel, id, 0,
3089 						 NULL);
3090 			if (!IS_ERR(sdev)) {
3091 				dev->sdev = sdev;
3092 				scsi_device_put(sdev);
3093 			}
3094 		}
3095 	}
3096 
3097 	/* If we scanned while EH was in progress or allocation
3098 	 * failure occurred, scan would have failed silently.  Check
3099 	 * whether all devices are attached.
3100 	 */
3101 	ata_port_for_each_link(link, ap) {
3102 		ata_link_for_each_dev(dev, link) {
3103 			if (ata_dev_enabled(dev) && !dev->sdev)
3104 				goto exit_loop;
3105 		}
3106 	}
3107  exit_loop:
3108 	if (!link)
3109 		return;
3110 
3111 	/* we're missing some SCSI devices */
3112 	if (sync) {
3113 		/* If caller requested synchrnous scan && we've made
3114 		 * any progress, sleep briefly and repeat.
3115 		 */
3116 		if (dev != last_failed_dev) {
3117 			msleep(100);
3118 			last_failed_dev = dev;
3119 			goto repeat;
3120 		}
3121 
3122 		/* We might be failing to detect boot device, give it
3123 		 * a few more chances.
3124 		 */
3125 		if (--tries) {
3126 			msleep(100);
3127 			goto repeat;
3128 		}
3129 
3130 		ata_port_printk(ap, KERN_ERR, "WARNING: synchronous SCSI scan "
3131 				"failed without making any progress,\n"
3132 				"                  switching to async\n");
3133 	}
3134 
3135 	queue_delayed_work(ata_aux_wq, &ap->hotplug_task,
3136 			   round_jiffies_relative(HZ));
3137 }
3138 
3139 /**
3140  *	ata_scsi_offline_dev - offline attached SCSI device
3141  *	@dev: ATA device to offline attached SCSI device for
3142  *
3143  *	This function is called from ata_eh_hotplug() and responsible
3144  *	for taking the SCSI device attached to @dev offline.  This
3145  *	function is called with host lock which protects dev->sdev
3146  *	against clearing.
3147  *
3148  *	LOCKING:
3149  *	spin_lock_irqsave(host lock)
3150  *
3151  *	RETURNS:
3152  *	1 if attached SCSI device exists, 0 otherwise.
3153  */
3154 int ata_scsi_offline_dev(struct ata_device *dev)
3155 {
3156 	if (dev->sdev) {
3157 		scsi_device_set_state(dev->sdev, SDEV_OFFLINE);
3158 		return 1;
3159 	}
3160 	return 0;
3161 }
3162 
3163 /**
3164  *	ata_scsi_remove_dev - remove attached SCSI device
3165  *	@dev: ATA device to remove attached SCSI device for
3166  *
3167  *	This function is called from ata_eh_scsi_hotplug() and
3168  *	responsible for removing the SCSI device attached to @dev.
3169  *
3170  *	LOCKING:
3171  *	Kernel thread context (may sleep).
3172  */
3173 static void ata_scsi_remove_dev(struct ata_device *dev)
3174 {
3175 	struct ata_port *ap = dev->link->ap;
3176 	struct scsi_device *sdev;
3177 	unsigned long flags;
3178 
3179 	/* Alas, we need to grab scan_mutex to ensure SCSI device
3180 	 * state doesn't change underneath us and thus
3181 	 * scsi_device_get() always succeeds.  The mutex locking can
3182 	 * be removed if there is __scsi_device_get() interface which
3183 	 * increments reference counts regardless of device state.
3184 	 */
3185 	mutex_lock(&ap->scsi_host->scan_mutex);
3186 	spin_lock_irqsave(ap->lock, flags);
3187 
3188 	/* clearing dev->sdev is protected by host lock */
3189 	sdev = dev->sdev;
3190 	dev->sdev = NULL;
3191 
3192 	if (sdev) {
3193 		/* If user initiated unplug races with us, sdev can go
3194 		 * away underneath us after the host lock and
3195 		 * scan_mutex are released.  Hold onto it.
3196 		 */
3197 		if (scsi_device_get(sdev) == 0) {
3198 			/* The following ensures the attached sdev is
3199 			 * offline on return from ata_scsi_offline_dev()
3200 			 * regardless it wins or loses the race
3201 			 * against this function.
3202 			 */
3203 			scsi_device_set_state(sdev, SDEV_OFFLINE);
3204 		} else {
3205 			WARN_ON(1);
3206 			sdev = NULL;
3207 		}
3208 	}
3209 
3210 	spin_unlock_irqrestore(ap->lock, flags);
3211 	mutex_unlock(&ap->scsi_host->scan_mutex);
3212 
3213 	if (sdev) {
3214 		ata_dev_printk(dev, KERN_INFO, "detaching (SCSI %s)\n",
3215 			       sdev->sdev_gendev.bus_id);
3216 
3217 		scsi_remove_device(sdev);
3218 		scsi_device_put(sdev);
3219 	}
3220 }
3221 
3222 static void ata_scsi_handle_link_detach(struct ata_link *link)
3223 {
3224 	struct ata_port *ap = link->ap;
3225 	struct ata_device *dev;
3226 
3227 	ata_link_for_each_dev(dev, link) {
3228 		unsigned long flags;
3229 
3230 		if (!(dev->flags & ATA_DFLAG_DETACHED))
3231 			continue;
3232 
3233 		spin_lock_irqsave(ap->lock, flags);
3234 		dev->flags &= ~ATA_DFLAG_DETACHED;
3235 		spin_unlock_irqrestore(ap->lock, flags);
3236 
3237 		ata_scsi_remove_dev(dev);
3238 	}
3239 }
3240 
3241 /**
3242  *	ata_scsi_media_change_notify - send media change event
3243  *	@dev: Pointer to the disk device with media change event
3244  *
3245  *	Tell the block layer to send a media change notification
3246  *	event.
3247  *
3248  * 	LOCKING:
3249  * 	spin_lock_irqsave(host lock)
3250  */
3251 void ata_scsi_media_change_notify(struct ata_device *dev)
3252 {
3253 #ifdef OTHER_AN_PATCHES_HAVE_BEEN_APPLIED
3254 	if (dev->sdev)
3255 		scsi_device_event_notify(dev->sdev, SDEV_MEDIA_CHANGE);
3256 #endif
3257 }
3258 
3259 /**
3260  *	ata_scsi_hotplug - SCSI part of hotplug
3261  *	@work: Pointer to ATA port to perform SCSI hotplug on
3262  *
3263  *	Perform SCSI part of hotplug.  It's executed from a separate
3264  *	workqueue after EH completes.  This is necessary because SCSI
3265  *	hot plugging requires working EH and hot unplugging is
3266  *	synchronized with hot plugging with a mutex.
3267  *
3268  *	LOCKING:
3269  *	Kernel thread context (may sleep).
3270  */
3271 void ata_scsi_hotplug(struct work_struct *work)
3272 {
3273 	struct ata_port *ap =
3274 		container_of(work, struct ata_port, hotplug_task.work);
3275 	int i;
3276 
3277 	if (ap->pflags & ATA_PFLAG_UNLOADING) {
3278 		DPRINTK("ENTER/EXIT - unloading\n");
3279 		return;
3280 	}
3281 
3282 	DPRINTK("ENTER\n");
3283 
3284 	/* Unplug detached devices.  We cannot use link iterator here
3285 	 * because PMP links have to be scanned even if PMP is
3286 	 * currently not attached.  Iterate manually.
3287 	 */
3288 	ata_scsi_handle_link_detach(&ap->link);
3289 	if (ap->pmp_link)
3290 		for (i = 0; i < SATA_PMP_MAX_PORTS; i++)
3291 			ata_scsi_handle_link_detach(&ap->pmp_link[i]);
3292 
3293 	/* scan for new ones */
3294 	ata_scsi_scan_host(ap, 0);
3295 
3296 	DPRINTK("EXIT\n");
3297 }
3298 
3299 /**
3300  *	ata_scsi_user_scan - indication for user-initiated bus scan
3301  *	@shost: SCSI host to scan
3302  *	@channel: Channel to scan
3303  *	@id: ID to scan
3304  *	@lun: LUN to scan
3305  *
3306  *	This function is called when user explicitly requests bus
3307  *	scan.  Set probe pending flag and invoke EH.
3308  *
3309  *	LOCKING:
3310  *	SCSI layer (we don't care)
3311  *
3312  *	RETURNS:
3313  *	Zero.
3314  */
3315 static int ata_scsi_user_scan(struct Scsi_Host *shost, unsigned int channel,
3316 			      unsigned int id, unsigned int lun)
3317 {
3318 	struct ata_port *ap = ata_shost_to_port(shost);
3319 	unsigned long flags;
3320 	int devno, rc = 0;
3321 
3322 	if (!ap->ops->error_handler)
3323 		return -EOPNOTSUPP;
3324 
3325 	if (lun != SCAN_WILD_CARD && lun)
3326 		return -EINVAL;
3327 
3328 	if (ap->nr_pmp_links == 0) {
3329 		if (channel != SCAN_WILD_CARD && channel)
3330 			return -EINVAL;
3331 		devno = id;
3332 	} else {
3333 		if (id != SCAN_WILD_CARD && id)
3334 			return -EINVAL;
3335 		devno = channel;
3336 	}
3337 
3338 	spin_lock_irqsave(ap->lock, flags);
3339 
3340 	if (devno == SCAN_WILD_CARD) {
3341 		struct ata_link *link;
3342 
3343 		ata_port_for_each_link(link, ap) {
3344 			struct ata_eh_info *ehi = &link->eh_info;
3345 			ehi->probe_mask |= (1 << ata_link_max_devices(link)) - 1;
3346 			ehi->action |= ATA_EH_SOFTRESET;
3347 		}
3348 	} else {
3349 		struct ata_device *dev = ata_find_dev(ap, devno);
3350 
3351 		if (dev) {
3352 			struct ata_eh_info *ehi = &dev->link->eh_info;
3353 			ehi->probe_mask |= 1 << dev->devno;
3354 			ehi->action |= ATA_EH_SOFTRESET;
3355 			ehi->flags |= ATA_EHI_RESUME_LINK;
3356 		} else
3357 			rc = -EINVAL;
3358 	}
3359 
3360 	if (rc == 0) {
3361 		ata_port_schedule_eh(ap);
3362 		spin_unlock_irqrestore(ap->lock, flags);
3363 		ata_port_wait_eh(ap);
3364 	} else
3365 		spin_unlock_irqrestore(ap->lock, flags);
3366 
3367 	return rc;
3368 }
3369 
3370 /**
3371  *	ata_scsi_dev_rescan - initiate scsi_rescan_device()
3372  *	@work: Pointer to ATA port to perform scsi_rescan_device()
3373  *
3374  *	After ATA pass thru (SAT) commands are executed successfully,
3375  *	libata need to propagate the changes to SCSI layer.  This
3376  *	function must be executed from ata_aux_wq such that sdev
3377  *	attach/detach don't race with rescan.
3378  *
3379  *	LOCKING:
3380  *	Kernel thread context (may sleep).
3381  */
3382 void ata_scsi_dev_rescan(struct work_struct *work)
3383 {
3384 	struct ata_port *ap =
3385 		container_of(work, struct ata_port, scsi_rescan_task);
3386 	struct ata_link *link;
3387 	struct ata_device *dev;
3388 	unsigned long flags;
3389 
3390 	spin_lock_irqsave(ap->lock, flags);
3391 
3392 	ata_port_for_each_link(link, ap) {
3393 		ata_link_for_each_dev(dev, link) {
3394 			struct scsi_device *sdev = dev->sdev;
3395 
3396 			if (!ata_dev_enabled(dev) || !sdev)
3397 				continue;
3398 			if (scsi_device_get(sdev))
3399 				continue;
3400 
3401 			spin_unlock_irqrestore(ap->lock, flags);
3402 			scsi_rescan_device(&(sdev->sdev_gendev));
3403 			scsi_device_put(sdev);
3404 			spin_lock_irqsave(ap->lock, flags);
3405 		}
3406 	}
3407 
3408 	spin_unlock_irqrestore(ap->lock, flags);
3409 }
3410 
3411 /**
3412  *	ata_sas_port_alloc - Allocate port for a SAS attached SATA device
3413  *	@host: ATA host container for all SAS ports
3414  *	@port_info: Information from low-level host driver
3415  *	@shost: SCSI host that the scsi device is attached to
3416  *
3417  *	LOCKING:
3418  *	PCI/etc. bus probe sem.
3419  *
3420  *	RETURNS:
3421  *	ata_port pointer on success / NULL on failure.
3422  */
3423 
3424 struct ata_port *ata_sas_port_alloc(struct ata_host *host,
3425 				    struct ata_port_info *port_info,
3426 				    struct Scsi_Host *shost)
3427 {
3428 	struct ata_port *ap;
3429 
3430 	ap = ata_port_alloc(host);
3431 	if (!ap)
3432 		return NULL;
3433 
3434 	ap->port_no = 0;
3435 	ap->lock = shost->host_lock;
3436 	ap->pio_mask = port_info->pio_mask;
3437 	ap->mwdma_mask = port_info->mwdma_mask;
3438 	ap->udma_mask = port_info->udma_mask;
3439 	ap->flags |= port_info->flags;
3440 	ap->ops = port_info->port_ops;
3441 	ap->cbl = ATA_CBL_SATA;
3442 
3443 	return ap;
3444 }
3445 EXPORT_SYMBOL_GPL(ata_sas_port_alloc);
3446 
3447 /**
3448  *	ata_sas_port_start - Set port up for dma.
3449  *	@ap: Port to initialize
3450  *
3451  *	Called just after data structures for each port are
3452  *	initialized.  Allocates DMA pad.
3453  *
3454  *	May be used as the port_start() entry in ata_port_operations.
3455  *
3456  *	LOCKING:
3457  *	Inherited from caller.
3458  */
3459 int ata_sas_port_start(struct ata_port *ap)
3460 {
3461 	return ata_pad_alloc(ap, ap->dev);
3462 }
3463 EXPORT_SYMBOL_GPL(ata_sas_port_start);
3464 
3465 /**
3466  *	ata_port_stop - Undo ata_sas_port_start()
3467  *	@ap: Port to shut down
3468  *
3469  *	Frees the DMA pad.
3470  *
3471  *	May be used as the port_stop() entry in ata_port_operations.
3472  *
3473  *	LOCKING:
3474  *	Inherited from caller.
3475  */
3476 
3477 void ata_sas_port_stop(struct ata_port *ap)
3478 {
3479 	ata_pad_free(ap, ap->dev);
3480 }
3481 EXPORT_SYMBOL_GPL(ata_sas_port_stop);
3482 
3483 /**
3484  *	ata_sas_port_init - Initialize a SATA device
3485  *	@ap: SATA port to initialize
3486  *
3487  *	LOCKING:
3488  *	PCI/etc. bus probe sem.
3489  *
3490  *	RETURNS:
3491  *	Zero on success, non-zero on error.
3492  */
3493 
3494 int ata_sas_port_init(struct ata_port *ap)
3495 {
3496 	int rc = ap->ops->port_start(ap);
3497 
3498 	if (!rc) {
3499 		ap->print_id = ata_print_id++;
3500 		rc = ata_bus_probe(ap);
3501 	}
3502 
3503 	return rc;
3504 }
3505 EXPORT_SYMBOL_GPL(ata_sas_port_init);
3506 
3507 /**
3508  *	ata_sas_port_destroy - Destroy a SATA port allocated by ata_sas_port_alloc
3509  *	@ap: SATA port to destroy
3510  *
3511  */
3512 
3513 void ata_sas_port_destroy(struct ata_port *ap)
3514 {
3515 	if (ap->ops->port_stop)
3516 		ap->ops->port_stop(ap);
3517 	kfree(ap);
3518 }
3519 EXPORT_SYMBOL_GPL(ata_sas_port_destroy);
3520 
3521 /**
3522  *	ata_sas_slave_configure - Default slave_config routine for libata devices
3523  *	@sdev: SCSI device to configure
3524  *	@ap: ATA port to which SCSI device is attached
3525  *
3526  *	RETURNS:
3527  *	Zero.
3528  */
3529 
3530 int ata_sas_slave_configure(struct scsi_device *sdev, struct ata_port *ap)
3531 {
3532 	ata_scsi_sdev_config(sdev);
3533 	ata_scsi_dev_config(sdev, ap->link.device);
3534 	return 0;
3535 }
3536 EXPORT_SYMBOL_GPL(ata_sas_slave_configure);
3537 
3538 /**
3539  *	ata_sas_queuecmd - Issue SCSI cdb to libata-managed device
3540  *	@cmd: SCSI command to be sent
3541  *	@done: Completion function, called when command is complete
3542  *	@ap:	ATA port to which the command is being sent
3543  *
3544  *	RETURNS:
3545  *	Return value from __ata_scsi_queuecmd() if @cmd can be queued,
3546  *	0 otherwise.
3547  */
3548 
3549 int ata_sas_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *),
3550 		     struct ata_port *ap)
3551 {
3552 	int rc = 0;
3553 
3554 	ata_scsi_dump_cdb(ap, cmd);
3555 
3556 	if (likely(ata_scsi_dev_enabled(ap->link.device)))
3557 		rc = __ata_scsi_queuecmd(cmd, done, ap->link.device);
3558 	else {
3559 		cmd->result = (DID_BAD_TARGET << 16);
3560 		done(cmd);
3561 	}
3562 	return rc;
3563 }
3564 EXPORT_SYMBOL_GPL(ata_sas_queuecmd);
3565