1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/*
3	* libata-scsi.c - helper library for ATA
4	*
5	* Copyright 2003-2004 Red Hat, Inc. All rights reserved.
6	* Copyright 2003-2004 Jeff Garzik
7	*
8	* libata documentation is available via 'make {ps|pdf}docs',
9	* as Documentation/driver-api/libata.rst
10	*
11	* Hardware documentation available from
12	* - http://www.t10.org/
13	* - http://www.t13.org/
14	*/
15
16	#include <linux/compat.h>
17	#include <linux/slab.h>
18	#include <linux/kernel.h>
19	#include <linux/blkdev.h>
20	#include <linux/spinlock.h>
21	#include <linux/export.h>
22	#include <scsi/scsi.h>
23	#include <scsi/scsi_host.h>
24	#include <scsi/scsi_cmnd.h>
25	#include <scsi/scsi_eh.h>
26	#include <scsi/scsi_device.h>
27	#include <scsi/scsi_tcq.h>
28	#include <scsi/scsi_transport.h>
29	#include <linux/libata.h>
30	#include <linux/hdreg.h>
31	#include <linux/uaccess.h>
32	#include <linux/suspend.h>
33	#include <asm/unaligned.h>
34	#include <linux/ioprio.h>
35	#include <linux/of.h>
36
37	#include "libata.h"
38	#include "libata-transport.h"
39
40	#define ATA_SCSI_RBUF_SIZE 2048
41
42	static DEFINE_SPINLOCK(ata_scsi_rbuf_lock);
43	static u8 ata_scsi_rbuf[ATA_SCSI_RBUF_SIZE];
44
45	typedef unsigned int (*ata_xlat_func_t)(struct ata_queued_cmd *qc);
46
47	static struct ata_device *__ata_scsi_find_dev(struct ata_port *ap,
48	const struct scsi_device *scsidev);
49
50	#define RW_RECOVERY_MPAGE 0x1
51	#define RW_RECOVERY_MPAGE_LEN 12
52	#define CACHE_MPAGE 0x8
53	#define CACHE_MPAGE_LEN 20
54	#define CONTROL_MPAGE 0xa
55	#define CONTROL_MPAGE_LEN 12
56	#define ALL_MPAGES 0x3f
57	#define ALL_SUB_MPAGES 0xff
58	#define CDL_T2A_SUB_MPAGE 0x07
59	#define CDL_T2B_SUB_MPAGE 0x08
60	#define CDL_T2_SUB_MPAGE_LEN 232
61	#define ATA_FEATURE_SUB_MPAGE 0xf2
62	#define ATA_FEATURE_SUB_MPAGE_LEN 16
63
64	static const u8 def_rw_recovery_mpage[RW_RECOVERY_MPAGE_LEN] = {
65	RW_RECOVERY_MPAGE,
66	RW_RECOVERY_MPAGE_LEN - 2,
67	(1 << 7), /* AWRE */
68	0, /* read retry count */
69	0, 0, 0, 0,
70	0, /* write retry count */
71	0, 0, 0
72	};
73
74	static const u8 def_cache_mpage[CACHE_MPAGE_LEN] = {
75	CACHE_MPAGE,
76	CACHE_MPAGE_LEN - 2,
77	0, /* contains WCE, needs to be 0 for logic */
78	0, 0, 0, 0, 0, 0, 0, 0, 0,
79	0, /* contains DRA, needs to be 0 for logic */
80	0, 0, 0, 0, 0, 0, 0
81	};
82
83	static const u8 def_control_mpage[CONTROL_MPAGE_LEN] = {
84	CONTROL_MPAGE,
85	CONTROL_MPAGE_LEN - 2,
86	2, /* DSENSE=0, GLTSD=1 */
87	0, /* [QAM+QERR may be 1, see 05-359r1] */
88	0, 0, 0, 0, 0xff, 0xff,
89	0, 30 /* extended self test time, see 05-359r1 */
90	};
91
92	static ssize_t ata_scsi_park_show(struct device *device,
93	struct device_attribute *attr, char *buf)
94	{
95	struct scsi_device *sdev = to_scsi_device(device);
96	struct ata_port *ap;
97	struct ata_link *link;
98	struct ata_device *dev;
99	unsigned long now;
100	unsigned int msecs;
101	int rc = 0;
102
103	ap = ata_shost_to_port(host: sdev->host);
104
105	spin_lock_irq(lock: ap->lock);
106	dev = ata_scsi_find_dev(ap, scsidev: sdev);
107	if (!dev) {
108	rc = -ENODEV;
109	goto unlock;
110	}
111	if (dev->flags & ATA_DFLAG_NO_UNLOAD) {
112	rc = -EOPNOTSUPP;
113	goto unlock;
114	}
115
116	link = dev->link;
117	now = jiffies;
118	if (ap->pflags & ATA_PFLAG_EH_IN_PROGRESS &&
119	link->eh_context.unloaded_mask & (1 << dev->devno) &&
120	time_after(dev->unpark_deadline, now))
121	msecs = jiffies_to_msecs(j: dev->unpark_deadline - now);
122	else
123	msecs = 0;
124
125	unlock:
126	spin_unlock_irq(lock: ap->lock);
127
128	return rc ? rc : sysfs_emit(buf, fmt: "%u\n", msecs);
129	}
130
131	static ssize_t ata_scsi_park_store(struct device *device,
132	struct device_attribute *attr,
133	const char *buf, size_t len)
134	{
135	struct scsi_device *sdev = to_scsi_device(device);
136	struct ata_port *ap;
137	struct ata_device *dev;
138	int input;
139	unsigned long flags;
140	int rc;
141
142	rc = kstrtoint(s: buf, base: 10, res: &input);
143	if (rc)
144	return rc;
145	if (input < -2)
146	return -EINVAL;
147	if (input > ATA_TMOUT_MAX_PARK) {
148	rc = -EOVERFLOW;
149	input = ATA_TMOUT_MAX_PARK;
150	}
151
152	ap = ata_shost_to_port(host: sdev->host);
153
154	spin_lock_irqsave(ap->lock, flags);
155	dev = ata_scsi_find_dev(ap, scsidev: sdev);
156	if (unlikely(!dev)) {
157	rc = -ENODEV;
158	goto unlock;
159	}
160	if (dev->class != ATA_DEV_ATA &&
161	dev->class != ATA_DEV_ZAC) {
162	rc = -EOPNOTSUPP;
163	goto unlock;
164	}
165
166	if (input >= 0) {
167	if (dev->flags & ATA_DFLAG_NO_UNLOAD) {
168	rc = -EOPNOTSUPP;
169	goto unlock;
170	}
171
172	dev->unpark_deadline = ata_deadline(from_jiffies: jiffies, timeout_msecs: input);
173	dev->link->eh_info.dev_action[dev->devno] |= ATA_EH_PARK;
174	ata_port_schedule_eh(ap);
175	complete(&ap->park_req_pending);
176	} else {
177	switch (input) {
178	case -1:
179	dev->flags &= ~ATA_DFLAG_NO_UNLOAD;
180	break;
181	case -2:
182	dev->flags |= ATA_DFLAG_NO_UNLOAD;
183	break;
184	}
185	}
186	unlock:
187	spin_unlock_irqrestore(lock: ap->lock, flags);
188
189	return rc ? rc : len;
190	}
191	DEVICE_ATTR(unload_heads, S_IRUGO | S_IWUSR,
192	ata_scsi_park_show, ata_scsi_park_store);
193	EXPORT_SYMBOL_GPL(dev_attr_unload_heads);
194
195	bool ata_scsi_sense_is_valid(u8 sk, u8 asc, u8 ascq)
196	{
197	/*
198	* If sk == NO_SENSE, and asc + ascq == NO ADDITIONAL SENSE INFORMATION,
199	* then there is no sense data to add.
200	*/
201	if (sk == 0 && asc == 0 && ascq == 0)
202	return false;
203
204	/* If sk > COMPLETED, sense data is bogus. */
205	if (sk > COMPLETED)
206	return false;
207
208	return true;
209	}
210
211	void ata_scsi_set_sense(struct ata_device *dev, struct scsi_cmnd *cmd,
212	u8 sk, u8 asc, u8 ascq)
213	{
214	bool d_sense = (dev->flags & ATA_DFLAG_D_SENSE);
215
216	scsi_build_sense(scmd: cmd, desc: d_sense, key: sk, asc, ascq);
217	}
218
219	void ata_scsi_set_sense_information(struct ata_device *dev,
220	struct scsi_cmnd *cmd,
221	const struct ata_taskfile *tf)
222	{
223	u64 information;
224
225	information = ata_tf_read_block(tf, dev);
226	if (information == U64_MAX)
227	return;
228
229	scsi_set_sense_information(buf: cmd->sense_buffer,
230	SCSI_SENSE_BUFFERSIZE, info: information);
231	}
232
233	static void ata_scsi_set_invalid_field(struct ata_device *dev,
234	struct scsi_cmnd *cmd, u16 field, u8 bit)
235	{
236	ata_scsi_set_sense(dev, cmd, ILLEGAL_REQUEST, asc: 0x24, ascq: 0x0);
237	/* "Invalid field in CDB" */
238	scsi_set_sense_field_pointer(buf: cmd->sense_buffer, SCSI_SENSE_BUFFERSIZE,
239	fp: field, bp: bit, cd: 1);
240	}
241
242	static void ata_scsi_set_invalid_parameter(struct ata_device *dev,
243	struct scsi_cmnd *cmd, u16 field)
244	{
245	/* "Invalid field in parameter list" */
246	ata_scsi_set_sense(dev, cmd, ILLEGAL_REQUEST, asc: 0x26, ascq: 0x0);
247	scsi_set_sense_field_pointer(buf: cmd->sense_buffer, SCSI_SENSE_BUFFERSIZE,
248	fp: field, bp: 0xff, cd: 0);
249	}
250
251	static struct attribute *ata_common_sdev_attrs[] = {
252	&dev_attr_unload_heads.attr,
253	NULL
254	};
255
256	static const struct attribute_group ata_common_sdev_attr_group = {
257	.attrs = ata_common_sdev_attrs
258	};
259
260	const struct attribute_group *ata_common_sdev_groups[] = {
261	&ata_common_sdev_attr_group,
262	NULL
263	};
264	EXPORT_SYMBOL_GPL(ata_common_sdev_groups);
265
266	/**
267	* ata_std_bios_param - generic bios head/sector/cylinder calculator used by sd.
268	* @sdev: SCSI device for which BIOS geometry is to be determined
269	* @bdev: block device associated with @sdev
270	* @capacity: capacity of SCSI device
271	* @geom: location to which geometry will be output
272	*
273	* Generic bios head/sector/cylinder calculator
274	* used by sd. Most BIOSes nowadays expect a XXX/255/16 (CHS)
275	* mapping. Some situations may arise where the disk is not
276	* bootable if this is not used.
277	*
278	* LOCKING:
279	* Defined by the SCSI layer. We don't really care.
280	*
281	* RETURNS:
282	* Zero.
283	*/
284	int ata_std_bios_param(struct scsi_device *sdev, struct block_device *bdev,
285	sector_t capacity, int geom[])
286	{
287	geom[0] = 255;
288	geom[1] = 63;
289	sector_div(capacity, 255*63);
290	geom[2] = capacity;
291
292	return 0;
293	}
294	EXPORT_SYMBOL_GPL(ata_std_bios_param);
295
296	/**
297	* ata_scsi_unlock_native_capacity - unlock native capacity
298	* @sdev: SCSI device to adjust device capacity for
299	*
300	* This function is called if a partition on @sdev extends beyond
301	* the end of the device. It requests EH to unlock HPA.
302	*
303	* LOCKING:
304	* Defined by the SCSI layer. Might sleep.
305	*/
306	void ata_scsi_unlock_native_capacity(struct scsi_device *sdev)
307	{
308	struct ata_port *ap = ata_shost_to_port(host: sdev->host);
309	struct ata_device *dev;
310	unsigned long flags;
311
312	spin_lock_irqsave(ap->lock, flags);
313
314	dev = ata_scsi_find_dev(ap, scsidev: sdev);
315	if (dev && dev->n_sectors < dev->n_native_sectors) {
316	dev->flags |= ATA_DFLAG_UNLOCK_HPA;
317	dev->link->eh_info.action |= ATA_EH_RESET;
318	ata_port_schedule_eh(ap);
319	}
320
321	spin_unlock_irqrestore(lock: ap->lock, flags);
322	ata_port_wait_eh(ap);
323	}
324	EXPORT_SYMBOL_GPL(ata_scsi_unlock_native_capacity);
325
326	/**
327	* ata_get_identity - Handler for HDIO_GET_IDENTITY ioctl
328	* @ap: target port
329	* @sdev: SCSI device to get identify data for
330	* @arg: User buffer area for identify data
331	*
332	* LOCKING:
333	* Defined by the SCSI layer. We don't really care.
334	*
335	* RETURNS:
336	* Zero on success, negative errno on error.
337	*/
338	static int ata_get_identity(struct ata_port *ap, struct scsi_device *sdev,
339	void __user *arg)
340	{
341	struct ata_device *dev = ata_scsi_find_dev(ap, scsidev: sdev);
342	u16 __user *dst = arg;
343	char buf[40];
344
345	if (!dev)
346	return -ENOMSG;
347
348	if (copy_to_user(to: dst, from: dev->id, n: ATA_ID_WORDS * sizeof(u16)))
349	return -EFAULT;
350
351	ata_id_string(id: dev->id, s: buf, ofs: ATA_ID_PROD, len: ATA_ID_PROD_LEN);
352	if (copy_to_user(to: dst + ATA_ID_PROD, from: buf, n: ATA_ID_PROD_LEN))
353	return -EFAULT;
354
355	ata_id_string(id: dev->id, s: buf, ofs: ATA_ID_FW_REV, len: ATA_ID_FW_REV_LEN);
356	if (copy_to_user(to: dst + ATA_ID_FW_REV, from: buf, n: ATA_ID_FW_REV_LEN))
357	return -EFAULT;
358
359	ata_id_string(id: dev->id, s: buf, ofs: ATA_ID_SERNO, len: ATA_ID_SERNO_LEN);
360	if (copy_to_user(to: dst + ATA_ID_SERNO, from: buf, n: ATA_ID_SERNO_LEN))
361	return -EFAULT;
362
363	return 0;
364	}
365
366	/**
367	* ata_cmd_ioctl - Handler for HDIO_DRIVE_CMD ioctl
368	* @scsidev: Device to which we are issuing command
369	* @arg: User provided data for issuing command
370	*
371	* LOCKING:
372	* Defined by the SCSI layer. We don't really care.
373	*
374	* RETURNS:
375	* Zero on success, negative errno on error.
376	*/
377	int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg)
378	{
379	int rc = 0;
380	u8 sensebuf[SCSI_SENSE_BUFFERSIZE];
381	u8 scsi_cmd[MAX_COMMAND_SIZE];
382	u8 args[4], *argbuf = NULL;
383	int argsize = 0;
384	struct scsi_sense_hdr sshdr;
385	const struct scsi_exec_args exec_args = {
386	.sshdr = &sshdr,
387	.sense = sensebuf,
388	.sense_len = sizeof(sensebuf),
389	};
390	int cmd_result;
391
392	if (arg == NULL)
393	return -EINVAL;
394
395	if (copy_from_user(to: args, from: arg, n: sizeof(args)))
396	return -EFAULT;
397
398	memset(sensebuf, 0, sizeof(sensebuf));
399	memset(scsi_cmd, 0, sizeof(scsi_cmd));
400
401	if (args[3]) {
402	argsize = ATA_SECT_SIZE * args[3];
403	argbuf = kmalloc(size: argsize, GFP_KERNEL);
404	if (argbuf == NULL) {
405	rc = -ENOMEM;
406	goto error;
407	}
408
409	scsi_cmd[1] = (4 << 1); /* PIO Data-in */
410	scsi_cmd[2] = 0x0e; /* no off.line or cc, read from dev,
411	block count in sector count field */
412	} else {
413	scsi_cmd[1] = (3 << 1); /* Non-data */
414	scsi_cmd[2] = 0x20; /* cc but no off.line or data xfer */
415	}
416
417	scsi_cmd[0] = ATA_16;
418
419	scsi_cmd[4] = args[2];
420	if (args[0] == ATA_CMD_SMART) { /* hack -- ide driver does this too */
421	scsi_cmd[6] = args[3];
422	scsi_cmd[8] = args[1];
423	scsi_cmd[10] = ATA_SMART_LBAM_PASS;
424	scsi_cmd[12] = ATA_SMART_LBAH_PASS;
425	} else {
426	scsi_cmd[6] = args[1];
427	}
428	scsi_cmd[14] = args[0];
429
430	/* Good values for timeout and retries? Values below
431	from scsi_ioctl_send_command() for default case... */
432	cmd_result = scsi_execute_cmd(sdev: scsidev, cmd: scsi_cmd, opf: REQ_OP_DRV_IN, buffer: argbuf,
433	bufflen: argsize, timeout: 10 * HZ, retries: 5, args: &exec_args);
434	if (cmd_result < 0) {
435	rc = cmd_result;
436	goto error;
437	}
438	if (scsi_sense_valid(sshdr: &sshdr)) {/* sense data available */
439	u8 *desc = sensebuf + 8;
440
441	/* If we set cc then ATA pass-through will cause a
442	* check condition even if no error. Filter that. */
443	if (scsi_status_is_check_condition(status: cmd_result)) {
444	if (sshdr.sense_key == RECOVERED_ERROR &&
445	sshdr.asc == 0 && sshdr.ascq == 0x1d)
446	cmd_result &= ~SAM_STAT_CHECK_CONDITION;
447	}
448
449	/* Send userspace a few ATA registers (same as drivers/ide) */
450	if (sensebuf[0] == 0x72 && /* format is "descriptor" */
451	desc[0] == 0x09) { /* code is "ATA Descriptor" */
452	args[0] = desc[13]; /* status */
453	args[1] = desc[3]; /* error */
454	args[2] = desc[5]; /* sector count (0:7) */
455	if (copy_to_user(to: arg, from: args, n: sizeof(args)))
456	rc = -EFAULT;
457	}
458	}
459
460
461	if (cmd_result) {
462	rc = -EIO;
463	goto error;
464	}
465
466	if ((argbuf)
467	&& copy_to_user(to: arg + sizeof(args), from: argbuf, n: argsize))
468	rc = -EFAULT;
469	error:
470	kfree(objp: argbuf);
471	return rc;
472	}
473
474	/**
475	* ata_task_ioctl - Handler for HDIO_DRIVE_TASK ioctl
476	* @scsidev: Device to which we are issuing command
477	* @arg: User provided data for issuing command
478	*
479	* LOCKING:
480	* Defined by the SCSI layer. We don't really care.
481	*
482	* RETURNS:
483	* Zero on success, negative errno on error.
484	*/
485	int ata_task_ioctl(struct scsi_device *scsidev, void __user *arg)
486	{
487	int rc = 0;
488	u8 sensebuf[SCSI_SENSE_BUFFERSIZE];
489	u8 scsi_cmd[MAX_COMMAND_SIZE];
490	u8 args[7];
491	struct scsi_sense_hdr sshdr;
492	int cmd_result;
493	const struct scsi_exec_args exec_args = {
494	.sshdr = &sshdr,
495	.sense = sensebuf,
496	.sense_len = sizeof(sensebuf),
497	};
498
499	if (arg == NULL)
500	return -EINVAL;
501
502	if (copy_from_user(to: args, from: arg, n: sizeof(args)))
503	return -EFAULT;
504
505	memset(sensebuf, 0, sizeof(sensebuf));
506	memset(scsi_cmd, 0, sizeof(scsi_cmd));
507	scsi_cmd[0] = ATA_16;
508	scsi_cmd[1] = (3 << 1); /* Non-data */
509	scsi_cmd[2] = 0x20; /* cc but no off.line or data xfer */
510	scsi_cmd[4] = args[1];
511	scsi_cmd[6] = args[2];
512	scsi_cmd[8] = args[3];
513	scsi_cmd[10] = args[4];
514	scsi_cmd[12] = args[5];
515	scsi_cmd[13] = args[6] & 0x4f;
516	scsi_cmd[14] = args[0];
517
518	/* Good values for timeout and retries? Values below
519	from scsi_ioctl_send_command() for default case... */
520	cmd_result = scsi_execute_cmd(sdev: scsidev, cmd: scsi_cmd, opf: REQ_OP_DRV_IN, NULL,
521	bufflen: 0, timeout: 10 * HZ, retries: 5, args: &exec_args);
522	if (cmd_result < 0) {
523	rc = cmd_result;
524	goto error;
525	}
526	if (scsi_sense_valid(sshdr: &sshdr)) {/* sense data available */
527	u8 *desc = sensebuf + 8;
528
529	/* If we set cc then ATA pass-through will cause a
530	* check condition even if no error. Filter that. */
531	if (cmd_result & SAM_STAT_CHECK_CONDITION) {
532	if (sshdr.sense_key == RECOVERED_ERROR &&
533	sshdr.asc == 0 && sshdr.ascq == 0x1d)
534	cmd_result &= ~SAM_STAT_CHECK_CONDITION;
535	}
536
537	/* Send userspace ATA registers */
538	if (sensebuf[0] == 0x72 && /* format is "descriptor" */
539	desc[0] == 0x09) {/* code is "ATA Descriptor" */
540	args[0] = desc[13]; /* status */
541	args[1] = desc[3]; /* error */
542	args[2] = desc[5]; /* sector count (0:7) */
543	args[3] = desc[7]; /* lbal */
544	args[4] = desc[9]; /* lbam */
545	args[5] = desc[11]; /* lbah */
546	args[6] = desc[12]; /* select */
547	if (copy_to_user(to: arg, from: args, n: sizeof(args)))
548	rc = -EFAULT;
549	}
550	}
551
552	if (cmd_result) {
553	rc = -EIO;
554	goto error;
555	}
556
557	error:
558	return rc;
559	}
560
561	static bool ata_ioc32(struct ata_port *ap)
562	{
563	if (ap->flags & ATA_FLAG_PIO_DMA)
564	return true;
565	if (ap->pflags & ATA_PFLAG_PIO32)
566	return true;
567	return false;
568	}
569
570	/*
571	* This handles both native and compat commands, so anything added
572	* here must have a compatible argument, or check in_compat_syscall()
573	*/
574	int ata_sas_scsi_ioctl(struct ata_port *ap, struct scsi_device *scsidev,
575	unsigned int cmd, void __user *arg)
576	{
577	unsigned long val;
578	int rc = -EINVAL;
579	unsigned long flags;
580
581	switch (cmd) {
582	case HDIO_GET_32BIT:
583	spin_lock_irqsave(ap->lock, flags);
584	val = ata_ioc32(ap);
585	spin_unlock_irqrestore(lock: ap->lock, flags);
586	#ifdef CONFIG_COMPAT
587	if (in_compat_syscall())
588	return put_user(val, (compat_ulong_t __user *)arg);
589	#endif
590	return put_user(val, (unsigned long __user *)arg);
591
592	case HDIO_SET_32BIT:
593	val = (unsigned long) arg;
594	rc = 0;
595	spin_lock_irqsave(ap->lock, flags);
596	if (ap->pflags & ATA_PFLAG_PIO32CHANGE) {
597	if (val)
598	ap->pflags |= ATA_PFLAG_PIO32;
599	else
600	ap->pflags &= ~ATA_PFLAG_PIO32;
601	} else {
602	if (val != ata_ioc32(ap))
603	rc = -EINVAL;
604	}
605	spin_unlock_irqrestore(lock: ap->lock, flags);
606	return rc;
607
608	case HDIO_GET_IDENTITY:
609	return ata_get_identity(ap, sdev: scsidev, arg);
610
611	case HDIO_DRIVE_CMD:
612	if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
613	return -EACCES;
614	return ata_cmd_ioctl(scsidev, arg);
615
616	case HDIO_DRIVE_TASK:
617	if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
618	return -EACCES;
619	return ata_task_ioctl(scsidev, arg);
620
621	default:
622	rc = -ENOTTY;
623	break;
624	}
625
626	return rc;
627	}
628	EXPORT_SYMBOL_GPL(ata_sas_scsi_ioctl);
629
630	int ata_scsi_ioctl(struct scsi_device *scsidev, unsigned int cmd,
631	void __user *arg)
632	{
633	return ata_sas_scsi_ioctl(ata_shost_to_port(host: scsidev->host),
634	scsidev, cmd, arg);
635	}
636	EXPORT_SYMBOL_GPL(ata_scsi_ioctl);
637
638	/**
639	* ata_scsi_qc_new - acquire new ata_queued_cmd reference
640	* @dev: ATA device to which the new command is attached
641	* @cmd: SCSI command that originated this ATA command
642	*
643	* Obtain a reference to an unused ata_queued_cmd structure,
644	* which is the basic libata structure representing a single
645	* ATA command sent to the hardware.
646	*
647	* If a command was available, fill in the SCSI-specific
648	* portions of the structure with information on the
649	* current command.
650	*
651	* LOCKING:
652	* spin_lock_irqsave(host lock)
653	*
654	* RETURNS:
655	* Command allocated, or %NULL if none available.
656	*/
657	static struct ata_queued_cmd *ata_scsi_qc_new(struct ata_device *dev,
658	struct scsi_cmnd *cmd)
659	{
660	struct ata_port *ap = dev->link->ap;
661	struct ata_queued_cmd *qc;
662	int tag;
663
664	if (unlikely(ata_port_is_frozen(ap)))
665	goto fail;
666
667	if (ap->flags & ATA_FLAG_SAS_HOST) {
668	/*
669	* SAS hosts may queue > ATA_MAX_QUEUE commands so use
670	* unique per-device budget token as a tag.
671	*/
672	if (WARN_ON_ONCE(cmd->budget_token >= ATA_MAX_QUEUE))
673	goto fail;
674	tag = cmd->budget_token;
675	} else {
676	tag = scsi_cmd_to_rq(scmd: cmd)->tag;
677	}
678
679	qc = __ata_qc_from_tag(ap, tag);
680	qc->tag = qc->hw_tag = tag;
681	qc->ap = ap;
682	qc->dev = dev;
683
684	ata_qc_reinit(qc);
685
686	qc->scsicmd = cmd;
687	qc->scsidone = scsi_done;
688
689	qc->sg = scsi_sglist(cmd);
690	qc->n_elem = scsi_sg_count(cmd);
691
692	if (scsi_cmd_to_rq(scmd: cmd)->rq_flags & RQF_QUIET)
693	qc->flags |= ATA_QCFLAG_QUIET;
694
695	return qc;
696
697	fail:
698	set_host_byte(cmd, status: DID_OK);
699	set_status_byte(cmd, status: SAM_STAT_TASK_SET_FULL);
700	scsi_done(cmd);
701	return NULL;
702	}
703
704	static void ata_qc_set_pc_nbytes(struct ata_queued_cmd *qc)
705	{
706	struct scsi_cmnd *scmd = qc->scsicmd;
707
708	qc->extrabytes = scmd->extra_len;
709	qc->nbytes = scsi_bufflen(cmd: scmd) + qc->extrabytes;
710	}
711
712	/**
713	* ata_to_sense_error - convert ATA error to SCSI error
714	* @id: ATA device number
715	* @drv_stat: value contained in ATA status register
716	* @drv_err: value contained in ATA error register
717	* @sk: the sense key we'll fill out
718	* @asc: the additional sense code we'll fill out
719	* @ascq: the additional sense code qualifier we'll fill out
720	*
721	* Converts an ATA error into a SCSI error. Fill out pointers to
722	* SK, ASC, and ASCQ bytes for later use in fixed or descriptor
723	* format sense blocks.
724	*
725	* LOCKING:
726	* spin_lock_irqsave(host lock)
727	*/
728	static void ata_to_sense_error(unsigned id, u8 drv_stat, u8 drv_err, u8 *sk,
729	u8 *asc, u8 *ascq)
730	{
731	int i;
732
733	/* Based on the 3ware driver translation table */
734	static const unsigned char sense_table[][4] = {
735	/* BBD|ECC|ID|MAR */
736	{0xd1, ABORTED_COMMAND, 0x00, 0x00},
737	// Device busy Aborted command
738	/* BBD|ECC|ID */
739	{0xd0, ABORTED_COMMAND, 0x00, 0x00},
740	// Device busy Aborted command
741	/* ECC|MC|MARK */
742	{0x61, HARDWARE_ERROR, 0x00, 0x00},
743	// Device fault Hardware error
744	/* ICRC|ABRT */ /* NB: ICRC & !ABRT is BBD */
745	{0x84, ABORTED_COMMAND, 0x47, 0x00},
746	// Data CRC error SCSI parity error
747	/* MC|ID|ABRT|TRK0|MARK */
748	{0x37, NOT_READY, 0x04, 0x00},
749	// Unit offline Not ready
750	/* MCR|MARK */
751	{0x09, NOT_READY, 0x04, 0x00},
752	// Unrecovered disk error Not ready
753	/* Bad address mark */
754	{0x01, MEDIUM_ERROR, 0x13, 0x00},
755	// Address mark not found for data field
756	/* TRK0 - Track 0 not found */
757	{0x02, HARDWARE_ERROR, 0x00, 0x00},
758	// Hardware error
759	/* Abort: 0x04 is not translated here, see below */
760	/* Media change request */
761	{0x08, NOT_READY, 0x04, 0x00},
762	// FIXME: faking offline
763	/* SRV/IDNF - ID not found */
764	{0x10, ILLEGAL_REQUEST, 0x21, 0x00},
765	// Logical address out of range
766	/* MC - Media Changed */
767	{0x20, UNIT_ATTENTION, 0x28, 0x00},
768	// Not ready to ready change, medium may have changed
769	/* ECC - Uncorrectable ECC error */
770	{0x40, MEDIUM_ERROR, 0x11, 0x04},
771	// Unrecovered read error
772	/* BBD - block marked bad */
773	{0x80, MEDIUM_ERROR, 0x11, 0x04},
774	// Block marked bad Medium error, unrecovered read error
775	{0xFF, 0xFF, 0xFF, 0xFF}, // END mark
776	};
777	static const unsigned char stat_table[][4] = {
778	/* Must be first because BUSY means no other bits valid */
779	{0x80, ABORTED_COMMAND, 0x47, 0x00},
780	// Busy, fake parity for now
781	{0x40, ILLEGAL_REQUEST, 0x21, 0x04},
782	// Device ready, unaligned write command
783	{0x20, HARDWARE_ERROR, 0x44, 0x00},
784	// Device fault, internal target failure
785	{0x08, ABORTED_COMMAND, 0x47, 0x00},
786	// Timed out in xfer, fake parity for now
787	{0x04, RECOVERED_ERROR, 0x11, 0x00},
788	// Recovered ECC error Medium error, recovered
789	{0xFF, 0xFF, 0xFF, 0xFF}, // END mark
790	};
791
792	/*
793	* Is this an error we can process/parse
794	*/
795	if (drv_stat & ATA_BUSY) {
796	drv_err = 0; /* Ignore the err bits, they're invalid */
797	}
798
799	if (drv_err) {
800	/* Look for drv_err */
801	for (i = 0; sense_table[i][0] != 0xFF; i++) {
802	/* Look for best matches first */
803	if ((sense_table[i][0] & drv_err) ==
804	sense_table[i][0]) {
805	*sk = sense_table[i][1];
806	*asc = sense_table[i][2];
807	*ascq = sense_table[i][3];
808	return;
809	}
810	}
811	}
812
813	/*
814	* Fall back to interpreting status bits. Note that if the drv_err
815	* has only the ABRT bit set, we decode drv_stat. ABRT by itself
816	* is not descriptive enough.
817	*/
818	for (i = 0; stat_table[i][0] != 0xFF; i++) {
819	if (stat_table[i][0] & drv_stat) {
820	*sk = stat_table[i][1];
821	*asc = stat_table[i][2];
822	*ascq = stat_table[i][3];
823	return;
824	}
825	}
826
827	/*
828	* We need a sensible error return here, which is tricky, and one
829	* that won't cause people to do things like return a disk wrongly.
830	*/
831	*sk = ABORTED_COMMAND;
832	*asc = 0x00;
833	*ascq = 0x00;
834	}
835
836	/*
837	* ata_gen_passthru_sense - Generate check condition sense block.
838	* @qc: Command that completed.
839	*
840	* This function is specific to the ATA descriptor format sense
841	* block specified for the ATA pass through commands. Regardless
842	* of whether the command errored or not, return a sense
843	* block. Copy all controller registers into the sense
844	* block. If there was no error, we get the request from an ATA
845	* passthrough command, so we use the following sense data:
846	* sk = RECOVERED ERROR
847	* asc,ascq = ATA PASS-THROUGH INFORMATION AVAILABLE
848	*
849	*
850	* LOCKING:
851	* None.
852	*/
853	static void ata_gen_passthru_sense(struct ata_queued_cmd *qc)
854	{
855	struct scsi_cmnd *cmd = qc->scsicmd;
856	struct ata_taskfile *tf = &qc->result_tf;
857	unsigned char *sb = cmd->sense_buffer;
858	unsigned char *desc = sb + 8;
859	u8 sense_key, asc, ascq;
860
861	memset(sb, 0, SCSI_SENSE_BUFFERSIZE);
862
863	/*
864	* Use ata_to_sense_error() to map status register bits
865	* onto sense key, asc & ascq.
866	*/
867	if (qc->err_mask ||
868	tf->status & (ATA_BUSY | ATA_DF | ATA_ERR | ATA_DRQ)) {
869	ata_to_sense_error(id: qc->ap->print_id, drv_stat: tf->status, drv_err: tf->error,
870	sk: &sense_key, asc: &asc, ascq: &ascq);
871	ata_scsi_set_sense(dev: qc->dev, cmd, sk: sense_key, asc, ascq);
872	} else {
873	/*
874	* ATA PASS-THROUGH INFORMATION AVAILABLE
875	* Always in descriptor format sense.
876	*/
877	scsi_build_sense(scmd: cmd, desc: 1, RECOVERED_ERROR, asc: 0, ascq: 0x1D);
878	}
879
880	if ((cmd->sense_buffer[0] & 0x7f) >= 0x72) {
881	u8 len;
882
883	/* descriptor format */
884	len = sb[7];
885	desc = (char *)scsi_sense_desc_find(sense_buffer: sb, sb_len: len + 8, desc_type: 9);
886	if (!desc) {
887	if (SCSI_SENSE_BUFFERSIZE < len + 14)
888	return;
889	sb[7] = len + 14;
890	desc = sb + 8 + len;
891	}
892	desc[0] = 9;
893	desc[1] = 12;
894	/*
895	* Copy registers into sense buffer.
896	*/
897	desc[2] = 0x00;
898	desc[3] = tf->error;
899	desc[5] = tf->nsect;
900	desc[7] = tf->lbal;
901	desc[9] = tf->lbam;
902	desc[11] = tf->lbah;
903	desc[12] = tf->device;
904	desc[13] = tf->status;
905
906	/*
907	* Fill in Extend bit, and the high order bytes
908	* if applicable.
909	*/
910	if (tf->flags & ATA_TFLAG_LBA48) {
911	desc[2] |= 0x01;
912	desc[4] = tf->hob_nsect;
913	desc[6] = tf->hob_lbal;
914	desc[8] = tf->hob_lbam;
915	desc[10] = tf->hob_lbah;
916	}
917	} else {
918	/* Fixed sense format */
919	desc[0] = tf->error;
920	desc[1] = tf->status;
921	desc[2] = tf->device;
922	desc[3] = tf->nsect;
923	desc[7] = 0;
924	if (tf->flags & ATA_TFLAG_LBA48) {
925	desc[8] |= 0x80;
926	if (tf->hob_nsect)
927	desc[8] |= 0x40;
928	if (tf->hob_lbal || tf->hob_lbam || tf->hob_lbah)
929	desc[8] |= 0x20;
930	}
931	desc[9] = tf->lbal;
932	desc[10] = tf->lbam;
933	desc[11] = tf->lbah;
934	}
935	}
936
937	/**
938	* ata_gen_ata_sense - generate a SCSI fixed sense block
939	* @qc: Command that we are erroring out
940	*
941	* Generate sense block for a failed ATA command @qc. Descriptor
942	* format is used to accommodate LBA48 block address.
943	*
944	* LOCKING:
945	* None.
946	*/
947	static void ata_gen_ata_sense(struct ata_queued_cmd *qc)
948	{
949	struct ata_device *dev = qc->dev;
950	struct scsi_cmnd *cmd = qc->scsicmd;
951	struct ata_taskfile *tf = &qc->result_tf;
952	unsigned char *sb = cmd->sense_buffer;
953	u64 block;
954	u8 sense_key, asc, ascq;
955
956	memset(sb, 0, SCSI_SENSE_BUFFERSIZE);
957
958	if (ata_dev_disabled(dev)) {
959	/* Device disabled after error recovery */
960	/* LOGICAL UNIT NOT READY, HARD RESET REQUIRED */
961	ata_scsi_set_sense(dev, cmd, NOT_READY, asc: 0x04, ascq: 0x21);
962	return;
963	}
964	/* Use ata_to_sense_error() to map status register bits
965	* onto sense key, asc & ascq.
966	*/
967	if (qc->err_mask ||
968	tf->status & (ATA_BUSY | ATA_DF | ATA_ERR | ATA_DRQ)) {
969	ata_to_sense_error(id: qc->ap->print_id, drv_stat: tf->status, drv_err: tf->error,
970	sk: &sense_key, asc: &asc, ascq: &ascq);
971	ata_scsi_set_sense(dev, cmd, sk: sense_key, asc, ascq);
972	} else {
973	/* Could not decode error */
974	ata_dev_warn(dev, "could not decode error status 0x%x err_mask 0x%x\n",
975	tf->status, qc->err_mask);
976	ata_scsi_set_sense(dev, cmd, ABORTED_COMMAND, asc: 0, ascq: 0);
977	return;
978	}
979
980	block = ata_tf_read_block(tf: &qc->result_tf, dev);
981	if (block == U64_MAX)
982	return;
983
984	scsi_set_sense_information(buf: sb, SCSI_SENSE_BUFFERSIZE, info: block);
985	}
986
987	void ata_scsi_sdev_config(struct scsi_device *sdev)
988	{
989	sdev->use_10_for_rw = 1;
990	sdev->use_10_for_ms = 1;
991	sdev->no_write_same = 1;
992
993	/* Schedule policy is determined by ->qc_defer() callback and
994	* it needs to see every deferred qc. Set dev_blocked to 1 to
995	* prevent SCSI midlayer from automatically deferring
996	* requests.
997	*/
998	sdev->max_device_blocked = 1;
999	}
1000
1001	/**
1002	* ata_scsi_dma_need_drain - Check whether data transfer may overflow
1003	* @rq: request to be checked
1004	*
1005	* ATAPI commands which transfer variable length data to host
1006	* might overflow due to application error or hardware bug. This
1007	* function checks whether overflow should be drained and ignored
1008	* for @request.
1009	*
1010	* LOCKING:
1011	* None.
1012	*
1013	* RETURNS:
1014	* 1 if ; otherwise, 0.
1015	*/
1016	bool ata_scsi_dma_need_drain(struct request *rq)
1017	{
1018	struct scsi_cmnd *scmd = blk_mq_rq_to_pdu(rq);
1019
1020	return atapi_cmd_type(opcode: scmd->cmnd[0]) == ATAPI_MISC;
1021	}
1022	EXPORT_SYMBOL_GPL(ata_scsi_dma_need_drain);
1023
1024	int ata_scsi_dev_config(struct scsi_device *sdev, struct ata_device *dev)
1025	{
1026	struct request_queue *q = sdev->request_queue;
1027	int depth = 1;
1028
1029	if (!ata_id_has_unload(id: dev->id))
1030	dev->flags |= ATA_DFLAG_NO_UNLOAD;
1031
1032	/* configure max sectors */
1033	dev->max_sectors = min(dev->max_sectors, sdev->host->max_sectors);
1034	blk_queue_max_hw_sectors(q, dev->max_sectors);
1035
1036	if (dev->class == ATA_DEV_ATAPI) {
1037	sdev->sector_size = ATA_SECT_SIZE;
1038
1039	/* set DMA padding */
1040	blk_queue_update_dma_pad(q, ATA_DMA_PAD_SZ - 1);
1041
1042	/* make room for appending the drain */
1043	blk_queue_max_segments(q, queue_max_segments(q) - 1);
1044
1045	sdev->dma_drain_len = ATAPI_MAX_DRAIN;
1046	sdev->dma_drain_buf = kmalloc(size: sdev->dma_drain_len, GFP_NOIO);
1047	if (!sdev->dma_drain_buf) {
1048	ata_dev_err(dev, "drain buffer allocation failed\n");
1049	return -ENOMEM;
1050	}
1051	} else {
1052	sdev->sector_size = ata_id_logical_sector_size(id: dev->id);
1053
1054	/*
1055	* Ask the sd driver to issue START STOP UNIT on runtime suspend
1056	* and resume and shutdown only. For system level suspend/resume,
1057	* devices power state is handled directly by libata EH.
1058	*/
1059	sdev->manage_runtime_start_stop = true;
1060	sdev->manage_shutdown = true;
1061	}
1062
1063	/*
1064	* ata_pio_sectors() expects buffer for each sector to not cross
1065	* page boundary. Enforce it by requiring buffers to be sector
1066	* aligned, which works iff sector_size is not larger than
1067	* PAGE_SIZE. ATAPI devices also need the alignment as
1068	* IDENTIFY_PACKET is executed as ATA_PROT_PIO.
1069	*/
1070	if (sdev->sector_size > PAGE_SIZE)
1071	ata_dev_warn(dev,
1072	"sector_size=%u > PAGE_SIZE, PIO may malfunction\n",
1073	sdev->sector_size);
1074
1075	blk_queue_update_dma_alignment(q, sdev->sector_size - 1);
1076
1077	if (dev->flags & ATA_DFLAG_AN)
1078	set_bit(nr: SDEV_EVT_MEDIA_CHANGE, addr: sdev->supported_events);
1079
1080	if (ata_ncq_supported(dev))
1081	depth = min(sdev->host->can_queue, ata_id_queue_depth(dev->id));
1082	depth = min(ATA_MAX_QUEUE, depth);
1083	scsi_change_queue_depth(sdev, depth);
1084
1085	if (dev->flags & ATA_DFLAG_TRUSTED)
1086	sdev->security_supported = 1;
1087
1088	dev->sdev = sdev;
1089	return 0;
1090	}
1091
1092	/**
1093	* ata_scsi_slave_alloc - Early setup of SCSI device
1094	* @sdev: SCSI device to examine
1095	*
1096	* This is called from scsi_alloc_sdev() when the scsi device
1097	* associated with an ATA device is scanned on a port.
1098	*
1099	* LOCKING:
1100	* Defined by SCSI layer. We don't really care.
1101	*/
1102
1103	int ata_scsi_slave_alloc(struct scsi_device *sdev)
1104	{
1105	struct ata_port *ap = ata_shost_to_port(host: sdev->host);
1106	struct device_link *link;
1107
1108	ata_scsi_sdev_config(sdev);
1109
1110	/*
1111	* Create a link from the ata_port device to the scsi device to ensure
1112	* that PM does suspend/resume in the correct order: the scsi device is
1113	* consumer (child) and the ata port the supplier (parent).
1114	*/
1115	link = device_link_add(consumer: &sdev->sdev_gendev, supplier: &ap->tdev,
1116	DL_FLAG_STATELESS |
1117	DL_FLAG_PM_RUNTIME | DL_FLAG_RPM_ACTIVE);
1118	if (!link) {
1119	ata_port_err(ap, "Failed to create link to scsi device %s\n",
1120	dev_name(&sdev->sdev_gendev));
1121	return -ENODEV;
1122	}
1123
1124	return 0;
1125	}
1126	EXPORT_SYMBOL_GPL(ata_scsi_slave_alloc);
1127
1128	/**
1129	* ata_scsi_slave_config - Set SCSI device attributes
1130	* @sdev: SCSI device to examine
1131	*
1132	* This is called before we actually start reading
1133	* and writing to the device, to configure certain
1134	* SCSI mid-layer behaviors.
1135	*
1136	* LOCKING:
1137	* Defined by SCSI layer. We don't really care.
1138	*/
1139
1140	int ata_scsi_slave_config(struct scsi_device *sdev)
1141	{
1142	struct ata_port *ap = ata_shost_to_port(host: sdev->host);
1143	struct ata_device *dev = __ata_scsi_find_dev(ap, scsidev: sdev);
1144
1145	if (dev)
1146	return ata_scsi_dev_config(sdev, dev);
1147
1148	return 0;
1149	}
1150	EXPORT_SYMBOL_GPL(ata_scsi_slave_config);
1151
1152	/**
1153	* ata_scsi_slave_destroy - SCSI device is about to be destroyed
1154	* @sdev: SCSI device to be destroyed
1155	*
1156	* @sdev is about to be destroyed for hot/warm unplugging. If
1157	* this unplugging was initiated by libata as indicated by NULL
1158	* dev->sdev, this function doesn't have to do anything.
1159	* Otherwise, SCSI layer initiated warm-unplug is in progress.
1160	* Clear dev->sdev, schedule the device for ATA detach and invoke
1161	* EH.
1162	*
1163	* LOCKING:
1164	* Defined by SCSI layer. We don't really care.
1165	*/
1166	void ata_scsi_slave_destroy(struct scsi_device *sdev)
1167	{
1168	struct ata_port *ap = ata_shost_to_port(host: sdev->host);
1169	unsigned long flags;
1170	struct ata_device *dev;
1171
1172	device_link_remove(consumer: &sdev->sdev_gendev, supplier: &ap->tdev);
1173
1174	spin_lock_irqsave(ap->lock, flags);
1175	dev = __ata_scsi_find_dev(ap, scsidev: sdev);
1176	if (dev && dev->sdev) {
1177	/* SCSI device already in CANCEL state, no need to offline it */
1178	dev->sdev = NULL;
1179	dev->flags |= ATA_DFLAG_DETACH;
1180	ata_port_schedule_eh(ap);
1181	}
1182	spin_unlock_irqrestore(lock: ap->lock, flags);
1183
1184	kfree(objp: sdev->dma_drain_buf);
1185	}
1186	EXPORT_SYMBOL_GPL(ata_scsi_slave_destroy);
1187
1188	/**
1189	* ata_scsi_start_stop_xlat - Translate SCSI START STOP UNIT command
1190	* @qc: Storage for translated ATA taskfile
1191	*
1192	* Sets up an ATA taskfile to issue STANDBY (to stop) or READ VERIFY
1193	* (to start). Perhaps these commands should be preceded by
1194	* CHECK POWER MODE to see what power mode the device is already in.
1195	* [See SAT revision 5 at www.t10.org]
1196	*
1197	* LOCKING:
1198	* spin_lock_irqsave(host lock)
1199	*
1200	* RETURNS:
1201	* Zero on success, non-zero on error.
1202	*/
1203	static unsigned int ata_scsi_start_stop_xlat(struct ata_queued_cmd *qc)
1204	{
1205	struct scsi_cmnd *scmd = qc->scsicmd;
1206	const u8 *cdb = scmd->cmnd;
1207	u16 fp;
1208	u8 bp = 0xff;
1209
1210	if (scmd->cmd_len < 5) {
1211	fp = 4;
1212	goto invalid_fld;
1213	}
1214
1215	/* LOEJ bit set not supported */
1216	if (cdb[4] & 0x2) {
1217	fp = 4;
1218	bp = 1;
1219	goto invalid_fld;
1220	}
1221
1222	/* Power conditions not supported */
1223	if (((cdb[4] >> 4) & 0xf) != 0) {
1224	fp = 4;
1225	bp = 3;
1226	goto invalid_fld;
1227	}
1228
1229	/* Ignore IMMED bit (cdb[1] & 0x1), violates sat-r05 */
1230	if (!ata_dev_power_init_tf(dev: qc->dev, tf: &qc->tf, set_active: cdb[4] & 0x1)) {
1231	ata_scsi_set_sense(dev: qc->dev, cmd: scmd, ABORTED_COMMAND, asc: 0, ascq: 0);
1232	return 1;
1233	}
1234
1235	/*
1236	* Standby and Idle condition timers could be implemented but that
1237	* would require libata to implement the Power condition mode page
1238	* and allow the user to change it. Changing mode pages requires
1239	* MODE SELECT to be implemented.
1240	*/
1241
1242	return 0;
1243
1244	invalid_fld:
1245	ata_scsi_set_invalid_field(dev: qc->dev, cmd: scmd, field: fp, bit: bp);
1246	return 1;
1247	}
1248
1249	/**
1250	* ata_scsi_flush_xlat - Translate SCSI SYNCHRONIZE CACHE command
1251	* @qc: Storage for translated ATA taskfile
1252	*
1253	* Sets up an ATA taskfile to issue FLUSH CACHE or
1254	* FLUSH CACHE EXT.
1255	*
1256	* LOCKING:
1257	* spin_lock_irqsave(host lock)
1258	*
1259	* RETURNS:
1260	* Zero on success, non-zero on error.
1261	*/
1262	static unsigned int ata_scsi_flush_xlat(struct ata_queued_cmd *qc)
1263	{
1264	struct ata_taskfile *tf = &qc->tf;
1265
1266	tf->flags |= ATA_TFLAG_DEVICE;
1267	tf->protocol = ATA_PROT_NODATA;
1268
1269	if (qc->dev->flags & ATA_DFLAG_FLUSH_EXT)
1270	tf->command = ATA_CMD_FLUSH_EXT;
1271	else
1272	tf->command = ATA_CMD_FLUSH;
1273
1274	/* flush is critical for IO integrity, consider it an IO command */
1275	qc->flags |= ATA_QCFLAG_IO;
1276
1277	return 0;
1278	}
1279
1280	/**
1281	* scsi_6_lba_len - Get LBA and transfer length
1282	* @cdb: SCSI command to translate
1283	*
1284	* Calculate LBA and transfer length for 6-byte commands.
1285	*
1286	* RETURNS:
1287	* @plba: the LBA
1288	* @plen: the transfer length
1289	*/
1290	static void scsi_6_lba_len(const u8 *cdb, u64 *plba, u32 *plen)
1291	{
1292	u64 lba = 0;
1293	u32 len;
1294
1295	lba |= ((u64)(cdb[1] & 0x1f)) << 16;
1296	lba |= ((u64)cdb[2]) << 8;
1297	lba |= ((u64)cdb[3]);
1298
1299	len = cdb[4];
1300
1301	*plba = lba;
1302	*plen = len;
1303	}
1304
1305	/**
1306	* scsi_10_lba_len - Get LBA and transfer length
1307	* @cdb: SCSI command to translate
1308	*
1309	* Calculate LBA and transfer length for 10-byte commands.
1310	*
1311	* RETURNS:
1312	* @plba: the LBA
1313	* @plen: the transfer length
1314	*/
1315	static inline void scsi_10_lba_len(const u8 *cdb, u64 *plba, u32 *plen)
1316	{
1317	*plba = get_unaligned_be32(p: &cdb[2]);
1318	*plen = get_unaligned_be16(p: &cdb[7]);
1319	}
1320
1321	/**
1322	* scsi_16_lba_len - Get LBA and transfer length
1323	* @cdb: SCSI command to translate
1324	*
1325	* Calculate LBA and transfer length for 16-byte commands.
1326	*
1327	* RETURNS:
1328	* @plba: the LBA
1329	* @plen: the transfer length
1330	*/
1331	static inline void scsi_16_lba_len(const u8 *cdb, u64 *plba, u32 *plen)
1332	{
1333	*plba = get_unaligned_be64(p: &cdb[2]);
1334	*plen = get_unaligned_be32(p: &cdb[10]);
1335	}
1336
1337	/**
1338	* scsi_dld - Get duration limit descriptor index
1339	* @cdb: SCSI command to translate
1340	*
1341	* Returns the dld bits indicating the index of a command duration limit
1342	* descriptor.
1343	*/
1344	static inline int scsi_dld(const u8 *cdb)
1345	{
1346	return ((cdb[1] & 0x01) << 2) | ((cdb[14] >> 6) & 0x03);
1347	}
1348
1349	/**
1350	* ata_scsi_verify_xlat - Translate SCSI VERIFY command into an ATA one
1351	* @qc: Storage for translated ATA taskfile
1352	*
1353	* Converts SCSI VERIFY command to an ATA READ VERIFY command.
1354	*
1355	* LOCKING:
1356	* spin_lock_irqsave(host lock)
1357	*
1358	* RETURNS:
1359	* Zero on success, non-zero on error.
1360	*/
1361	static unsigned int ata_scsi_verify_xlat(struct ata_queued_cmd *qc)
1362	{
1363	struct scsi_cmnd *scmd = qc->scsicmd;
1364	struct ata_taskfile *tf = &qc->tf;
1365	struct ata_device *dev = qc->dev;
1366	u64 dev_sectors = qc->dev->n_sectors;
1367	const u8 *cdb = scmd->cmnd;
1368	u64 block;
1369	u32 n_block;
1370	u16 fp;
1371
1372	tf->flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
1373	tf->protocol = ATA_PROT_NODATA;
1374
1375	switch (cdb[0]) {
1376	case VERIFY:
1377	if (scmd->cmd_len < 10) {
1378	fp = 9;
1379	goto invalid_fld;
1380	}
1381	scsi_10_lba_len(cdb, plba: &block, plen: &n_block);
1382	break;
1383	case VERIFY_16:
1384	if (scmd->cmd_len < 16) {
1385	fp = 15;
1386	goto invalid_fld;
1387	}
1388	scsi_16_lba_len(cdb, plba: &block, plen: &n_block);
1389	break;
1390	default:
1391	fp = 0;
1392	goto invalid_fld;
1393	}
1394
1395	if (!n_block)
1396	goto nothing_to_do;
1397	if (block >= dev_sectors)
1398	goto out_of_range;
1399	if ((block + n_block) > dev_sectors)
1400	goto out_of_range;
1401
1402	if (dev->flags & ATA_DFLAG_LBA) {
1403	tf->flags |= ATA_TFLAG_LBA;
1404
1405	if (lba_28_ok(block, n_block)) {
1406	/* use LBA28 */
1407	tf->command = ATA_CMD_VERIFY;
1408	tf->device |= (block >> 24) & 0xf;
1409	} else if (lba_48_ok(block, n_block)) {
1410	if (!(dev->flags & ATA_DFLAG_LBA48))
1411	goto out_of_range;
1412
1413	/* use LBA48 */
1414	tf->flags |= ATA_TFLAG_LBA48;
1415	tf->command = ATA_CMD_VERIFY_EXT;
1416
1417	tf->hob_nsect = (n_block >> 8) & 0xff;
1418
1419	tf->hob_lbah = (block >> 40) & 0xff;
1420	tf->hob_lbam = (block >> 32) & 0xff;
1421	tf->hob_lbal = (block >> 24) & 0xff;
1422	} else
1423	/* request too large even for LBA48 */
1424	goto out_of_range;
1425
1426	tf->nsect = n_block & 0xff;
1427
1428	tf->lbah = (block >> 16) & 0xff;
1429	tf->lbam = (block >> 8) & 0xff;
1430	tf->lbal = block & 0xff;
1431
1432	tf->device |= ATA_LBA;
1433	} else {
1434	/* CHS */
1435	u32 sect, head, cyl, track;
1436
1437	if (!lba_28_ok(block, n_block))
1438	goto out_of_range;
1439
1440	/* Convert LBA to CHS */
1441	track = (u32)block / dev->sectors;
1442	cyl = track / dev->heads;
1443	head = track % dev->heads;
1444	sect = (u32)block % dev->sectors + 1;
1445
1446	/* Check whether the converted CHS can fit.
1447	Cylinder: 0-65535
1448	Head: 0-15
1449	Sector: 1-255*/
1450	if ((cyl >> 16) || (head >> 4) || (sect >> 8) || (!sect))
1451	goto out_of_range;
1452
1453	tf->command = ATA_CMD_VERIFY;
1454	tf->nsect = n_block & 0xff; /* Sector count 0 means 256 sectors */
1455	tf->lbal = sect;
1456	tf->lbam = cyl;
1457	tf->lbah = cyl >> 8;
1458	tf->device |= head;
1459	}
1460
1461	return 0;
1462
1463	invalid_fld:
1464	ata_scsi_set_invalid_field(dev: qc->dev, cmd: scmd, field: fp, bit: 0xff);
1465	return 1;
1466
1467	out_of_range:
1468	ata_scsi_set_sense(dev: qc->dev, cmd: scmd, ILLEGAL_REQUEST, asc: 0x21, ascq: 0x0);
1469	/* "Logical Block Address out of range" */
1470	return 1;
1471
1472	nothing_to_do:
1473	scmd->result = SAM_STAT_GOOD;
1474	return 1;
1475	}
1476
1477	static bool ata_check_nblocks(struct scsi_cmnd *scmd, u32 n_blocks)
1478	{
1479	struct request *rq = scsi_cmd_to_rq(scmd);
1480	u32 req_blocks;
1481
1482	if (!blk_rq_is_passthrough(rq))
1483	return true;
1484
1485	req_blocks = blk_rq_bytes(rq) / scmd->device->sector_size;
1486	if (n_blocks > req_blocks)
1487	return false;
1488
1489	return true;
1490	}
1491
1492	/**
1493	* ata_scsi_rw_xlat - Translate SCSI r/w command into an ATA one
1494	* @qc: Storage for translated ATA taskfile
1495	*
1496	* Converts any of six SCSI read/write commands into the
1497	* ATA counterpart, including starting sector (LBA),
1498	* sector count, and taking into account the device's LBA48
1499	* support.
1500	*
1501	* Commands %READ_6, %READ_10, %READ_16, %WRITE_6, %WRITE_10, and
1502	* %WRITE_16 are currently supported.
1503	*
1504	* LOCKING:
1505	* spin_lock_irqsave(host lock)
1506	*
1507	* RETURNS:
1508	* Zero on success, non-zero on error.
1509	*/
1510	static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
1511	{
1512	struct scsi_cmnd *scmd = qc->scsicmd;
1513	const u8 *cdb = scmd->cmnd;
1514	struct request *rq = scsi_cmd_to_rq(scmd);
1515	int class = IOPRIO_PRIO_CLASS(req_get_ioprio(rq));
1516	unsigned int tf_flags = 0;
1517	int dld = 0;
1518	u64 block;
1519	u32 n_block;
1520	int rc;
1521	u16 fp = 0;
1522
1523	switch (cdb[0]) {
1524	case WRITE_6:
1525	case WRITE_10:
1526	case WRITE_16:
1527	tf_flags |= ATA_TFLAG_WRITE;
1528	break;
1529	}
1530
1531	/* Calculate the SCSI LBA, transfer length and FUA. */
1532	switch (cdb[0]) {
1533	case READ_10:
1534	case WRITE_10:
1535	if (unlikely(scmd->cmd_len < 10)) {
1536	fp = 9;
1537	goto invalid_fld;
1538	}
1539	scsi_10_lba_len(cdb, plba: &block, plen: &n_block);
1540	if (cdb[1] & (1 << 3))
1541	tf_flags |= ATA_TFLAG_FUA;
1542	if (!ata_check_nblocks(scmd, n_blocks: n_block))
1543	goto invalid_fld;
1544	break;
1545	case READ_6:
1546	case WRITE_6:
1547	if (unlikely(scmd->cmd_len < 6)) {
1548	fp = 5;
1549	goto invalid_fld;
1550	}
1551	scsi_6_lba_len(cdb, plba: &block, plen: &n_block);
1552
1553	/* for 6-byte r/w commands, transfer length 0
1554	* means 256 blocks of data, not 0 block.
1555	*/
1556	if (!n_block)
1557	n_block = 256;
1558	if (!ata_check_nblocks(scmd, n_blocks: n_block))
1559	goto invalid_fld;
1560	break;
1561	case READ_16:
1562	case WRITE_16:
1563	if (unlikely(scmd->cmd_len < 16)) {
1564	fp = 15;
1565	goto invalid_fld;
1566	}
1567	scsi_16_lba_len(cdb, plba: &block, plen: &n_block);
1568	dld = scsi_dld(cdb);
1569	if (cdb[1] & (1 << 3))
1570	tf_flags |= ATA_TFLAG_FUA;
1571	if (!ata_check_nblocks(scmd, n_blocks: n_block))
1572	goto invalid_fld;
1573	break;
1574	default:
1575	fp = 0;
1576	goto invalid_fld;
1577	}
1578
1579	/* Check and compose ATA command */
1580	if (!n_block)
1581	/* For 10-byte and 16-byte SCSI R/W commands, transfer
1582	* length 0 means transfer 0 block of data.
1583	* However, for ATA R/W commands, sector count 0 means
1584	* 256 or 65536 sectors, not 0 sectors as in SCSI.
1585	*
1586	* WARNING: one or two older ATA drives treat 0 as 0...
1587	*/
1588	goto nothing_to_do;
1589
1590	qc->flags |= ATA_QCFLAG_IO;
1591	qc->nbytes = n_block * scmd->device->sector_size;
1592
1593	rc = ata_build_rw_tf(qc, block, n_block, tf_flags, dld, class);
1594	if (likely(rc == 0))
1595	return 0;
1596
1597	if (rc == -ERANGE)
1598	goto out_of_range;
1599	/* treat all other errors as -EINVAL, fall through */
1600	invalid_fld:
1601	ata_scsi_set_invalid_field(dev: qc->dev, cmd: scmd, field: fp, bit: 0xff);
1602	return 1;
1603
1604	out_of_range:
1605	ata_scsi_set_sense(dev: qc->dev, cmd: scmd, ILLEGAL_REQUEST, asc: 0x21, ascq: 0x0);
1606	/* "Logical Block Address out of range" */
1607	return 1;
1608
1609	nothing_to_do:
1610	scmd->result = SAM_STAT_GOOD;
1611	return 1;
1612	}
1613
1614	static void ata_qc_done(struct ata_queued_cmd *qc)
1615	{
1616	struct scsi_cmnd *cmd = qc->scsicmd;
1617	void (*done)(struct scsi_cmnd *) = qc->scsidone;
1618
1619	ata_qc_free(qc);
1620	done(cmd);
1621	}
1622
1623	static void ata_scsi_qc_complete(struct ata_queued_cmd *qc)
1624	{
1625	struct scsi_cmnd *cmd = qc->scsicmd;
1626	u8 *cdb = cmd->cmnd;
1627	int need_sense = (qc->err_mask != 0) &&
1628	!(qc->flags & ATA_QCFLAG_SENSE_VALID);
1629
1630	/* For ATA pass thru (SAT) commands, generate a sense block if
1631	* user mandated it or if there's an error. Note that if we
1632	* generate because the user forced us to [CK_COND =1], a check
1633	* condition is generated and the ATA register values are returned
1634	* whether the command completed successfully or not. If there
1635	* was no error, we use the following sense data:
1636	* sk = RECOVERED ERROR
1637	* asc,ascq = ATA PASS-THROUGH INFORMATION AVAILABLE
1638	*/
1639	if (((cdb[0] == ATA_16) || (cdb[0] == ATA_12)) &&
1640	((cdb[2] & 0x20) || need_sense))
1641	ata_gen_passthru_sense(qc);
1642	else if (need_sense)
1643	ata_gen_ata_sense(qc);
1644	else
1645	/* Keep the SCSI ML and status byte, clear host byte. */
1646	cmd->result &= 0x0000ffff;
1647
1648	ata_qc_done(qc);
1649	}
1650
1651	/**
1652	* ata_scsi_translate - Translate then issue SCSI command to ATA device
1653	* @dev: ATA device to which the command is addressed
1654	* @cmd: SCSI command to execute
1655	* @xlat_func: Actor which translates @cmd to an ATA taskfile
1656	*
1657	* Our ->queuecommand() function has decided that the SCSI
1658	* command issued can be directly translated into an ATA
1659	* command, rather than handled internally.
1660	*
1661	* This function sets up an ata_queued_cmd structure for the
1662	* SCSI command, and sends that ata_queued_cmd to the hardware.
1663	*
1664	* The xlat_func argument (actor) returns 0 if ready to execute
1665	* ATA command, else 1 to finish translation. If 1 is returned
1666	* then cmd->result (and possibly cmd->sense_buffer) are assumed
1667	* to be set reflecting an error condition or clean (early)
1668	* termination.
1669	*
1670	* LOCKING:
1671	* spin_lock_irqsave(host lock)
1672	*
1673	* RETURNS:
1674	* 0 on success, SCSI_ML_QUEUE_DEVICE_BUSY if the command
1675	* needs to be deferred.
1676	*/
1677	static int ata_scsi_translate(struct ata_device *dev, struct scsi_cmnd *cmd,
1678	ata_xlat_func_t xlat_func)
1679	{
1680	struct ata_port *ap = dev->link->ap;
1681	struct ata_queued_cmd *qc;
1682	int rc;
1683
1684	qc = ata_scsi_qc_new(dev, cmd);
1685	if (!qc)
1686	goto err_mem;
1687
1688	/* data is present; dma-map it */
1689	if (cmd->sc_data_direction == DMA_FROM_DEVICE ||
1690	cmd->sc_data_direction == DMA_TO_DEVICE) {
1691	if (unlikely(scsi_bufflen(cmd) < 1)) {
1692	ata_dev_warn(dev, "WARNING: zero len r/w req\n");
1693	goto err_did;
1694	}
1695
1696	ata_sg_init(qc, sg: scsi_sglist(cmd), n_elem: scsi_sg_count(cmd));
1697
1698	qc->dma_dir = cmd->sc_data_direction;
1699	}
1700
1701	qc->complete_fn = ata_scsi_qc_complete;
1702
1703	if (xlat_func(qc))
1704	goto early_finish;
1705
1706	if (ap->ops->qc_defer) {
1707	if ((rc = ap->ops->qc_defer(qc)))
1708	goto defer;
1709	}
1710
1711	/* select device, send command to hardware */
1712	ata_qc_issue(qc);
1713
1714	return 0;
1715
1716	early_finish:
1717	ata_qc_free(qc);
1718	scsi_done(cmd);
1719	return 0;
1720
1721	err_did:
1722	ata_qc_free(qc);
1723	cmd->result = (DID_ERROR << 16);
1724	scsi_done(cmd);
1725	err_mem:
1726	return 0;
1727
1728	defer:
1729	ata_qc_free(qc);
1730	if (rc == ATA_DEFER_LINK)
1731	return SCSI_MLQUEUE_DEVICE_BUSY;
1732	else
1733	return SCSI_MLQUEUE_HOST_BUSY;
1734	}
1735
1736	struct ata_scsi_args {
1737	struct ata_device *dev;
1738	u16 *id;
1739	struct scsi_cmnd *cmd;
1740	};
1741
1742	/**
1743	* ata_scsi_rbuf_fill - wrapper for SCSI command simulators
1744	* @args: device IDENTIFY data / SCSI command of interest.
1745	* @actor: Callback hook for desired SCSI command simulator
1746	*
1747	* Takes care of the hard work of simulating a SCSI command...
1748	* Mapping the response buffer, calling the command's handler,
1749	* and handling the handler's return value. This return value
1750	* indicates whether the handler wishes the SCSI command to be
1751	* completed successfully (0), or not (in which case cmd->result
1752	* and sense buffer are assumed to be set).
1753	*
1754	* LOCKING:
1755	* spin_lock_irqsave(host lock)
1756	*/
1757	static void ata_scsi_rbuf_fill(struct ata_scsi_args *args,
1758	unsigned int (*actor)(struct ata_scsi_args *args, u8 *rbuf))
1759	{
1760	unsigned int rc;
1761	struct scsi_cmnd *cmd = args->cmd;
1762	unsigned long flags;
1763
1764	spin_lock_irqsave(&ata_scsi_rbuf_lock, flags);
1765
1766	memset(ata_scsi_rbuf, 0, ATA_SCSI_RBUF_SIZE);
1767	rc = actor(args, ata_scsi_rbuf);
1768	if (rc == 0)
1769	sg_copy_from_buffer(sgl: scsi_sglist(cmd), nents: scsi_sg_count(cmd),
1770	buf: ata_scsi_rbuf, ATA_SCSI_RBUF_SIZE);
1771
1772	spin_unlock_irqrestore(lock: &ata_scsi_rbuf_lock, flags);
1773
1774	if (rc == 0)
1775	cmd->result = SAM_STAT_GOOD;
1776	}
1777
1778	/**
1779	* ata_scsiop_inq_std - Simulate INQUIRY command
1780	* @args: device IDENTIFY data / SCSI command of interest.
1781	* @rbuf: Response buffer, to which simulated SCSI cmd output is sent.
1782	*
1783	* Returns standard device identification data associated
1784	* with non-VPD INQUIRY command output.
1785	*
1786	* LOCKING:
1787	* spin_lock_irqsave(host lock)
1788	*/
1789	static unsigned int ata_scsiop_inq_std(struct ata_scsi_args *args, u8 *rbuf)
1790	{
1791	static const u8 versions[] = {
1792	0x00,
1793	0x60, /* SAM-3 (no version claimed) */
1794
1795	0x03,
1796	0x20, /* SBC-2 (no version claimed) */
1797
1798	0x03,
1799	0x00 /* SPC-3 (no version claimed) */
1800	};
1801	static const u8 versions_zbc[] = {
1802	0x00,
1803	0xA0, /* SAM-5 (no version claimed) */
1804
1805	0x06,
1806	0x00, /* SBC-4 (no version claimed) */
1807
1808	0x05,
1809	0xC0, /* SPC-5 (no version claimed) */
1810
1811	0x60,
1812	0x24, /* ZBC r05 */
1813	};
1814
1815	u8 hdr[] = {
1816	TYPE_DISK,
1817	0,
1818	0x5, /* claim SPC-3 version compatibility */
1819	2,
1820	95 - 4,
1821	0,
1822	0,
1823	2
1824	};
1825
1826	/* set scsi removable (RMB) bit per ata bit, or if the
1827	* AHCI port says it's external (Hotplug-capable, eSATA).
1828	*/
1829	if (ata_id_removable(args->id) ||
1830	(args->dev->link->ap->pflags & ATA_PFLAG_EXTERNAL))
1831	hdr[1] |= (1 << 7);
1832
1833	if (args->dev->class == ATA_DEV_ZAC) {
1834	hdr[0] = TYPE_ZBC;
1835	hdr[2] = 0x7; /* claim SPC-5 version compatibility */
1836	}
1837
1838	if (args->dev->flags & ATA_DFLAG_CDL)
1839	hdr[2] = 0xd; /* claim SPC-6 version compatibility */
1840
1841	memcpy(rbuf, hdr, sizeof(hdr));
1842	memcpy(&rbuf[8], "ATA ", 8);
1843	ata_id_string(id: args->id, s: &rbuf[16], ofs: ATA_ID_PROD, len: 16);
1844
1845	/* From SAT, use last 2 words from fw rev unless they are spaces */
1846	ata_id_string(id: args->id, s: &rbuf[32], ofs: ATA_ID_FW_REV + 2, len: 4);
1847	if (strncmp(&rbuf[32], " ", 4) == 0)
1848	ata_id_string(id: args->id, s: &rbuf[32], ofs: ATA_ID_FW_REV, len: 4);
1849
1850	if (rbuf[32] == 0 || rbuf[32] == ' ')
1851	memcpy(&rbuf[32], "n/a ", 4);
1852
1853	if (ata_id_zoned_cap(id: args->id) || args->dev->class == ATA_DEV_ZAC)
1854	memcpy(rbuf + 58, versions_zbc, sizeof(versions_zbc));
1855	else
1856	memcpy(rbuf + 58, versions, sizeof(versions));
1857
1858	return 0;
1859	}
1860
1861	/**
1862	* ata_scsiop_inq_00 - Simulate INQUIRY VPD page 0, list of pages
1863	* @args: device IDENTIFY data / SCSI command of interest.
1864	* @rbuf: Response buffer, to which simulated SCSI cmd output is sent.
1865	*
1866	* Returns list of inquiry VPD pages available.
1867	*
1868	* LOCKING:
1869	* spin_lock_irqsave(host lock)
1870	*/
1871	static unsigned int ata_scsiop_inq_00(struct ata_scsi_args *args, u8 *rbuf)
1872	{
1873	int i, num_pages = 0;
1874	static const u8 pages[] = {
1875	0x00, /* page 0x00, this page */
1876	0x80, /* page 0x80, unit serial no page */
1877	0x83, /* page 0x83, device ident page */
1878	0x89, /* page 0x89, ata info page */
1879	0xb0, /* page 0xb0, block limits page */
1880	0xb1, /* page 0xb1, block device characteristics page */
1881	0xb2, /* page 0xb2, thin provisioning page */
1882	0xb6, /* page 0xb6, zoned block device characteristics */
1883	0xb9, /* page 0xb9, concurrent positioning ranges */
1884	};
1885
1886	for (i = 0; i < sizeof(pages); i++) {
1887	if (pages[i] == 0xb6 &&
1888	!(args->dev->flags & ATA_DFLAG_ZAC))
1889	continue;
1890	rbuf[num_pages + 4] = pages[i];
1891	num_pages++;
1892	}
1893	rbuf[3] = num_pages; /* number of supported VPD pages */
1894	return 0;
1895	}
1896
1897	/**
1898	* ata_scsiop_inq_80 - Simulate INQUIRY VPD page 80, device serial number
1899	* @args: device IDENTIFY data / SCSI command of interest.
1900	* @rbuf: Response buffer, to which simulated SCSI cmd output is sent.
1901	*
1902	* Returns ATA device serial number.
1903	*
1904	* LOCKING:
1905	* spin_lock_irqsave(host lock)
1906	*/
1907	static unsigned int ata_scsiop_inq_80(struct ata_scsi_args *args, u8 *rbuf)
1908	{
1909	static const u8 hdr[] = {
1910	0,
1911	0x80, /* this page code */
1912	0,
1913	ATA_ID_SERNO_LEN, /* page len */
1914	};
1915
1916	memcpy(rbuf, hdr, sizeof(hdr));
1917	ata_id_string(id: args->id, s: (unsigned char *) &rbuf[4],
1918	ofs: ATA_ID_SERNO, len: ATA_ID_SERNO_LEN);
1919	return 0;
1920	}
1921
1922	/**
1923	* ata_scsiop_inq_83 - Simulate INQUIRY VPD page 83, device identity
1924	* @args: device IDENTIFY data / SCSI command of interest.
1925	* @rbuf: Response buffer, to which simulated SCSI cmd output is sent.
1926	*
1927	* Yields two logical unit device identification designators:
1928	* - vendor specific ASCII containing the ATA serial number
1929	* - SAT defined "t10 vendor id based" containing ASCII vendor
1930	* name ("ATA "), model and serial numbers.
1931	*
1932	* LOCKING:
1933	* spin_lock_irqsave(host lock)
1934	*/
1935	static unsigned int ata_scsiop_inq_83(struct ata_scsi_args *args, u8 *rbuf)
1936	{
1937	const int sat_model_serial_desc_len = 68;
1938	int num;
1939
1940	rbuf[1] = 0x83; /* this page code */
1941	num = 4;
1942
1943	/* piv=0, assoc=lu, code_set=ACSII, designator=vendor */
1944	rbuf[num + 0] = 2;
1945	rbuf[num + 3] = ATA_ID_SERNO_LEN;
1946	num += 4;
1947	ata_id_string(id: args->id, s: (unsigned char *) rbuf + num,
1948	ofs: ATA_ID_SERNO, len: ATA_ID_SERNO_LEN);
1949	num += ATA_ID_SERNO_LEN;
1950
1951	/* SAT defined lu model and serial numbers descriptor */
1952	/* piv=0, assoc=lu, code_set=ACSII, designator=t10 vendor id */
1953	rbuf[num + 0] = 2;
1954	rbuf[num + 1] = 1;
1955	rbuf[num + 3] = sat_model_serial_desc_len;
1956	num += 4;
1957	memcpy(rbuf + num, "ATA ", 8);
1958	num += 8;
1959	ata_id_string(id: args->id, s: (unsigned char *) rbuf + num, ofs: ATA_ID_PROD,
1960	len: ATA_ID_PROD_LEN);
1961	num += ATA_ID_PROD_LEN;
1962	ata_id_string(id: args->id, s: (unsigned char *) rbuf + num, ofs: ATA_ID_SERNO,
1963	len: ATA_ID_SERNO_LEN);
1964	num += ATA_ID_SERNO_LEN;
1965
1966	if (ata_id_has_wwn(id: args->id)) {
1967	/* SAT defined lu world wide name */
1968	/* piv=0, assoc=lu, code_set=binary, designator=NAA */
1969	rbuf[num + 0] = 1;
1970	rbuf[num + 1] = 3;
1971	rbuf[num + 3] = ATA_ID_WWN_LEN;
1972	num += 4;
1973	ata_id_string(id: args->id, s: (unsigned char *) rbuf + num,
1974	ofs: ATA_ID_WWN, len: ATA_ID_WWN_LEN);
1975	num += ATA_ID_WWN_LEN;
1976	}
1977	rbuf[3] = num - 4; /* page len (assume less than 256 bytes) */
1978	return 0;
1979	}
1980
1981	/**
1982	* ata_scsiop_inq_89 - Simulate INQUIRY VPD page 89, ATA info
1983	* @args: device IDENTIFY data / SCSI command of interest.
1984	* @rbuf: Response buffer, to which simulated SCSI cmd output is sent.
1985	*
1986	* Yields SAT-specified ATA VPD page.
1987	*
1988	* LOCKING:
1989	* spin_lock_irqsave(host lock)
1990	*/
1991	static unsigned int ata_scsiop_inq_89(struct ata_scsi_args *args, u8 *rbuf)
1992	{
1993	rbuf[1] = 0x89; /* our page code */
1994	rbuf[2] = (0x238 >> 8); /* page size fixed at 238h */
1995	rbuf[3] = (0x238 & 0xff);
1996
1997	memcpy(&rbuf[8], "linux ", 8);
1998	memcpy(&rbuf[16], "libata ", 16);
1999	memcpy(&rbuf[32], DRV_VERSION, 4);
2000
2001	rbuf[36] = 0x34; /* force D2H Reg FIS (34h) */
2002	rbuf[37] = (1 << 7); /* bit 7 indicates Command FIS */
2003	/* TODO: PMP? */
2004
2005	/* we don't store the ATA device signature, so we fake it */
2006	rbuf[38] = ATA_DRDY; /* really, this is Status reg */
2007	rbuf[40] = 0x1;
2008	rbuf[48] = 0x1;
2009
2010	rbuf[56] = ATA_CMD_ID_ATA;
2011
2012	memcpy(&rbuf[60], &args->id[0], 512);
2013	return 0;
2014	}
2015
2016	static unsigned int ata_scsiop_inq_b0(struct ata_scsi_args *args, u8 *rbuf)
2017	{
2018	struct ata_device *dev = args->dev;
2019	u16 min_io_sectors;
2020
2021	rbuf[1] = 0xb0;
2022	rbuf[3] = 0x3c; /* required VPD size with unmap support */
2023
2024	/*
2025	* Optimal transfer length granularity.
2026	*
2027	* This is always one physical block, but for disks with a smaller
2028	* logical than physical sector size we need to figure out what the
2029	* latter is.
2030	*/
2031	min_io_sectors = 1 << ata_id_log2_per_physical_sector(id: args->id);
2032	put_unaligned_be16(val: min_io_sectors, p: &rbuf[6]);
2033
2034	/*
2035	* Optimal unmap granularity.
2036	*
2037	* The ATA spec doesn't even know about a granularity or alignment
2038	* for the TRIM command. We can leave away most of the unmap related
2039	* VPD page entries, but we have specifify a granularity to signal
2040	* that we support some form of unmap - in thise case via WRITE SAME
2041	* with the unmap bit set.
2042	*/
2043	if (ata_id_has_trim(id: args->id)) {
2044	u64 max_blocks = 65535 * ATA_MAX_TRIM_RNUM;
2045
2046	if (dev->horkage & ATA_HORKAGE_MAX_TRIM_128M)
2047	max_blocks = 128 << (20 - SECTOR_SHIFT);
2048
2049	put_unaligned_be64(val: max_blocks, p: &rbuf[36]);
2050	put_unaligned_be32(val: 1, p: &rbuf[28]);
2051	}
2052
2053	return 0;
2054	}
2055
2056	static unsigned int ata_scsiop_inq_b1(struct ata_scsi_args *args, u8 *rbuf)
2057	{
2058	int form_factor = ata_id_form_factor(id: args->id);
2059	int media_rotation_rate = ata_id_rotation_rate(id: args->id);
2060	u8 zoned = ata_id_zoned_cap(id: args->id);
2061
2062	rbuf[1] = 0xb1;
2063	rbuf[3] = 0x3c;
2064	rbuf[4] = media_rotation_rate >> 8;
2065	rbuf[5] = media_rotation_rate;
2066	rbuf[7] = form_factor;
2067	if (zoned)
2068	rbuf[8] = (zoned << 4);
2069
2070	return 0;
2071	}
2072
2073	static unsigned int ata_scsiop_inq_b2(struct ata_scsi_args *args, u8 *rbuf)
2074	{
2075	/* SCSI Thin Provisioning VPD page: SBC-3 rev 22 or later */
2076	rbuf[1] = 0xb2;
2077	rbuf[3] = 0x4;
2078	rbuf[5] = 1 << 6; /* TPWS */
2079
2080	return 0;
2081	}
2082
2083	static unsigned int ata_scsiop_inq_b6(struct ata_scsi_args *args, u8 *rbuf)
2084	{
2085	/*
2086	* zbc-r05 SCSI Zoned Block device characteristics VPD page
2087	*/
2088	rbuf[1] = 0xb6;
2089	rbuf[3] = 0x3C;
2090
2091	/*
2092	* URSWRZ bit is only meaningful for host-managed ZAC drives
2093	*/
2094	if (args->dev->zac_zoned_cap & 1)
2095	rbuf[4] |= 1;
2096	put_unaligned_be32(val: args->dev->zac_zones_optimal_open, p: &rbuf[8]);
2097	put_unaligned_be32(val: args->dev->zac_zones_optimal_nonseq, p: &rbuf[12]);
2098	put_unaligned_be32(val: args->dev->zac_zones_max_open, p: &rbuf[16]);
2099
2100	return 0;
2101	}
2102
2103	static unsigned int ata_scsiop_inq_b9(struct ata_scsi_args *args, u8 *rbuf)
2104	{
2105	struct ata_cpr_log *cpr_log = args->dev->cpr_log;
2106	u8 *desc = &rbuf[64];
2107	int i;
2108
2109	/* SCSI Concurrent Positioning Ranges VPD page: SBC-5 rev 1 or later */
2110	rbuf[1] = 0xb9;
2111	put_unaligned_be16(val: 64 + (int)cpr_log->nr_cpr * 32 - 4, p: &rbuf[2]);
2112
2113	for (i = 0; i < cpr_log->nr_cpr; i++, desc += 32) {
2114	desc[0] = cpr_log->cpr[i].num;
2115	desc[1] = cpr_log->cpr[i].num_storage_elements;
2116	put_unaligned_be64(val: cpr_log->cpr[i].start_lba, p: &desc[8]);
2117	put_unaligned_be64(val: cpr_log->cpr[i].num_lbas, p: &desc[16]);
2118	}
2119
2120	return 0;
2121	}
2122
2123	/**
2124	* modecpy - Prepare response for MODE SENSE
2125	* @dest: output buffer
2126	* @src: data being copied
2127	* @n: length of mode page
2128	* @changeable: whether changeable parameters are requested
2129	*
2130	* Generate a generic MODE SENSE page for either current or changeable
2131	* parameters.
2132	*
2133	* LOCKING:
2134	* None.
2135	*/
2136	static void modecpy(u8 *dest, const u8 *src, int n, bool changeable)
2137	{
2138	if (changeable) {
2139	memcpy(dest, src, 2);
2140	memset(dest + 2, 0, n - 2);
2141	} else {
2142	memcpy(dest, src, n);
2143	}
2144	}
2145
2146	/**
2147	* ata_msense_caching - Simulate MODE SENSE caching info page
2148	* @id: device IDENTIFY data
2149	* @buf: output buffer
2150	* @changeable: whether changeable parameters are requested
2151	*
2152	* Generate a caching info page, which conditionally indicates
2153	* write caching to the SCSI layer, depending on device
2154	* capabilities.
2155	*
2156	* LOCKING:
2157	* None.
2158	*/
2159	static unsigned int ata_msense_caching(u16 *id, u8 *buf, bool changeable)
2160	{
2161	modecpy(dest: buf, src: def_cache_mpage, n: sizeof(def_cache_mpage), changeable);
2162	if (changeable) {
2163	buf[2] |= (1 << 2); /* ata_mselect_caching() */
2164	} else {
2165	buf[2] |= (ata_id_wcache_enabled(id) << 2); /* write cache enable */
2166	buf[12] |= (!ata_id_rahead_enabled(id) << 5); /* disable read ahead */
2167	}
2168	return sizeof(def_cache_mpage);
2169	}
2170
2171	/*
2172	* Simulate MODE SENSE control mode page, sub-page 0.
2173	*/
2174	static unsigned int ata_msense_control_spg0(struct ata_device *dev, u8 *buf,
2175	bool changeable)
2176	{
2177	modecpy(dest: buf, src: def_control_mpage,
2178	n: sizeof(def_control_mpage), changeable);
2179	if (changeable) {
2180	/* ata_mselect_control() */
2181	buf[2] |= (1 << 2);
2182	} else {
2183	bool d_sense = (dev->flags & ATA_DFLAG_D_SENSE);
2184
2185	/* descriptor format sense data */
2186	buf[2] |= (d_sense << 2);
2187	}
2188
2189	return sizeof(def_control_mpage);
2190	}
2191
2192	/*
2193	* Translate an ATA duration limit in microseconds to a SCSI duration limit
2194	* using the t2cdlunits 0xa (10ms). Since the SCSI duration limits are 2-bytes
2195	* only, take care of overflows.
2196	*/
2197	static inline u16 ata_xlat_cdl_limit(u8 *buf)
2198	{
2199	u32 limit = get_unaligned_le32(p: buf);
2200
2201	return min_t(u32, limit / 10000, 65535);
2202	}
2203
2204	/*
2205	* Simulate MODE SENSE control mode page, sub-pages 07h and 08h
2206	* (command duration limits T2A and T2B mode pages).
2207	*/
2208	static unsigned int ata_msense_control_spgt2(struct ata_device *dev, u8 *buf,
2209	u8 spg)
2210	{
2211	u8 *b, *cdl = dev->cdl, *desc;
2212	u32 policy;
2213	int i;
2214
2215	/*
2216	* Fill the subpage. The first four bytes of the T2A/T2B mode pages
2217	* are a header. The PAGE LENGTH field is the size of the page
2218	* excluding the header.
2219	*/
2220	buf[0] = CONTROL_MPAGE;
2221	buf[1] = spg;
2222	put_unaligned_be16(CDL_T2_SUB_MPAGE_LEN - 4, p: &buf[2]);
2223	if (spg == CDL_T2A_SUB_MPAGE) {
2224	/*
2225	* Read descriptors map to the T2A page:
2226	* set perf_vs_duration_guidleine.
2227	*/
2228	buf[7] = (cdl[0] & 0x03) << 4;
2229	desc = cdl + 64;
2230	} else {
2231	/* Write descriptors map to the T2B page */
2232	desc = cdl + 288;
2233	}
2234
2235	/* Fill the T2 page descriptors */
2236	b = &buf[8];
2237	policy = get_unaligned_le32(p: &cdl[0]);
2238	for (i = 0; i < 7; i++, b += 32, desc += 32) {
2239	/* t2cdlunits: fixed to 10ms */
2240	b[0] = 0x0a;
2241
2242	/* Max inactive time and its policy */
2243	put_unaligned_be16(val: ata_xlat_cdl_limit(buf: &desc[8]), p: &b[2]);
2244	b[6] = ((policy >> 8) & 0x0f) << 4;
2245
2246	/* Max active time and its policy */
2247	put_unaligned_be16(val: ata_xlat_cdl_limit(buf: &desc[4]), p: &b[4]);
2248	b[6] |= (policy >> 4) & 0x0f;
2249
2250	/* Command duration guideline and its policy */
2251	put_unaligned_be16(val: ata_xlat_cdl_limit(buf: &desc[16]), p: &b[10]);
2252	b[14] = policy & 0x0f;
2253	}
2254
2255	return CDL_T2_SUB_MPAGE_LEN;
2256	}
2257
2258	/*
2259	* Simulate MODE SENSE control mode page, sub-page f2h
2260	* (ATA feature control mode page).
2261	*/
2262	static unsigned int ata_msense_control_ata_feature(struct ata_device *dev,
2263	u8 *buf)
2264	{
2265	/* PS=0, SPF=1 */
2266	buf[0] = CONTROL_MPAGE | (1 << 6);
2267	buf[1] = ATA_FEATURE_SUB_MPAGE;
2268
2269	/*
2270	* The first four bytes of ATA Feature Control mode page are a header.
2271	* The PAGE LENGTH field is the size of the page excluding the header.
2272	*/
2273	put_unaligned_be16(ATA_FEATURE_SUB_MPAGE_LEN - 4, p: &buf[2]);
2274
2275	if (dev->flags & ATA_DFLAG_CDL)
2276	buf[4] = 0x02; /* Support T2A and T2B pages */
2277	else
2278	buf[4] = 0;
2279
2280	return ATA_FEATURE_SUB_MPAGE_LEN;
2281	}
2282
2283	/**
2284	* ata_msense_control - Simulate MODE SENSE control mode page
2285	* @dev: ATA device of interest
2286	* @buf: output buffer
2287	* @spg: sub-page code
2288	* @changeable: whether changeable parameters are requested
2289	*
2290	* Generate a generic MODE SENSE control mode page.
2291	*
2292	* LOCKING:
2293	* None.
2294	*/
2295	static unsigned int ata_msense_control(struct ata_device *dev, u8 *buf,
2296	u8 spg, bool changeable)
2297	{
2298	unsigned int n;
2299
2300	switch (spg) {
2301	case 0:
2302	return ata_msense_control_spg0(dev, buf, changeable);
2303	case CDL_T2A_SUB_MPAGE:
2304	case CDL_T2B_SUB_MPAGE:
2305	return ata_msense_control_spgt2(dev, buf, spg);
2306	case ATA_FEATURE_SUB_MPAGE:
2307	return ata_msense_control_ata_feature(dev, buf);
2308	case ALL_SUB_MPAGES:
2309	n = ata_msense_control_spg0(dev, buf, changeable);
2310	n += ata_msense_control_spgt2(dev, buf: buf + n, CDL_T2A_SUB_MPAGE);
2311	n += ata_msense_control_spgt2(dev, buf: buf + n, CDL_T2A_SUB_MPAGE);
2312	n += ata_msense_control_ata_feature(dev, buf: buf + n);
2313	return n;
2314	default:
2315	return 0;
2316	}
2317	}
2318
2319	/**
2320	* ata_msense_rw_recovery - Simulate MODE SENSE r/w error recovery page
2321	* @buf: output buffer
2322	* @changeable: whether changeable parameters are requested
2323	*
2324	* Generate a generic MODE SENSE r/w error recovery page.
2325	*
2326	* LOCKING:
2327	* None.
2328	*/
2329	static unsigned int ata_msense_rw_recovery(u8 *buf, bool changeable)
2330	{
2331	modecpy(dest: buf, src: def_rw_recovery_mpage, n: sizeof(def_rw_recovery_mpage),
2332	changeable);
2333	return sizeof(def_rw_recovery_mpage);
2334	}
2335
2336	/**
2337	* ata_scsiop_mode_sense - Simulate MODE SENSE 6, 10 commands
2338	* @args: device IDENTIFY data / SCSI command of interest.
2339	* @rbuf: Response buffer, to which simulated SCSI cmd output is sent.
2340	*
2341	* Simulate MODE SENSE commands. Assume this is invoked for direct
2342	* access devices (e.g. disks) only. There should be no block
2343	* descriptor for other device types.
2344	*
2345	* LOCKING:
2346	* spin_lock_irqsave(host lock)
2347	*/
2348	static unsigned int ata_scsiop_mode_sense(struct ata_scsi_args *args, u8 *rbuf)
2349	{
2350	struct ata_device *dev = args->dev;
2351	u8 *scsicmd = args->cmd->cmnd, *p = rbuf;
2352	static const u8 sat_blk_desc[] = {
2353	0, 0, 0, 0, /* number of blocks: sat unspecified */
2354	0,
2355	0, 0x2, 0x0 /* block length: 512 bytes */
2356	};
2357	u8 pg, spg;
2358	unsigned int ebd, page_control, six_byte;
2359	u8 dpofua = 0, bp = 0xff;
2360	u16 fp;
2361
2362	six_byte = (scsicmd[0] == MODE_SENSE);
2363	ebd = !(scsicmd[1] & 0x8); /* dbd bit inverted == edb */
2364	/*
2365	* LLBA bit in msense(10) ignored (compliant)
2366	*/
2367
2368	page_control = scsicmd[2] >> 6;
2369	switch (page_control) {
2370	case 0: /* current */
2371	case 1: /* changeable */
2372	case 2: /* defaults */
2373	break; /* supported */
2374	case 3: /* saved */
2375	goto saving_not_supp;
2376	default:
2377	fp = 2;
2378	bp = 6;
2379	goto invalid_fld;
2380	}
2381
2382	if (six_byte)
2383	p += 4 + (ebd ? 8 : 0);
2384	else
2385	p += 8 + (ebd ? 8 : 0);
2386
2387	pg = scsicmd[2] & 0x3f;
2388	spg = scsicmd[3];
2389
2390	/*
2391	* Supported subpages: all subpages and sub-pages 07h, 08h and f2h of
2392	* the control page.
2393	*/
2394	if (spg) {
2395	switch (spg) {
2396	case ALL_SUB_MPAGES:
2397	break;
2398	case CDL_T2A_SUB_MPAGE:
2399	case CDL_T2B_SUB_MPAGE:
2400	case ATA_FEATURE_SUB_MPAGE:
2401	if (dev->flags & ATA_DFLAG_CDL && pg == CONTROL_MPAGE)
2402	break;
2403	fallthrough;
2404	default:
2405	fp = 3;
2406	goto invalid_fld;
2407	}
2408	}
2409
2410	switch(pg) {
2411	case RW_RECOVERY_MPAGE:
2412	p += ata_msense_rw_recovery(buf: p, changeable: page_control == 1);
2413	break;
2414
2415	case CACHE_MPAGE:
2416	p += ata_msense_caching(id: args->id, buf: p, changeable: page_control == 1);
2417	break;
2418
2419	case CONTROL_MPAGE:
2420	p += ata_msense_control(dev: args->dev, buf: p, spg, changeable: page_control == 1);
2421	break;
2422
2423	case ALL_MPAGES:
2424	p += ata_msense_rw_recovery(buf: p, changeable: page_control == 1);
2425	p += ata_msense_caching(id: args->id, buf: p, changeable: page_control == 1);
2426	p += ata_msense_control(dev: args->dev, buf: p, spg, changeable: page_control == 1);
2427	break;
2428
2429	default: /* invalid page code */
2430	fp = 2;
2431	goto invalid_fld;
2432	}
2433
2434	if (dev->flags & ATA_DFLAG_FUA)
2435	dpofua = 1 << 4;
2436
2437	if (six_byte) {
2438	rbuf[0] = p - rbuf - 1;
2439	rbuf[2] |= dpofua;
2440	if (ebd) {
2441	rbuf[3] = sizeof(sat_blk_desc);
2442	memcpy(rbuf + 4, sat_blk_desc, sizeof(sat_blk_desc));
2443	}
2444	} else {
2445	put_unaligned_be16(val: p - rbuf - 2, p: &rbuf[0]);
2446	rbuf[3] |= dpofua;
2447	if (ebd) {
2448	rbuf[7] = sizeof(sat_blk_desc);
2449	memcpy(rbuf + 8, sat_blk_desc, sizeof(sat_blk_desc));
2450	}
2451	}
2452	return 0;
2453
2454	invalid_fld:
2455	ata_scsi_set_invalid_field(dev, cmd: args->cmd, field: fp, bit: bp);
2456	return 1;
2457
2458	saving_not_supp:
2459	ata_scsi_set_sense(dev, cmd: args->cmd, ILLEGAL_REQUEST, asc: 0x39, ascq: 0x0);
2460	/* "Saving parameters not supported" */
2461	return 1;
2462	}
2463
2464	/**
2465	* ata_scsiop_read_cap - Simulate READ CAPACITY[ 16] commands
2466	* @args: device IDENTIFY data / SCSI command of interest.
2467	* @rbuf: Response buffer, to which simulated SCSI cmd output is sent.
2468	*
2469	* Simulate READ CAPACITY commands.
2470	*
2471	* LOCKING:
2472	* None.
2473	*/
2474	static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
2475	{
2476	struct ata_device *dev = args->dev;
2477	u64 last_lba = dev->n_sectors - 1; /* LBA of the last block */
2478	u32 sector_size; /* physical sector size in bytes */
2479	u8 log2_per_phys;
2480	u16 lowest_aligned;
2481
2482	sector_size = ata_id_logical_sector_size(id: dev->id);
2483	log2_per_phys = ata_id_log2_per_physical_sector(id: dev->id);
2484	lowest_aligned = ata_id_logical_sector_offset(id: dev->id, log2_per_phys);
2485
2486	if (args->cmd->cmnd[0] == READ_CAPACITY) {
2487	if (last_lba >= 0xffffffffULL)
2488	last_lba = 0xffffffff;
2489
2490	/* sector count, 32-bit */
2491	rbuf[0] = last_lba >> (8 * 3);
2492	rbuf[1] = last_lba >> (8 * 2);
2493	rbuf[2] = last_lba >> (8 * 1);
2494	rbuf[3] = last_lba;
2495
2496	/* sector size */
2497	rbuf[4] = sector_size >> (8 * 3);
2498	rbuf[5] = sector_size >> (8 * 2);
2499	rbuf[6] = sector_size >> (8 * 1);
2500	rbuf[7] = sector_size;
2501	} else {
2502	/* sector count, 64-bit */
2503	rbuf[0] = last_lba >> (8 * 7);
2504	rbuf[1] = last_lba >> (8 * 6);
2505	rbuf[2] = last_lba >> (8 * 5);
2506	rbuf[3] = last_lba >> (8 * 4);
2507	rbuf[4] = last_lba >> (8 * 3);
2508	rbuf[5] = last_lba >> (8 * 2);
2509	rbuf[6] = last_lba >> (8 * 1);
2510	rbuf[7] = last_lba;
2511
2512	/* sector size */
2513	rbuf[ 8] = sector_size >> (8 * 3);
2514	rbuf[ 9] = sector_size >> (8 * 2);
2515	rbuf[10] = sector_size >> (8 * 1);
2516	rbuf[11] = sector_size;
2517
2518	rbuf[12] = 0;
2519	rbuf[13] = log2_per_phys;
2520	rbuf[14] = (lowest_aligned >> 8) & 0x3f;
2521	rbuf[15] = lowest_aligned;
2522
2523	if (ata_id_has_trim(id: args->id) &&
2524	!(dev->horkage & ATA_HORKAGE_NOTRIM)) {
2525	rbuf[14] |= 0x80; /* LBPME */
2526
2527	if (ata_id_has_zero_after_trim(id: args->id) &&
2528	dev->horkage & ATA_HORKAGE_ZERO_AFTER_TRIM) {
2529	ata_dev_info(dev, "Enabling discard_zeroes_data\n");
2530	rbuf[14] |= 0x40; /* LBPRZ */
2531	}
2532	}
2533	if (ata_id_zoned_cap(id: args->id) ||
2534	args->dev->class == ATA_DEV_ZAC)
2535	rbuf[12] = (1 << 4); /* RC_BASIS */
2536	}
2537	return 0;
2538	}
2539
2540	/**
2541	* ata_scsiop_report_luns - Simulate REPORT LUNS command
2542	* @args: device IDENTIFY data / SCSI command of interest.
2543	* @rbuf: Response buffer, to which simulated SCSI cmd output is sent.
2544	*
2545	* Simulate REPORT LUNS command.
2546	*
2547	* LOCKING:
2548	* spin_lock_irqsave(host lock)
2549	*/
2550	static unsigned int ata_scsiop_report_luns(struct ata_scsi_args *args, u8 *rbuf)
2551	{
2552	rbuf[3] = 8; /* just one lun, LUN 0, size 8 bytes */
2553
2554	return 0;
2555	}
2556
2557	/*
2558	* ATAPI devices typically report zero for their SCSI version, and sometimes
2559	* deviate from the spec WRT response data format. If SCSI version is
2560	* reported as zero like normal, then we make the following fixups:
2561	* 1) Fake MMC-5 version, to indicate to the Linux scsi midlayer this is a
2562	* modern device.
2563	* 2) Ensure response data format / ATAPI information are always correct.
2564	*/
2565	static void atapi_fixup_inquiry(struct scsi_cmnd *cmd)
2566	{
2567	u8 buf[4];
2568
2569	sg_copy_to_buffer(sgl: scsi_sglist(cmd), nents: scsi_sg_count(cmd), buf, buflen: 4);
2570	if (buf[2] == 0) {
2571	buf[2] = 0x5;
2572	buf[3] = 0x32;
2573	}
2574	sg_copy_from_buffer(sgl: scsi_sglist(cmd), nents: scsi_sg_count(cmd), buf, buflen: 4);
2575	}
2576
2577	static void atapi_qc_complete(struct ata_queued_cmd *qc)
2578	{
2579	struct scsi_cmnd *cmd = qc->scsicmd;
2580	unsigned int err_mask = qc->err_mask;
2581
2582	/* handle completion from EH */
2583	if (unlikely(err_mask || qc->flags & ATA_QCFLAG_SENSE_VALID)) {
2584
2585	if (!(qc->flags & ATA_QCFLAG_SENSE_VALID)) {
2586	/* FIXME: not quite right; we don't want the
2587	* translation of taskfile registers into a
2588	* sense descriptors, since that's only
2589	* correct for ATA, not ATAPI
2590	*/
2591	ata_gen_passthru_sense(qc);
2592	}
2593
2594	/* SCSI EH automatically locks door if sdev->locked is
2595	* set. Sometimes door lock request continues to
2596	* fail, for example, when no media is present. This
2597	* creates a loop - SCSI EH issues door lock which
2598	* fails and gets invoked again to acquire sense data
2599	* for the failed command.
2600	*
2601	* If door lock fails, always clear sdev->locked to
2602	* avoid this infinite loop.
2603	*
2604	* This may happen before SCSI scan is complete. Make
2605	* sure qc->dev->sdev isn't NULL before dereferencing.
2606	*/
2607	if (qc->cdb[0] == ALLOW_MEDIUM_REMOVAL && qc->dev->sdev)
2608	qc->dev->sdev->locked = 0;
2609
2610	qc->scsicmd->result = SAM_STAT_CHECK_CONDITION;
2611	ata_qc_done(qc);
2612	return;
2613	}
2614
2615	/* successful completion path */
2616	if (cmd->cmnd[0] == INQUIRY && (cmd->cmnd[1] & 0x03) == 0)
2617	atapi_fixup_inquiry(cmd);
2618	cmd->result = SAM_STAT_GOOD;
2619
2620	ata_qc_done(qc);
2621	}
2622	/**
2623	* atapi_xlat - Initialize PACKET taskfile
2624	* @qc: command structure to be initialized
2625	*
2626	* LOCKING:
2627	* spin_lock_irqsave(host lock)
2628	*
2629	* RETURNS:
2630	* Zero on success, non-zero on failure.
2631	*/
2632	static unsigned int atapi_xlat(struct ata_queued_cmd *qc)
2633	{
2634	struct scsi_cmnd *scmd = qc->scsicmd;
2635	struct ata_device *dev = qc->dev;
2636	int nodata = (scmd->sc_data_direction == DMA_NONE);
2637	int using_pio = !nodata && (dev->flags & ATA_DFLAG_PIO);
2638	unsigned int nbytes;
2639
2640	memset(qc->cdb, 0, dev->cdb_len);
2641	memcpy(qc->cdb, scmd->cmnd, scmd->cmd_len);
2642
2643	qc->complete_fn = atapi_qc_complete;
2644
2645	qc->tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
2646	if (scmd->sc_data_direction == DMA_TO_DEVICE) {
2647	qc->tf.flags |= ATA_TFLAG_WRITE;
2648	}
2649
2650	qc->tf.command = ATA_CMD_PACKET;
2651	ata_qc_set_pc_nbytes(qc);
2652
2653	/* check whether ATAPI DMA is safe */
2654	if (!nodata && !using_pio && atapi_check_dma(qc))
2655	using_pio = 1;
2656
2657	/* Some controller variants snoop this value for Packet
2658	* transfers to do state machine and FIFO management. Thus we
2659	* want to set it properly, and for DMA where it is
2660	* effectively meaningless.
2661	*/
2662	nbytes = min(ata_qc_raw_nbytes(qc), (unsigned int)63 * 1024);
2663
2664	/* Most ATAPI devices which honor transfer chunk size don't
2665	* behave according to the spec when odd chunk size which
2666	* matches the transfer length is specified. If the number of
2667	* bytes to transfer is 2n+1. According to the spec, what
2668	* should happen is to indicate that 2n+1 is going to be
2669	* transferred and transfer 2n+2 bytes where the last byte is
2670	* padding.
2671	*
2672	* In practice, this doesn't happen. ATAPI devices first
2673	* indicate and transfer 2n bytes and then indicate and
2674	* transfer 2 bytes where the last byte is padding.
2675	*
2676	* This inconsistency confuses several controllers which
2677	* perform PIO using DMA such as Intel AHCIs and sil3124/32.
2678	* These controllers use actual number of transferred bytes to
2679	* update DMA pointer and transfer of 4n+2 bytes make those
2680	* controller push DMA pointer by 4n+4 bytes because SATA data
2681	* FISes are aligned to 4 bytes. This causes data corruption
2682	* and buffer overrun.
2683	*
2684	* Always setting nbytes to even number solves this problem
2685	* because then ATAPI devices don't have to split data at 2n
2686	* boundaries.
2687	*/
2688	if (nbytes & 0x1)
2689	nbytes++;
2690
2691	qc->tf.lbam = (nbytes & 0xFF);
2692	qc->tf.lbah = (nbytes >> 8);
2693
2694	if (nodata)
2695	qc->tf.protocol = ATAPI_PROT_NODATA;
2696	else if (using_pio)
2697	qc->tf.protocol = ATAPI_PROT_PIO;
2698	else {
2699	/* DMA data xfer */
2700	qc->tf.protocol = ATAPI_PROT_DMA;
2701	qc->tf.feature |= ATAPI_PKT_DMA;
2702
2703	if ((dev->flags & ATA_DFLAG_DMADIR) &&
2704	(scmd->sc_data_direction != DMA_TO_DEVICE))
2705	/* some SATA bridges need us to indicate data xfer direction */
2706	qc->tf.feature |= ATAPI_DMADIR;
2707	}
2708
2709
2710	/* FIXME: We need to translate 0x05 READ_BLOCK_LIMITS to a MODE_SENSE
2711	as ATAPI tape drives don't get this right otherwise */
2712	return 0;
2713	}
2714
2715	static struct ata_device *ata_find_dev(struct ata_port *ap, unsigned int devno)
2716	{
2717	/*
2718	* For the non-PMP case, ata_link_max_devices() returns 1 (SATA case),
2719	* or 2 (IDE master + slave case). However, the former case includes
2720	* libsas hosted devices which are numbered per scsi host, leading
2721	* to devno potentially being larger than 0 but with each struct
2722	* ata_device having its own struct ata_port and struct ata_link.
2723	* To accommodate these, ignore devno and always use device number 0.
2724	*/
2725	if (likely(!sata_pmp_attached(ap))) {
2726	int link_max_devices = ata_link_max_devices(link: &ap->link);
2727
2728	if (link_max_devices == 1)
2729	return &ap->link.device[0];
2730
2731	if (devno < link_max_devices)
2732	return &ap->link.device[devno];
2733
2734	return NULL;
2735	}
2736
2737	/*
2738	* For PMP-attached devices, the device number corresponds to C
2739	* (channel) of SCSI [H:C:I:L], indicating the port pmp link
2740	* for the device.
2741	*/
2742	if (devno < ap->nr_pmp_links)
2743	return &ap->pmp_link[devno].device[0];
2744
2745	return NULL;
2746	}
2747
2748	static struct ata_device *__ata_scsi_find_dev(struct ata_port *ap,
2749	const struct scsi_device *scsidev)
2750	{
2751	int devno;
2752
2753	/* skip commands not addressed to targets we simulate */
2754	if (!sata_pmp_attached(ap)) {
2755	if (unlikely(scsidev->channel || scsidev->lun))
2756	return NULL;
2757	devno = scsidev->id;
2758	} else {
2759	if (unlikely(scsidev->id || scsidev->lun))
2760	return NULL;
2761	devno = scsidev->channel;
2762	}
2763
2764	return ata_find_dev(ap, devno);
2765	}
2766
2767	/**
2768	* ata_scsi_find_dev - lookup ata_device from scsi_cmnd
2769	* @ap: ATA port to which the device is attached
2770	* @scsidev: SCSI device from which we derive the ATA device
2771	*
2772	* Given various information provided in struct scsi_cmnd,
2773	* map that onto an ATA bus, and using that mapping
2774	* determine which ata_device is associated with the
2775	* SCSI command to be sent.
2776	*
2777	* LOCKING:
2778	* spin_lock_irqsave(host lock)
2779	*
2780	* RETURNS:
2781	* Associated ATA device, or %NULL if not found.
2782	*/
2783	struct ata_device *
2784	ata_scsi_find_dev(struct ata_port *ap, const struct scsi_device *scsidev)
2785	{
2786	struct ata_device *dev = __ata_scsi_find_dev(ap, scsidev);
2787
2788	if (unlikely(!dev || !ata_dev_enabled(dev)))
2789	return NULL;
2790
2791	return dev;
2792	}
2793
2794	/*
2795	* ata_scsi_map_proto - Map pass-thru protocol value to taskfile value.
2796	* @byte1: Byte 1 from pass-thru CDB.
2797	*
2798	* RETURNS:
2799	* ATA_PROT_UNKNOWN if mapping failed/unimplemented, protocol otherwise.
2800	*/
2801	static u8
2802	ata_scsi_map_proto(u8 byte1)
2803	{
2804	switch((byte1 & 0x1e) >> 1) {
2805	case 3: /* Non-data */
2806	return ATA_PROT_NODATA;
2807
2808	case 6: /* DMA */
2809	case 10: /* UDMA Data-in */
2810	case 11: /* UDMA Data-Out */
2811	return ATA_PROT_DMA;
2812
2813	case 4: /* PIO Data-in */
2814	case 5: /* PIO Data-out */
2815	return ATA_PROT_PIO;
2816
2817	case 12: /* FPDMA */
2818	return ATA_PROT_NCQ;
2819
2820	case 0: /* Hard Reset */
2821	case 1: /* SRST */
2822	case 8: /* Device Diagnostic */
2823	case 9: /* Device Reset */
2824	case 7: /* DMA Queued */
2825	case 15: /* Return Response Info */
2826	default: /* Reserved */
2827	break;
2828	}
2829
2830	return ATA_PROT_UNKNOWN;
2831	}
2832
2833	/**
2834	* ata_scsi_pass_thru - convert ATA pass-thru CDB to taskfile
2835	* @qc: command structure to be initialized
2836	*
2837	* Handles either 12, 16, or 32-byte versions of the CDB.
2838	*
2839	* RETURNS:
2840	* Zero on success, non-zero on failure.
2841	*/
2842	static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
2843	{
2844	struct ata_taskfile *tf = &(qc->tf);
2845	struct scsi_cmnd *scmd = qc->scsicmd;
2846	struct ata_device *dev = qc->dev;
2847	const u8 *cdb = scmd->cmnd;
2848	u16 fp;
2849	u16 cdb_offset = 0;
2850
2851	/* 7Fh variable length cmd means a ata pass-thru(32) */
2852	if (cdb[0] == VARIABLE_LENGTH_CMD)
2853	cdb_offset = 9;
2854
2855	tf->protocol = ata_scsi_map_proto(byte1: cdb[1 + cdb_offset]);
2856	if (tf->protocol == ATA_PROT_UNKNOWN) {
2857	fp = 1;
2858	goto invalid_fld;
2859	}
2860
2861	if ((cdb[2 + cdb_offset] & 0x3) == 0) {
2862	/*
2863	* When T_LENGTH is zero (No data is transferred), dir should
2864	* be DMA_NONE.
2865	*/
2866	if (scmd->sc_data_direction != DMA_NONE) {
2867	fp = 2 + cdb_offset;
2868	goto invalid_fld;
2869	}
2870
2871	if (ata_is_ncq(prot: tf->protocol))
2872	tf->protocol = ATA_PROT_NCQ_NODATA;
2873	}
2874
2875	/* enable LBA */
2876	tf->flags |= ATA_TFLAG_LBA;
2877
2878	/*
2879	* 12 and 16 byte CDBs use different offsets to
2880	* provide the various register values.
2881	*/
2882	switch (cdb[0]) {
2883	case ATA_16:
2884	/*
2885	* 16-byte CDB - may contain extended commands.
2886	*
2887	* If that is the case, copy the upper byte register values.
2888	*/
2889	if (cdb[1] & 0x01) {
2890	tf->hob_feature = cdb[3];
2891	tf->hob_nsect = cdb[5];
2892	tf->hob_lbal = cdb[7];
2893	tf->hob_lbam = cdb[9];
2894	tf->hob_lbah = cdb[11];
2895	tf->flags |= ATA_TFLAG_LBA48;
2896	} else
2897	tf->flags &= ~ATA_TFLAG_LBA48;
2898
2899	/*
2900	* Always copy low byte, device and command registers.
2901	*/
2902	tf->feature = cdb[4];
2903	tf->nsect = cdb[6];
2904	tf->lbal = cdb[8];
2905	tf->lbam = cdb[10];
2906	tf->lbah = cdb[12];
2907	tf->device = cdb[13];
2908	tf->command = cdb[14];
2909	break;
2910	case ATA_12:
2911	/*
2912	* 12-byte CDB - incapable of extended commands.
2913	*/
2914	tf->flags &= ~ATA_TFLAG_LBA48;
2915
2916	tf->feature = cdb[3];
2917	tf->nsect = cdb[4];
2918	tf->lbal = cdb[5];
2919	tf->lbam = cdb[6];
2920	tf->lbah = cdb[7];
2921	tf->device = cdb[8];
2922	tf->command = cdb[9];
2923	break;
2924	default:
2925	/*
2926	* 32-byte CDB - may contain extended command fields.
2927	*
2928	* If that is the case, copy the upper byte register values.
2929	*/
2930	if (cdb[10] & 0x01) {
2931	tf->hob_feature = cdb[20];
2932	tf->hob_nsect = cdb[22];
2933	tf->hob_lbal = cdb[16];
2934	tf->hob_lbam = cdb[15];
2935	tf->hob_lbah = cdb[14];
2936	tf->flags |= ATA_TFLAG_LBA48;
2937	} else
2938	tf->flags &= ~ATA_TFLAG_LBA48;
2939
2940	tf->feature = cdb[21];
2941	tf->nsect = cdb[23];
2942	tf->lbal = cdb[19];
2943	tf->lbam = cdb[18];
2944	tf->lbah = cdb[17];
2945	tf->device = cdb[24];
2946	tf->command = cdb[25];
2947	tf->auxiliary = get_unaligned_be32(p: &cdb[28]);
2948	break;
2949	}
2950
2951	/* For NCQ commands copy the tag value */
2952	if (ata_is_ncq(prot: tf->protocol))
2953	tf->nsect = qc->hw_tag << 3;
2954
2955	/* enforce correct master/slave bit */
2956	tf->device = dev->devno ?
2957	tf->device | ATA_DEV1 : tf->device & ~ATA_DEV1;
2958
2959	switch (tf->command) {
2960	/* READ/WRITE LONG use a non-standard sect_size */
2961	case ATA_CMD_READ_LONG:
2962	case ATA_CMD_READ_LONG_ONCE:
2963	case ATA_CMD_WRITE_LONG:
2964	case ATA_CMD_WRITE_LONG_ONCE:
2965	if (tf->protocol != ATA_PROT_PIO || tf->nsect != 1) {
2966	fp = 1;
2967	goto invalid_fld;
2968	}
2969	qc->sect_size = scsi_bufflen(cmd: scmd);
2970	break;
2971
2972	/* commands using reported Logical Block size (e.g. 512 or 4K) */
2973	case ATA_CMD_CFA_WRITE_NE:
2974	case ATA_CMD_CFA_TRANS_SECT:
2975	case ATA_CMD_CFA_WRITE_MULT_NE:
2976	/* XXX: case ATA_CMD_CFA_WRITE_SECTORS_WITHOUT_ERASE: */
2977	case ATA_CMD_READ:
2978	case ATA_CMD_READ_EXT:
2979	case ATA_CMD_READ_QUEUED:
2980	/* XXX: case ATA_CMD_READ_QUEUED_EXT: */
2981	case ATA_CMD_FPDMA_READ:
2982	case ATA_CMD_READ_MULTI:
2983	case ATA_CMD_READ_MULTI_EXT:
2984	case ATA_CMD_PIO_READ:
2985	case ATA_CMD_PIO_READ_EXT:
2986	case ATA_CMD_READ_STREAM_DMA_EXT:
2987	case ATA_CMD_READ_STREAM_EXT:
2988	case ATA_CMD_VERIFY:
2989	case ATA_CMD_VERIFY_EXT:
2990	case ATA_CMD_WRITE:
2991	case ATA_CMD_WRITE_EXT:
2992	case ATA_CMD_WRITE_FUA_EXT:
2993	case ATA_CMD_WRITE_QUEUED:
2994	case ATA_CMD_WRITE_QUEUED_FUA_EXT:
2995	case ATA_CMD_FPDMA_WRITE:
2996	case ATA_CMD_WRITE_MULTI:
2997	case ATA_CMD_WRITE_MULTI_EXT:
2998	case ATA_CMD_WRITE_MULTI_FUA_EXT:
2999	case ATA_CMD_PIO_WRITE:
3000	case ATA_CMD_PIO_WRITE_EXT:
3001	case ATA_CMD_WRITE_STREAM_DMA_EXT:
3002	case ATA_CMD_WRITE_STREAM_EXT:
3003	qc->sect_size = scmd->device->sector_size;
3004	break;
3005
3006	/* Everything else uses 512 byte "sectors" */
3007	default:
3008	qc->sect_size = ATA_SECT_SIZE;
3009	}
3010
3011	/*
3012	* Set flags so that all registers will be written, pass on
3013	* write indication (used for PIO/DMA setup), result TF is
3014	* copied back and we don't whine too much about its failure.
3015	*/
3016	tf->flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
3017	if (scmd->sc_data_direction == DMA_TO_DEVICE)
3018	tf->flags |= ATA_TFLAG_WRITE;
3019
3020	qc->flags |= ATA_QCFLAG_RESULT_TF | ATA_QCFLAG_QUIET;
3021
3022	/*
3023	* Set transfer length.
3024	*
3025	* TODO: find out if we need to do more here to
3026	* cover scatter/gather case.
3027	*/
3028	ata_qc_set_pc_nbytes(qc);
3029
3030	/* We may not issue DMA commands if no DMA mode is set */
3031	if (tf->protocol == ATA_PROT_DMA && !ata_dma_enabled(adev: dev)) {
3032	fp = 1;
3033	goto invalid_fld;
3034	}
3035
3036	/* We may not issue NCQ commands to devices not supporting NCQ */
3037	if (ata_is_ncq(prot: tf->protocol) && !ata_ncq_enabled(dev)) {
3038	fp = 1;
3039	goto invalid_fld;
3040	}
3041
3042	/* sanity check for pio multi commands */
3043	if ((cdb[1] & 0xe0) && !is_multi_taskfile(tf)) {
3044	fp = 1;
3045	goto invalid_fld;
3046	}
3047
3048	if (is_multi_taskfile(tf)) {
3049	unsigned int multi_count = 1 << (cdb[1] >> 5);
3050
3051	/* compare the passed through multi_count
3052	* with the cached multi_count of libata
3053	*/
3054	if (multi_count != dev->multi_count)
3055	ata_dev_warn(dev, "invalid multi_count %u ignored\n",
3056	multi_count);
3057	}
3058
3059	/*
3060	* Filter SET_FEATURES - XFER MODE command -- otherwise,
3061	* SET_FEATURES - XFER MODE must be preceded/succeeded
3062	* by an update to hardware-specific registers for each
3063	* controller (i.e. the reason for ->set_piomode(),
3064	* ->set_dmamode(), and ->post_set_mode() hooks).
3065	*/
3066	if (tf->command == ATA_CMD_SET_FEATURES &&
3067	tf->feature == SETFEATURES_XFER) {
3068	fp = (cdb[0] == ATA_16) ? 4 : 3;
3069	goto invalid_fld;
3070	}
3071
3072	/*
3073	* Filter TPM commands by default. These provide an
3074	* essentially uncontrolled encrypted "back door" between
3075	* applications and the disk. Set libata.allow_tpm=1 if you
3076	* have a real reason for wanting to use them. This ensures
3077	* that installed software cannot easily mess stuff up without
3078	* user intent. DVR type users will probably ship with this enabled
3079	* for movie content management.
3080	*
3081	* Note that for ATA8 we can issue a DCS change and DCS freeze lock
3082	* for this and should do in future but that it is not sufficient as
3083	* DCS is an optional feature set. Thus we also do the software filter
3084	* so that we comply with the TC consortium stated goal that the user
3085	* can turn off TC features of their system.
3086	*/
3087	if (tf->command >= 0x5C && tf->command <= 0x5F && !libata_allow_tpm) {
3088	fp = (cdb[0] == ATA_16) ? 14 : 9;
3089	goto invalid_fld;
3090	}
3091
3092	return 0;
3093
3094	invalid_fld:
3095	ata_scsi_set_invalid_field(dev, cmd: scmd, field: fp, bit: 0xff);
3096	return 1;
3097	}
3098
3099	/**
3100	* ata_format_dsm_trim_descr() - SATL Write Same to DSM Trim
3101	* @cmd: SCSI command being translated
3102	* @trmax: Maximum number of entries that will fit in sector_size bytes.
3103	* @sector: Starting sector
3104	* @count: Total Range of request in logical sectors
3105	*
3106	* Rewrite the WRITE SAME descriptor to be a DSM TRIM little-endian formatted
3107	* descriptor.
3108	*
3109	* Upto 64 entries of the format:
3110	* 63:48 Range Length
3111	* 47:0 LBA
3112	*
3113	* Range Length of 0 is ignored.
3114	* LBA's should be sorted order and not overlap.
3115	*
3116	* NOTE: this is the same format as ADD LBA(S) TO NV CACHE PINNED SET
3117	*
3118	* Return: Number of bytes copied into sglist.
3119	*/
3120	static size_t ata_format_dsm_trim_descr(struct scsi_cmnd *cmd, u32 trmax,
3121	u64 sector, u32 count)
3122	{
3123	struct scsi_device *sdp = cmd->device;
3124	size_t len = sdp->sector_size;
3125	size_t r;
3126	__le64 *buf;
3127	u32 i = 0;
3128	unsigned long flags;
3129
3130	WARN_ON(len > ATA_SCSI_RBUF_SIZE);
3131
3132	if (len > ATA_SCSI_RBUF_SIZE)
3133	len = ATA_SCSI_RBUF_SIZE;
3134
3135	spin_lock_irqsave(&ata_scsi_rbuf_lock, flags);
3136	buf = ((void *)ata_scsi_rbuf);
3137	memset(buf, 0, len);
3138	while (i < trmax) {
3139	u64 entry = sector |
3140	((u64)(count > 0xffff ? 0xffff : count) << 48);
3141	buf[i++] = __cpu_to_le64(entry);
3142	if (count <= 0xffff)
3143	break;
3144	count -= 0xffff;
3145	sector += 0xffff;
3146	}
3147	r = sg_copy_from_buffer(sgl: scsi_sglist(cmd), nents: scsi_sg_count(cmd), buf, buflen: len);
3148	spin_unlock_irqrestore(lock: &ata_scsi_rbuf_lock, flags);
3149
3150	return r;
3151	}
3152
3153	/**
3154	* ata_scsi_write_same_xlat() - SATL Write Same to ATA SCT Write Same
3155	* @qc: Command to be translated
3156	*
3157	* Translate a SCSI WRITE SAME command to be either a DSM TRIM command or
3158	* an SCT Write Same command.
3159	* Based on WRITE SAME has the UNMAP flag:
3160	*
3161	* - When set translate to DSM TRIM
3162	* - When clear translate to SCT Write Same
3163	*/
3164	static unsigned int ata_scsi_write_same_xlat(struct ata_queued_cmd *qc)
3165	{
3166	struct ata_taskfile *tf = &qc->tf;
3167	struct scsi_cmnd *scmd = qc->scsicmd;
3168	struct scsi_device *sdp = scmd->device;
3169	size_t len = sdp->sector_size;
3170	struct ata_device *dev = qc->dev;
3171	const u8 *cdb = scmd->cmnd;
3172	u64 block;
3173	u32 n_block;
3174	const u32 trmax = len >> 3;
3175	u32 size;
3176	u16 fp;
3177	u8 bp = 0xff;
3178	u8 unmap = cdb[1] & 0x8;
3179
3180	/* we may not issue DMA commands if no DMA mode is set */
3181	if (unlikely(!ata_dma_enabled(dev)))
3182	goto invalid_opcode;
3183
3184	/*
3185	* We only allow sending this command through the block layer,
3186	* as it modifies the DATA OUT buffer, which would corrupt user
3187	* memory for SG_IO commands.
3188	*/
3189	if (unlikely(blk_rq_is_passthrough(scsi_cmd_to_rq(scmd))))
3190	goto invalid_opcode;
3191
3192	if (unlikely(scmd->cmd_len < 16)) {
3193	fp = 15;
3194	goto invalid_fld;
3195	}
3196	scsi_16_lba_len(cdb, plba: &block, plen: &n_block);
3197
3198	if (!unmap ||
3199	(dev->horkage & ATA_HORKAGE_NOTRIM) ||
3200	!ata_id_has_trim(id: dev->id)) {
3201	fp = 1;
3202	bp = 3;
3203	goto invalid_fld;
3204	}
3205	/* If the request is too large the cmd is invalid */
3206	if (n_block > 0xffff * trmax) {
3207	fp = 2;
3208	goto invalid_fld;
3209	}
3210
3211	/*
3212	* WRITE SAME always has a sector sized buffer as payload, this
3213	* should never be a multiple entry S/G list.
3214	*/
3215	if (!scsi_sg_count(cmd: scmd))
3216	goto invalid_param_len;
3217
3218	/*
3219	* size must match sector size in bytes
3220	* For DATA SET MANAGEMENT TRIM in ACS-2 nsect (aka count)
3221	* is defined as number of 512 byte blocks to be transferred.
3222	*/
3223
3224	size = ata_format_dsm_trim_descr(cmd: scmd, trmax, sector: block, count: n_block);
3225	if (size != len)
3226	goto invalid_param_len;
3227
3228	if (ata_ncq_enabled(dev) && ata_fpdma_dsm_supported(dev)) {
3229	/* Newer devices support queued TRIM commands */
3230	tf->protocol = ATA_PROT_NCQ;
3231	tf->command = ATA_CMD_FPDMA_SEND;
3232	tf->hob_nsect = ATA_SUBCMD_FPDMA_SEND_DSM & 0x1f;
3233	tf->nsect = qc->hw_tag << 3;
3234	tf->hob_feature = (size / 512) >> 8;
3235	tf->feature = size / 512;
3236
3237	tf->auxiliary = 1;
3238	} else {
3239	tf->protocol = ATA_PROT_DMA;
3240	tf->hob_feature = 0;
3241	tf->feature = ATA_DSM_TRIM;
3242	tf->hob_nsect = (size / 512) >> 8;
3243	tf->nsect = size / 512;
3244	tf->command = ATA_CMD_DSM;
3245	}
3246
3247	tf->flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE | ATA_TFLAG_LBA48 |
3248	ATA_TFLAG_WRITE;
3249
3250	ata_qc_set_pc_nbytes(qc);
3251
3252	return 0;
3253
3254	invalid_fld:
3255	ata_scsi_set_invalid_field(dev, cmd: scmd, field: fp, bit: bp);
3256	return 1;
3257	invalid_param_len:
3258	/* "Parameter list length error" */
3259	ata_scsi_set_sense(dev, cmd: scmd, ILLEGAL_REQUEST, asc: 0x1a, ascq: 0x0);
3260	return 1;
3261	invalid_opcode:
3262	/* "Invalid command operation code" */
3263	ata_scsi_set_sense(dev, cmd: scmd, ILLEGAL_REQUEST, asc: 0x20, ascq: 0x0);
3264	return 1;
3265	}
3266
3267	/**
3268	* ata_scsiop_maint_in - Simulate a subset of MAINTENANCE_IN
3269	* @args: device MAINTENANCE_IN data / SCSI command of interest.
3270	* @rbuf: Response buffer, to which simulated SCSI cmd output is sent.
3271	*
3272	* Yields a subset to satisfy scsi_report_opcode()
3273	*
3274	* LOCKING:
3275	* spin_lock_irqsave(host lock)
3276	*/
3277	static unsigned int ata_scsiop_maint_in(struct ata_scsi_args *args, u8 *rbuf)
3278	{
3279	struct ata_device *dev = args->dev;
3280	u8 *cdb = args->cmd->cmnd;
3281	u8 supported = 0, cdlp = 0, rwcdlp = 0;
3282	unsigned int err = 0;
3283
3284	if (cdb[2] != 1 && cdb[2] != 3) {
3285	ata_dev_warn(dev, "invalid command format %d\n", cdb[2]);
3286	err = 2;
3287	goto out;
3288	}
3289
3290	switch (cdb[3]) {
3291	case INQUIRY:
3292	case MODE_SENSE:
3293	case MODE_SENSE_10:
3294	case READ_CAPACITY:
3295	case SERVICE_ACTION_IN_16:
3296	case REPORT_LUNS:
3297	case REQUEST_SENSE:
3298	case SYNCHRONIZE_CACHE:
3299	case SYNCHRONIZE_CACHE_16:
3300	case REZERO_UNIT:
3301	case SEEK_6:
3302	case SEEK_10:
3303	case TEST_UNIT_READY:
3304	case SEND_DIAGNOSTIC:
3305	case MAINTENANCE_IN:
3306	case READ_6:
3307	case READ_10:
3308	case WRITE_6:
3309	case WRITE_10:
3310	case ATA_12:
3311	case ATA_16:
3312	case VERIFY:
3313	case VERIFY_16:
3314	case MODE_SELECT:
3315	case MODE_SELECT_10:
3316	case START_STOP:
3317	supported = 3;
3318	break;
3319	case READ_16:
3320	supported = 3;
3321	if (dev->flags & ATA_DFLAG_CDL) {
3322	/*
3323	* CDL read descriptors map to the T2A page, that is,
3324	* rwcdlp = 0x01 and cdlp = 0x01
3325	*/
3326	rwcdlp = 0x01;
3327	cdlp = 0x01 << 3;
3328	}
3329	break;
3330	case WRITE_16:
3331	supported = 3;
3332	if (dev->flags & ATA_DFLAG_CDL) {
3333	/*
3334	* CDL write descriptors map to the T2B page, that is,
3335	* rwcdlp = 0x01 and cdlp = 0x02
3336	*/
3337	rwcdlp = 0x01;
3338	cdlp = 0x02 << 3;
3339	}
3340	break;
3341	case ZBC_IN:
3342	case ZBC_OUT:
3343	if (ata_id_zoned_cap(id: dev->id) ||
3344	dev->class == ATA_DEV_ZAC)
3345	supported = 3;
3346	break;
3347	case SECURITY_PROTOCOL_IN:
3348	case SECURITY_PROTOCOL_OUT:
3349	if (dev->flags & ATA_DFLAG_TRUSTED)
3350	supported = 3;
3351	break;
3352	default:
3353	break;
3354	}
3355	out:
3356	/* One command format */
3357	rbuf[0] = rwcdlp;
3358	rbuf[1] = cdlp | supported;
3359	return err;
3360	}
3361
3362	/**
3363	* ata_scsi_report_zones_complete - convert ATA output
3364	* @qc: command structure returning the data
3365	*
3366	* Convert T-13 little-endian field representation into
3367	* T-10 big-endian field representation.
3368	* What a mess.
3369	*/
3370	static void ata_scsi_report_zones_complete(struct ata_queued_cmd *qc)
3371	{
3372	struct scsi_cmnd *scmd = qc->scsicmd;
3373	struct sg_mapping_iter miter;
3374	unsigned long flags;
3375	unsigned int bytes = 0;
3376
3377	sg_miter_start(miter: &miter, sgl: scsi_sglist(cmd: scmd), nents: scsi_sg_count(cmd: scmd),
3378	SG_MITER_TO_SG | SG_MITER_ATOMIC);
3379
3380	local_irq_save(flags);
3381	while (sg_miter_next(miter: &miter)) {
3382	unsigned int offset = 0;
3383
3384	if (bytes == 0) {
3385	char *hdr;
3386	u32 list_length;
3387	u64 max_lba, opt_lba;
3388	u16 same;
3389
3390	/* Swizzle header */
3391	hdr = miter.addr;
3392	list_length = get_unaligned_le32(p: &hdr[0]);
3393	same = get_unaligned_le16(p: &hdr[4]);
3394	max_lba = get_unaligned_le64(p: &hdr[8]);
3395	opt_lba = get_unaligned_le64(p: &hdr[16]);
3396	put_unaligned_be32(val: list_length, p: &hdr[0]);
3397	hdr[4] = same & 0xf;
3398	put_unaligned_be64(val: max_lba, p: &hdr[8]);
3399	put_unaligned_be64(val: opt_lba, p: &hdr[16]);
3400	offset += 64;
3401	bytes += 64;
3402	}
3403	while (offset < miter.length) {
3404	char *rec;
3405	u8 cond, type, non_seq, reset;
3406	u64 size, start, wp;
3407
3408	/* Swizzle zone descriptor */
3409	rec = miter.addr + offset;
3410	type = rec[0] & 0xf;
3411	cond = (rec[1] >> 4) & 0xf;
3412	non_seq = (rec[1] & 2);
3413	reset = (rec[1] & 1);
3414	size = get_unaligned_le64(p: &rec[8]);
3415	start = get_unaligned_le64(p: &rec[16]);
3416	wp = get_unaligned_le64(p: &rec[24]);
3417	rec[0] = type;
3418	rec[1] = (cond << 4) | non_seq | reset;
3419	put_unaligned_be64(val: size, p: &rec[8]);
3420	put_unaligned_be64(val: start, p: &rec[16]);
3421	put_unaligned_be64(val: wp, p: &rec[24]);
3422	WARN_ON(offset + 64 > miter.length);
3423	offset += 64;
3424	bytes += 64;
3425	}
3426	}
3427	sg_miter_stop(miter: &miter);
3428	local_irq_restore(flags);
3429
3430	ata_scsi_qc_complete(qc);
3431	}
3432
3433	static unsigned int ata_scsi_zbc_in_xlat(struct ata_queued_cmd *qc)
3434	{
3435	struct ata_taskfile *tf = &qc->tf;
3436	struct scsi_cmnd *scmd = qc->scsicmd;
3437	const u8 *cdb = scmd->cmnd;
3438	u16 sect, fp = (u16)-1;
3439	u8 sa, options, bp = 0xff;
3440	u64 block;
3441	u32 n_block;
3442
3443	if (unlikely(scmd->cmd_len < 16)) {
3444	ata_dev_warn(qc->dev, "invalid cdb length %d\n",
3445	scmd->cmd_len);
3446	fp = 15;
3447	goto invalid_fld;
3448	}
3449	scsi_16_lba_len(cdb, plba: &block, plen: &n_block);
3450	if (n_block != scsi_bufflen(cmd: scmd)) {
3451	ata_dev_warn(qc->dev, "non-matching transfer count (%d/%d)\n",
3452	n_block, scsi_bufflen(scmd));
3453	goto invalid_param_len;
3454	}
3455	sa = cdb[1] & 0x1f;
3456	if (sa != ZI_REPORT_ZONES) {
3457	ata_dev_warn(qc->dev, "invalid service action %d\n", sa);
3458	fp = 1;
3459	goto invalid_fld;
3460	}
3461	/*
3462	* ZAC allows only for transfers in 512 byte blocks,
3463	* and uses a 16 bit value for the transfer count.
3464	*/
3465	if ((n_block / 512) > 0xffff || n_block < 512 || (n_block % 512)) {
3466	ata_dev_warn(qc->dev, "invalid transfer count %d\n", n_block);
3467	goto invalid_param_len;
3468	}
3469	sect = n_block / 512;
3470	options = cdb[14] & 0xbf;
3471
3472	if (ata_ncq_enabled(dev: qc->dev) &&
3473	ata_fpdma_zac_mgmt_in_supported(dev: qc->dev)) {
3474	tf->protocol = ATA_PROT_NCQ;
3475	tf->command = ATA_CMD_FPDMA_RECV;
3476	tf->hob_nsect = ATA_SUBCMD_FPDMA_RECV_ZAC_MGMT_IN & 0x1f;
3477	tf->nsect = qc->hw_tag << 3;
3478	tf->feature = sect & 0xff;
3479	tf->hob_feature = (sect >> 8) & 0xff;
3480	tf->auxiliary = ATA_SUBCMD_ZAC_MGMT_IN_REPORT_ZONES | (options << 8);
3481	} else {
3482	tf->command = ATA_CMD_ZAC_MGMT_IN;
3483	tf->feature = ATA_SUBCMD_ZAC_MGMT_IN_REPORT_ZONES;
3484	tf->protocol = ATA_PROT_DMA;
3485	tf->hob_feature = options;
3486	tf->hob_nsect = (sect >> 8) & 0xff;
3487	tf->nsect = sect & 0xff;
3488	}
3489	tf->device = ATA_LBA;
3490	tf->lbah = (block >> 16) & 0xff;
3491	tf->lbam = (block >> 8) & 0xff;
3492	tf->lbal = block & 0xff;
3493	tf->hob_lbah = (block >> 40) & 0xff;
3494	tf->hob_lbam = (block >> 32) & 0xff;
3495	tf->hob_lbal = (block >> 24) & 0xff;
3496
3497	tf->flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE | ATA_TFLAG_LBA48;
3498	qc->flags |= ATA_QCFLAG_RESULT_TF;
3499
3500	ata_qc_set_pc_nbytes(qc);
3501
3502	qc->complete_fn = ata_scsi_report_zones_complete;
3503
3504	return 0;
3505
3506	invalid_fld:
3507	ata_scsi_set_invalid_field(dev: qc->dev, cmd: scmd, field: fp, bit: bp);
3508	return 1;
3509
3510	invalid_param_len:
3511	/* "Parameter list length error" */
3512	ata_scsi_set_sense(dev: qc->dev, cmd: scmd, ILLEGAL_REQUEST, asc: 0x1a, ascq: 0x0);
3513	return 1;
3514	}
3515
3516	static unsigned int ata_scsi_zbc_out_xlat(struct ata_queued_cmd *qc)
3517	{
3518	struct ata_taskfile *tf = &qc->tf;
3519	struct scsi_cmnd *scmd = qc->scsicmd;
3520	struct ata_device *dev = qc->dev;
3521	const u8 *cdb = scmd->cmnd;
3522	u8 all, sa;
3523	u64 block;
3524	u32 n_block;
3525	u16 fp = (u16)-1;
3526
3527	if (unlikely(scmd->cmd_len < 16)) {
3528	fp = 15;
3529	goto invalid_fld;
3530	}
3531
3532	sa = cdb[1] & 0x1f;
3533	if ((sa != ZO_CLOSE_ZONE) && (sa != ZO_FINISH_ZONE) &&
3534	(sa != ZO_OPEN_ZONE) && (sa != ZO_RESET_WRITE_POINTER)) {
3535	fp = 1;
3536	goto invalid_fld;
3537	}
3538
3539	scsi_16_lba_len(cdb, plba: &block, plen: &n_block);
3540	if (n_block) {
3541	/*
3542	* ZAC MANAGEMENT OUT doesn't define any length
3543	*/
3544	goto invalid_param_len;
3545	}
3546
3547	all = cdb[14] & 0x1;
3548	if (all) {
3549	/*
3550	* Ignore the block address (zone ID) as defined by ZBC.
3551	*/
3552	block = 0;
3553	} else if (block >= dev->n_sectors) {
3554	/*
3555	* Block must be a valid zone ID (a zone start LBA).
3556	*/
3557	fp = 2;
3558	goto invalid_fld;
3559	}
3560
3561	if (ata_ncq_enabled(dev: qc->dev) &&
3562	ata_fpdma_zac_mgmt_out_supported(dev: qc->dev)) {
3563	tf->protocol = ATA_PROT_NCQ_NODATA;
3564	tf->command = ATA_CMD_NCQ_NON_DATA;
3565	tf->feature = ATA_SUBCMD_NCQ_NON_DATA_ZAC_MGMT_OUT;
3566	tf->nsect = qc->hw_tag << 3;
3567	tf->auxiliary = sa | ((u16)all << 8);
3568	} else {
3569	tf->protocol = ATA_PROT_NODATA;
3570	tf->command = ATA_CMD_ZAC_MGMT_OUT;
3571	tf->feature = sa;
3572	tf->hob_feature = all;
3573	}
3574	tf->lbah = (block >> 16) & 0xff;
3575	tf->lbam = (block >> 8) & 0xff;
3576	tf->lbal = block & 0xff;
3577	tf->hob_lbah = (block >> 40) & 0xff;
3578	tf->hob_lbam = (block >> 32) & 0xff;
3579	tf->hob_lbal = (block >> 24) & 0xff;
3580	tf->device = ATA_LBA;
3581	tf->flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE | ATA_TFLAG_LBA48;
3582
3583	return 0;
3584
3585	invalid_fld:
3586	ata_scsi_set_invalid_field(dev: qc->dev, cmd: scmd, field: fp, bit: 0xff);
3587	return 1;
3588	invalid_param_len:
3589	/* "Parameter list length error" */
3590	ata_scsi_set_sense(dev: qc->dev, cmd: scmd, ILLEGAL_REQUEST, asc: 0x1a, ascq: 0x0);
3591	return 1;
3592	}
3593
3594	/**
3595	* ata_mselect_caching - Simulate MODE SELECT for caching info page
3596	* @qc: Storage for translated ATA taskfile
3597	* @buf: input buffer
3598	* @len: number of valid bytes in the input buffer
3599	* @fp: out parameter for the failed field on error
3600	*
3601	* Prepare a taskfile to modify caching information for the device.
3602	*
3603	* LOCKING:
3604	* None.
3605	*/
3606	static int ata_mselect_caching(struct ata_queued_cmd *qc,
3607	const u8 *buf, int len, u16 *fp)
3608	{
3609	struct ata_taskfile *tf = &qc->tf;
3610	struct ata_device *dev = qc->dev;
3611	u8 mpage[CACHE_MPAGE_LEN];
3612	u8 wce;
3613	int i;
3614
3615	/*
3616	* The first two bytes of def_cache_mpage are a header, so offsets
3617	* in mpage are off by 2 compared to buf. Same for len.
3618	*/
3619
3620	if (len != CACHE_MPAGE_LEN - 2) {
3621	*fp = min(len, CACHE_MPAGE_LEN - 2);
3622	return -EINVAL;
3623	}
3624
3625	wce = buf[0] & (1 << 2);
3626
3627	/*
3628	* Check that read-only bits are not modified.
3629	*/
3630	ata_msense_caching(id: dev->id, buf: mpage, changeable: false);
3631	for (i = 0; i < CACHE_MPAGE_LEN - 2; i++) {
3632	if (i == 0)
3633	continue;
3634	if (mpage[i + 2] != buf[i]) {
3635	*fp = i;
3636	return -EINVAL;
3637	}
3638	}
3639
3640	tf->flags |= ATA_TFLAG_DEVICE | ATA_TFLAG_ISADDR;
3641	tf->protocol = ATA_PROT_NODATA;
3642	tf->nsect = 0;
3643	tf->command = ATA_CMD_SET_FEATURES;
3644	tf->feature = wce ? SETFEATURES_WC_ON : SETFEATURES_WC_OFF;
3645	return 0;
3646	}
3647
3648	/*
3649	* Simulate MODE SELECT control mode page, sub-page 0.
3650	*/
3651	static int ata_mselect_control_spg0(struct ata_queued_cmd *qc,
3652	const u8 *buf, int len, u16 *fp)
3653	{
3654	struct ata_device *dev = qc->dev;
3655	u8 mpage[CONTROL_MPAGE_LEN];
3656	u8 d_sense;
3657	int i;
3658
3659	/*
3660	* The first two bytes of def_control_mpage are a header, so offsets
3661	* in mpage are off by 2 compared to buf. Same for len.
3662	*/
3663
3664	if (len != CONTROL_MPAGE_LEN - 2) {
3665	*fp = min(len, CONTROL_MPAGE_LEN - 2);
3666	return -EINVAL;
3667	}
3668
3669	d_sense = buf[0] & (1 << 2);
3670
3671	/*
3672	* Check that read-only bits are not modified.
3673	*/
3674	ata_msense_control_spg0(dev, buf: mpage, changeable: false);
3675	for (i = 0; i < CONTROL_MPAGE_LEN - 2; i++) {
3676	if (i == 0)
3677	continue;
3678	if (mpage[2 + i] != buf[i]) {
3679	*fp = i;
3680	return -EINVAL;
3681	}
3682	}
3683	if (d_sense & (1 << 2))
3684	dev->flags |= ATA_DFLAG_D_SENSE;
3685	else
3686	dev->flags &= ~ATA_DFLAG_D_SENSE;
3687	return 0;
3688	}
3689
3690	/*
3691	* Translate MODE SELECT control mode page, sub-pages f2h (ATA feature mode
3692	* page) into a SET FEATURES command.
3693	*/
3694	static unsigned int ata_mselect_control_ata_feature(struct ata_queued_cmd *qc,
3695	const u8 *buf, int len,
3696	u16 *fp)
3697	{
3698	struct ata_device *dev = qc->dev;
3699	struct ata_taskfile *tf = &qc->tf;
3700	u8 cdl_action;
3701
3702	/*
3703	* The first four bytes of ATA Feature Control mode page are a header,
3704	* so offsets in mpage are off by 4 compared to buf. Same for len.
3705	*/
3706	if (len != ATA_FEATURE_SUB_MPAGE_LEN - 4) {
3707	*fp = min(len, ATA_FEATURE_SUB_MPAGE_LEN - 4);
3708	return -EINVAL;
3709	}
3710
3711	/* Check cdl_ctrl */
3712	switch (buf[0] & 0x03) {
3713	case 0:
3714	/* Disable CDL */
3715	cdl_action = 0;
3716	dev->flags &= ~ATA_DFLAG_CDL_ENABLED;
3717	break;
3718	case 0x02:
3719	/* Enable CDL T2A/T2B: NCQ priority must be disabled */
3720	if (dev->flags & ATA_DFLAG_NCQ_PRIO_ENABLED) {
3721	ata_dev_err(dev,
3722	"NCQ priority must be disabled to enable CDL\n");
3723	return -EINVAL;
3724	}
3725	cdl_action = 1;
3726	dev->flags |= ATA_DFLAG_CDL_ENABLED;
3727	break;
3728	default:
3729	*fp = 0;
3730	return -EINVAL;
3731	}
3732
3733	tf->flags |= ATA_TFLAG_DEVICE | ATA_TFLAG_ISADDR;
3734	tf->protocol = ATA_PROT_NODATA;
3735	tf->command = ATA_CMD_SET_FEATURES;
3736	tf->feature = SETFEATURES_CDL;
3737	tf->nsect = cdl_action;
3738
3739	return 1;
3740	}
3741
3742	/**
3743	* ata_mselect_control - Simulate MODE SELECT for control page
3744	* @qc: Storage for translated ATA taskfile
3745	* @spg: target sub-page of the control page
3746	* @buf: input buffer
3747	* @len: number of valid bytes in the input buffer
3748	* @fp: out parameter for the failed field on error
3749	*
3750	* Prepare a taskfile to modify caching information for the device.
3751	*
3752	* LOCKING:
3753	* None.
3754	*/
3755	static int ata_mselect_control(struct ata_queued_cmd *qc, u8 spg,
3756	const u8 *buf, int len, u16 *fp)
3757	{
3758	switch (spg) {
3759	case 0:
3760	return ata_mselect_control_spg0(qc, buf, len, fp);
3761	case ATA_FEATURE_SUB_MPAGE:
3762	return ata_mselect_control_ata_feature(qc, buf, len, fp);
3763	default:
3764	return -EINVAL;
3765	}
3766	}
3767
3768	/**
3769	* ata_scsi_mode_select_xlat - Simulate MODE SELECT 6, 10 commands
3770	* @qc: Storage for translated ATA taskfile
3771	*
3772	* Converts a MODE SELECT command to an ATA SET FEATURES taskfile.
3773	* Assume this is invoked for direct access devices (e.g. disks) only.
3774	* There should be no block descriptor for other device types.
3775	*
3776	* LOCKING:
3777	* spin_lock_irqsave(host lock)
3778	*/
3779	static unsigned int ata_scsi_mode_select_xlat(struct ata_queued_cmd *qc)
3780	{
3781	struct scsi_cmnd *scmd = qc->scsicmd;
3782	const u8 *cdb = scmd->cmnd;
3783	u8 pg, spg;
3784	unsigned six_byte, pg_len, hdr_len, bd_len;
3785	int len, ret;
3786	u16 fp = (u16)-1;
3787	u8 bp = 0xff;
3788	u8 buffer[64];
3789	const u8 *p = buffer;
3790
3791	six_byte = (cdb[0] == MODE_SELECT);
3792	if (six_byte) {
3793	if (scmd->cmd_len < 5) {
3794	fp = 4;
3795	goto invalid_fld;
3796	}
3797
3798	len = cdb[4];
3799	hdr_len = 4;
3800	} else {
3801	if (scmd->cmd_len < 9) {
3802	fp = 8;
3803	goto invalid_fld;
3804	}
3805
3806	len = get_unaligned_be16(p: &cdb[7]);
3807	hdr_len = 8;
3808	}
3809
3810	/* We only support PF=1, SP=0. */
3811	if ((cdb[1] & 0x11) != 0x10) {
3812	fp = 1;
3813	bp = (cdb[1] & 0x01) ? 1 : 5;
3814	goto invalid_fld;
3815	}
3816
3817	/* Test early for possible overrun. */
3818	if (!scsi_sg_count(cmd: scmd) || scsi_sglist(cmd: scmd)->length < len)
3819	goto invalid_param_len;
3820
3821	/* Move past header and block descriptors. */
3822	if (len < hdr_len)
3823	goto invalid_param_len;
3824
3825	if (!sg_copy_to_buffer(sgl: scsi_sglist(cmd: scmd), nents: scsi_sg_count(cmd: scmd),
3826	buf: buffer, buflen: sizeof(buffer)))
3827	goto invalid_param_len;
3828
3829	if (six_byte)
3830	bd_len = p[3];
3831	else
3832	bd_len = get_unaligned_be16(p: &p[6]);
3833
3834	len -= hdr_len;
3835	p += hdr_len;
3836	if (len < bd_len)
3837	goto invalid_param_len;
3838	if (bd_len != 0 && bd_len != 8) {
3839	fp = (six_byte) ? 3 : 6;
3840	fp += bd_len + hdr_len;
3841	goto invalid_param;
3842	}
3843
3844	len -= bd_len;
3845	p += bd_len;
3846	if (len == 0)
3847	goto skip;
3848
3849	/* Parse both possible formats for the mode page headers. */
3850	pg = p[0] & 0x3f;
3851	if (p[0] & 0x40) {
3852	if (len < 4)
3853	goto invalid_param_len;
3854
3855	spg = p[1];
3856	pg_len = get_unaligned_be16(p: &p[2]);
3857	p += 4;
3858	len -= 4;
3859	} else {
3860	if (len < 2)
3861	goto invalid_param_len;
3862
3863	spg = 0;
3864	pg_len = p[1];
3865	p += 2;
3866	len -= 2;
3867	}
3868
3869	/*
3870	* Supported subpages: all subpages and ATA feature sub-page f2h of
3871	* the control page.
3872	*/
3873	if (spg) {
3874	switch (spg) {
3875	case ALL_SUB_MPAGES:
3876	/* All subpages is not supported for the control page */
3877	if (pg == CONTROL_MPAGE) {
3878	fp = (p[0] & 0x40) ? 1 : 0;
3879	fp += hdr_len + bd_len;
3880	goto invalid_param;
3881	}
3882	break;
3883	case ATA_FEATURE_SUB_MPAGE:
3884	if (qc->dev->flags & ATA_DFLAG_CDL &&
3885	pg == CONTROL_MPAGE)
3886	break;
3887	fallthrough;
3888	default:
3889	fp = (p[0] & 0x40) ? 1 : 0;
3890	fp += hdr_len + bd_len;
3891	goto invalid_param;
3892	}
3893	}
3894	if (pg_len > len)
3895	goto invalid_param_len;
3896
3897	switch (pg) {
3898	case CACHE_MPAGE:
3899	if (ata_mselect_caching(qc, buf: p, len: pg_len, fp: &fp) < 0) {
3900	fp += hdr_len + bd_len;
3901	goto invalid_param;
3902	}
3903	break;
3904	case CONTROL_MPAGE:
3905	ret = ata_mselect_control(qc, spg, buf: p, len: pg_len, fp: &fp);
3906	if (ret < 0) {
3907	fp += hdr_len + bd_len;
3908	goto invalid_param;
3909	}
3910	if (!ret)
3911	goto skip; /* No ATA command to send */
3912	break;
3913	default:
3914	/* Invalid page code */
3915	fp = bd_len + hdr_len;
3916	goto invalid_param;
3917	}
3918
3919	/*
3920	* Only one page has changeable data, so we only support setting one
3921	* page at a time.
3922	*/
3923	if (len > pg_len)
3924	goto invalid_param;
3925
3926	return 0;
3927
3928	invalid_fld:
3929	ata_scsi_set_invalid_field(dev: qc->dev, cmd: scmd, field: fp, bit: bp);
3930	return 1;
3931
3932	invalid_param:
3933	ata_scsi_set_invalid_parameter(dev: qc->dev, cmd: scmd, field: fp);
3934	return 1;
3935
3936	invalid_param_len:
3937	/* "Parameter list length error" */
3938	ata_scsi_set_sense(dev: qc->dev, cmd: scmd, ILLEGAL_REQUEST, asc: 0x1a, ascq: 0x0);
3939	return 1;
3940
3941	skip:
3942	scmd->result = SAM_STAT_GOOD;
3943	return 1;
3944	}
3945
3946	static u8 ata_scsi_trusted_op(u32 len, bool send, bool dma)
3947	{
3948	if (len == 0)
3949	return ATA_CMD_TRUSTED_NONDATA;
3950	else if (send)
3951	return dma ? ATA_CMD_TRUSTED_SND_DMA : ATA_CMD_TRUSTED_SND;
3952	else
3953	return dma ? ATA_CMD_TRUSTED_RCV_DMA : ATA_CMD_TRUSTED_RCV;
3954	}
3955
3956	static unsigned int ata_scsi_security_inout_xlat(struct ata_queued_cmd *qc)
3957	{
3958	struct scsi_cmnd *scmd = qc->scsicmd;
3959	const u8 *cdb = scmd->cmnd;
3960	struct ata_taskfile *tf = &qc->tf;
3961	u8 secp = cdb[1];
3962	bool send = (cdb[0] == SECURITY_PROTOCOL_OUT);
3963	u16 spsp = get_unaligned_be16(p: &cdb[2]);
3964	u32 len = get_unaligned_be32(p: &cdb[6]);
3965	bool dma = !(qc->dev->flags & ATA_DFLAG_PIO);
3966
3967	/*
3968	* We don't support the ATA "security" protocol.
3969	*/
3970	if (secp == 0xef) {
3971	ata_scsi_set_invalid_field(dev: qc->dev, cmd: scmd, field: 1, bit: 0);
3972	return 1;
3973	}
3974
3975	if (cdb[4] & 7) { /* INC_512 */
3976	if (len > 0xffff) {
3977	ata_scsi_set_invalid_field(dev: qc->dev, cmd: scmd, field: 6, bit: 0);
3978	return 1;
3979	}
3980	} else {
3981	if (len > 0x01fffe00) {
3982	ata_scsi_set_invalid_field(dev: qc->dev, cmd: scmd, field: 6, bit: 0);
3983	return 1;
3984	}
3985
3986	/* convert to the sector-based ATA addressing */
3987	len = (len + 511) / 512;
3988	}
3989
3990	tf->protocol = dma ? ATA_PROT_DMA : ATA_PROT_PIO;
3991	tf->flags |= ATA_TFLAG_DEVICE | ATA_TFLAG_ISADDR | ATA_TFLAG_LBA;
3992	if (send)
3993	tf->flags |= ATA_TFLAG_WRITE;
3994	tf->command = ata_scsi_trusted_op(len, send, dma);
3995	tf->feature = secp;
3996	tf->lbam = spsp & 0xff;
3997	tf->lbah = spsp >> 8;
3998
3999	if (len) {
4000	tf->nsect = len & 0xff;
4001	tf->lbal = len >> 8;
4002	} else {
4003	if (!send)
4004	tf->lbah = (1 << 7);
4005	}
4006
4007	ata_qc_set_pc_nbytes(qc);
4008	return 0;
4009	}
4010
4011	/**
4012	* ata_scsi_var_len_cdb_xlat - SATL variable length CDB to Handler
4013	* @qc: Command to be translated
4014	*
4015	* Translate a SCSI variable length CDB to specified commands.
4016	* It checks a service action value in CDB to call corresponding handler.
4017	*
4018	* RETURNS:
4019	* Zero on success, non-zero on failure
4020	*
4021	*/
4022	static unsigned int ata_scsi_var_len_cdb_xlat(struct ata_queued_cmd *qc)
4023	{
4024	struct scsi_cmnd *scmd = qc->scsicmd;
4025	const u8 *cdb = scmd->cmnd;
4026	const u16 sa = get_unaligned_be16(p: &cdb[8]);
4027
4028	/*
4029	* if service action represents a ata pass-thru(32) command,
4030	* then pass it to ata_scsi_pass_thru handler.
4031	*/
4032	if (sa == ATA_32)
4033	return ata_scsi_pass_thru(qc);
4034
4035	/* unsupported service action */
4036	return 1;
4037	}
4038
4039	/**
4040	* ata_get_xlat_func - check if SCSI to ATA translation is possible
4041	* @dev: ATA device
4042	* @cmd: SCSI command opcode to consider
4043	*
4044	* Look up the SCSI command given, and determine whether the
4045	* SCSI command is to be translated or simulated.
4046	*
4047	* RETURNS:
4048	* Pointer to translation function if possible, %NULL if not.
4049	*/
4050
4051	static inline ata_xlat_func_t ata_get_xlat_func(struct ata_device *dev, u8 cmd)
4052	{
4053	switch (cmd) {
4054	case READ_6:
4055	case READ_10:
4056	case READ_16:
4057
4058	case WRITE_6:
4059	case WRITE_10:
4060	case WRITE_16:
4061	return ata_scsi_rw_xlat;
4062
4063	case WRITE_SAME_16:
4064	return ata_scsi_write_same_xlat;
4065
4066	case SYNCHRONIZE_CACHE:
4067	case SYNCHRONIZE_CACHE_16:
4068	if (ata_try_flush_cache(dev))
4069	return ata_scsi_flush_xlat;
4070	break;
4071
4072	case VERIFY:
4073	case VERIFY_16:
4074	return ata_scsi_verify_xlat;
4075
4076	case ATA_12:
4077	case ATA_16:
4078	return ata_scsi_pass_thru;
4079
4080	case VARIABLE_LENGTH_CMD:
4081	return ata_scsi_var_len_cdb_xlat;
4082
4083	case MODE_SELECT:
4084	case MODE_SELECT_10:
4085	return ata_scsi_mode_select_xlat;
4086
4087	case ZBC_IN:
4088	return ata_scsi_zbc_in_xlat;
4089
4090	case ZBC_OUT:
4091	return ata_scsi_zbc_out_xlat;
4092
4093	case SECURITY_PROTOCOL_IN:
4094	case SECURITY_PROTOCOL_OUT:
4095	if (!(dev->flags & ATA_DFLAG_TRUSTED))
4096	break;
4097	return ata_scsi_security_inout_xlat;
4098
4099	case START_STOP:
4100	return ata_scsi_start_stop_xlat;
4101	}
4102
4103	return NULL;
4104	}
4105
4106	int __ata_scsi_queuecmd(struct scsi_cmnd *scmd, struct ata_device *dev)
4107	{
4108	struct ata_port *ap = dev->link->ap;
4109	u8 scsi_op = scmd->cmnd[0];
4110	ata_xlat_func_t xlat_func;
4111
4112	/*
4113	* scsi_queue_rq() will defer commands if scsi_host_in_recovery().
4114	* However, this check is done without holding the ap->lock (a libata
4115	* specific lock), so we can have received an error irq since then,
4116	* therefore we must check if EH is pending, while holding ap->lock.
4117	*/
4118	if (ap->pflags & (ATA_PFLAG_EH_PENDING | ATA_PFLAG_EH_IN_PROGRESS))
4119	return SCSI_MLQUEUE_DEVICE_BUSY;
4120
4121	if (unlikely(!scmd->cmd_len))
4122	goto bad_cdb_len;
4123
4124	if (dev->class == ATA_DEV_ATA || dev->class == ATA_DEV_ZAC) {
4125	if (unlikely(scmd->cmd_len > dev->cdb_len))
4126	goto bad_cdb_len;
4127
4128	xlat_func = ata_get_xlat_func(dev, cmd: scsi_op);
4129	} else if (likely((scsi_op != ATA_16) || !atapi_passthru16)) {
4130	/* relay SCSI command to ATAPI device */
4131	int len = COMMAND_SIZE(scsi_op);
4132
4133	if (unlikely(len > scmd->cmd_len ||
4134	len > dev->cdb_len ||
4135	scmd->cmd_len > ATAPI_CDB_LEN))
4136	goto bad_cdb_len;
4137
4138	xlat_func = atapi_xlat;
4139	} else {
4140	/* ATA_16 passthru, treat as an ATA command */
4141	if (unlikely(scmd->cmd_len > 16))
4142	goto bad_cdb_len;
4143
4144	xlat_func = ata_get_xlat_func(dev, cmd: scsi_op);
4145	}
4146
4147	if (xlat_func)
4148	return ata_scsi_translate(dev, cmd: scmd, xlat_func);
4149
4150	ata_scsi_simulate(dev, cmd: scmd);
4151
4152	return 0;
4153
4154	bad_cdb_len:
4155	scmd->result = DID_ERROR << 16;
4156	scsi_done(cmd: scmd);
4157	return 0;
4158	}
4159
4160	/**
4161	* ata_scsi_queuecmd - Issue SCSI cdb to libata-managed device
4162	* @shost: SCSI host of command to be sent
4163	* @cmd: SCSI command to be sent
4164	*
4165	* In some cases, this function translates SCSI commands into
4166	* ATA taskfiles, and queues the taskfiles to be sent to
4167	* hardware. In other cases, this function simulates a
4168	* SCSI device by evaluating and responding to certain
4169	* SCSI commands. This creates the overall effect of
4170	* ATA and ATAPI devices appearing as SCSI devices.
4171	*
4172	* LOCKING:
4173	* ATA host lock
4174	*
4175	* RETURNS:
4176	* Return value from __ata_scsi_queuecmd() if @cmd can be queued,
4177	* 0 otherwise.
4178	*/
4179	int ata_scsi_queuecmd(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
4180	{
4181	struct ata_port *ap;
4182	struct ata_device *dev;
4183	struct scsi_device *scsidev = cmd->device;
4184	int rc = 0;
4185	unsigned long irq_flags;
4186
4187	ap = ata_shost_to_port(host: shost);
4188
4189	spin_lock_irqsave(ap->lock, irq_flags);
4190
4191	dev = ata_scsi_find_dev(ap, scsidev);
4192	if (likely(dev))
4193	rc = __ata_scsi_queuecmd(scmd: cmd, dev);
4194	else {
4195	cmd->result = (DID_BAD_TARGET << 16);
4196	scsi_done(cmd);
4197	}
4198
4199	spin_unlock_irqrestore(lock: ap->lock, flags: irq_flags);
4200
4201	return rc;
4202	}
4203	EXPORT_SYMBOL_GPL(ata_scsi_queuecmd);
4204
4205	/**
4206	* ata_scsi_simulate - simulate SCSI command on ATA device
4207	* @dev: the target device
4208	* @cmd: SCSI command being sent to device.
4209	*
4210	* Interprets and directly executes a select list of SCSI commands
4211	* that can be handled internally.
4212	*
4213	* LOCKING:
4214	* spin_lock_irqsave(host lock)
4215	*/
4216
4217	void ata_scsi_simulate(struct ata_device *dev, struct scsi_cmnd *cmd)
4218	{
4219	struct ata_scsi_args args;
4220	const u8 *scsicmd = cmd->cmnd;
4221	u8 tmp8;
4222
4223	args.dev = dev;
4224	args.id = dev->id;
4225	args.cmd = cmd;
4226
4227	switch(scsicmd[0]) {
4228	case INQUIRY:
4229	if (scsicmd[1] & 2) /* is CmdDt set? */
4230	ata_scsi_set_invalid_field(dev, cmd, field: 1, bit: 0xff);
4231	else if ((scsicmd[1] & 1) == 0) /* is EVPD clear? */
4232	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_inq_std);
4233	else switch (scsicmd[2]) {
4234	case 0x00:
4235	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_inq_00);
4236	break;
4237	case 0x80:
4238	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_inq_80);
4239	break;
4240	case 0x83:
4241	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_inq_83);
4242	break;
4243	case 0x89:
4244	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_inq_89);
4245	break;
4246	case 0xb0:
4247	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_inq_b0);
4248	break;
4249	case 0xb1:
4250	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_inq_b1);
4251	break;
4252	case 0xb2:
4253	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_inq_b2);
4254	break;
4255	case 0xb6:
4256	if (dev->flags & ATA_DFLAG_ZAC)
4257	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_inq_b6);
4258	else
4259	ata_scsi_set_invalid_field(dev, cmd, field: 2, bit: 0xff);
4260	break;
4261	case 0xb9:
4262	if (dev->cpr_log)
4263	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_inq_b9);
4264	else
4265	ata_scsi_set_invalid_field(dev, cmd, field: 2, bit: 0xff);
4266	break;
4267	default:
4268	ata_scsi_set_invalid_field(dev, cmd, field: 2, bit: 0xff);
4269	break;
4270	}
4271	break;
4272
4273	case MODE_SENSE:
4274	case MODE_SENSE_10:
4275	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_mode_sense);
4276	break;
4277
4278	case READ_CAPACITY:
4279	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_read_cap);
4280	break;
4281
4282	case SERVICE_ACTION_IN_16:
4283	if ((scsicmd[1] & 0x1f) == SAI_READ_CAPACITY_16)
4284	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_read_cap);
4285	else
4286	ata_scsi_set_invalid_field(dev, cmd, field: 1, bit: 0xff);
4287	break;
4288
4289	case REPORT_LUNS:
4290	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_report_luns);
4291	break;
4292
4293	case REQUEST_SENSE:
4294	ata_scsi_set_sense(dev, cmd, sk: 0, asc: 0, ascq: 0);
4295	break;
4296
4297	/* if we reach this, then writeback caching is disabled,
4298	* turning this into a no-op.
4299	*/
4300	case SYNCHRONIZE_CACHE:
4301	case SYNCHRONIZE_CACHE_16:
4302	fallthrough;
4303
4304	/* no-op's, complete with success */
4305	case REZERO_UNIT:
4306	case SEEK_6:
4307	case SEEK_10:
4308	case TEST_UNIT_READY:
4309	break;
4310
4311	case SEND_DIAGNOSTIC:
4312	tmp8 = scsicmd[1] & ~(1 << 3);
4313	if (tmp8 != 0x4 || scsicmd[3] || scsicmd[4])
4314	ata_scsi_set_invalid_field(dev, cmd, field: 1, bit: 0xff);
4315	break;
4316
4317	case MAINTENANCE_IN:
4318	if ((scsicmd[1] & 0x1f) == MI_REPORT_SUPPORTED_OPERATION_CODES)
4319	ata_scsi_rbuf_fill(args: &args, actor: ata_scsiop_maint_in);
4320	else
4321	ata_scsi_set_invalid_field(dev, cmd, field: 1, bit: 0xff);
4322	break;
4323
4324	/* all other commands */
4325	default:
4326	ata_scsi_set_sense(dev, cmd, ILLEGAL_REQUEST, asc: 0x20, ascq: 0x0);
4327	/* "Invalid command operation code" */
4328	break;
4329	}
4330
4331	scsi_done(cmd);
4332	}
4333
4334	int ata_scsi_add_hosts(struct ata_host *host, const struct scsi_host_template *sht)
4335	{
4336	int i, rc;
4337
4338	for (i = 0; i < host->n_ports; i++) {
4339	struct ata_port *ap = host->ports[i];
4340	struct Scsi_Host *shost;
4341
4342	rc = -ENOMEM;
4343	shost = scsi_host_alloc(sht, sizeof(struct ata_port *));
4344	if (!shost)
4345	goto err_alloc;
4346
4347	shost->eh_noresume = 1;
4348	*(struct ata_port **)&shost->hostdata[0] = ap;
4349	ap->scsi_host = shost;
4350
4351	shost->transportt = ata_scsi_transport_template;
4352	shost->unique_id = ap->print_id;
4353	shost->max_id = 16;
4354	shost->max_lun = 1;
4355	shost->max_channel = 1;
4356	shost->max_cmd_len = 32;
4357
4358	/* Schedule policy is determined by ->qc_defer()
4359	* callback and it needs to see every deferred qc.
4360	* Set host_blocked to 1 to prevent SCSI midlayer from
4361	* automatically deferring requests.
4362	*/
4363	shost->max_host_blocked = 1;
4364
4365	rc = scsi_add_host_with_dma(shost, &ap->tdev, ap->host->dev);
4366	if (rc)
4367	goto err_alloc;
4368	}
4369
4370	return 0;
4371
4372	err_alloc:
4373	while (--i >= 0) {
4374	struct Scsi_Host *shost = host->ports[i]->scsi_host;
4375
4376	/* scsi_host_put() is in ata_devres_release() */
4377	scsi_remove_host(shost);
4378	}
4379	return rc;
4380	}
4381
4382	#ifdef CONFIG_OF
4383	static void ata_scsi_assign_ofnode(struct ata_device *dev, struct ata_port *ap)
4384	{
4385	struct scsi_device *sdev = dev->sdev;
4386	struct device *d = ap->host->dev;
4387	struct device_node *np = d->of_node;
4388	struct device_node *child;
4389
4390	for_each_available_child_of_node(np, child) {
4391	int ret;
4392	u32 val;
4393
4394	ret = of_property_read_u32(np: child, propname: "reg", out_value: &val);
4395	if (ret)
4396	continue;
4397	if (val == dev->devno) {
4398	dev_dbg(d, "found matching device node\n");
4399	sdev->sdev_gendev.of_node = child;
4400	return;
4401	}
4402	}
4403	}
4404	#else
4405	static void ata_scsi_assign_ofnode(struct ata_device *dev, struct ata_port *ap)
4406	{
4407	}
4408	#endif
4409
4410	void ata_scsi_scan_host(struct ata_port *ap, int sync)
4411	{
4412	int tries = 5;
4413	struct ata_device *last_failed_dev = NULL;
4414	struct ata_link *link;
4415	struct ata_device *dev;
4416
4417	repeat:
4418	ata_for_each_link(link, ap, EDGE) {
4419	ata_for_each_dev(dev, link, ENABLED) {
4420	struct scsi_device *sdev;
4421	int channel = 0, id = 0;
4422
4423	if (dev->sdev)
4424	continue;
4425
4426	if (ata_is_host_link(link))
4427	id = dev->devno;
4428	else
4429	channel = link->pmp;
4430
4431	sdev = __scsi_add_device(ap->scsi_host, channel, id, 0,
4432	NULL);
4433	if (!IS_ERR(ptr: sdev)) {
4434	dev->sdev = sdev;
4435	ata_scsi_assign_ofnode(dev, ap);
4436	scsi_device_put(sdev);
4437	} else {
4438	dev->sdev = NULL;
4439	}
4440	}
4441	}
4442
4443	/* If we scanned while EH was in progress or allocation
4444	* failure occurred, scan would have failed silently. Check
4445	* whether all devices are attached.
4446	*/
4447	ata_for_each_link(link, ap, EDGE) {
4448	ata_for_each_dev(dev, link, ENABLED) {
4449	if (!dev->sdev)
4450	goto exit_loop;
4451	}
4452	}
4453	exit_loop:
4454	if (!link)
4455	return;
4456
4457	/* we're missing some SCSI devices */
4458	if (sync) {
4459	/* If caller requested synchrnous scan && we've made
4460	* any progress, sleep briefly and repeat.
4461	*/
4462	if (dev != last_failed_dev) {
4463	msleep(msecs: 100);
4464	last_failed_dev = dev;
4465	goto repeat;
4466	}
4467
4468	/* We might be failing to detect boot device, give it
4469	* a few more chances.
4470	*/
4471	if (--tries) {
4472	msleep(msecs: 100);
4473	goto repeat;
4474	}
4475
4476	ata_port_err(ap,
4477	"WARNING: synchronous SCSI scan failed without making any progress, switching to async\n");
4478	}
4479
4480	queue_delayed_work(wq: system_long_wq, dwork: &ap->hotplug_task,
4481	delay: round_jiffies_relative(HZ));
4482	}
4483
4484	/**
4485	* ata_scsi_offline_dev - offline attached SCSI device
4486	* @dev: ATA device to offline attached SCSI device for
4487	*
4488	* This function is called from ata_eh_hotplug() and responsible
4489	* for taking the SCSI device attached to @dev offline. This
4490	* function is called with host lock which protects dev->sdev
4491	* against clearing.
4492	*
4493	* LOCKING:
4494	* spin_lock_irqsave(host lock)
4495	*
4496	* RETURNS:
4497	* 1 if attached SCSI device exists, 0 otherwise.
4498	*/
4499	int ata_scsi_offline_dev(struct ata_device *dev)
4500	{
4501	if (dev->sdev) {
4502	scsi_device_set_state(sdev: dev->sdev, state: SDEV_OFFLINE);
4503	return 1;
4504	}
4505	return 0;
4506	}
4507
4508	/**
4509	* ata_scsi_remove_dev - remove attached SCSI device
4510	* @dev: ATA device to remove attached SCSI device for
4511	*
4512	* This function is called from ata_eh_scsi_hotplug() and
4513	* responsible for removing the SCSI device attached to @dev.
4514	*
4515	* LOCKING:
4516	* Kernel thread context (may sleep).
4517	*/
4518	static void ata_scsi_remove_dev(struct ata_device *dev)
4519	{
4520	struct ata_port *ap = dev->link->ap;
4521	struct scsi_device *sdev;
4522	unsigned long flags;
4523
4524	/* Alas, we need to grab scan_mutex to ensure SCSI device
4525	* state doesn't change underneath us and thus
4526	* scsi_device_get() always succeeds. The mutex locking can
4527	* be removed if there is __scsi_device_get() interface which
4528	* increments reference counts regardless of device state.
4529	*/
4530	mutex_lock(&ap->scsi_host->scan_mutex);
4531	spin_lock_irqsave(ap->lock, flags);
4532
4533	/* clearing dev->sdev is protected by host lock */
4534	sdev = dev->sdev;
4535	dev->sdev = NULL;
4536
4537	if (sdev) {
4538	/* If user initiated unplug races with us, sdev can go
4539	* away underneath us after the host lock and
4540	* scan_mutex are released. Hold onto it.
4541	*/
4542	if (scsi_device_get(sdev) == 0) {
4543	/* The following ensures the attached sdev is
4544	* offline on return from ata_scsi_offline_dev()
4545	* regardless it wins or loses the race
4546	* against this function.
4547	*/
4548	scsi_device_set_state(sdev, state: SDEV_OFFLINE);
4549	} else {
4550	WARN_ON(1);
4551	sdev = NULL;
4552	}
4553	}
4554
4555	spin_unlock_irqrestore(lock: ap->lock, flags);
4556	mutex_unlock(lock: &ap->scsi_host->scan_mutex);
4557
4558	if (sdev) {
4559	ata_dev_info(dev, "detaching (SCSI %s)\n",
4560	dev_name(&sdev->sdev_gendev));
4561
4562	scsi_remove_device(sdev);
4563	scsi_device_put(sdev);
4564	}
4565	}
4566
4567	static void ata_scsi_handle_link_detach(struct ata_link *link)
4568	{
4569	struct ata_port *ap = link->ap;
4570	struct ata_device *dev;
4571
4572	ata_for_each_dev(dev, link, ALL) {
4573	unsigned long flags;
4574
4575	if (!(dev->flags & ATA_DFLAG_DETACHED))
4576	continue;
4577
4578	spin_lock_irqsave(ap->lock, flags);
4579	dev->flags &= ~ATA_DFLAG_DETACHED;
4580	spin_unlock_irqrestore(lock: ap->lock, flags);
4581
4582	if (zpodd_dev_enabled(dev))
4583	zpodd_exit(dev);
4584
4585	ata_scsi_remove_dev(dev);
4586	}
4587	}
4588
4589	/**
4590	* ata_scsi_media_change_notify - send media change event
4591	* @dev: Pointer to the disk device with media change event
4592	*
4593	* Tell the block layer to send a media change notification
4594	* event.
4595	*
4596	* LOCKING:
4597	* spin_lock_irqsave(host lock)
4598	*/
4599	void ata_scsi_media_change_notify(struct ata_device *dev)
4600	{
4601	if (dev->sdev)
4602	sdev_evt_send_simple(sdev: dev->sdev, evt_type: SDEV_EVT_MEDIA_CHANGE,
4603	GFP_ATOMIC);
4604	}
4605
4606	/**
4607	* ata_scsi_hotplug - SCSI part of hotplug
4608	* @work: Pointer to ATA port to perform SCSI hotplug on
4609	*
4610	* Perform SCSI part of hotplug. It's executed from a separate
4611	* workqueue after EH completes. This is necessary because SCSI
4612	* hot plugging requires working EH and hot unplugging is
4613	* synchronized with hot plugging with a mutex.
4614	*
4615	* LOCKING:
4616	* Kernel thread context (may sleep).
4617	*/
4618	void ata_scsi_hotplug(struct work_struct *work)
4619	{
4620	struct ata_port *ap =
4621	container_of(work, struct ata_port, hotplug_task.work);
4622	int i;
4623
4624	if (ap->pflags & ATA_PFLAG_UNLOADING)
4625	return;
4626
4627	mutex_lock(&ap->scsi_scan_mutex);
4628
4629	/* Unplug detached devices. We cannot use link iterator here
4630	* because PMP links have to be scanned even if PMP is
4631	* currently not attached. Iterate manually.
4632	*/
4633	ata_scsi_handle_link_detach(link: &ap->link);
4634	if (ap->pmp_link)
4635	for (i = 0; i < SATA_PMP_MAX_PORTS; i++)
4636	ata_scsi_handle_link_detach(link: &ap->pmp_link[i]);
4637
4638	/* scan for new ones */
4639	ata_scsi_scan_host(ap, sync: 0);
4640
4641	mutex_unlock(lock: &ap->scsi_scan_mutex);
4642	}
4643
4644	/**
4645	* ata_scsi_user_scan - indication for user-initiated bus scan
4646	* @shost: SCSI host to scan
4647	* @channel: Channel to scan
4648	* @id: ID to scan
4649	* @lun: LUN to scan
4650	*
4651	* This function is called when user explicitly requests bus
4652	* scan. Set probe pending flag and invoke EH.
4653	*
4654	* LOCKING:
4655	* SCSI layer (we don't care)
4656	*
4657	* RETURNS:
4658	* Zero.
4659	*/
4660	int ata_scsi_user_scan(struct Scsi_Host *shost, unsigned int channel,
4661	unsigned int id, u64 lun)
4662	{
4663	struct ata_port *ap = ata_shost_to_port(host: shost);
4664	unsigned long flags;
4665	int devno, rc = 0;
4666
4667	if (lun != SCAN_WILD_CARD && lun)
4668	return -EINVAL;
4669
4670	if (!sata_pmp_attached(ap)) {
4671	if (channel != SCAN_WILD_CARD && channel)
4672	return -EINVAL;
4673	devno = id;
4674	} else {
4675	if (id != SCAN_WILD_CARD && id)
4676	return -EINVAL;
4677	devno = channel;
4678	}
4679
4680	spin_lock_irqsave(ap->lock, flags);
4681
4682	if (devno == SCAN_WILD_CARD) {
4683	struct ata_link *link;
4684
4685	ata_for_each_link(link, ap, EDGE) {
4686	struct ata_eh_info *ehi = &link->eh_info;
4687	ehi->probe_mask |= ATA_ALL_DEVICES;
4688	ehi->action |= ATA_EH_RESET;
4689	}
4690	} else {
4691	struct ata_device *dev = ata_find_dev(ap, devno);
4692
4693	if (dev) {
4694	struct ata_eh_info *ehi = &dev->link->eh_info;
4695	ehi->probe_mask |= 1 << dev->devno;
4696	ehi->action |= ATA_EH_RESET;
4697	} else
4698	rc = -EINVAL;
4699	}
4700
4701	if (rc == 0) {
4702	ata_port_schedule_eh(ap);
4703	spin_unlock_irqrestore(lock: ap->lock, flags);
4704	ata_port_wait_eh(ap);
4705	} else
4706	spin_unlock_irqrestore(lock: ap->lock, flags);
4707
4708	return rc;
4709	}
4710
4711	/**
4712	* ata_scsi_dev_rescan - initiate scsi_rescan_device()
4713	* @work: Pointer to ATA port to perform scsi_rescan_device()
4714	*
4715	* After ATA pass thru (SAT) commands are executed successfully,
4716	* libata need to propagate the changes to SCSI layer.
4717	*
4718	* LOCKING:
4719	* Kernel thread context (may sleep).
4720	*/
4721	void ata_scsi_dev_rescan(struct work_struct *work)
4722	{
4723	struct ata_port *ap =
4724	container_of(work, struct ata_port, scsi_rescan_task.work);
4725	struct ata_link *link;
4726	struct ata_device *dev;
4727	unsigned long flags;
4728	int ret = 0;
4729
4730	mutex_lock(&ap->scsi_scan_mutex);
4731	spin_lock_irqsave(ap->lock, flags);
4732
4733	ata_for_each_link(link, ap, EDGE) {
4734	ata_for_each_dev(dev, link, ENABLED) {
4735	struct scsi_device *sdev = dev->sdev;
4736
4737	/*
4738	* If the port was suspended before this was scheduled,
4739	* bail out.
4740	*/
4741	if (ap->pflags & ATA_PFLAG_SUSPENDED)
4742	goto unlock;
4743
4744	if (!sdev)
4745	continue;
4746	if (scsi_device_get(sdev))
4747	continue;
4748
4749	spin_unlock_irqrestore(lock: ap->lock, flags);
4750	ret = scsi_rescan_device(sdev);
4751	scsi_device_put(sdev);
4752	spin_lock_irqsave(ap->lock, flags);
4753
4754	if (ret)
4755	goto unlock;
4756	}
4757	}
4758
4759	unlock:
4760	spin_unlock_irqrestore(lock: ap->lock, flags);
4761	mutex_unlock(lock: &ap->scsi_scan_mutex);
4762
4763	/* Reschedule with a delay if scsi_rescan_device() returned an error */
4764	if (ret)
4765	schedule_delayed_work(dwork: &ap->scsi_rescan_task,
4766	delay: msecs_to_jiffies(m: 5));
4767	}
4768