drivers/scsi/scsi_debug.c

   1 /*
   2  * vvvvvvvvvvvvvvvvvvvvvvv Original vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
   3  *  Copyright (C) 1992  Eric Youngdale
   4  *  Simulate a host adapter with 2 disks attached.  Do a lot of checking
   5  *  to make sure that we are not getting blocks mixed up, and PANIC if
   6  *  anything out of the ordinary is seen.
   7  * ^^^^^^^^^^^^^^^^^^^^^^^ Original ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   8  *
   9  *  This version is more generic, simulating a variable number of disk
  10  *  (or disk like devices) sharing a common amount of RAM. To be more
  11  *  realistic, the simulated devices have the transport attributes of
  12  *  SAS disks.
  13  *
  14  *
  15  *  For documentation see http://sg.danny.cz/sg/sdebug26.html
  16  *
  17  *   D. Gilbert (dpg) work for Magneto-Optical device test [20010421]
  18  *   dpg: work for devfs large number of disks [20010809]
  19  *        forked for lk 2.5 series [20011216, 20020101]
  20  *        use vmalloc() more inquiry+mode_sense [20020302]
  21  *        add timers for delayed responses [20020721]
  22  *   Patrick Mansfield <patmans@us.ibm.com> max_luns+scsi_level [20021031]
  23  *   Mike Anderson <andmike@us.ibm.com> sysfs work [20021118]
  24  *   dpg: change style of boot options to "scsi_debug.num_tgts=2" and
  25  *        module options to "modprobe scsi_debug num_tgts=2" [20021221]
  26  */
  27
  28
  29 #define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
  30
  31 #include <linux/module.h>
  32
  33 #include <linux/kernel.h>
  34 #include <linux/errno.h>
  35 #include <linux/timer.h>
  36 #include <linux/slab.h>
  37 #include <linux/types.h>
  38 #include <linux/string.h>
  39 #include <linux/genhd.h>
  40 #include <linux/fs.h>
  41 #include <linux/init.h>
  42 #include <linux/proc_fs.h>
  43 #include <linux/vmalloc.h>
  44 #include <linux/moduleparam.h>
  45 #include <linux/scatterlist.h>
  46 #include <linux/blkdev.h>
  47 #include <linux/crc-t10dif.h>
  48 #include <linux/spinlock.h>
  49 #include <linux/interrupt.h>
  50 #include <linux/atomic.h>
  51 #include <linux/hrtimer.h>
  52
  53 #include <net/checksum.h>
  54
  55 #include <asm/unaligned.h>
  56
  57 #include <scsi/scsi.h>
  58 #include <scsi/scsi_cmnd.h>
  59 #include <scsi/scsi_device.h>
  60 #include <scsi/scsi_host.h>
  61 #include <scsi/scsicam.h>
  62 #include <scsi/scsi_eh.h>
  63 #include <scsi/scsi_tcq.h>
  64 #include <scsi/scsi_dbg.h>
  65
  66 #include "sd.h"
  67 #include "scsi_logging.h"
  68
  69 #define SCSI_DEBUG_VERSION "1.85"
  70 static const char *scsi_debug_version_date = "20141022";
  71
  72 #define MY_NAME "scsi_debug"
  73
  74 /* Additional Sense Code (ASC) */
  75 #define NO_ADDITIONAL_SENSE 0x0
  76 #define LOGICAL_UNIT_NOT_READY 0x4
  77 #define LOGICAL_UNIT_COMMUNICATION_FAILURE 0x8
  78 #define UNRECOVERED_READ_ERR 0x11
  79 #define PARAMETER_LIST_LENGTH_ERR 0x1a
  80 #define INVALID_OPCODE 0x20
  81 #define LBA_OUT_OF_RANGE 0x21
  82 #define INVALID_FIELD_IN_CDB 0x24
  83 #define INVALID_FIELD_IN_PARAM_LIST 0x26
  84 #define UA_RESET_ASC 0x29
  85 #define UA_CHANGED_ASC 0x2a
  86 #define TARGET_CHANGED_ASC 0x3f
  87 #define LUNS_CHANGED_ASCQ 0x0e
  88 #define INSUFF_RES_ASC 0x55
  89 #define INSUFF_RES_ASCQ 0x3
  90 #define POWER_ON_RESET_ASCQ 0x0
  91 #define BUS_RESET_ASCQ 0x2      /* scsi bus reset occurred */
  92 #define MODE_CHANGED_ASCQ 0x1   /* mode parameters changed */
  93 #define CAPACITY_CHANGED_ASCQ 0x9
  94 #define SAVING_PARAMS_UNSUP 0x39
  95 #define TRANSPORT_PROBLEM 0x4b
  96 #define THRESHOLD_EXCEEDED 0x5d
  97 #define LOW_POWER_COND_ON 0x5e
  98 #define MISCOMPARE_VERIFY_ASC 0x1d
  99 #define MICROCODE_CHANGED_ASCQ 0x1      /* with TARGET_CHANGED_ASC */
 100 #define MICROCODE_CHANGED_WO_RESET_ASCQ 0x16
 101
 102 /* Additional Sense Code Qualifier (ASCQ) */
 103 #define ACK_NAK_TO 0x3
 104
 105
 106 /* Default values for driver parameters */
 107 #define DEF_NUM_HOST   1
 108 #define DEF_NUM_TGTS   1
 109 #define DEF_MAX_LUNS   1
 110 /* With these defaults, this driver will make 1 host with 1 target
 111  * (id 0) containing 1 logical unit (lun 0). That is 1 device.
 112  */
 113 #define DEF_ATO 1
 114 #define DEF_DELAY   1           /* if > 0 unit is a jiffy */
 115 #define DEF_DEV_SIZE_MB   8
 116 #define DEF_DIF 0
 117 #define DEF_DIX 0
 118 #define DEF_D_SENSE   0
 119 #define DEF_EVERY_NTH   0
 120 #define DEF_FAKE_RW     0
 121 #define DEF_GUARD 0
 122 #define DEF_HOST_LOCK 0
 123 #define DEF_LBPU 0
 124 #define DEF_LBPWS 0
 125 #define DEF_LBPWS10 0
 126 #define DEF_LBPRZ 1
 127 #define DEF_LOWEST_ALIGNED 0
 128 #define DEF_NDELAY   0          /* if > 0 unit is a nanosecond */
 129 #define DEF_NO_LUN_0   0
 130 #define DEF_NUM_PARTS   0
 131 #define DEF_OPTS   0
 132 #define DEF_OPT_BLKS 64
 133 #define DEF_PHYSBLK_EXP 0
 134 #define DEF_PTYPE   0
 135 #define DEF_REMOVABLE false
 136 #define DEF_SCSI_LEVEL   6    /* INQUIRY, byte2 [6->SPC-4] */
 137 #define DEF_SECTOR_SIZE 512
 138 #define DEF_UNMAP_ALIGNMENT 0
 139 #define DEF_UNMAP_GRANULARITY 1
 140 #define DEF_UNMAP_MAX_BLOCKS 0xFFFFFFFF
 141 #define DEF_UNMAP_MAX_DESC 256
 142 #define DEF_VIRTUAL_GB   0
 143 #define DEF_VPD_USE_HOSTNO 1
 144 #define DEF_WRITESAME_LENGTH 0xFFFF
 145 #define DEF_STRICT 0
 146 #define DELAY_OVERRIDDEN -9999
 147
 148 /* bit mask values for scsi_debug_opts */
 149 #define SCSI_DEBUG_OPT_NOISE   1
 150 #define SCSI_DEBUG_OPT_MEDIUM_ERR   2
 151 #define SCSI_DEBUG_OPT_TIMEOUT   4
 152 #define SCSI_DEBUG_OPT_RECOVERED_ERR   8
 153 #define SCSI_DEBUG_OPT_TRANSPORT_ERR   16
 154 #define SCSI_DEBUG_OPT_DIF_ERR   32
 155 #define SCSI_DEBUG_OPT_DIX_ERR   64
 156 #define SCSI_DEBUG_OPT_MAC_TIMEOUT  128
 157 #define SCSI_DEBUG_OPT_SHORT_TRANSFER   0x100
 158 #define SCSI_DEBUG_OPT_Q_NOISE  0x200
 159 #define SCSI_DEBUG_OPT_ALL_TSF  0x400
 160 #define SCSI_DEBUG_OPT_RARE_TSF 0x800
 161 #define SCSI_DEBUG_OPT_N_WCE    0x1000
 162 #define SCSI_DEBUG_OPT_RESET_NOISE 0x2000
 163 #define SCSI_DEBUG_OPT_NO_CDB_NOISE 0x4000
 164 #define SCSI_DEBUG_OPT_ALL_NOISE (0x1 | 0x200 | 0x2000)
 165 /* When "every_nth" > 0 then modulo "every_nth" commands:
 166  *   - a no response is simulated if SCSI_DEBUG_OPT_TIMEOUT is set
 167  *   - a RECOVERED_ERROR is simulated on successful read and write
 168  *     commands if SCSI_DEBUG_OPT_RECOVERED_ERR is set.
 169  *   - a TRANSPORT_ERROR is simulated on successful read and write
 170  *     commands if SCSI_DEBUG_OPT_TRANSPORT_ERR is set.
 171  *
 172  * When "every_nth" < 0 then after "- every_nth" commands:
 173  *   - a no response is simulated if SCSI_DEBUG_OPT_TIMEOUT is set
 174  *   - a RECOVERED_ERROR is simulated on successful read and write
 175  *     commands if SCSI_DEBUG_OPT_RECOVERED_ERR is set.
 176  *   - a TRANSPORT_ERROR is simulated on successful read and write
 177  *     commands if SCSI_DEBUG_OPT_TRANSPORT_ERR is set.
 178  * This will continue until some other action occurs (e.g. the user
 179  * writing a new value (other than -1 or 1) to every_nth via sysfs).
 180  */
 181
 182 /* As indicated in SAM-5 and SPC-4 Unit Attentions (UAs)are returned in
 183  * priority order. In the subset implemented here lower numbers have higher
 184  * priority. The UA numbers should be a sequence starting from 0 with
 185  * SDEBUG_NUM_UAS being 1 higher than the highest numbered UA. */
 186 #define SDEBUG_UA_POR 0         /* Power on, reset, or bus device reset */
 187 #define SDEBUG_UA_BUS_RESET 1
 188 #define SDEBUG_UA_MODE_CHANGED 2
 189 #define SDEBUG_UA_CAPACITY_CHANGED 3
 190 #define SDEBUG_UA_LUNS_CHANGED 4
 191 #define SDEBUG_UA_MICROCODE_CHANGED 5   /* simulate firmware change */
 192 #define SDEBUG_UA_MICROCODE_CHANGED_WO_RESET 6
 193 #define SDEBUG_NUM_UAS 7
 194
 195 /* for check_readiness() */
 196 #define UAS_ONLY 1      /* check for UAs only */
 197 #define UAS_TUR 0       /* if no UAs then check if media access possible */
 198
 199 /* when 1==SCSI_DEBUG_OPT_MEDIUM_ERR, a medium error is simulated at this
 200  * sector on read commands: */
 201 #define OPT_MEDIUM_ERR_ADDR   0x1234 /* that's sector 4660 in decimal */
 202 #define OPT_MEDIUM_ERR_NUM    10     /* number of consecutive medium errs */
 203
 204 /* If REPORT LUNS has luns >= 256 it can choose "flat space" (value 1)
 205  * or "peripheral device" addressing (value 0) */
 206 #define SAM2_LUN_ADDRESS_METHOD 0
 207
 208 /* SCSI_DEBUG_CANQUEUE is the maximum number of commands that can be queued
 209  * (for response) at one time. Can be reduced by max_queue option. Command
 210  * responses are not queued when delay=0 and ndelay=0. The per-device
 211  * DEF_CMD_PER_LUN can be changed via sysfs:
 212  * /sys/class/scsi_device/<h:c:t:l>/device/queue_depth but cannot exceed
 213  * SCSI_DEBUG_CANQUEUE. */
 214 #define SCSI_DEBUG_CANQUEUE_WORDS  9    /* a WORD is bits in a long */
 215 #define SCSI_DEBUG_CANQUEUE  (SCSI_DEBUG_CANQUEUE_WORDS * BITS_PER_LONG)
 216 #define DEF_CMD_PER_LUN  255
 217
 218 #if DEF_CMD_PER_LUN > SCSI_DEBUG_CANQUEUE
 219 #warning "Expect DEF_CMD_PER_LUN <= SCSI_DEBUG_CANQUEUE"
 220 #endif
 221
 222 /* SCSI opcodes (first byte of cdb) mapped onto these indexes */
 223 enum sdeb_opcode_index {
 224         SDEB_I_INVALID_OPCODE = 0,
 225         SDEB_I_INQUIRY = 1,
 226         SDEB_I_REPORT_LUNS = 2,
 227         SDEB_I_REQUEST_SENSE = 3,
 228         SDEB_I_TEST_UNIT_READY = 4,
 229         SDEB_I_MODE_SENSE = 5,          /* 6, 10 */
 230         SDEB_I_MODE_SELECT = 6,         /* 6, 10 */
 231         SDEB_I_LOG_SENSE = 7,
 232         SDEB_I_READ_CAPACITY = 8,       /* 10; 16 is in SA_IN(16) */
 233         SDEB_I_READ = 9,                /* 6, 10, 12, 16 */
 234         SDEB_I_WRITE = 10,              /* 6, 10, 12, 16 */
 235         SDEB_I_START_STOP = 11,
 236         SDEB_I_SERV_ACT_IN = 12,        /* 12, 16 */
 237         SDEB_I_SERV_ACT_OUT = 13,       /* 12, 16 */
 238         SDEB_I_MAINT_IN = 14,
 239         SDEB_I_MAINT_OUT = 15,
 240         SDEB_I_VERIFY = 16,             /* 10 only */
 241         SDEB_I_VARIABLE_LEN = 17,
 242         SDEB_I_RESERVE = 18,            /* 6, 10 */
 243         SDEB_I_RELEASE = 19,            /* 6, 10 */
 244         SDEB_I_ALLOW_REMOVAL = 20,      /* PREVENT ALLOW MEDIUM REMOVAL */
 245         SDEB_I_REZERO_UNIT = 21,        /* REWIND in SSC */
 246         SDEB_I_ATA_PT = 22,             /* 12, 16 */
 247         SDEB_I_SEND_DIAG = 23,
 248         SDEB_I_UNMAP = 24,
 249         SDEB_I_XDWRITEREAD = 25,        /* 10 only */
 250         SDEB_I_WRITE_BUFFER = 26,
 251         SDEB_I_WRITE_SAME = 27,         /* 10, 16 */
 252         SDEB_I_SYNC_CACHE = 28,         /* 10 only */
 253         SDEB_I_COMP_WRITE = 29,
 254         SDEB_I_LAST_ELEMENT = 30,       /* keep this last */
 255 };
 256
 257 static const unsigned char opcode_ind_arr[256] = {
 258 /* 0x0; 0x0->0x1f: 6 byte cdbs */
 259         SDEB_I_TEST_UNIT_READY, SDEB_I_REZERO_UNIT, 0, SDEB_I_REQUEST_SENSE,
 260             0, 0, 0, 0,
 261         SDEB_I_READ, 0, SDEB_I_WRITE, 0, 0, 0, 0, 0,
 262         0, 0, SDEB_I_INQUIRY, 0, 0, SDEB_I_MODE_SELECT, SDEB_I_RESERVE,
 263             SDEB_I_RELEASE,
 264         0, 0, SDEB_I_MODE_SENSE, SDEB_I_START_STOP, 0, SDEB_I_SEND_DIAG,
 265             SDEB_I_ALLOW_REMOVAL, 0,
 266 /* 0x20; 0x20->0x3f: 10 byte cdbs */
 267         0, 0, 0, 0, 0, SDEB_I_READ_CAPACITY, 0, 0,
 268         SDEB_I_READ, 0, SDEB_I_WRITE, 0, 0, 0, 0, SDEB_I_VERIFY,
 269         0, 0, 0, 0, 0, SDEB_I_SYNC_CACHE, 0, 0,
 270         0, 0, 0, SDEB_I_WRITE_BUFFER, 0, 0, 0, 0,
 271 /* 0x40; 0x40->0x5f: 10 byte cdbs */
 272         0, SDEB_I_WRITE_SAME, SDEB_I_UNMAP, 0, 0, 0, 0, 0,
 273         0, 0, 0, 0, 0, SDEB_I_LOG_SENSE, 0, 0,
 274         0, 0, 0, SDEB_I_XDWRITEREAD, 0, SDEB_I_MODE_SELECT, SDEB_I_RESERVE,
 275             SDEB_I_RELEASE,
 276         0, 0, SDEB_I_MODE_SENSE, 0, 0, 0, 0, 0,
 277 /* 0x60; 0x60->0x7d are reserved */
 278         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 279         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 280         0, SDEB_I_VARIABLE_LEN,
 281 /* 0x80; 0x80->0x9f: 16 byte cdbs */
 282         0, 0, 0, 0, 0, SDEB_I_ATA_PT, 0, 0,
 283         SDEB_I_READ, SDEB_I_COMP_WRITE, SDEB_I_WRITE, 0, 0, 0, 0, 0,
 284         0, 0, 0, SDEB_I_WRITE_SAME, 0, 0, 0, 0,
 285         0, 0, 0, 0, 0, 0, SDEB_I_SERV_ACT_IN, SDEB_I_SERV_ACT_OUT,
 286 /* 0xa0; 0xa0->0xbf: 12 byte cdbs */
 287         SDEB_I_REPORT_LUNS, SDEB_I_ATA_PT, 0, SDEB_I_MAINT_IN,
 288              SDEB_I_MAINT_OUT, 0, 0, 0,
 289         SDEB_I_READ, SDEB_I_SERV_ACT_OUT, SDEB_I_WRITE, SDEB_I_SERV_ACT_IN,
 290              0, 0, 0, 0,
 291         0, 0, 0, 0, 0, 0, 0, 0,
 292         0, 0, 0, 0, 0, 0, 0, 0,
 293 /* 0xc0; 0xc0->0xff: vendor specific */
 294         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 295         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 296         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 297         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 298 };
 299
 300 #define F_D_IN                  1
 301 #define F_D_OUT                 2
 302 #define F_D_OUT_MAYBE           4       /* WRITE SAME, NDOB bit */
 303 #define F_D_UNKN                8
 304 #define F_RL_WLUN_OK            0x10
 305 #define F_SKIP_UA               0x20
 306 #define F_DELAY_OVERR           0x40
 307 #define F_SA_LOW                0x80    /* cdb byte 1, bits 4 to 0 */
 308 #define F_SA_HIGH               0x100   /* as used by variable length cdbs */
 309 #define F_INV_OP                0x200
 310 #define F_FAKE_RW               0x400
 311 #define F_M_ACCESS              0x800   /* media access */
 312
 313 #define FF_RESPOND (F_RL_WLUN_OK | F_SKIP_UA | F_DELAY_OVERR)
 314 #define FF_DIRECT_IO (F_M_ACCESS | F_FAKE_RW)
 315 #define FF_SA (F_SA_HIGH | F_SA_LOW)
 316
 317 struct sdebug_dev_info;
 318 static int resp_inquiry(struct scsi_cmnd *, struct sdebug_dev_info *);
 319 static int resp_report_luns(struct scsi_cmnd *, struct sdebug_dev_info *);
 320 static int resp_requests(struct scsi_cmnd *, struct sdebug_dev_info *);
 321 static int resp_mode_sense(struct scsi_cmnd *, struct sdebug_dev_info *);
 322 static int resp_mode_select(struct scsi_cmnd *, struct sdebug_dev_info *);
 323 static int resp_log_sense(struct scsi_cmnd *, struct sdebug_dev_info *);
 324 static int resp_readcap(struct scsi_cmnd *, struct sdebug_dev_info *);
 325 static int resp_read_dt0(struct scsi_cmnd *, struct sdebug_dev_info *);
 326 static int resp_write_dt0(struct scsi_cmnd *, struct sdebug_dev_info *);
 327 static int resp_start_stop(struct scsi_cmnd *, struct sdebug_dev_info *);
 328 static int resp_readcap16(struct scsi_cmnd *, struct sdebug_dev_info *);
 329 static int resp_get_lba_status(struct scsi_cmnd *, struct sdebug_dev_info *);
 330 static int resp_report_tgtpgs(struct scsi_cmnd *, struct sdebug_dev_info *);
 331 static int resp_unmap(struct scsi_cmnd *, struct sdebug_dev_info *);
 332 static int resp_rsup_opcodes(struct scsi_cmnd *, struct sdebug_dev_info *);
 333 static int resp_rsup_tmfs(struct scsi_cmnd *, struct sdebug_dev_info *);
 334 static int resp_write_same_10(struct scsi_cmnd *, struct sdebug_dev_info *);
 335 static int resp_write_same_16(struct scsi_cmnd *, struct sdebug_dev_info *);
 336 static int resp_xdwriteread_10(struct scsi_cmnd *, struct sdebug_dev_info *);
 337 static int resp_comp_write(struct scsi_cmnd *, struct sdebug_dev_info *);
 338 static int resp_write_buffer(struct scsi_cmnd *, struct sdebug_dev_info *);
 339
 340 struct opcode_info_t {
 341         u8 num_attached;        /* 0 if this is it (i.e. a leaf); use 0xff
 342                                  * for terminating element */
 343         u8 opcode;              /* if num_attached > 0, preferred */
 344         u16 sa;                 /* service action */
 345         u32 flags;              /* OR-ed set of SDEB_F_* */
 346         int (*pfp)(struct scsi_cmnd *, struct sdebug_dev_info *);
 347         const struct opcode_info_t *arrp;  /* num_attached elements or NULL */
 348         u8 len_mask[16];        /* len=len_mask[0], then mask for cdb[1]... */
 349                                 /* ignore cdb bytes after position 15 */
 350 };
 351
 352 static const struct opcode_info_t msense_iarr[1] = {
 353         {0, 0x1a, 0, F_D_IN, NULL, NULL,
 354             {6,  0xe8, 0xff, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 355 };
 356
 357 static const struct opcode_info_t mselect_iarr[1] = {
 358         {0, 0x15, 0, F_D_OUT, NULL, NULL,
 359             {6,  0xf1, 0, 0, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 360 };
 361
 362 static const struct opcode_info_t read_iarr[3] = {
 363         {0, 0x28, 0, F_D_IN | FF_DIRECT_IO, resp_read_dt0, NULL,/* READ(10) */
 364             {10,  0xff, 0xff, 0xff, 0xff, 0xff, 0x1f, 0xff, 0xff, 0xc7, 0, 0,
 365              0, 0, 0, 0} },
 366         {0, 0x8, 0, F_D_IN | FF_DIRECT_IO, resp_read_dt0, NULL, /* READ(6) */
 367             {6,  0xff, 0xff, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 368         {0, 0xa8, 0, F_D_IN | FF_DIRECT_IO, resp_read_dt0, NULL,/* READ(12) */
 369             {12,  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x9f,
 370              0xc7, 0, 0, 0, 0} },
 371 };
 372
 373 static const struct opcode_info_t write_iarr[3] = {
 374         {0, 0x2a, 0, F_D_OUT | FF_DIRECT_IO, resp_write_dt0, NULL,   /* 10 */
 375             {10,  0xfb, 0xff, 0xff, 0xff, 0xff, 0x1f, 0xff, 0xff, 0xc7, 0, 0,
 376              0, 0, 0, 0} },
 377         {0, 0xa, 0, F_D_OUT | FF_DIRECT_IO, resp_write_dt0, NULL,    /* 6 */
 378             {6,  0xff, 0xff, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 379         {0, 0xaa, 0, F_D_OUT | FF_DIRECT_IO, resp_write_dt0, NULL,   /* 12 */
 380             {12,  0xfb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x9f,
 381              0xc7, 0, 0, 0, 0} },
 382 };
 383
 384 static const struct opcode_info_t sa_in_iarr[1] = {
 385         {0, 0x9e, 0x12, F_SA_LOW | F_D_IN, resp_get_lba_status, NULL,
 386             {16,  0x12, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 387              0xff, 0xff, 0xff, 0, 0xc7} },
 388 };
 389
 390 static const struct opcode_info_t vl_iarr[1] = {        /* VARIABLE LENGTH */
 391         {0, 0x7f, 0xb, F_SA_HIGH | F_D_OUT | FF_DIRECT_IO, resp_write_dt0,
 392             NULL, {32,  0xc7, 0, 0, 0, 0, 0x1f, 0x18, 0x0, 0xb, 0xfa,
 393                    0, 0xff, 0xff, 0xff, 0xff} },        /* WRITE(32) */
 394 };
 395
 396 static const struct opcode_info_t maint_in_iarr[2] = {
 397         {0, 0xa3, 0xc, F_SA_LOW | F_D_IN, resp_rsup_opcodes, NULL,
 398             {12,  0xc, 0x87, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0,
 399              0xc7, 0, 0, 0, 0} },
 400         {0, 0xa3, 0xd, F_SA_LOW | F_D_IN, resp_rsup_tmfs, NULL,
 401             {12,  0xd, 0x80, 0, 0, 0, 0xff, 0xff, 0xff, 0xff, 0, 0xc7, 0, 0,
 402              0, 0} },
 403 };
 404
 405 static const struct opcode_info_t write_same_iarr[1] = {
 406         {0, 0x93, 0, F_D_OUT_MAYBE | FF_DIRECT_IO, resp_write_same_16, NULL,
 407             {16,  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 408              0xff, 0xff, 0xff, 0x1f, 0xc7} },
 409 };
 410
 411 static const struct opcode_info_t reserve_iarr[1] = {
 412         {0, 0x16, 0, F_D_OUT, NULL, NULL,       /* RESERVE(6) */
 413             {6,  0x1f, 0xff, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 414 };
 415
 416 static const struct opcode_info_t release_iarr[1] = {
 417         {0, 0x17, 0, F_D_OUT, NULL, NULL,       /* RELEASE(6) */
 418             {6,  0x1f, 0xff, 0, 0, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 419 };
 420
 421
 422 /* This array is accessed via SDEB_I_* values. Make sure all are mapped,
 423  * plus the terminating elements for logic that scans this table such as
 424  * REPORT SUPPORTED OPERATION CODES. */
 425 static const struct opcode_info_t opcode_info_arr[SDEB_I_LAST_ELEMENT + 1] = {
 426 /* 0 */
 427         {0, 0, 0, F_INV_OP | FF_RESPOND, NULL, NULL,
 428             {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 429         {0, 0x12, 0, FF_RESPOND | F_D_IN, resp_inquiry, NULL,
 430             {6,  0xe3, 0xff, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 431         {0, 0xa0, 0, FF_RESPOND | F_D_IN, resp_report_luns, NULL,
 432             {12,  0xe3, 0xff, 0, 0, 0, 0xff, 0xff, 0xff, 0xff, 0, 0xc7, 0, 0,
 433              0, 0} },
 434         {0, 0x3, 0, FF_RESPOND | F_D_IN, resp_requests, NULL,
 435             {6,  0xe1, 0, 0, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 436         {0, 0x0, 0, F_M_ACCESS | F_RL_WLUN_OK, NULL, NULL,/* TEST UNIT READY */
 437             {6,  0, 0, 0, 0, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 438         {1, 0x5a, 0, F_D_IN, resp_mode_sense, msense_iarr,
 439             {10,  0xf8, 0xff, 0xff, 0, 0, 0, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0,
 440              0} },
 441         {1, 0x55, 0, F_D_OUT, resp_mode_select, mselect_iarr,
 442             {10,  0xf1, 0, 0, 0, 0, 0, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0} },
 443         {0, 0x4d, 0, F_D_IN, resp_log_sense, NULL,
 444             {10,  0xe3, 0xff, 0xff, 0, 0xff, 0xff, 0xff, 0xff, 0xc7, 0, 0, 0,
 445              0, 0, 0} },
 446         {0, 0x25, 0, F_D_IN, resp_readcap, NULL,
 447             {10,  0xe1, 0xff, 0xff, 0xff, 0xff, 0, 0, 0x1, 0xc7, 0, 0, 0, 0,
 448              0, 0} },
 449         {3, 0x88, 0, F_D_IN | FF_DIRECT_IO, resp_read_dt0, read_iarr,
 450             {16,  0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 451              0xff, 0xff, 0xff, 0x9f, 0xc7} },           /* READ(16) */
 452 /* 10 */
 453         {3, 0x8a, 0, F_D_OUT | FF_DIRECT_IO, resp_write_dt0, write_iarr,
 454             {16,  0xfa, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 455              0xff, 0xff, 0xff, 0x9f, 0xc7} },           /* WRITE(16) */
 456         {0, 0x1b, 0, 0, resp_start_stop, NULL,          /* START STOP UNIT */
 457             {6,  0x1, 0, 0xf, 0xf7, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 458         {1, 0x9e, 0x10, F_SA_LOW | F_D_IN, resp_readcap16, sa_in_iarr,
 459             {16,  0x10, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 460              0xff, 0xff, 0xff, 0x1, 0xc7} },    /* READ CAPACITY(16) */
 461         {0, 0, 0, F_INV_OP | FF_RESPOND, NULL, NULL, /* SA OUT */
 462             {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 463         {2, 0xa3, 0xa, F_SA_LOW | F_D_IN, resp_report_tgtpgs, maint_in_iarr,
 464             {12,  0xea, 0, 0, 0, 0, 0xff, 0xff, 0xff, 0xff, 0, 0xc7, 0, 0, 0,
 465              0} },
 466         {0, 0, 0, F_INV_OP | FF_RESPOND, NULL, NULL, /* MAINT OUT */
 467             {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 468         {0, 0, 0, F_INV_OP | FF_RESPOND, NULL, NULL, /* VERIFY */
 469             {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 470         {1, 0x7f, 0x9, F_SA_HIGH | F_D_IN | FF_DIRECT_IO, resp_read_dt0,
 471             vl_iarr, {32,  0xc7, 0, 0, 0, 0, 0x1f, 0x18, 0x0, 0x9, 0xfe, 0,
 472                       0xff, 0xff, 0xff, 0xff} },/* VARIABLE LENGTH, READ(32) */
 473         {1, 0x56, 0, F_D_OUT, NULL, reserve_iarr, /* RESERVE(10) */
 474             {10,  0xff, 0xff, 0xff, 0, 0, 0, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0,
 475              0} },
 476         {1, 0x57, 0, F_D_OUT, NULL, release_iarr, /* RELEASE(10) */
 477             {10,  0x13, 0xff, 0xff, 0, 0, 0, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0,
 478              0} },
 479 /* 20 */
 480         {0, 0, 0, F_INV_OP | FF_RESPOND, NULL, NULL, /* ALLOW REMOVAL */
 481             {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 482         {0, 0x1, 0, 0, resp_start_stop, NULL, /* REWIND ?? */
 483             {6,  0x1, 0, 0, 0, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 484         {0, 0, 0, F_INV_OP | FF_RESPOND, NULL, NULL, /* ATA_PT */
 485             {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 486         {0, 0x1d, F_D_OUT, 0, NULL, NULL,       /* SEND DIAGNOSTIC */
 487             {6,  0xf7, 0, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 488         {0, 0x42, 0, F_D_OUT | FF_DIRECT_IO, resp_unmap, NULL, /* UNMAP */
 489             {10,  0x1, 0, 0, 0, 0, 0x1f, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0} },
 490         {0, 0x53, 0, F_D_IN | F_D_OUT | FF_DIRECT_IO, resp_xdwriteread_10,
 491             NULL, {10,  0xff, 0xff, 0xff, 0xff, 0xff, 0x1f, 0xff, 0xff, 0xc7,
 492                    0, 0, 0, 0, 0, 0} },
 493         {0, 0x3b, 0, F_D_OUT_MAYBE, resp_write_buffer, NULL,
 494             {10,  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xc7, 0, 0,
 495              0, 0, 0, 0} },                     /* WRITE_BUFFER */
 496         {1, 0x41, 0, F_D_OUT_MAYBE | FF_DIRECT_IO, resp_write_same_10,
 497             write_same_iarr, {10,  0xff, 0xff, 0xff, 0xff, 0xff, 0x1f, 0xff,
 498                               0xff, 0xc7, 0, 0, 0, 0, 0, 0} },
 499         {0, 0x35, 0, F_DELAY_OVERR | FF_DIRECT_IO, NULL, NULL, /* SYNC_CACHE */
 500             {10,  0x7, 0xff, 0xff, 0xff, 0xff, 0x1f, 0xff, 0xff, 0xc7, 0, 0,
 501              0, 0, 0, 0} },
 502         {0, 0x89, 0, F_D_OUT | FF_DIRECT_IO, resp_comp_write, NULL,
 503             {16,  0xf8, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0, 0,
 504              0, 0xff, 0x1f, 0xc7} },            /* COMPARE AND WRITE */
 505
 506 /* 30 */
 507         {0xff, 0, 0, 0, NULL, NULL,             /* terminating element */
 508             {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 509 };
 510
 511 struct sdebug_scmd_extra_t {
 512         bool inj_recovered;
 513         bool inj_transport;
 514         bool inj_dif;
 515         bool inj_dix;
 516         bool inj_short;
 517 };
 518
 519 static int scsi_debug_add_host = DEF_NUM_HOST;
 520 static int scsi_debug_ato = DEF_ATO;
 521 static int scsi_debug_delay = DEF_DELAY;
 522 static int scsi_debug_dev_size_mb = DEF_DEV_SIZE_MB;
 523 static int scsi_debug_dif = DEF_DIF;
 524 static int scsi_debug_dix = DEF_DIX;
 525 static int scsi_debug_dsense = DEF_D_SENSE;
 526 static int scsi_debug_every_nth = DEF_EVERY_NTH;
 527 static int scsi_debug_fake_rw = DEF_FAKE_RW;
 528 static unsigned int scsi_debug_guard = DEF_GUARD;
 529 static int scsi_debug_lowest_aligned = DEF_LOWEST_ALIGNED;
 530 static int scsi_debug_max_luns = DEF_MAX_LUNS;
 531 static int scsi_debug_max_queue = SCSI_DEBUG_CANQUEUE;
 532 static atomic_t retired_max_queue;      /* if > 0 then was prior max_queue */
 533 static int scsi_debug_ndelay = DEF_NDELAY;
 534 static int scsi_debug_no_lun_0 = DEF_NO_LUN_0;
 535 static int scsi_debug_no_uld = 0;
 536 static int scsi_debug_num_parts = DEF_NUM_PARTS;
 537 static int scsi_debug_num_tgts = DEF_NUM_TGTS; /* targets per host */
 538 static int scsi_debug_opt_blks = DEF_OPT_BLKS;
 539 static int scsi_debug_opts = DEF_OPTS;
 540 static int scsi_debug_physblk_exp = DEF_PHYSBLK_EXP;
 541 static int scsi_debug_ptype = DEF_PTYPE; /* SCSI peripheral type (0==disk) */
 542 static int scsi_debug_scsi_level = DEF_SCSI_LEVEL;
 543 static int scsi_debug_sector_size = DEF_SECTOR_SIZE;
 544 static int scsi_debug_virtual_gb = DEF_VIRTUAL_GB;
 545 static int scsi_debug_vpd_use_hostno = DEF_VPD_USE_HOSTNO;
 546 static unsigned int scsi_debug_lbpu = DEF_LBPU;
 547 static unsigned int scsi_debug_lbpws = DEF_LBPWS;
 548 static unsigned int scsi_debug_lbpws10 = DEF_LBPWS10;
 549 static unsigned int scsi_debug_lbprz = DEF_LBPRZ;
 550 static unsigned int scsi_debug_unmap_alignment = DEF_UNMAP_ALIGNMENT;
 551 static unsigned int scsi_debug_unmap_granularity = DEF_UNMAP_GRANULARITY;
 552 static unsigned int scsi_debug_unmap_max_blocks = DEF_UNMAP_MAX_BLOCKS;
 553 static unsigned int scsi_debug_unmap_max_desc = DEF_UNMAP_MAX_DESC;
 554 static unsigned int scsi_debug_write_same_length = DEF_WRITESAME_LENGTH;
 555 static bool scsi_debug_removable = DEF_REMOVABLE;
 556 static bool scsi_debug_clustering;
 557 static bool scsi_debug_host_lock = DEF_HOST_LOCK;
 558 static bool scsi_debug_strict = DEF_STRICT;
 559 static bool sdebug_any_injecting_opt;
 560
 561 static atomic_t sdebug_cmnd_count;
 562 static atomic_t sdebug_completions;
 563 static atomic_t sdebug_a_tsf;           /* counter of 'almost' TSFs */
 564
 565 #define DEV_READONLY(TGT)      (0)
 566
 567 static unsigned int sdebug_store_sectors;
 568 static sector_t sdebug_capacity;        /* in sectors */
 569
 570 /* old BIOS stuff, kernel may get rid of them but some mode sense pages
 571    may still need them */
 572 static int sdebug_heads;                /* heads per disk */
 573 static int sdebug_cylinders_per;        /* cylinders per surface */
 574 static int sdebug_sectors_per;          /* sectors per cylinder */
 575
 576 #define SDEBUG_MAX_PARTS 4
 577
 578 #define SCSI_DEBUG_MAX_CMD_LEN 32
 579
 580 static unsigned int scsi_debug_lbp(void)
 581 {
 582         return ((0 == scsi_debug_fake_rw) &&
 583                 (scsi_debug_lbpu | scsi_debug_lbpws | scsi_debug_lbpws10));
 584 }
 585
 586 struct sdebug_dev_info {
 587         struct list_head dev_list;
 588         unsigned int channel;
 589         unsigned int target;
 590         u64 lun;
 591         struct sdebug_host_info *sdbg_host;
 592         unsigned long uas_bm[1];
 593         atomic_t num_in_q;
 594         char stopped;           /* TODO: should be atomic */
 595         bool used;
 596 };
 597
 598 struct sdebug_host_info {
 599         struct list_head host_list;
 600         struct Scsi_Host *shost;
 601         struct device dev;
 602         struct list_head dev_info_list;
 603 };
 604
 605 #define to_sdebug_host(d)       \
 606         container_of(d, struct sdebug_host_info, dev)
 607
 608 static LIST_HEAD(sdebug_host_list);
 609 static DEFINE_SPINLOCK(sdebug_host_list_lock);
 610
 611
 612 struct sdebug_hrtimer {         /* ... is derived from hrtimer */
 613         struct hrtimer hrt;     /* must be first element */
 614         int qa_indx;
 615 };
 616
 617 struct sdebug_queued_cmd {
 618         /* in_use flagged by a bit in queued_in_use_bm[] */
 619         struct timer_list *cmnd_timerp;
 620         struct tasklet_struct *tletp;
 621         struct sdebug_hrtimer *sd_hrtp;
 622         struct scsi_cmnd * a_cmnd;
 623 };
 624 static struct sdebug_queued_cmd queued_arr[SCSI_DEBUG_CANQUEUE];
 625 static unsigned long queued_in_use_bm[SCSI_DEBUG_CANQUEUE_WORDS];
 626
 627
 628 static unsigned char * fake_storep;     /* ramdisk storage */
 629 static struct sd_dif_tuple *dif_storep; /* protection info */
 630 static void *map_storep;                /* provisioning map */
 631
 632 static unsigned long map_size;
 633 static int num_aborts;
 634 static int num_dev_resets;
 635 static int num_target_resets;
 636 static int num_bus_resets;
 637 static int num_host_resets;
 638 static int dix_writes;
 639 static int dix_reads;
 640 static int dif_errors;
 641
 642 static DEFINE_SPINLOCK(queued_arr_lock);
 643 static DEFINE_RWLOCK(atomic_rw);
 644
 645 static char sdebug_proc_name[] = MY_NAME;
 646 static const char *my_name = MY_NAME;
 647
 648 static struct bus_type pseudo_lld_bus;
 649
 650 static struct device_driver sdebug_driverfs_driver = {
 651         .name           = sdebug_proc_name,
 652         .bus            = &pseudo_lld_bus,
 653 };
 654
 655 static const int check_condition_result =
 656                 (DRIVER_SENSE << 24) | SAM_STAT_CHECK_CONDITION;
 657
 658 static const int illegal_condition_result =
 659         (DRIVER_SENSE << 24) | (DID_ABORT << 16) | SAM_STAT_CHECK_CONDITION;
 660
 661 static const int device_qfull_result =
 662         (DID_OK << 16) | (COMMAND_COMPLETE << 8) | SAM_STAT_TASK_SET_FULL;
 663
 664 static unsigned char caching_pg[] = {0x8, 18, 0x14, 0, 0xff, 0xff, 0, 0,
 665                                      0xff, 0xff, 0xff, 0xff, 0x80, 0x14, 0, 0,
 666                                      0, 0, 0, 0};
 667 static unsigned char ctrl_m_pg[] = {0xa, 10, 2, 0, 0, 0, 0, 0,
 668                                     0, 0, 0x2, 0x4b};
 669 static unsigned char iec_m_pg[] = {0x1c, 0xa, 0x08, 0, 0, 0, 0, 0,
 670                                    0, 0, 0x0, 0x0};
 671
 672 static void *fake_store(unsigned long long lba)
 673 {
 674         lba = do_div(lba, sdebug_store_sectors);
 675
 676         return fake_storep + lba * scsi_debug_sector_size;
 677 }
 678
 679 static struct sd_dif_tuple *dif_store(sector_t sector)
 680 {
 681         sector = do_div(sector, sdebug_store_sectors);
 682
 683         return dif_storep + sector;
 684 }
 685
 686 static int sdebug_add_adapter(void);
 687 static void sdebug_remove_adapter(void);
 688
 689 static void sdebug_max_tgts_luns(void)
 690 {
 691         struct sdebug_host_info *sdbg_host;
 692         struct Scsi_Host *hpnt;
 693
 694         spin_lock(&sdebug_host_list_lock);
 695         list_for_each_entry(sdbg_host, &sdebug_host_list, host_list) {
 696                 hpnt = sdbg_host->shost;
 697                 if ((hpnt->this_id >= 0) &&
 698                     (scsi_debug_num_tgts > hpnt->this_id))
 699                         hpnt->max_id = scsi_debug_num_tgts + 1;
 700                 else
 701                         hpnt->max_id = scsi_debug_num_tgts;
 702                 /* scsi_debug_max_luns; */
 703                 hpnt->max_lun = SCSI_W_LUN_REPORT_LUNS;
 704         }
 705         spin_unlock(&sdebug_host_list_lock);
 706 }
 707
 708 enum sdeb_cmd_data {SDEB_IN_DATA = 0, SDEB_IN_CDB = 1};
 709
 710 /* Set in_bit to -1 to indicate no bit position of invalid field */
 711 static void
 712 mk_sense_invalid_fld(struct scsi_cmnd *scp, enum sdeb_cmd_data c_d,
 713                      int in_byte, int in_bit)
 714 {
 715         unsigned char *sbuff;
 716         u8 sks[4];
 717         int sl, asc;
 718
 719         sbuff = scp->sense_buffer;
 720         if (!sbuff) {
 721                 sdev_printk(KERN_ERR, scp->device,
 722                             "%s: sense_buffer is NULL\n", __func__);
 723                 return;
 724         }
 725         asc = c_d ? INVALID_FIELD_IN_CDB : INVALID_FIELD_IN_PARAM_LIST;
 726         memset(sbuff, 0, SCSI_SENSE_BUFFERSIZE);
 727         scsi_build_sense_buffer(scsi_debug_dsense, sbuff, ILLEGAL_REQUEST,
 728                                 asc, 0);
 729         memset(sks, 0, sizeof(sks));
 730         sks[0] = 0x80;
 731         if (c_d)
 732                 sks[0] |= 0x40;
 733         if (in_bit >= 0) {
 734                 sks[0] |= 0x8;
 735                 sks[0] |= 0x7 & in_bit;
 736         }
 737         put_unaligned_be16(in_byte, sks + 1);
 738         if (scsi_debug_dsense) {
 739                 sl = sbuff[7] + 8;
 740                 sbuff[7] = sl;
 741                 sbuff[sl] = 0x2;
 742                 sbuff[sl + 1] = 0x6;
 743                 memcpy(sbuff + sl + 4, sks, 3);
 744         } else
 745                 memcpy(sbuff + 15, sks, 3);
 746         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
 747                 sdev_printk(KERN_INFO, scp->device, "%s:  [sense_key,asc,ascq"
 748                             "]: [0x5,0x%x,0x0] %c byte=%d, bit=%d\n",
 749                             my_name, asc, c_d ? 'C' : 'D', in_byte, in_bit);
 750 }
 751
 752 static void mk_sense_buffer(struct scsi_cmnd *scp, int key, int asc, int asq)
 753 {
 754         unsigned char *sbuff;
 755
 756         sbuff = scp->sense_buffer;
 757         if (!sbuff) {
 758                 sdev_printk(KERN_ERR, scp->device,
 759                             "%s: sense_buffer is NULL\n", __func__);
 760                 return;
 761         }
 762         memset(sbuff, 0, SCSI_SENSE_BUFFERSIZE);
 763
 764         scsi_build_sense_buffer(scsi_debug_dsense, sbuff, key, asc, asq);
 765
 766         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
 767                 sdev_printk(KERN_INFO, scp->device,
 768                             "%s:  [sense_key,asc,ascq]: [0x%x,0x%x,0x%x]\n",
 769                             my_name, key, asc, asq);
 770 }
 771
 772 static void
 773 mk_sense_invalid_opcode(struct scsi_cmnd *scp)
 774 {
 775         mk_sense_buffer(scp, ILLEGAL_REQUEST, INVALID_OPCODE, 0);
 776 }
 777
 778 static int scsi_debug_ioctl(struct scsi_device *dev, int cmd, void __user *arg)
 779 {
 780         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts) {
 781                 if (0x1261 == cmd)
 782                         sdev_printk(KERN_INFO, dev,
 783                                     "%s: BLKFLSBUF [0x1261]\n", __func__);
 784                 else if (0x5331 == cmd)
 785                         sdev_printk(KERN_INFO, dev,
 786                                     "%s: CDROM_GET_CAPABILITY [0x5331]\n",
 787                                     __func__);
 788                 else
 789                         sdev_printk(KERN_INFO, dev, "%s: cmd=0x%x\n",
 790                                     __func__, cmd);
 791         }
 792         return -EINVAL;
 793         /* return -ENOTTY; // correct return but upsets fdisk */
 794 }
 795
 796 static void clear_luns_changed_on_target(struct sdebug_dev_info *devip)
 797 {
 798         struct sdebug_host_info *sdhp;
 799         struct sdebug_dev_info *dp;
 800
 801         spin_lock(&sdebug_host_list_lock);
 802         list_for_each_entry(sdhp, &sdebug_host_list, host_list) {
 803                 list_for_each_entry(dp, &sdhp->dev_info_list, dev_list) {
 804                         if ((devip->sdbg_host == dp->sdbg_host) &&
 805                             (devip->target == dp->target))
 806                                 clear_bit(SDEBUG_UA_LUNS_CHANGED, dp->uas_bm);
 807                 }
 808         }
 809         spin_unlock(&sdebug_host_list_lock);
 810 }
 811
 812 static int check_readiness(struct scsi_cmnd *SCpnt, int uas_only,
 813                            struct sdebug_dev_info * devip)
 814 {
 815         int k;
 816         bool debug = !!(SCSI_DEBUG_OPT_NOISE & scsi_debug_opts);
 817
 818         k = find_first_bit(devip->uas_bm, SDEBUG_NUM_UAS);
 819         if (k != SDEBUG_NUM_UAS) {
 820                 const char *cp = NULL;
 821
 822                 switch (k) {
 823                 case SDEBUG_UA_POR:
 824                         mk_sense_buffer(SCpnt, UNIT_ATTENTION,
 825                                         UA_RESET_ASC, POWER_ON_RESET_ASCQ);
 826                         if (debug)
 827                                 cp = "power on reset";
 828                         break;
 829                 case SDEBUG_UA_BUS_RESET:
 830                         mk_sense_buffer(SCpnt, UNIT_ATTENTION,
 831                                         UA_RESET_ASC, BUS_RESET_ASCQ);
 832                         if (debug)
 833                                 cp = "bus reset";
 834                         break;
 835                 case SDEBUG_UA_MODE_CHANGED:
 836                         mk_sense_buffer(SCpnt, UNIT_ATTENTION,
 837                                         UA_CHANGED_ASC, MODE_CHANGED_ASCQ);
 838                         if (debug)
 839                                 cp = "mode parameters changed";
 840                         break;
 841                 case SDEBUG_UA_CAPACITY_CHANGED:
 842                         mk_sense_buffer(SCpnt, UNIT_ATTENTION,
 843                                         UA_CHANGED_ASC, CAPACITY_CHANGED_ASCQ);
 844                         if (debug)
 845                                 cp = "capacity data changed";
 846                         break;
 847                 case SDEBUG_UA_MICROCODE_CHANGED:
 848                         mk_sense_buffer(SCpnt, UNIT_ATTENTION,
 849                                  TARGET_CHANGED_ASC, MICROCODE_CHANGED_ASCQ);
 850                         if (debug)
 851                                 cp = "microcode has been changed";
 852                         break;
 853                 case SDEBUG_UA_MICROCODE_CHANGED_WO_RESET:
 854                         mk_sense_buffer(SCpnt, UNIT_ATTENTION,
 855                                         TARGET_CHANGED_ASC,
 856                                         MICROCODE_CHANGED_WO_RESET_ASCQ);
 857                         if (debug)
 858                                 cp = "microcode has been changed without reset";
 859                         break;
 860                 case SDEBUG_UA_LUNS_CHANGED:
 861                         /*
 862                          * SPC-3 behavior is to report a UNIT ATTENTION with
 863                          * ASC/ASCQ REPORTED LUNS DATA HAS CHANGED on every LUN
 864                          * on the target, until a REPORT LUNS command is
 865                          * received.  SPC-4 behavior is to report it only once.
 866                          * NOTE:  scsi_debug_scsi_level does not use the same
 867                          * values as struct scsi_device->scsi_level.
 868                          */
 869                         if (scsi_debug_scsi_level >= 6) /* SPC-4 and above */
 870                                 clear_luns_changed_on_target(devip);
 871                         mk_sense_buffer(SCpnt, UNIT_ATTENTION,
 872                                         TARGET_CHANGED_ASC,
 873                                         LUNS_CHANGED_ASCQ);
 874                         if (debug)
 875                                 cp = "reported luns data has changed";
 876                         break;
 877                 default:
 878                         pr_warn("%s: unexpected unit attention code=%d\n",
 879                                 __func__, k);
 880                         if (debug)
 881                                 cp = "unknown";
 882                         break;
 883                 }
 884                 clear_bit(k, devip->uas_bm);
 885                 if (debug)
 886                         sdev_printk(KERN_INFO, SCpnt->device,
 887                                    "%s reports: Unit attention: %s\n",
 888                                    my_name, cp);
 889                 return check_condition_result;
 890         }
 891         if ((UAS_TUR == uas_only) && devip->stopped) {
 892                 mk_sense_buffer(SCpnt, NOT_READY, LOGICAL_UNIT_NOT_READY,
 893                                 0x2);
 894                 if (debug)
 895                         sdev_printk(KERN_INFO, SCpnt->device,
 896                                     "%s reports: Not ready: %s\n", my_name,
 897                                     "initializing command required");
 898                 return check_condition_result;
 899         }
 900         return 0;
 901 }
 902
 903 /* Returns 0 if ok else (DID_ERROR << 16). Sets scp->resid . */
 904 static int fill_from_dev_buffer(struct scsi_cmnd *scp, unsigned char *arr,
 905                                 int arr_len)
 906 {
 907         int act_len;
 908         struct scsi_data_buffer *sdb = scsi_in(scp);
 909
 910         if (!sdb->length)
 911                 return 0;
 912         if (!(scsi_bidi_cmnd(scp) || scp->sc_data_direction == DMA_FROM_DEVICE))
 913                 return (DID_ERROR << 16);
 914
 915         act_len = sg_copy_from_buffer(sdb->table.sgl, sdb->table.nents,
 916                                       arr, arr_len);
 917         sdb->resid = scsi_bufflen(scp) - act_len;
 918
 919         return 0;
 920 }
 921
 922 /* Returns number of bytes fetched into 'arr' or -1 if error. */
 923 static int fetch_to_dev_buffer(struct scsi_cmnd *scp, unsigned char *arr,
 924                                int arr_len)
 925 {
 926         if (!scsi_bufflen(scp))
 927                 return 0;
 928         if (!(scsi_bidi_cmnd(scp) || scp->sc_data_direction == DMA_TO_DEVICE))
 929                 return -1;
 930
 931         return scsi_sg_copy_to_buffer(scp, arr, arr_len);
 932 }
 933
 934
 935 static const char * inq_vendor_id = "Linux   ";
 936 static const char * inq_product_id = "scsi_debug      ";
 937 static const char *inq_product_rev = "0184";    /* version less '.' */
 938
 939 /* Device identification VPD page. Returns number of bytes placed in arr */
 940 static int inquiry_evpd_83(unsigned char * arr, int port_group_id,
 941                            int target_dev_id, int dev_id_num,
 942                            const char * dev_id_str,
 943                            int dev_id_str_len)
 944 {
 945         int num, port_a;
 946         char b[32];
 947
 948         port_a = target_dev_id + 1;
 949         /* T10 vendor identifier field format (faked) */
 950         arr[0] = 0x2;   /* ASCII */
 951         arr[1] = 0x1;
 952         arr[2] = 0x0;
 953         memcpy(&arr[4], inq_vendor_id, 8);
 954         memcpy(&arr[12], inq_product_id, 16);
 955         memcpy(&arr[28], dev_id_str, dev_id_str_len);
 956         num = 8 + 16 + dev_id_str_len;
 957         arr[3] = num;
 958         num += 4;
 959         if (dev_id_num >= 0) {
 960                 /* NAA-5, Logical unit identifier (binary) */
 961                 arr[num++] = 0x1;       /* binary (not necessarily sas) */
 962                 arr[num++] = 0x3;       /* PIV=0, lu, naa */
 963                 arr[num++] = 0x0;
 964                 arr[num++] = 0x8;
 965                 arr[num++] = 0x53;  /* naa-5 ieee company id=0x333333 (fake) */
 966                 arr[num++] = 0x33;
 967                 arr[num++] = 0x33;
 968                 arr[num++] = 0x30;
 969                 arr[num++] = (dev_id_num >> 24);
 970                 arr[num++] = (dev_id_num >> 16) & 0xff;
 971                 arr[num++] = (dev_id_num >> 8) & 0xff;
 972                 arr[num++] = dev_id_num & 0xff;
 973                 /* Target relative port number */
 974                 arr[num++] = 0x61;      /* proto=sas, binary */
 975                 arr[num++] = 0x94;      /* PIV=1, target port, rel port */
 976                 arr[num++] = 0x0;       /* reserved */
 977                 arr[num++] = 0x4;       /* length */
 978                 arr[num++] = 0x0;       /* reserved */
 979                 arr[num++] = 0x0;       /* reserved */
 980                 arr[num++] = 0x0;
 981                 arr[num++] = 0x1;       /* relative port A */
 982         }
 983         /* NAA-5, Target port identifier */
 984         arr[num++] = 0x61;      /* proto=sas, binary */
 985         arr[num++] = 0x93;      /* piv=1, target port, naa */
 986         arr[num++] = 0x0;
 987         arr[num++] = 0x8;
 988         arr[num++] = 0x52;      /* naa-5, company id=0x222222 (fake) */
 989         arr[num++] = 0x22;
 990         arr[num++] = 0x22;
 991         arr[num++] = 0x20;
 992         arr[num++] = (port_a >> 24);
 993         arr[num++] = (port_a >> 16) & 0xff;
 994         arr[num++] = (port_a >> 8) & 0xff;
 995         arr[num++] = port_a & 0xff;
 996         /* NAA-5, Target port group identifier */
 997         arr[num++] = 0x61;      /* proto=sas, binary */
 998         arr[num++] = 0x95;      /* piv=1, target port group id */
 999         arr[num++] = 0x0;
1000         arr[num++] = 0x4;
1001         arr[num++] = 0;
1002         arr[num++] = 0;
1003         arr[num++] = (port_group_id >> 8) & 0xff;
1004         arr[num++] = port_group_id & 0xff;
1005         /* NAA-5, Target device identifier */
1006         arr[num++] = 0x61;      /* proto=sas, binary */
1007         arr[num++] = 0xa3;      /* piv=1, target device, naa */
1008         arr[num++] = 0x0;
1009         arr[num++] = 0x8;
1010         arr[num++] = 0x52;      /* naa-5, company id=0x222222 (fake) */
1011         arr[num++] = 0x22;
1012         arr[num++] = 0x22;
1013         arr[num++] = 0x20;
1014         arr[num++] = (target_dev_id >> 24);
1015         arr[num++] = (target_dev_id >> 16) & 0xff;
1016         arr[num++] = (target_dev_id >> 8) & 0xff;
1017         arr[num++] = target_dev_id & 0xff;
1018         /* SCSI name string: Target device identifier */
1019         arr[num++] = 0x63;      /* proto=sas, UTF-8 */
1020         arr[num++] = 0xa8;      /* piv=1, target device, SCSI name string */
1021         arr[num++] = 0x0;
1022         arr[num++] = 24;
1023         memcpy(arr + num, "naa.52222220", 12);
1024         num += 12;
1025         snprintf(b, sizeof(b), "%08X", target_dev_id);
1026         memcpy(arr + num, b, 8);
1027         num += 8;
1028         memset(arr + num, 0, 4);
1029         num += 4;
1030         return num;
1031 }
1032
1033
1034 static unsigned char vpd84_data[] = {
1035 /* from 4th byte */ 0x22,0x22,0x22,0x0,0xbb,0x0,
1036     0x22,0x22,0x22,0x0,0xbb,0x1,
1037     0x22,0x22,0x22,0x0,0xbb,0x2,
1038 };
1039
1040 /*  Software interface identification VPD page */
1041 static int inquiry_evpd_84(unsigned char * arr)
1042 {
1043         memcpy(arr, vpd84_data, sizeof(vpd84_data));
1044         return sizeof(vpd84_data);
1045 }
1046
1047 /* Management network addresses VPD page */
1048 static int inquiry_evpd_85(unsigned char * arr)
1049 {
1050         int num = 0;
1051         const char * na1 = "https://www.kernel.org/config";
1052         const char * na2 = "http://www.kernel.org/log";
1053         int plen, olen;
1054
1055         arr[num++] = 0x1;       /* lu, storage config */
1056         arr[num++] = 0x0;       /* reserved */
1057         arr[num++] = 0x0;
1058         olen = strlen(na1);
1059         plen = olen + 1;
1060         if (plen % 4)
1061                 plen = ((plen / 4) + 1) * 4;
1062         arr[num++] = plen;      /* length, null termianted, padded */
1063         memcpy(arr + num, na1, olen);
1064         memset(arr + num + olen, 0, plen - olen);
1065         num += plen;
1066
1067         arr[num++] = 0x4;       /* lu, logging */
1068         arr[num++] = 0x0;       /* reserved */
1069         arr[num++] = 0x0;
1070         olen = strlen(na2);
1071         plen = olen + 1;
1072         if (plen % 4)
1073                 plen = ((plen / 4) + 1) * 4;
1074         arr[num++] = plen;      /* length, null terminated, padded */
1075         memcpy(arr + num, na2, olen);
1076         memset(arr + num + olen, 0, plen - olen);
1077         num += plen;
1078
1079         return num;
1080 }
1081
1082 /* SCSI ports VPD page */
1083 static int inquiry_evpd_88(unsigned char * arr, int target_dev_id)
1084 {
1085         int num = 0;
1086         int port_a, port_b;
1087
1088         port_a = target_dev_id + 1;
1089         port_b = port_a + 1;
1090         arr[num++] = 0x0;       /* reserved */
1091         arr[num++] = 0x0;       /* reserved */
1092         arr[num++] = 0x0;
1093         arr[num++] = 0x1;       /* relative port 1 (primary) */
1094         memset(arr + num, 0, 6);
1095         num += 6;
1096         arr[num++] = 0x0;
1097         arr[num++] = 12;        /* length tp descriptor */
1098         /* naa-5 target port identifier (A) */
1099         arr[num++] = 0x61;      /* proto=sas, binary */
1100         arr[num++] = 0x93;      /* PIV=1, target port, NAA */
1101         arr[num++] = 0x0;       /* reserved */
1102         arr[num++] = 0x8;       /* length */
1103         arr[num++] = 0x52;      /* NAA-5, company_id=0x222222 (fake) */
1104         arr[num++] = 0x22;
1105         arr[num++] = 0x22;
1106         arr[num++] = 0x20;
1107         arr[num++] = (port_a >> 24);
1108         arr[num++] = (port_a >> 16) & 0xff;
1109         arr[num++] = (port_a >> 8) & 0xff;
1110         arr[num++] = port_a & 0xff;
1111
1112         arr[num++] = 0x0;       /* reserved */
1113         arr[num++] = 0x0;       /* reserved */
1114         arr[num++] = 0x0;
1115         arr[num++] = 0x2;       /* relative port 2 (secondary) */
1116         memset(arr + num, 0, 6);
1117         num += 6;
1118         arr[num++] = 0x0;
1119         arr[num++] = 12;        /* length tp descriptor */
1120         /* naa-5 target port identifier (B) */
1121         arr[num++] = 0x61;      /* proto=sas, binary */
1122         arr[num++] = 0x93;      /* PIV=1, target port, NAA */
1123         arr[num++] = 0x0;       /* reserved */
1124         arr[num++] = 0x8;       /* length */
1125         arr[num++] = 0x52;      /* NAA-5, company_id=0x222222 (fake) */
1126         arr[num++] = 0x22;
1127         arr[num++] = 0x22;
1128         arr[num++] = 0x20;
1129         arr[num++] = (port_b >> 24);
1130         arr[num++] = (port_b >> 16) & 0xff;
1131         arr[num++] = (port_b >> 8) & 0xff;
1132         arr[num++] = port_b & 0xff;
1133
1134         return num;
1135 }
1136
1137
1138 static unsigned char vpd89_data[] = {
1139 /* from 4th byte */ 0,0,0,0,
1140 'l','i','n','u','x',' ',' ',' ',
1141 'S','A','T',' ','s','c','s','i','_','d','e','b','u','g',' ',' ',
1142 '1','2','3','4',
1143 0x34,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,
1144 0xec,0,0,0,
1145 0x5a,0xc,0xff,0x3f,0x37,0xc8,0x10,0,0,0,0,0,0x3f,0,0,0,
1146 0,0,0,0,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x20,0x20,0x20,0x20,
1147 0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0,0,0,0x40,0x4,0,0x2e,0x33,
1148 0x38,0x31,0x20,0x20,0x20,0x20,0x54,0x53,0x38,0x33,0x30,0x30,0x33,0x31,
1149 0x53,0x41,
1150 0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
1151 0x20,0x20,
1152 0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
1153 0x10,0x80,
1154 0,0,0,0x2f,0,0,0,0x2,0,0x2,0x7,0,0xff,0xff,0x1,0,
1155 0x3f,0,0xc1,0xff,0x3e,0,0x10,0x1,0xb0,0xf8,0x50,0x9,0,0,0x7,0,
1156 0x3,0,0x78,0,0x78,0,0xf0,0,0x78,0,0,0,0,0,0,0,
1157 0,0,0,0,0,0,0,0,0x2,0,0,0,0,0,0,0,
1158 0x7e,0,0x1b,0,0x6b,0x34,0x1,0x7d,0x3,0x40,0x69,0x34,0x1,0x3c,0x3,0x40,
1159 0x7f,0x40,0,0,0,0,0xfe,0xfe,0,0,0,0,0,0xfe,0,0,
1160 0,0,0,0,0,0,0,0,0xb0,0xf8,0x50,0x9,0,0,0,0,
1161 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1162 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1163 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1164 0x1,0,0xb0,0xf8,0x50,0x9,0xb0,0xf8,0x50,0x9,0x20,0x20,0x2,0,0xb6,0x42,
1165 0,0x80,0x8a,0,0x6,0x3c,0xa,0x3c,0xff,0xff,0xc6,0x7,0,0x1,0,0x8,
1166 0xf0,0xf,0,0x10,0x2,0,0x30,0,0,0,0,0,0,0,0x6,0xfe,
1167 0,0,0x2,0,0x50,0,0x8a,0,0x4f,0x95,0,0,0x21,0,0xb,0,
1168 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1169 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1170 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1171 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1172 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1173 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1174 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1175 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1176 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1177 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1178 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1179 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0xa5,0x51,
1180 };
1181
1182 /* ATA Information VPD page */
1183 static int inquiry_evpd_89(unsigned char * arr)
1184 {
1185         memcpy(arr, vpd89_data, sizeof(vpd89_data));
1186         return sizeof(vpd89_data);
1187 }
1188
1189
1190 static unsigned char vpdb0_data[] = {
1191         /* from 4th byte */ 0,0,0,4, 0,0,0x4,0, 0,0,0,64,
1192         0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1193         0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1194         0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1195 };
1196
1197 /* Block limits VPD page (SBC-3) */
1198 static int inquiry_evpd_b0(unsigned char * arr)
1199 {
1200         unsigned int gran;
1201
1202         memcpy(arr, vpdb0_data, sizeof(vpdb0_data));
1203
1204         /* Optimal transfer length granularity */
1205         gran = 1 << scsi_debug_physblk_exp;
1206         arr[2] = (gran >> 8) & 0xff;
1207         arr[3] = gran & 0xff;
1208
1209         /* Maximum Transfer Length */
1210         if (sdebug_store_sectors > 0x400) {
1211                 arr[4] = (sdebug_store_sectors >> 24) & 0xff;
1212                 arr[5] = (sdebug_store_sectors >> 16) & 0xff;
1213                 arr[6] = (sdebug_store_sectors >> 8) & 0xff;
1214                 arr[7] = sdebug_store_sectors & 0xff;
1215         }
1216
1217         /* Optimal Transfer Length */
1218         put_unaligned_be32(scsi_debug_opt_blks, &arr[8]);
1219
1220         if (scsi_debug_lbpu) {
1221                 /* Maximum Unmap LBA Count */
1222                 put_unaligned_be32(scsi_debug_unmap_max_blocks, &arr[16]);
1223
1224                 /* Maximum Unmap Block Descriptor Count */
1225                 put_unaligned_be32(scsi_debug_unmap_max_desc, &arr[20]);
1226         }
1227
1228         /* Unmap Granularity Alignment */
1229         if (scsi_debug_unmap_alignment) {
1230                 put_unaligned_be32(scsi_debug_unmap_alignment, &arr[28]);
1231                 arr[28] |= 0x80; /* UGAVALID */
1232         }
1233
1234         /* Optimal Unmap Granularity */
1235         put_unaligned_be32(scsi_debug_unmap_granularity, &arr[24]);
1236
1237         /* Maximum WRITE SAME Length */
1238         put_unaligned_be64(scsi_debug_write_same_length, &arr[32]);
1239
1240         return 0x3c; /* Mandatory page length for Logical Block Provisioning */
1241
1242         return sizeof(vpdb0_data);
1243 }
1244
1245 /* Block device characteristics VPD page (SBC-3) */
1246 static int inquiry_evpd_b1(unsigned char *arr)
1247 {
1248         memset(arr, 0, 0x3c);
1249         arr[0] = 0;
1250         arr[1] = 1;     /* non rotating medium (e.g. solid state) */
1251         arr[2] = 0;
1252         arr[3] = 5;     /* less than 1.8" */
1253
1254         return 0x3c;
1255 }
1256
1257 /* Logical block provisioning VPD page (SBC-3) */
1258 static int inquiry_evpd_b2(unsigned char *arr)
1259 {
1260         memset(arr, 0, 0x4);
1261         arr[0] = 0;                     /* threshold exponent */
1262
1263         if (scsi_debug_lbpu)
1264                 arr[1] = 1 << 7;
1265
1266         if (scsi_debug_lbpws)
1267                 arr[1] |= 1 << 6;
1268
1269         if (scsi_debug_lbpws10)
1270                 arr[1] |= 1 << 5;
1271
1272         if (scsi_debug_lbprz)
1273                 arr[1] |= 1 << 2;
1274
1275         return 0x4;
1276 }
1277
1278 #define SDEBUG_LONG_INQ_SZ 96
1279 #define SDEBUG_MAX_INQ_ARR_SZ 584
1280
1281 static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
1282 {
1283         unsigned char pq_pdt;
1284         unsigned char * arr;
1285         unsigned char *cmd = scp->cmnd;
1286         int alloc_len, n, ret;
1287         bool have_wlun;
1288
1289         alloc_len = (cmd[3] << 8) + cmd[4];
1290         arr = kzalloc(SDEBUG_MAX_INQ_ARR_SZ, GFP_ATOMIC);
1291         if (! arr)
1292                 return DID_REQUEUE << 16;
1293         have_wlun = (scp->device->lun == SCSI_W_LUN_REPORT_LUNS);
1294         if (have_wlun)
1295                 pq_pdt = 0x1e;  /* present, wlun */
1296         else if (scsi_debug_no_lun_0 && (0 == devip->lun))
1297                 pq_pdt = 0x7f;  /* not present, no device type */
1298         else
1299                 pq_pdt = (scsi_debug_ptype & 0x1f);
1300         arr[0] = pq_pdt;
1301         if (0x2 & cmd[1]) {  /* CMDDT bit set */
1302                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 1, 1);
1303                 kfree(arr);
1304                 return check_condition_result;
1305         } else if (0x1 & cmd[1]) {  /* EVPD bit set */
1306                 int lu_id_num, port_group_id, target_dev_id, len;
1307                 char lu_id_str[6];
1308                 int host_no = devip->sdbg_host->shost->host_no;
1309
1310                 port_group_id = (((host_no + 1) & 0x7f) << 8) +
1311                     (devip->channel & 0x7f);
1312                 if (0 == scsi_debug_vpd_use_hostno)
1313                         host_no = 0;
1314                 lu_id_num = have_wlun ? -1 : (((host_no + 1) * 2000) +
1315                             (devip->target * 1000) + devip->lun);
1316                 target_dev_id = ((host_no + 1) * 2000) +
1317                                  (devip->target * 1000) - 3;
1318                 len = scnprintf(lu_id_str, 6, "%d", lu_id_num);
1319                 if (0 == cmd[2]) { /* supported vital product data pages */
1320                         arr[1] = cmd[2];        /*sanity */
1321                         n = 4;
1322                         arr[n++] = 0x0;   /* this page */
1323                         arr[n++] = 0x80;  /* unit serial number */
1324                         arr[n++] = 0x83;  /* device identification */
1325                         arr[n++] = 0x84;  /* software interface ident. */
1326                         arr[n++] = 0x85;  /* management network addresses */
1327                         arr[n++] = 0x86;  /* extended inquiry */
1328                         arr[n++] = 0x87;  /* mode page policy */
1329                         arr[n++] = 0x88;  /* SCSI ports */
1330                         arr[n++] = 0x89;  /* ATA information */
1331                         arr[n++] = 0xb0;  /* Block limits (SBC) */
1332                         arr[n++] = 0xb1;  /* Block characteristics (SBC) */
1333                         if (scsi_debug_lbp()) /* Logical Block Prov. (SBC) */
1334                                 arr[n++] = 0xb2;
1335                         arr[3] = n - 4;   /* number of supported VPD pages */
1336                 } else if (0x80 == cmd[2]) { /* unit serial number */
1337                         arr[1] = cmd[2];        /*sanity */
1338                         arr[3] = len;
1339                         memcpy(&arr[4], lu_id_str, len);
1340                 } else if (0x83 == cmd[2]) { /* device identification */
1341                         arr[1] = cmd[2];        /*sanity */
1342                         arr[3] = inquiry_evpd_83(&arr[4], port_group_id,
1343                                                  target_dev_id, lu_id_num,
1344                                                  lu_id_str, len);
1345                 } else if (0x84 == cmd[2]) { /* Software interface ident. */
1346                         arr[1] = cmd[2];        /*sanity */
1347                         arr[3] = inquiry_evpd_84(&arr[4]);
1348                 } else if (0x85 == cmd[2]) { /* Management network addresses */
1349                         arr[1] = cmd[2];        /*sanity */
1350                         arr[3] = inquiry_evpd_85(&arr[4]);
1351                 } else if (0x86 == cmd[2]) { /* extended inquiry */
1352                         arr[1] = cmd[2];        /*sanity */
1353                         arr[3] = 0x3c;  /* number of following entries */
1354                         if (scsi_debug_dif == SD_DIF_TYPE3_PROTECTION)
1355                                 arr[4] = 0x4;   /* SPT: GRD_CHK:1 */
1356                         else if (scsi_debug_dif)
1357                                 arr[4] = 0x5;   /* SPT: GRD_CHK:1, REF_CHK:1 */
1358                         else
1359                                 arr[4] = 0x0;   /* no protection stuff */
1360                         arr[5] = 0x7;   /* head of q, ordered + simple q's */
1361                 } else if (0x87 == cmd[2]) { /* mode page policy */
1362                         arr[1] = cmd[2];        /*sanity */
1363                         arr[3] = 0x8;   /* number of following entries */
1364                         arr[4] = 0x2;   /* disconnect-reconnect mp */
1365                         arr[6] = 0x80;  /* mlus, shared */
1366                         arr[8] = 0x18;   /* protocol specific lu */
1367                         arr[10] = 0x82;  /* mlus, per initiator port */
1368                 } else if (0x88 == cmd[2]) { /* SCSI Ports */
1369                         arr[1] = cmd[2];        /*sanity */
1370                         arr[3] = inquiry_evpd_88(&arr[4], target_dev_id);
1371                 } else if (0x89 == cmd[2]) { /* ATA information */
1372                         arr[1] = cmd[2];        /*sanity */
1373                         n = inquiry_evpd_89(&arr[4]);
1374                         arr[2] = (n >> 8);
1375                         arr[3] = (n & 0xff);
1376                 } else if (0xb0 == cmd[2]) { /* Block limits (SBC) */
1377                         arr[1] = cmd[2];        /*sanity */
1378                         arr[3] = inquiry_evpd_b0(&arr[4]);
1379                 } else if (0xb1 == cmd[2]) { /* Block characteristics (SBC) */
1380                         arr[1] = cmd[2];        /*sanity */
1381                         arr[3] = inquiry_evpd_b1(&arr[4]);
1382                 } else if (0xb2 == cmd[2]) { /* Logical Block Prov. (SBC) */
1383                         arr[1] = cmd[2];        /*sanity */
1384                         arr[3] = inquiry_evpd_b2(&arr[4]);
1385                 } else {
1386                         mk_sense_invalid_fld(scp, SDEB_IN_CDB, 2, -1);
1387                         kfree(arr);
1388                         return check_condition_result;
1389                 }
1390                 len = min(((arr[2] << 8) + arr[3]) + 4, alloc_len);
1391                 ret = fill_from_dev_buffer(scp, arr,
1392                             min(len, SDEBUG_MAX_INQ_ARR_SZ));
1393                 kfree(arr);
1394                 return ret;
1395         }
1396         /* drops through here for a standard inquiry */
1397         arr[1] = scsi_debug_removable ? 0x80 : 0;       /* Removable disk */
1398         arr[2] = scsi_debug_scsi_level;
1399         arr[3] = 2;    /* response_data_format==2 */
1400         arr[4] = SDEBUG_LONG_INQ_SZ - 5;
1401         arr[5] = scsi_debug_dif ? 1 : 0; /* PROTECT bit */
1402         if (0 == scsi_debug_vpd_use_hostno)
1403                 arr[5] = 0x10; /* claim: implicit TGPS */
1404         arr[6] = 0x10; /* claim: MultiP */
1405         /* arr[6] |= 0x40; ... claim: EncServ (enclosure services) */
1406         arr[7] = 0xa; /* claim: LINKED + CMDQUE */
1407         memcpy(&arr[8], inq_vendor_id, 8);
1408         memcpy(&arr[16], inq_product_id, 16);
1409         memcpy(&arr[32], inq_product_rev, 4);
1410         /* version descriptors (2 bytes each) follow */
1411         arr[58] = 0x0; arr[59] = 0xa2;  /* SAM-5 rev 4 */
1412         arr[60] = 0x4; arr[61] = 0x68;  /* SPC-4 rev 37 */
1413         n = 62;
1414         if (scsi_debug_ptype == 0) {
1415                 arr[n++] = 0x4; arr[n++] = 0xc5; /* SBC-4 rev 36 */
1416         } else if (scsi_debug_ptype == 1) {
1417                 arr[n++] = 0x5; arr[n++] = 0x25; /* SSC-4 rev 3 */
1418         }
1419         arr[n++] = 0x20; arr[n++] = 0xe6;  /* SPL-3 rev 7 */
1420         ret = fill_from_dev_buffer(scp, arr,
1421                             min(alloc_len, SDEBUG_LONG_INQ_SZ));
1422         kfree(arr);
1423         return ret;
1424 }
1425
1426 static int resp_requests(struct scsi_cmnd * scp,
1427                          struct sdebug_dev_info * devip)
1428 {
1429         unsigned char * sbuff;
1430         unsigned char *cmd = scp->cmnd;
1431         unsigned char arr[SCSI_SENSE_BUFFERSIZE];
1432         bool dsense, want_dsense;
1433         int len = 18;
1434
1435         memset(arr, 0, sizeof(arr));
1436         dsense = !!(cmd[1] & 1);
1437         want_dsense = dsense || scsi_debug_dsense;
1438         sbuff = scp->sense_buffer;
1439         if ((iec_m_pg[2] & 0x4) && (6 == (iec_m_pg[3] & 0xf))) {
1440                 if (dsense) {
1441                         arr[0] = 0x72;
1442                         arr[1] = 0x0;           /* NO_SENSE in sense_key */
1443                         arr[2] = THRESHOLD_EXCEEDED;
1444                         arr[3] = 0xff;          /* TEST set and MRIE==6 */
1445                         len = 8;
1446                 } else {
1447                         arr[0] = 0x70;
1448                         arr[2] = 0x0;           /* NO_SENSE in sense_key */
1449                         arr[7] = 0xa;           /* 18 byte sense buffer */
1450                         arr[12] = THRESHOLD_EXCEEDED;
1451                         arr[13] = 0xff;         /* TEST set and MRIE==6 */
1452                 }
1453         } else {
1454                 memcpy(arr, sbuff, SCSI_SENSE_BUFFERSIZE);
1455                 if (arr[0] >= 0x70 && dsense == scsi_debug_dsense)
1456                         ;       /* have sense and formats match */
1457                 else if (arr[0] <= 0x70) {
1458                         if (dsense) {
1459                                 memset(arr, 0, 8);
1460                                 arr[0] = 0x72;
1461                                 len = 8;
1462                         } else {
1463                                 memset(arr, 0, 18);
1464                                 arr[0] = 0x70;
1465                                 arr[7] = 0xa;
1466                         }
1467                 } else if (dsense) {
1468                         memset(arr, 0, 8);
1469                         arr[0] = 0x72;
1470                         arr[1] = sbuff[2];     /* sense key */
1471                         arr[2] = sbuff[12];    /* asc */
1472                         arr[3] = sbuff[13];    /* ascq */
1473                         len = 8;
1474                 } else {
1475                         memset(arr, 0, 18);
1476                         arr[0] = 0x70;
1477                         arr[2] = sbuff[1];
1478                         arr[7] = 0xa;
1479                         arr[12] = sbuff[1];
1480                         arr[13] = sbuff[3];
1481                 }
1482
1483         }
1484         mk_sense_buffer(scp, 0, NO_ADDITIONAL_SENSE, 0);
1485         return fill_from_dev_buffer(scp, arr, len);
1486 }
1487
1488 static int resp_start_stop(struct scsi_cmnd * scp,
1489                            struct sdebug_dev_info * devip)
1490 {
1491         unsigned char *cmd = scp->cmnd;
1492         int power_cond, start;
1493
1494         power_cond = (cmd[4] & 0xf0) >> 4;
1495         if (power_cond) {
1496                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 4, 7);
1497                 return check_condition_result;
1498         }
1499         start = cmd[4] & 1;
1500         if (start == devip->stopped)
1501                 devip->stopped = !start;
1502         return 0;
1503 }
1504
1505 static sector_t get_sdebug_capacity(void)
1506 {
1507         if (scsi_debug_virtual_gb > 0)
1508                 return (sector_t)scsi_debug_virtual_gb *
1509                         (1073741824 / scsi_debug_sector_size);
1510         else
1511                 return sdebug_store_sectors;
1512 }
1513
1514 #define SDEBUG_READCAP_ARR_SZ 8
1515 static int resp_readcap(struct scsi_cmnd * scp,
1516                         struct sdebug_dev_info * devip)
1517 {
1518         unsigned char arr[SDEBUG_READCAP_ARR_SZ];
1519         unsigned int capac;
1520
1521         /* following just in case virtual_gb changed */
1522         sdebug_capacity = get_sdebug_capacity();
1523         memset(arr, 0, SDEBUG_READCAP_ARR_SZ);
1524         if (sdebug_capacity < 0xffffffff) {
1525                 capac = (unsigned int)sdebug_capacity - 1;
1526                 arr[0] = (capac >> 24);
1527                 arr[1] = (capac >> 16) & 0xff;
1528                 arr[2] = (capac >> 8) & 0xff;
1529                 arr[3] = capac & 0xff;
1530         } else {
1531                 arr[0] = 0xff;
1532                 arr[1] = 0xff;
1533                 arr[2] = 0xff;
1534                 arr[3] = 0xff;
1535         }
1536         arr[6] = (scsi_debug_sector_size >> 8) & 0xff;
1537         arr[7] = scsi_debug_sector_size & 0xff;
1538         return fill_from_dev_buffer(scp, arr, SDEBUG_READCAP_ARR_SZ);
1539 }
1540
1541 #define SDEBUG_READCAP16_ARR_SZ 32
1542 static int resp_readcap16(struct scsi_cmnd * scp,
1543                           struct sdebug_dev_info * devip)
1544 {
1545         unsigned char *cmd = scp->cmnd;
1546         unsigned char arr[SDEBUG_READCAP16_ARR_SZ];
1547         unsigned long long capac;
1548         int k, alloc_len;
1549
1550         alloc_len = ((cmd[10] << 24) + (cmd[11] << 16) + (cmd[12] << 8)
1551                      + cmd[13]);
1552         /* following just in case virtual_gb changed */
1553         sdebug_capacity = get_sdebug_capacity();
1554         memset(arr, 0, SDEBUG_READCAP16_ARR_SZ);
1555         capac = sdebug_capacity - 1;
1556         for (k = 0; k < 8; ++k, capac >>= 8)
1557                 arr[7 - k] = capac & 0xff;
1558         arr[8] = (scsi_debug_sector_size >> 24) & 0xff;
1559         arr[9] = (scsi_debug_sector_size >> 16) & 0xff;
1560         arr[10] = (scsi_debug_sector_size >> 8) & 0xff;
1561         arr[11] = scsi_debug_sector_size & 0xff;
1562         arr[13] = scsi_debug_physblk_exp & 0xf;
1563         arr[14] = (scsi_debug_lowest_aligned >> 8) & 0x3f;
1564
1565         if (scsi_debug_lbp()) {
1566                 arr[14] |= 0x80; /* LBPME */
1567                 if (scsi_debug_lbprz)
1568                         arr[14] |= 0x40; /* LBPRZ */
1569         }
1570
1571         arr[15] = scsi_debug_lowest_aligned & 0xff;
1572
1573         if (scsi_debug_dif) {
1574                 arr[12] = (scsi_debug_dif - 1) << 1; /* P_TYPE */
1575                 arr[12] |= 1; /* PROT_EN */
1576         }
1577
1578         return fill_from_dev_buffer(scp, arr,
1579                                     min(alloc_len, SDEBUG_READCAP16_ARR_SZ));
1580 }
1581
1582 #define SDEBUG_MAX_TGTPGS_ARR_SZ 1412
1583
1584 static int resp_report_tgtpgs(struct scsi_cmnd * scp,
1585                               struct sdebug_dev_info * devip)
1586 {
1587         unsigned char *cmd = scp->cmnd;
1588         unsigned char * arr;
1589         int host_no = devip->sdbg_host->shost->host_no;
1590         int n, ret, alen, rlen;
1591         int port_group_a, port_group_b, port_a, port_b;
1592
1593         alen = ((cmd[6] << 24) + (cmd[7] << 16) + (cmd[8] << 8)
1594                 + cmd[9]);
1595
1596         arr = kzalloc(SDEBUG_MAX_TGTPGS_ARR_SZ, GFP_ATOMIC);
1597         if (! arr)
1598                 return DID_REQUEUE << 16;
1599         /*
1600          * EVPD page 0x88 states we have two ports, one
1601          * real and a fake port with no device connected.
1602          * So we create two port groups with one port each
1603          * and set the group with port B to unavailable.
1604          */
1605         port_a = 0x1; /* relative port A */
1606         port_b = 0x2; /* relative port B */
1607         port_group_a = (((host_no + 1) & 0x7f) << 8) +
1608             (devip->channel & 0x7f);
1609         port_group_b = (((host_no + 1) & 0x7f) << 8) +
1610             (devip->channel & 0x7f) + 0x80;
1611
1612         /*
1613          * The asymmetric access state is cycled according to the host_id.
1614          */
1615         n = 4;
1616         if (0 == scsi_debug_vpd_use_hostno) {
1617             arr[n++] = host_no % 3; /* Asymm access state */
1618             arr[n++] = 0x0F; /* claim: all states are supported */
1619         } else {
1620             arr[n++] = 0x0; /* Active/Optimized path */
1621             arr[n++] = 0x01; /* claim: only support active/optimized paths */
1622         }
1623         arr[n++] = (port_group_a >> 8) & 0xff;
1624         arr[n++] = port_group_a & 0xff;
1625         arr[n++] = 0;    /* Reserved */
1626         arr[n++] = 0;    /* Status code */
1627         arr[n++] = 0;    /* Vendor unique */
1628         arr[n++] = 0x1;  /* One port per group */
1629         arr[n++] = 0;    /* Reserved */
1630         arr[n++] = 0;    /* Reserved */
1631         arr[n++] = (port_a >> 8) & 0xff;
1632         arr[n++] = port_a & 0xff;
1633         arr[n++] = 3;    /* Port unavailable */
1634         arr[n++] = 0x08; /* claim: only unavailalbe paths are supported */
1635         arr[n++] = (port_group_b >> 8) & 0xff;
1636         arr[n++] = port_group_b & 0xff;
1637         arr[n++] = 0;    /* Reserved */
1638         arr[n++] = 0;    /* Status code */
1639         arr[n++] = 0;    /* Vendor unique */
1640         arr[n++] = 0x1;  /* One port per group */
1641         arr[n++] = 0;    /* Reserved */
1642         arr[n++] = 0;    /* Reserved */
1643         arr[n++] = (port_b >> 8) & 0xff;
1644         arr[n++] = port_b & 0xff;
1645
1646         rlen = n - 4;
1647         arr[0] = (rlen >> 24) & 0xff;
1648         arr[1] = (rlen >> 16) & 0xff;
1649         arr[2] = (rlen >> 8) & 0xff;
1650         arr[3] = rlen & 0xff;
1651
1652         /*
1653          * Return the smallest value of either
1654          * - The allocated length
1655          * - The constructed command length
1656          * - The maximum array size
1657          */
1658         rlen = min(alen,n);
1659         ret = fill_from_dev_buffer(scp, arr,
1660                                    min(rlen, SDEBUG_MAX_TGTPGS_ARR_SZ));
1661         kfree(arr);
1662         return ret;
1663 }
1664
1665 static int
1666 resp_rsup_opcodes(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
1667 {
1668         bool rctd;
1669         u8 reporting_opts, req_opcode, sdeb_i, supp;
1670         u16 req_sa, u;
1671         u32 alloc_len, a_len;
1672         int k, offset, len, errsts, count, bump, na;
1673         const struct opcode_info_t *oip;
1674         const struct opcode_info_t *r_oip;
1675         u8 *arr;
1676         u8 *cmd = scp->cmnd;
1677
1678         rctd = !!(cmd[2] & 0x80);
1679         reporting_opts = cmd[2] & 0x7;
1680         req_opcode = cmd[3];
1681         req_sa = get_unaligned_be16(cmd + 4);
1682         alloc_len = get_unaligned_be32(cmd + 6);
1683         if (alloc_len < 4 || alloc_len > 0xffff) {
1684                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 6, -1);
1685                 return check_condition_result;
1686         }
1687         if (alloc_len > 8192)
1688                 a_len = 8192;
1689         else
1690                 a_len = alloc_len;
1691         arr = kzalloc((a_len < 256) ? 320 : a_len + 64, GFP_ATOMIC);
1692         if (NULL == arr) {
1693                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC,
1694                                 INSUFF_RES_ASCQ);
1695                 return check_condition_result;
1696         }
1697         switch (reporting_opts) {
1698         case 0: /* all commands */
1699                 /* count number of commands */
1700                 for (count = 0, oip = opcode_info_arr;
1701                      oip->num_attached != 0xff; ++oip) {
1702                         if (F_INV_OP & oip->flags)
1703                                 continue;
1704                         count += (oip->num_attached + 1);
1705                 }
1706                 bump = rctd ? 20 : 8;
1707                 put_unaligned_be32(count * bump, arr);
1708                 for (offset = 4, oip = opcode_info_arr;
1709                      oip->num_attached != 0xff && offset < a_len; ++oip) {
1710                         if (F_INV_OP & oip->flags)
1711                                 continue;
1712                         na = oip->num_attached;
1713                         arr[offset] = oip->opcode;
1714                         put_unaligned_be16(oip->sa, arr + offset + 2);
1715                         if (rctd)
1716                                 arr[offset + 5] |= 0x2;
1717                         if (FF_SA & oip->flags)
1718                                 arr[offset + 5] |= 0x1;
1719                         put_unaligned_be16(oip->len_mask[0], arr + offset + 6);
1720                         if (rctd)
1721                                 put_unaligned_be16(0xa, arr + offset + 8);
1722                         r_oip = oip;
1723                         for (k = 0, oip = oip->arrp; k < na; ++k, ++oip) {
1724                                 if (F_INV_OP & oip->flags)
1725                                         continue;
1726                                 offset += bump;
1727                                 arr[offset] = oip->opcode;
1728                                 put_unaligned_be16(oip->sa, arr + offset + 2);
1729                                 if (rctd)
1730                                         arr[offset + 5] |= 0x2;
1731                                 if (FF_SA & oip->flags)
1732                                         arr[offset + 5] |= 0x1;
1733                                 put_unaligned_be16(oip->len_mask[0],
1734                                                    arr + offset + 6);
1735                                 if (rctd)
1736                                         put_unaligned_be16(0xa,
1737                                                            arr + offset + 8);
1738                         }
1739                         oip = r_oip;
1740                         offset += bump;
1741                 }
1742                 break;
1743         case 1: /* one command: opcode only */
1744         case 2: /* one command: opcode plus service action */
1745         case 3: /* one command: if sa==0 then opcode only else opcode+sa */
1746                 sdeb_i = opcode_ind_arr[req_opcode];
1747                 oip = &opcode_info_arr[sdeb_i];
1748                 if (F_INV_OP & oip->flags) {
1749                         supp = 1;
1750                         offset = 4;
1751                 } else {
1752                         if (1 == reporting_opts) {
1753                                 if (FF_SA & oip->flags) {
1754                                         mk_sense_invalid_fld(scp, SDEB_IN_CDB,
1755                                                              2, 2);
1756                                         kfree(arr);
1757                                         return check_condition_result;
1758                                 }
1759                                 req_sa = 0;
1760                         } else if (2 == reporting_opts &&
1761                                    0 == (FF_SA & oip->flags)) {
1762                                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 4, -1);
1763                                 kfree(arr);     /* point at requested sa */
1764                                 return check_condition_result;
1765                         }
1766                         if (0 == (FF_SA & oip->flags) &&
1767                             req_opcode == oip->opcode)
1768                                 supp = 3;
1769                         else if (0 == (FF_SA & oip->flags)) {
1770                                 na = oip->num_attached;
1771                                 for (k = 0, oip = oip->arrp; k < na;
1772                                      ++k, ++oip) {
1773                                         if (req_opcode == oip->opcode)
1774                                                 break;
1775                                 }
1776                                 supp = (k >= na) ? 1 : 3;
1777                         } else if (req_sa != oip->sa) {
1778                                 na = oip->num_attached;
1779                                 for (k = 0, oip = oip->arrp; k < na;
1780                                      ++k, ++oip) {
1781                                         if (req_sa == oip->sa)
1782                                                 break;
1783                                 }
1784                                 supp = (k >= na) ? 1 : 3;
1785                         } else
1786                                 supp = 3;
1787                         if (3 == supp) {
1788                                 u = oip->len_mask[0];
1789                                 put_unaligned_be16(u, arr + 2);
1790                                 arr[4] = oip->opcode;
1791                                 for (k = 1; k < u; ++k)
1792                                         arr[4 + k] = (k < 16) ?
1793                                                  oip->len_mask[k] : 0xff;
1794                                 offset = 4 + u;
1795                         } else
1796                                 offset = 4;
1797                 }
1798                 arr[1] = (rctd ? 0x80 : 0) | supp;
1799                 if (rctd) {
1800                         put_unaligned_be16(0xa, arr + offset);
1801                         offset += 12;
1802                 }
1803                 break;
1804         default:
1805                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 2, 2);
1806                 kfree(arr);
1807                 return check_condition_result;
1808         }
1809         offset = (offset < a_len) ? offset : a_len;
1810         len = (offset < alloc_len) ? offset : alloc_len;
1811         errsts = fill_from_dev_buffer(scp, arr, len);
1812         kfree(arr);
1813         return errsts;
1814 }
1815
1816 static int
1817 resp_rsup_tmfs(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
1818 {
1819         bool repd;
1820         u32 alloc_len, len;
1821         u8 arr[16];
1822         u8 *cmd = scp->cmnd;
1823
1824         memset(arr, 0, sizeof(arr));
1825         repd = !!(cmd[2] & 0x80);
1826         alloc_len = get_unaligned_be32(cmd + 6);
1827         if (alloc_len < 4) {
1828                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 6, -1);
1829                 return check_condition_result;
1830         }
1831         arr[0] = 0xc8;          /* ATS | ATSS | LURS */
1832         arr[1] = 0x1;           /* ITNRS */
1833         if (repd) {
1834                 arr[3] = 0xc;
1835                 len = 16;
1836         } else
1837                 len = 4;
1838
1839         len = (len < alloc_len) ? len : alloc_len;
1840         return fill_from_dev_buffer(scp, arr, len);
1841 }
1842
1843 /* <<Following mode page info copied from ST318451LW>> */
1844
1845 static int resp_err_recov_pg(unsigned char * p, int pcontrol, int target)
1846 {       /* Read-Write Error Recovery page for mode_sense */
1847         unsigned char err_recov_pg[] = {0x1, 0xa, 0xc0, 11, 240, 0, 0, 0,
1848                                         5, 0, 0xff, 0xff};
1849
1850         memcpy(p, err_recov_pg, sizeof(err_recov_pg));
1851         if (1 == pcontrol)
1852                 memset(p + 2, 0, sizeof(err_recov_pg) - 2);
1853         return sizeof(err_recov_pg);
1854 }
1855
1856 static int resp_disconnect_pg(unsigned char * p, int pcontrol, int target)
1857 {       /* Disconnect-Reconnect page for mode_sense */
1858         unsigned char disconnect_pg[] = {0x2, 0xe, 128, 128, 0, 10, 0, 0,
1859                                          0, 0, 0, 0, 0, 0, 0, 0};
1860
1861         memcpy(p, disconnect_pg, sizeof(disconnect_pg));
1862         if (1 == pcontrol)
1863                 memset(p + 2, 0, sizeof(disconnect_pg) - 2);
1864         return sizeof(disconnect_pg);
1865 }
1866
1867 static int resp_format_pg(unsigned char * p, int pcontrol, int target)
1868 {       /* Format device page for mode_sense */
1869         unsigned char format_pg[] = {0x3, 0x16, 0, 0, 0, 0, 0, 0,
1870                                      0, 0, 0, 0, 0, 0, 0, 0,
1871                                      0, 0, 0, 0, 0x40, 0, 0, 0};
1872
1873         memcpy(p, format_pg, sizeof(format_pg));
1874         p[10] = (sdebug_sectors_per >> 8) & 0xff;
1875         p[11] = sdebug_sectors_per & 0xff;
1876         p[12] = (scsi_debug_sector_size >> 8) & 0xff;
1877         p[13] = scsi_debug_sector_size & 0xff;
1878         if (scsi_debug_removable)
1879                 p[20] |= 0x20; /* should agree with INQUIRY */
1880         if (1 == pcontrol)
1881                 memset(p + 2, 0, sizeof(format_pg) - 2);
1882         return sizeof(format_pg);
1883 }
1884
1885 static int resp_caching_pg(unsigned char * p, int pcontrol, int target)
1886 {       /* Caching page for mode_sense */
1887         unsigned char ch_caching_pg[] = {/* 0x8, 18, */ 0x4, 0, 0, 0, 0, 0,
1888                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
1889         unsigned char d_caching_pg[] = {0x8, 18, 0x14, 0, 0xff, 0xff, 0, 0,
1890                 0xff, 0xff, 0xff, 0xff, 0x80, 0x14, 0, 0,     0, 0, 0, 0};
1891
1892         if (SCSI_DEBUG_OPT_N_WCE & scsi_debug_opts)
1893                 caching_pg[2] &= ~0x4;  /* set WCE=0 (default WCE=1) */
1894         memcpy(p, caching_pg, sizeof(caching_pg));
1895         if (1 == pcontrol)
1896                 memcpy(p + 2, ch_caching_pg, sizeof(ch_caching_pg));
1897         else if (2 == pcontrol)
1898                 memcpy(p, d_caching_pg, sizeof(d_caching_pg));
1899         return sizeof(caching_pg);
1900 }
1901
1902 static int resp_ctrl_m_pg(unsigned char * p, int pcontrol, int target)
1903 {       /* Control mode page for mode_sense */
1904         unsigned char ch_ctrl_m_pg[] = {/* 0xa, 10, */ 0x6, 0, 0, 0, 0, 0,
1905                                         0, 0, 0, 0};
1906         unsigned char d_ctrl_m_pg[] = {0xa, 10, 2, 0, 0, 0, 0, 0,
1907                                      0, 0, 0x2, 0x4b};
1908
1909         if (scsi_debug_dsense)
1910                 ctrl_m_pg[2] |= 0x4;
1911         else
1912                 ctrl_m_pg[2] &= ~0x4;
1913
1914         if (scsi_debug_ato)
1915                 ctrl_m_pg[5] |= 0x80; /* ATO=1 */
1916
1917         memcpy(p, ctrl_m_pg, sizeof(ctrl_m_pg));
1918         if (1 == pcontrol)
1919                 memcpy(p + 2, ch_ctrl_m_pg, sizeof(ch_ctrl_m_pg));
1920         else if (2 == pcontrol)
1921                 memcpy(p, d_ctrl_m_pg, sizeof(d_ctrl_m_pg));
1922         return sizeof(ctrl_m_pg);
1923 }
1924
1925
1926 static int resp_iec_m_pg(unsigned char * p, int pcontrol, int target)
1927 {       /* Informational Exceptions control mode page for mode_sense */
1928         unsigned char ch_iec_m_pg[] = {/* 0x1c, 0xa, */ 0x4, 0xf, 0, 0, 0, 0,
1929                                        0, 0, 0x0, 0x0};
1930         unsigned char d_iec_m_pg[] = {0x1c, 0xa, 0x08, 0, 0, 0, 0, 0,
1931                                       0, 0, 0x0, 0x0};
1932
1933         memcpy(p, iec_m_pg, sizeof(iec_m_pg));
1934         if (1 == pcontrol)
1935                 memcpy(p + 2, ch_iec_m_pg, sizeof(ch_iec_m_pg));
1936         else if (2 == pcontrol)
1937                 memcpy(p, d_iec_m_pg, sizeof(d_iec_m_pg));
1938         return sizeof(iec_m_pg);
1939 }
1940
1941 static int resp_sas_sf_m_pg(unsigned char * p, int pcontrol, int target)
1942 {       /* SAS SSP mode page - short format for mode_sense */
1943         unsigned char sas_sf_m_pg[] = {0x19, 0x6,
1944                 0x6, 0x0, 0x7, 0xd0, 0x0, 0x0};
1945
1946         memcpy(p, sas_sf_m_pg, sizeof(sas_sf_m_pg));
1947         if (1 == pcontrol)
1948                 memset(p + 2, 0, sizeof(sas_sf_m_pg) - 2);
1949         return sizeof(sas_sf_m_pg);
1950 }
1951
1952
1953 static int resp_sas_pcd_m_spg(unsigned char * p, int pcontrol, int target,
1954                               int target_dev_id)
1955 {       /* SAS phy control and discover mode page for mode_sense */
1956         unsigned char sas_pcd_m_pg[] = {0x59, 0x1, 0, 0x64, 0, 0x6, 0, 2,
1957                     0, 0, 0, 0, 0x10, 0x9, 0x8, 0x0,
1958                     0x52, 0x22, 0x22, 0x20, 0x0, 0x0, 0x0, 0x0,
1959                     0x51, 0x11, 0x11, 0x10, 0x0, 0x0, 0x0, 0x1,
1960                     0x2, 0, 0, 0, 0, 0, 0, 0,
1961                     0x88, 0x99, 0, 0, 0, 0, 0, 0,
1962                     0, 0, 0, 0, 0, 0, 0, 0,
1963                     0, 1, 0, 0, 0x10, 0x9, 0x8, 0x0,
1964                     0x52, 0x22, 0x22, 0x20, 0x0, 0x0, 0x0, 0x0,
1965                     0x51, 0x11, 0x11, 0x10, 0x0, 0x0, 0x0, 0x1,
1966                     0x3, 0, 0, 0, 0, 0, 0, 0,
1967                     0x88, 0x99, 0, 0, 0, 0, 0, 0,
1968                     0, 0, 0, 0, 0, 0, 0, 0,
1969                 };
1970         int port_a, port_b;
1971
1972         port_a = target_dev_id + 1;
1973         port_b = port_a + 1;
1974         memcpy(p, sas_pcd_m_pg, sizeof(sas_pcd_m_pg));
1975         p[20] = (port_a >> 24);
1976         p[21] = (port_a >> 16) & 0xff;
1977         p[22] = (port_a >> 8) & 0xff;
1978         p[23] = port_a & 0xff;
1979         p[48 + 20] = (port_b >> 24);
1980         p[48 + 21] = (port_b >> 16) & 0xff;
1981         p[48 + 22] = (port_b >> 8) & 0xff;
1982         p[48 + 23] = port_b & 0xff;
1983         if (1 == pcontrol)
1984                 memset(p + 4, 0, sizeof(sas_pcd_m_pg) - 4);
1985         return sizeof(sas_pcd_m_pg);
1986 }
1987
1988 static int resp_sas_sha_m_spg(unsigned char * p, int pcontrol)
1989 {       /* SAS SSP shared protocol specific port mode subpage */
1990         unsigned char sas_sha_m_pg[] = {0x59, 0x2, 0, 0xc, 0, 0x6, 0x10, 0,
1991                     0, 0, 0, 0, 0, 0, 0, 0,
1992                 };
1993
1994         memcpy(p, sas_sha_m_pg, sizeof(sas_sha_m_pg));
1995         if (1 == pcontrol)
1996                 memset(p + 4, 0, sizeof(sas_sha_m_pg) - 4);
1997         return sizeof(sas_sha_m_pg);
1998 }
1999
2000 #define SDEBUG_MAX_MSENSE_SZ 256
2001
2002 static int
2003 resp_mode_sense(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
2004 {
2005         unsigned char dbd, llbaa;
2006         int pcontrol, pcode, subpcode, bd_len;
2007         unsigned char dev_spec;
2008         int k, alloc_len, msense_6, offset, len, target_dev_id;
2009         int target = scp->device->id;
2010         unsigned char * ap;
2011         unsigned char arr[SDEBUG_MAX_MSENSE_SZ];
2012         unsigned char *cmd = scp->cmnd;
2013
2014         dbd = !!(cmd[1] & 0x8);
2015         pcontrol = (cmd[2] & 0xc0) >> 6;
2016         pcode = cmd[2] & 0x3f;
2017         subpcode = cmd[3];
2018         msense_6 = (MODE_SENSE == cmd[0]);
2019         llbaa = msense_6 ? 0 : !!(cmd[1] & 0x10);
2020         if ((0 == scsi_debug_ptype) && (0 == dbd))
2021                 bd_len = llbaa ? 16 : 8;
2022         else
2023                 bd_len = 0;
2024         alloc_len = msense_6 ? cmd[4] : ((cmd[7] << 8) | cmd[8]);
2025         memset(arr, 0, SDEBUG_MAX_MSENSE_SZ);
2026         if (0x3 == pcontrol) {  /* Saving values not supported */
2027                 mk_sense_buffer(scp, ILLEGAL_REQUEST, SAVING_PARAMS_UNSUP, 0);
2028                 return check_condition_result;
2029         }
2030         target_dev_id = ((devip->sdbg_host->shost->host_no + 1) * 2000) +
2031                         (devip->target * 1000) - 3;
2032         /* set DPOFUA bit for disks */
2033         if (0 == scsi_debug_ptype)
2034                 dev_spec = (DEV_READONLY(target) ? 0x80 : 0x0) | 0x10;
2035         else
2036                 dev_spec = 0x0;
2037         if (msense_6) {
2038                 arr[2] = dev_spec;
2039                 arr[3] = bd_len;
2040                 offset = 4;
2041         } else {
2042                 arr[3] = dev_spec;
2043                 if (16 == bd_len)
2044                         arr[4] = 0x1;   /* set LONGLBA bit */
2045                 arr[7] = bd_len;        /* assume 255 or less */
2046                 offset = 8;
2047         }
2048         ap = arr + offset;
2049         if ((bd_len > 0) && (!sdebug_capacity))
2050                 sdebug_capacity = get_sdebug_capacity();
2051
2052         if (8 == bd_len) {
2053                 if (sdebug_capacity > 0xfffffffe) {
2054                         ap[0] = 0xff;
2055                         ap[1] = 0xff;
2056                         ap[2] = 0xff;
2057                         ap[3] = 0xff;
2058                 } else {
2059                         ap[0] = (sdebug_capacity >> 24) & 0xff;
2060                         ap[1] = (sdebug_capacity >> 16) & 0xff;
2061                         ap[2] = (sdebug_capacity >> 8) & 0xff;
2062                         ap[3] = sdebug_capacity & 0xff;
2063                 }
2064                 ap[6] = (scsi_debug_sector_size >> 8) & 0xff;
2065                 ap[7] = scsi_debug_sector_size & 0xff;
2066                 offset += bd_len;
2067                 ap = arr + offset;
2068         } else if (16 == bd_len) {
2069                 unsigned long long capac = sdebug_capacity;
2070
2071                 for (k = 0; k < 8; ++k, capac >>= 8)
2072                         ap[7 - k] = capac & 0xff;
2073                 ap[12] = (scsi_debug_sector_size >> 24) & 0xff;
2074                 ap[13] = (scsi_debug_sector_size >> 16) & 0xff;
2075                 ap[14] = (scsi_debug_sector_size >> 8) & 0xff;
2076                 ap[15] = scsi_debug_sector_size & 0xff;
2077                 offset += bd_len;
2078                 ap = arr + offset;
2079         }
2080
2081         if ((subpcode > 0x0) && (subpcode < 0xff) && (0x19 != pcode)) {
2082                 /* TODO: Control Extension page */
2083                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 3, -1);
2084                 return check_condition_result;
2085         }
2086         switch (pcode) {
2087         case 0x1:       /* Read-Write error recovery page, direct access */
2088                 len = resp_err_recov_pg(ap, pcontrol, target);
2089                 offset += len;
2090                 break;
2091         case 0x2:       /* Disconnect-Reconnect page, all devices */
2092                 len = resp_disconnect_pg(ap, pcontrol, target);
2093                 offset += len;
2094                 break;
2095         case 0x3:       /* Format device page, direct access */
2096                 len = resp_format_pg(ap, pcontrol, target);
2097                 offset += len;
2098                 break;
2099         case 0x8:       /* Caching page, direct access */
2100                 len = resp_caching_pg(ap, pcontrol, target);
2101                 offset += len;
2102                 break;
2103         case 0xa:       /* Control Mode page, all devices */
2104                 len = resp_ctrl_m_pg(ap, pcontrol, target);
2105                 offset += len;
2106                 break;
2107         case 0x19:      /* if spc==1 then sas phy, control+discover */
2108                 if ((subpcode > 0x2) && (subpcode < 0xff)) {
2109                         mk_sense_invalid_fld(scp, SDEB_IN_CDB, 3, -1);
2110                         return check_condition_result;
2111                 }
2112                 len = 0;
2113                 if ((0x0 == subpcode) || (0xff == subpcode))
2114                         len += resp_sas_sf_m_pg(ap + len, pcontrol, target);
2115                 if ((0x1 == subpcode) || (0xff == subpcode))
2116                         len += resp_sas_pcd_m_spg(ap + len, pcontrol, target,
2117                                                   target_dev_id);
2118                 if ((0x2 == subpcode) || (0xff == subpcode))
2119                         len += resp_sas_sha_m_spg(ap + len, pcontrol);
2120                 offset += len;
2121                 break;
2122         case 0x1c:      /* Informational Exceptions Mode page, all devices */
2123                 len = resp_iec_m_pg(ap, pcontrol, target);
2124                 offset += len;
2125                 break;
2126         case 0x3f:      /* Read all Mode pages */
2127                 if ((0 == subpcode) || (0xff == subpcode)) {
2128                         len = resp_err_recov_pg(ap, pcontrol, target);
2129                         len += resp_disconnect_pg(ap + len, pcontrol, target);
2130                         len += resp_format_pg(ap + len, pcontrol, target);
2131                         len += resp_caching_pg(ap + len, pcontrol, target);
2132                         len += resp_ctrl_m_pg(ap + len, pcontrol, target);
2133                         len += resp_sas_sf_m_pg(ap + len, pcontrol, target);
2134                         if (0xff == subpcode) {
2135                                 len += resp_sas_pcd_m_spg(ap + len, pcontrol,
2136                                                   target, target_dev_id);
2137                                 len += resp_sas_sha_m_spg(ap + len, pcontrol);
2138                         }
2139                         len += resp_iec_m_pg(ap + len, pcontrol, target);
2140                 } else {
2141                         mk_sense_invalid_fld(scp, SDEB_IN_CDB, 3, -1);
2142                         return check_condition_result;
2143                 }
2144                 offset += len;
2145                 break;
2146         default:
2147                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 2, 5);
2148                 return check_condition_result;
2149         }
2150         if (msense_6)
2151                 arr[0] = offset - 1;
2152         else {
2153                 arr[0] = ((offset - 2) >> 8) & 0xff;
2154                 arr[1] = (offset - 2) & 0xff;
2155         }
2156         return fill_from_dev_buffer(scp, arr, min(alloc_len, offset));
2157 }
2158
2159 #define SDEBUG_MAX_MSELECT_SZ 512
2160
2161 static int
2162 resp_mode_select(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
2163 {
2164         int pf, sp, ps, md_len, bd_len, off, spf, pg_len;
2165         int param_len, res, mpage;
2166         unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
2167         unsigned char *cmd = scp->cmnd;
2168         int mselect6 = (MODE_SELECT == cmd[0]);
2169
2170         memset(arr, 0, sizeof(arr));
2171         pf = cmd[1] & 0x10;
2172         sp = cmd[1] & 0x1;
2173         param_len = mselect6 ? cmd[4] : ((cmd[7] << 8) + cmd[8]);
2174         if ((0 == pf) || sp || (param_len > SDEBUG_MAX_MSELECT_SZ)) {
2175                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, mselect6 ? 4 : 7, -1);
2176                 return check_condition_result;
2177         }
2178         res = fetch_to_dev_buffer(scp, arr, param_len);
2179         if (-1 == res)
2180                 return (DID_ERROR << 16);
2181         else if ((res < param_len) &&
2182                  (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
2183                 sdev_printk(KERN_INFO, scp->device,
2184                             "%s: cdb indicated=%d, IO sent=%d bytes\n",
2185                             __func__, param_len, res);
2186         md_len = mselect6 ? (arr[0] + 1) : ((arr[0] << 8) + arr[1] + 2);
2187         bd_len = mselect6 ? arr[3] : ((arr[6] << 8) + arr[7]);
2188         if (md_len > 2) {
2189                 mk_sense_invalid_fld(scp, SDEB_IN_DATA, 0, -1);
2190                 return check_condition_result;
2191         }
2192         off = bd_len + (mselect6 ? 4 : 8);
2193         mpage = arr[off] & 0x3f;
2194         ps = !!(arr[off] & 0x80);
2195         if (ps) {
2196                 mk_sense_invalid_fld(scp, SDEB_IN_DATA, off, 7);
2197                 return check_condition_result;
2198         }
2199         spf = !!(arr[off] & 0x40);
2200         pg_len = spf ? ((arr[off + 2] << 8) + arr[off + 3] + 4) :
2201                        (arr[off + 1] + 2);
2202         if ((pg_len + off) > param_len) {
2203                 mk_sense_buffer(scp, ILLEGAL_REQUEST,
2204                                 PARAMETER_LIST_LENGTH_ERR, 0);
2205                 return check_condition_result;
2206         }
2207         switch (mpage) {
2208         case 0x8:      /* Caching Mode page */
2209                 if (caching_pg[1] == arr[off + 1]) {
2210                         memcpy(caching_pg + 2, arr + off + 2,
2211                                sizeof(caching_pg) - 2);
2212                         goto set_mode_changed_ua;
2213                 }
2214                 break;
2215         case 0xa:      /* Control Mode page */
2216                 if (ctrl_m_pg[1] == arr[off + 1]) {
2217                         memcpy(ctrl_m_pg + 2, arr + off + 2,
2218                                sizeof(ctrl_m_pg) - 2);
2219                         scsi_debug_dsense = !!(ctrl_m_pg[2] & 0x4);
2220                         goto set_mode_changed_ua;
2221                 }
2222                 break;
2223         case 0x1c:      /* Informational Exceptions Mode page */
2224                 if (iec_m_pg[1] == arr[off + 1]) {
2225                         memcpy(iec_m_pg + 2, arr + off + 2,
2226                                sizeof(iec_m_pg) - 2);
2227                         goto set_mode_changed_ua;
2228                 }
2229                 break;
2230         default:
2231                 break;
2232         }
2233         mk_sense_invalid_fld(scp, SDEB_IN_DATA, off, 5);
2234         return check_condition_result;
2235 set_mode_changed_ua:
2236         set_bit(SDEBUG_UA_MODE_CHANGED, devip->uas_bm);
2237         return 0;
2238 }
2239
2240 static int resp_temp_l_pg(unsigned char * arr)
2241 {
2242         unsigned char temp_l_pg[] = {0x0, 0x0, 0x3, 0x2, 0x0, 38,
2243                                      0x0, 0x1, 0x3, 0x2, 0x0, 65,
2244                 };
2245
2246         memcpy(arr, temp_l_pg, sizeof(temp_l_pg));
2247         return sizeof(temp_l_pg);
2248 }
2249
2250 static int resp_ie_l_pg(unsigned char * arr)
2251 {
2252         unsigned char ie_l_pg[] = {0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 38,
2253                 };
2254
2255         memcpy(arr, ie_l_pg, sizeof(ie_l_pg));
2256         if (iec_m_pg[2] & 0x4) {        /* TEST bit set */
2257                 arr[4] = THRESHOLD_EXCEEDED;
2258                 arr[5] = 0xff;
2259         }
2260         return sizeof(ie_l_pg);
2261 }
2262
2263 #define SDEBUG_MAX_LSENSE_SZ 512
2264
2265 static int resp_log_sense(struct scsi_cmnd * scp,
2266                           struct sdebug_dev_info * devip)
2267 {
2268         int ppc, sp, pcontrol, pcode, subpcode, alloc_len, len, n;
2269         unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
2270         unsigned char *cmd = scp->cmnd;
2271
2272         memset(arr, 0, sizeof(arr));
2273         ppc = cmd[1] & 0x2;
2274         sp = cmd[1] & 0x1;
2275         if (ppc || sp) {
2276                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 1, ppc ? 1 : 0);
2277                 return check_condition_result;
2278         }
2279         pcontrol = (cmd[2] & 0xc0) >> 6;
2280         pcode = cmd[2] & 0x3f;
2281         subpcode = cmd[3] & 0xff;
2282         alloc_len = (cmd[7] << 8) + cmd[8];
2283         arr[0] = pcode;
2284         if (0 == subpcode) {
2285                 switch (pcode) {
2286                 case 0x0:       /* Supported log pages log page */
2287                         n = 4;
2288                         arr[n++] = 0x0;         /* this page */
2289                         arr[n++] = 0xd;         /* Temperature */
2290                         arr[n++] = 0x2f;        /* Informational exceptions */
2291                         arr[3] = n - 4;
2292                         break;
2293                 case 0xd:       /* Temperature log page */
2294                         arr[3] = resp_temp_l_pg(arr + 4);
2295                         break;
2296                 case 0x2f:      /* Informational exceptions log page */
2297                         arr[3] = resp_ie_l_pg(arr + 4);
2298                         break;
2299                 default:
2300                         mk_sense_invalid_fld(scp, SDEB_IN_CDB, 2, 5);
2301                         return check_condition_result;
2302                 }
2303         } else if (0xff == subpcode) {
2304                 arr[0] |= 0x40;
2305                 arr[1] = subpcode;
2306                 switch (pcode) {
2307                 case 0x0:       /* Supported log pages and subpages log page */
2308                         n = 4;
2309                         arr[n++] = 0x0;
2310                         arr[n++] = 0x0;         /* 0,0 page */
2311                         arr[n++] = 0x0;
2312                         arr[n++] = 0xff;        /* this page */
2313                         arr[n++] = 0xd;
2314                         arr[n++] = 0x0;         /* Temperature */
2315                         arr[n++] = 0x2f;
2316                         arr[n++] = 0x0; /* Informational exceptions */
2317                         arr[3] = n - 4;
2318                         break;
2319                 case 0xd:       /* Temperature subpages */
2320                         n = 4;
2321                         arr[n++] = 0xd;
2322                         arr[n++] = 0x0;         /* Temperature */
2323                         arr[3] = n - 4;
2324                         break;
2325                 case 0x2f:      /* Informational exceptions subpages */
2326                         n = 4;
2327                         arr[n++] = 0x2f;
2328                         arr[n++] = 0x0;         /* Informational exceptions */
2329                         arr[3] = n - 4;
2330                         break;
2331                 default:
2332                         mk_sense_invalid_fld(scp, SDEB_IN_CDB, 2, 5);
2333                         return check_condition_result;
2334                 }
2335         } else {
2336                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 3, -1);
2337                 return check_condition_result;
2338         }
2339         len = min(((arr[2] << 8) + arr[3]) + 4, alloc_len);
2340         return fill_from_dev_buffer(scp, arr,
2341                     min(len, SDEBUG_MAX_INQ_ARR_SZ));
2342 }
2343
2344 static int check_device_access_params(struct scsi_cmnd *scp,
2345                                       unsigned long long lba, unsigned int num)
2346 {
2347         if (lba + num > sdebug_capacity) {
2348                 mk_sense_buffer(scp, ILLEGAL_REQUEST, LBA_OUT_OF_RANGE, 0);
2349                 return check_condition_result;
2350         }
2351         /* transfer length excessive (tie in to block limits VPD page) */
2352         if (num > sdebug_store_sectors) {
2353                 /* needs work to find which cdb byte 'num' comes from */
2354                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB, 0);
2355                 return check_condition_result;
2356         }
2357         return 0;
2358 }
2359
2360 /* Returns number of bytes copied or -1 if error. */
2361 static int
2362 do_device_access(struct scsi_cmnd *scmd, u64 lba, u32 num, bool do_write)
2363 {
2364         int ret;
2365         u64 block, rest = 0;
2366         struct scsi_data_buffer *sdb;
2367         enum dma_data_direction dir;
2368
2369         if (do_write) {
2370                 sdb = scsi_out(scmd);
2371                 dir = DMA_TO_DEVICE;
2372         } else {
2373                 sdb = scsi_in(scmd);
2374                 dir = DMA_FROM_DEVICE;
2375         }
2376
2377         if (!sdb->length)
2378                 return 0;
2379         if (!(scsi_bidi_cmnd(scmd) || scmd->sc_data_direction == dir))
2380                 return -1;
2381
2382         block = do_div(lba, sdebug_store_sectors);
2383         if (block + num > sdebug_store_sectors)
2384                 rest = block + num - sdebug_store_sectors;
2385
2386         ret = sg_copy_buffer(sdb->table.sgl, sdb->table.nents,
2387                    fake_storep + (block * scsi_debug_sector_size),
2388                    (num - rest) * scsi_debug_sector_size, 0, do_write);
2389         if (ret != (num - rest) * scsi_debug_sector_size)
2390                 return ret;
2391
2392         if (rest) {
2393                 ret += sg_copy_buffer(sdb->table.sgl, sdb->table.nents,
2394                             fake_storep, rest * scsi_debug_sector_size,
2395                             (num - rest) * scsi_debug_sector_size, do_write);
2396         }
2397
2398         return ret;
2399 }
2400
2401 /* If fake_store(lba,num) compares equal to arr(num), then copy top half of
2402  * arr into fake_store(lba,num) and return true. If comparison fails then
2403  * return false. */
2404 static bool
2405 comp_write_worker(u64 lba, u32 num, const u8 *arr)
2406 {
2407         bool res;
2408         u64 block, rest = 0;
2409         u32 store_blks = sdebug_store_sectors;
2410         u32 lb_size = scsi_debug_sector_size;
2411
2412         block = do_div(lba, store_blks);
2413         if (block + num > store_blks)
2414                 rest = block + num - store_blks;
2415
2416         res = !memcmp(fake_storep + (block * lb_size), arr,
2417                       (num - rest) * lb_size);
2418         if (!res)
2419                 return res;
2420         if (rest)
2421                 res = memcmp(fake_storep, arr + ((num - rest) * lb_size),
2422                              rest * lb_size);
2423         if (!res)
2424                 return res;
2425         arr += num * lb_size;
2426         memcpy(fake_storep + (block * lb_size), arr, (num - rest) * lb_size);
2427         if (rest)
2428                 memcpy(fake_storep, arr + ((num - rest) * lb_size),
2429                        rest * lb_size);
2430         return res;
2431 }
2432
2433 static __be16 dif_compute_csum(const void *buf, int len)
2434 {
2435         __be16 csum;
2436
2437         if (scsi_debug_guard)
2438                 csum = (__force __be16)ip_compute_csum(buf, len);
2439         else
2440                 csum = cpu_to_be16(crc_t10dif(buf, len));
2441
2442         return csum;
2443 }
2444
2445 static int dif_verify(struct sd_dif_tuple *sdt, const void *data,
2446                       sector_t sector, u32 ei_lba)
2447 {
2448         __be16 csum = dif_compute_csum(data, scsi_debug_sector_size);
2449
2450         if (sdt->guard_tag != csum) {
2451                 pr_err("GUARD check failed on sector %lu rcvd 0x%04x, data 0x%04x\n",
2452                         (unsigned long)sector,
2453                         be16_to_cpu(sdt->guard_tag),
2454                         be16_to_cpu(csum));
2455                 return 0x01;
2456         }
2457         if (scsi_debug_dif == SD_DIF_TYPE1_PROTECTION &&
2458             be32_to_cpu(sdt->ref_tag) != (sector & 0xffffffff)) {
2459                 pr_err("REF check failed on sector %lu\n",
2460                         (unsigned long)sector);
2461                 return 0x03;
2462         }
2463         if (scsi_debug_dif == SD_DIF_TYPE2_PROTECTION &&
2464             be32_to_cpu(sdt->ref_tag) != ei_lba) {
2465                 pr_err("REF check failed on sector %lu\n",
2466                         (unsigned long)sector);
2467                 return 0x03;
2468         }
2469         return 0;
2470 }
2471
2472 static void dif_copy_prot(struct scsi_cmnd *SCpnt, sector_t sector,
2473                           unsigned int sectors, bool read)
2474 {
2475         size_t resid;
2476         void *paddr;
2477         const void *dif_store_end = dif_storep + sdebug_store_sectors;
2478         struct sg_mapping_iter miter;
2479
2480         /* Bytes of protection data to copy into sgl */
2481         resid = sectors * sizeof(*dif_storep);
2482
2483         sg_miter_start(&miter, scsi_prot_sglist(SCpnt),
2484                         scsi_prot_sg_count(SCpnt), SG_MITER_ATOMIC |
2485                         (read ? SG_MITER_TO_SG : SG_MITER_FROM_SG));
2486
2487         while (sg_miter_next(&miter) && resid > 0) {
2488                 size_t len = min(miter.length, resid);
2489                 void *start = dif_store(sector);
2490                 size_t rest = 0;
2491
2492                 if (dif_store_end < start + len)
2493                         rest = start + len - dif_store_end;
2494
2495                 paddr = miter.addr;
2496
2497                 if (read)
2498                         memcpy(paddr, start, len - rest);
2499                 else
2500                         memcpy(start, paddr, len - rest);
2501
2502                 if (rest) {
2503                         if (read)
2504                                 memcpy(paddr + len - rest, dif_storep, rest);
2505                         else
2506                                 memcpy(dif_storep, paddr + len - rest, rest);
2507                 }
2508
2509                 sector += len / sizeof(*dif_storep);
2510                 resid -= len;
2511         }
2512         sg_miter_stop(&miter);
2513 }
2514
2515 static int prot_verify_read(struct scsi_cmnd *SCpnt, sector_t start_sec,
2516                             unsigned int sectors, u32 ei_lba)
2517 {
2518         unsigned int i;
2519         struct sd_dif_tuple *sdt;
2520         sector_t sector;
2521
2522         for (i = 0; i < sectors; i++, ei_lba++) {
2523                 int ret;
2524
2525                 sector = start_sec + i;
2526                 sdt = dif_store(sector);
2527
2528                 if (sdt->app_tag == cpu_to_be16(0xffff))
2529                         continue;
2530
2531                 ret = dif_verify(sdt, fake_store(sector), sector, ei_lba);
2532                 if (ret) {
2533                         dif_errors++;
2534                         return ret;
2535                 }
2536         }
2537
2538         dif_copy_prot(SCpnt, start_sec, sectors, true);
2539         dix_reads++;
2540
2541         return 0;
2542 }
2543
2544 static int
2545 resp_read_dt0(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
2546 {
2547         u8 *cmd = scp->cmnd;
2548         u64 lba;
2549         u32 num;
2550         u32 ei_lba;
2551         unsigned long iflags;
2552         int ret;
2553         bool check_prot;
2554
2555         switch (cmd[0]) {
2556         case READ_16:
2557                 ei_lba = 0;
2558                 lba = get_unaligned_be64(cmd + 2);
2559                 num = get_unaligned_be32(cmd + 10);
2560                 check_prot = true;
2561                 break;
2562         case READ_10:
2563                 ei_lba = 0;
2564                 lba = get_unaligned_be32(cmd + 2);
2565                 num = get_unaligned_be16(cmd + 7);
2566                 check_prot = true;
2567                 break;
2568         case READ_6:
2569                 ei_lba = 0;
2570                 lba = (u32)cmd[3] | (u32)cmd[2] << 8 |
2571                       (u32)(cmd[1] & 0x1f) << 16;
2572                 num = (0 == cmd[4]) ? 256 : cmd[4];
2573                 check_prot = true;
2574                 break;
2575         case READ_12:
2576                 ei_lba = 0;
2577                 lba = get_unaligned_be32(cmd + 2);
2578                 num = get_unaligned_be32(cmd + 6);
2579                 check_prot = true;
2580                 break;
2581         case XDWRITEREAD_10:
2582                 ei_lba = 0;
2583                 lba = get_unaligned_be32(cmd + 2);
2584                 num = get_unaligned_be16(cmd + 7);
2585                 check_prot = false;
2586                 break;
2587         default:        /* assume READ(32) */
2588                 lba = get_unaligned_be64(cmd + 12);
2589                 ei_lba = get_unaligned_be32(cmd + 20);
2590                 num = get_unaligned_be32(cmd + 28);
2591                 check_prot = false;
2592                 break;
2593         }
2594         if (check_prot) {
2595                 if (scsi_debug_dif == SD_DIF_TYPE2_PROTECTION &&
2596                     (cmd[1] & 0xe0)) {
2597                         mk_sense_invalid_opcode(scp);
2598                         return check_condition_result;
2599                 }
2600                 if ((scsi_debug_dif == SD_DIF_TYPE1_PROTECTION ||
2601                      scsi_debug_dif == SD_DIF_TYPE3_PROTECTION) &&
2602                     (cmd[1] & 0xe0) == 0)
2603                         sdev_printk(KERN_ERR, scp->device, "Unprotected RD "
2604                                     "to DIF device\n");
2605         }
2606         if (sdebug_any_injecting_opt) {
2607                 struct sdebug_scmd_extra_t *ep = scsi_cmd_priv(scp);
2608
2609                 if (ep->inj_short)
2610                         num /= 2;
2611         }
2612
2613         /* inline check_device_access_params() */
2614         if (lba + num > sdebug_capacity) {
2615                 mk_sense_buffer(scp, ILLEGAL_REQUEST, LBA_OUT_OF_RANGE, 0);
2616                 return check_condition_result;
2617         }
2618         /* transfer length excessive (tie in to block limits VPD page) */
2619         if (num > sdebug_store_sectors) {
2620                 /* needs work to find which cdb byte 'num' comes from */
2621                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB, 0);
2622                 return check_condition_result;
2623         }
2624
2625         if ((SCSI_DEBUG_OPT_MEDIUM_ERR & scsi_debug_opts) &&
2626             (lba <= (OPT_MEDIUM_ERR_ADDR + OPT_MEDIUM_ERR_NUM - 1)) &&
2627             ((lba + num) > OPT_MEDIUM_ERR_ADDR)) {
2628                 /* claim unrecoverable read error */
2629                 mk_sense_buffer(scp, MEDIUM_ERROR, UNRECOVERED_READ_ERR, 0);
2630                 /* set info field and valid bit for fixed descriptor */
2631                 if (0x70 == (scp->sense_buffer[0] & 0x7f)) {
2632                         scp->sense_buffer[0] |= 0x80;   /* Valid bit */
2633                         ret = (lba < OPT_MEDIUM_ERR_ADDR)
2634                               ? OPT_MEDIUM_ERR_ADDR : (int)lba;
2635                         put_unaligned_be32(ret, scp->sense_buffer + 3);
2636                 }
2637                 scsi_set_resid(scp, scsi_bufflen(scp));
2638                 return check_condition_result;
2639         }
2640
2641         read_lock_irqsave(&atomic_rw, iflags);
2642
2643         /* DIX + T10 DIF */
2644         if (scsi_debug_dix && scsi_prot_sg_count(scp)) {
2645                 int prot_ret = prot_verify_read(scp, lba, num, ei_lba);
2646
2647                 if (prot_ret) {
2648                         read_unlock_irqrestore(&atomic_rw, iflags);
2649                         mk_sense_buffer(scp, ABORTED_COMMAND, 0x10, prot_ret);
2650                         return illegal_condition_result;
2651                 }
2652         }
2653
2654         ret = do_device_access(scp, lba, num, false);
2655         read_unlock_irqrestore(&atomic_rw, iflags);
2656         if (ret == -1)
2657                 return DID_ERROR << 16;
2658
2659         scsi_in(scp)->resid = scsi_bufflen(scp) - ret;
2660
2661         if (sdebug_any_injecting_opt) {
2662                 struct sdebug_scmd_extra_t *ep = scsi_cmd_priv(scp);
2663
2664                 if (ep->inj_recovered) {
2665                         mk_sense_buffer(scp, RECOVERED_ERROR,
2666                                         THRESHOLD_EXCEEDED, 0);
2667                         return check_condition_result;
2668                 } else if (ep->inj_transport) {
2669                         mk_sense_buffer(scp, ABORTED_COMMAND,
2670                                         TRANSPORT_PROBLEM, ACK_NAK_TO);
2671                         return check_condition_result;
2672                 } else if (ep->inj_dif) {
2673                         /* Logical block guard check failed */
2674                         mk_sense_buffer(scp, ABORTED_COMMAND, 0x10, 1);
2675                         return illegal_condition_result;
2676                 } else if (ep->inj_dix) {
2677                         mk_sense_buffer(scp, ILLEGAL_REQUEST, 0x10, 1);
2678                         return illegal_condition_result;
2679                 }
2680         }
2681         return 0;
2682 }
2683
2684 void dump_sector(unsigned char *buf, int len)
2685 {
2686         int i, j, n;
2687
2688         pr_err(">>> Sector Dump <<<\n");
2689         for (i = 0 ; i < len ; i += 16) {
2690                 char b[128];
2691
2692                 for (j = 0, n = 0; j < 16; j++) {
2693                         unsigned char c = buf[i+j];
2694
2695                         if (c >= 0x20 && c < 0x7e)
2696                                 n += scnprintf(b + n, sizeof(b) - n,
2697                                                " %c ", buf[i+j]);
2698                         else
2699                                 n += scnprintf(b + n, sizeof(b) - n,
2700                                                "%02x ", buf[i+j]);
2701                 }
2702                 pr_err("%04d: %s\n", i, b);
2703         }
2704 }
2705
2706 static int prot_verify_write(struct scsi_cmnd *SCpnt, sector_t start_sec,
2707                              unsigned int sectors, u32 ei_lba)
2708 {
2709         int ret;
2710         struct sd_dif_tuple *sdt;
2711         void *daddr;
2712         sector_t sector = start_sec;
2713         int ppage_offset;
2714         int dpage_offset;
2715         struct sg_mapping_iter diter;
2716         struct sg_mapping_iter piter;
2717
2718         BUG_ON(scsi_sg_count(SCpnt) == 0);
2719         BUG_ON(scsi_prot_sg_count(SCpnt) == 0);
2720
2721         sg_miter_start(&piter, scsi_prot_sglist(SCpnt),
2722                         scsi_prot_sg_count(SCpnt),
2723                         SG_MITER_ATOMIC | SG_MITER_FROM_SG);
2724         sg_miter_start(&diter, scsi_sglist(SCpnt), scsi_sg_count(SCpnt),
2725                         SG_MITER_ATOMIC | SG_MITER_FROM_SG);
2726
2727         /* For each protection page */
2728         while (sg_miter_next(&piter)) {
2729                 dpage_offset = 0;
2730                 if (WARN_ON(!sg_miter_next(&diter))) {
2731                         ret = 0x01;
2732                         goto out;
2733                 }
2734
2735                 for (ppage_offset = 0; ppage_offset < piter.length;
2736                      ppage_offset += sizeof(struct sd_dif_tuple)) {
2737                         /* If we're at the end of the current
2738                          * data page advance to the next one
2739                          */
2740                         if (dpage_offset >= diter.length) {
2741                                 if (WARN_ON(!sg_miter_next(&diter))) {
2742                                         ret = 0x01;
2743                                         goto out;
2744                                 }
2745                                 dpage_offset = 0;
2746                         }
2747
2748                         sdt = piter.addr + ppage_offset;
2749                         daddr = diter.addr + dpage_offset;
2750
2751                         ret = dif_verify(sdt, daddr, sector, ei_lba);
2752                         if (ret) {
2753                                 dump_sector(daddr, scsi_debug_sector_size);
2754                                 goto out;
2755                         }
2756
2757                         sector++;
2758                         ei_lba++;
2759                         dpage_offset += scsi_debug_sector_size;
2760                 }
2761                 diter.consumed = dpage_offset;
2762                 sg_miter_stop(&diter);
2763         }
2764         sg_miter_stop(&piter);
2765
2766         dif_copy_prot(SCpnt, start_sec, sectors, false);
2767         dix_writes++;
2768
2769         return 0;
2770
2771 out:
2772         dif_errors++;
2773         sg_miter_stop(&diter);
2774         sg_miter_stop(&piter);
2775         return ret;
2776 }
2777
2778 static unsigned long lba_to_map_index(sector_t lba)
2779 {
2780         if (scsi_debug_unmap_alignment) {
2781                 lba += scsi_debug_unmap_granularity -
2782                         scsi_debug_unmap_alignment;
2783         }
2784         do_div(lba, scsi_debug_unmap_granularity);
2785
2786         return lba;
2787 }
2788
2789 static sector_t map_index_to_lba(unsigned long index)
2790 {
2791         sector_t lba = index * scsi_debug_unmap_granularity;
2792
2793         if (scsi_debug_unmap_alignment) {
2794                 lba -= scsi_debug_unmap_granularity -
2795                         scsi_debug_unmap_alignment;
2796         }
2797
2798         return lba;
2799 }
2800
2801 static unsigned int map_state(sector_t lba, unsigned int *num)
2802 {
2803         sector_t end;
2804         unsigned int mapped;
2805         unsigned long index;
2806         unsigned long next;
2807
2808         index = lba_to_map_index(lba);
2809         mapped = test_bit(index, map_storep);
2810
2811         if (mapped)
2812                 next = find_next_zero_bit(map_storep, map_size, index);
2813         else
2814                 next = find_next_bit(map_storep, map_size, index);
2815
2816         end = min_t(sector_t, sdebug_store_sectors,  map_index_to_lba(next));
2817         *num = end - lba;
2818
2819         return mapped;
2820 }
2821
2822 static void map_region(sector_t lba, unsigned int len)
2823 {
2824         sector_t end = lba + len;
2825
2826         while (lba < end) {
2827                 unsigned long index = lba_to_map_index(lba);
2828
2829                 if (index < map_size)
2830                         set_bit(index, map_storep);
2831
2832                 lba = map_index_to_lba(index + 1);
2833         }
2834 }
2835
2836 static void unmap_region(sector_t lba, unsigned int len)
2837 {
2838         sector_t end = lba + len;
2839
2840         while (lba < end) {
2841                 unsigned long index = lba_to_map_index(lba);
2842
2843                 if (lba == map_index_to_lba(index) &&
2844                     lba + scsi_debug_unmap_granularity <= end &&
2845                     index < map_size) {
2846                         clear_bit(index, map_storep);
2847                         if (scsi_debug_lbprz) {
2848                                 memset(fake_storep +
2849                                        lba * scsi_debug_sector_size, 0,
2850                                        scsi_debug_sector_size *
2851                                        scsi_debug_unmap_granularity);
2852                         }
2853                         if (dif_storep) {
2854                                 memset(dif_storep + lba, 0xff,
2855                                        sizeof(*dif_storep) *
2856                                        scsi_debug_unmap_granularity);
2857                         }
2858                 }
2859                 lba = map_index_to_lba(index + 1);
2860         }
2861 }
2862
2863 static int
2864 resp_write_dt0(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
2865 {
2866         u8 *cmd = scp->cmnd;
2867         u64 lba;
2868         u32 num;
2869         u32 ei_lba;
2870         unsigned long iflags;
2871         int ret;
2872         bool check_prot;
2873
2874         switch (cmd[0]) {
2875         case WRITE_16:
2876                 ei_lba = 0;
2877                 lba = get_unaligned_be64(cmd + 2);
2878                 num = get_unaligned_be32(cmd + 10);
2879                 check_prot = true;
2880                 break;
2881         case WRITE_10:
2882                 ei_lba = 0;
2883                 lba = get_unaligned_be32(cmd + 2);
2884                 num = get_unaligned_be16(cmd + 7);
2885                 check_prot = true;
2886                 break;
2887         case WRITE_6:
2888                 ei_lba = 0;
2889                 lba = (u32)cmd[3] | (u32)cmd[2] << 8 |
2890                       (u32)(cmd[1] & 0x1f) << 16;
2891                 num = (0 == cmd[4]) ? 256 : cmd[4];
2892                 check_prot = true;
2893                 break;
2894         case WRITE_12:
2895                 ei_lba = 0;
2896                 lba = get_unaligned_be32(cmd + 2);
2897                 num = get_unaligned_be32(cmd + 6);
2898                 check_prot = true;
2899                 break;
2900         case 0x53:      /* XDWRITEREAD(10) */
2901                 ei_lba = 0;
2902                 lba = get_unaligned_be32(cmd + 2);
2903                 num = get_unaligned_be16(cmd + 7);
2904                 check_prot = false;
2905                 break;
2906         default:        /* assume WRITE(32) */
2907                 lba = get_unaligned_be64(cmd + 12);
2908                 ei_lba = get_unaligned_be32(cmd + 20);
2909                 num = get_unaligned_be32(cmd + 28);
2910                 check_prot = false;
2911                 break;
2912         }
2913         if (check_prot) {
2914                 if (scsi_debug_dif == SD_DIF_TYPE2_PROTECTION &&
2915                     (cmd[1] & 0xe0)) {
2916                         mk_sense_invalid_opcode(scp);
2917                         return check_condition_result;
2918                 }
2919                 if ((scsi_debug_dif == SD_DIF_TYPE1_PROTECTION ||
2920                      scsi_debug_dif == SD_DIF_TYPE3_PROTECTION) &&
2921                     (cmd[1] & 0xe0) == 0)
2922                         sdev_printk(KERN_ERR, scp->device, "Unprotected WR "
2923                                     "to DIF device\n");
2924         }
2925
2926         /* inline check_device_access_params() */
2927         if (lba + num > sdebug_capacity) {
2928                 mk_sense_buffer(scp, ILLEGAL_REQUEST, LBA_OUT_OF_RANGE, 0);
2929                 return check_condition_result;
2930         }
2931         /* transfer length excessive (tie in to block limits VPD page) */
2932         if (num > sdebug_store_sectors) {
2933                 /* needs work to find which cdb byte 'num' comes from */
2934                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB, 0);
2935                 return check_condition_result;
2936         }
2937
2938         write_lock_irqsave(&atomic_rw, iflags);
2939
2940         /* DIX + T10 DIF */
2941         if (scsi_debug_dix && scsi_prot_sg_count(scp)) {
2942                 int prot_ret = prot_verify_write(scp, lba, num, ei_lba);
2943
2944                 if (prot_ret) {
2945                         write_unlock_irqrestore(&atomic_rw, iflags);
2946                         mk_sense_buffer(scp, ILLEGAL_REQUEST, 0x10, prot_ret);
2947                         return illegal_condition_result;
2948                 }
2949         }
2950
2951         ret = do_device_access(scp, lba, num, true);
2952         if (scsi_debug_lbp())
2953                 map_region(lba, num);
2954         write_unlock_irqrestore(&atomic_rw, iflags);
2955         if (-1 == ret)
2956                 return (DID_ERROR << 16);
2957         else if ((ret < (num * scsi_debug_sector_size)) &&
2958                  (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
2959                 sdev_printk(KERN_INFO, scp->device,
2960                             "%s: write: cdb indicated=%u, IO sent=%d bytes\n",
2961                             my_name, num * scsi_debug_sector_size, ret);
2962
2963         if (sdebug_any_injecting_opt) {
2964                 struct sdebug_scmd_extra_t *ep = scsi_cmd_priv(scp);
2965
2966                 if (ep->inj_recovered) {
2967                         mk_sense_buffer(scp, RECOVERED_ERROR,
2968                                         THRESHOLD_EXCEEDED, 0);
2969                         return check_condition_result;
2970                 } else if (ep->inj_dif) {
2971                         /* Logical block guard check failed */
2972                         mk_sense_buffer(scp, ABORTED_COMMAND, 0x10, 1);
2973                         return illegal_condition_result;
2974                 } else if (ep->inj_dix) {
2975                         mk_sense_buffer(scp, ILLEGAL_REQUEST, 0x10, 1);
2976                         return illegal_condition_result;
2977                 }
2978         }
2979         return 0;
2980 }
2981
2982 static int
2983 resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num, u32 ei_lba,
2984                 bool unmap, bool ndob)
2985 {
2986         unsigned long iflags;
2987         unsigned long long i;
2988         int ret;
2989
2990         ret = check_device_access_params(scp, lba, num);
2991         if (ret)
2992                 return ret;
2993
2994         write_lock_irqsave(&atomic_rw, iflags);
2995
2996         if (unmap && scsi_debug_lbp()) {
2997                 unmap_region(lba, num);
2998                 goto out;
2999         }
3000
3001         /* if ndob then zero 1 logical block, else fetch 1 logical block */
3002         if (ndob) {
3003                 memset(fake_storep + (lba * scsi_debug_sector_size), 0,
3004                        scsi_debug_sector_size);
3005                 ret = 0;
3006         } else
3007                 ret = fetch_to_dev_buffer(scp, fake_storep +
3008                                                (lba * scsi_debug_sector_size),
3009                                           scsi_debug_sector_size);
3010
3011         if (-1 == ret) {
3012                 write_unlock_irqrestore(&atomic_rw, iflags);
3013                 return (DID_ERROR << 16);
3014         } else if ((ret < (num * scsi_debug_sector_size)) &&
3015                  (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
3016                 sdev_printk(KERN_INFO, scp->device,
3017                             "%s: %s: cdb indicated=%u, IO sent=%d bytes\n",
3018                             my_name, "write same",
3019                             num * scsi_debug_sector_size, ret);
3020
3021         /* Copy first sector to remaining blocks */
3022         for (i = 1 ; i < num ; i++)
3023                 memcpy(fake_storep + ((lba + i) * scsi_debug_sector_size),
3024                        fake_storep + (lba * scsi_debug_sector_size),
3025                        scsi_debug_sector_size);
3026
3027         if (scsi_debug_lbp())
3028                 map_region(lba, num);
3029 out:
3030         write_unlock_irqrestore(&atomic_rw, iflags);
3031
3032         return 0;
3033 }
3034
3035 static int
3036 resp_write_same_10(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
3037 {
3038         u8 *cmd = scp->cmnd;
3039         u32 lba;
3040         u16 num;
3041         u32 ei_lba = 0;
3042         bool unmap = false;
3043
3044         if (cmd[1] & 0x8) {
3045                 if (scsi_debug_lbpws10 == 0) {
3046                         mk_sense_invalid_fld(scp, SDEB_IN_CDB, 1, 3);
3047                         return check_condition_result;
3048                 } else
3049                         unmap = true;
3050         }
3051         lba = get_unaligned_be32(cmd + 2);
3052         num = get_unaligned_be16(cmd + 7);
3053         if (num > scsi_debug_write_same_length) {
3054                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 7, -1);
3055                 return check_condition_result;
3056         }
3057         return resp_write_same(scp, lba, num, ei_lba, unmap, false);
3058 }
3059
3060 static int
3061 resp_write_same_16(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
3062 {
3063         u8 *cmd = scp->cmnd;
3064         u64 lba;
3065         u32 num;
3066         u32 ei_lba = 0;
3067         bool unmap = false;
3068         bool ndob = false;
3069
3070         if (cmd[1] & 0x8) {     /* UNMAP */
3071                 if (scsi_debug_lbpws == 0) {
3072                         mk_sense_invalid_fld(scp, SDEB_IN_CDB, 1, 3);
3073                         return check_condition_result;
3074                 } else
3075                         unmap = true;
3076         }
3077         if (cmd[1] & 0x1)  /* NDOB (no data-out buffer, assumes zeroes) */
3078                 ndob = true;
3079         lba = get_unaligned_be64(cmd + 2);
3080         num = get_unaligned_be32(cmd + 10);
3081         if (num > scsi_debug_write_same_length) {
3082                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 10, -1);
3083                 return check_condition_result;
3084         }
3085         return resp_write_same(scp, lba, num, ei_lba, unmap, ndob);
3086 }
3087
3088 /* Note the mode field is in the same position as the (lower) service action
3089  * field. For the Report supported operation codes command, SPC-4 suggests
3090  * each mode of this command should be reported separately; for future. */
3091 static int
3092 resp_write_buffer(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
3093 {
3094         u8 *cmd = scp->cmnd;
3095         struct scsi_device *sdp = scp->device;
3096         struct sdebug_dev_info *dp;
3097         u8 mode;
3098
3099         mode = cmd[1] & 0x1f;
3100         switch (mode) {
3101         case 0x4:       /* download microcode (MC) and activate (ACT) */
3102                 /* set UAs on this device only */
3103                 set_bit(SDEBUG_UA_BUS_RESET, devip->uas_bm);
3104                 set_bit(SDEBUG_UA_MICROCODE_CHANGED, devip->uas_bm);
3105                 break;
3106         case 0x5:       /* download MC, save and ACT */
3107                 set_bit(SDEBUG_UA_MICROCODE_CHANGED_WO_RESET, devip->uas_bm);
3108                 break;
3109         case 0x6:       /* download MC with offsets and ACT */
3110                 /* set UAs on most devices (LUs) in this target */
3111                 list_for_each_entry(dp,
3112                                     &devip->sdbg_host->dev_info_list,
3113                                     dev_list)
3114                         if (dp->target == sdp->id) {
3115                                 set_bit(SDEBUG_UA_BUS_RESET, dp->uas_bm);
3116                                 if (devip != dp)
3117                                         set_bit(SDEBUG_UA_MICROCODE_CHANGED,
3118                                                 dp->uas_bm);
3119                         }
3120                 break;
3121         case 0x7:       /* download MC with offsets, save, and ACT */
3122                 /* set UA on all devices (LUs) in this target */
3123                 list_for_each_entry(dp,
3124                                     &devip->sdbg_host->dev_info_list,
3125                                     dev_list)
3126                         if (dp->target == sdp->id)
3127                                 set_bit(SDEBUG_UA_MICROCODE_CHANGED_WO_RESET,
3128                                         dp->uas_bm);
3129                 break;
3130         default:
3131                 /* do nothing for this command for other mode values */
3132                 break;
3133         }
3134         return 0;
3135 }
3136
3137 static int
3138 resp_comp_write(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
3139 {
3140         u8 *cmd = scp->cmnd;
3141         u8 *arr;
3142         u8 *fake_storep_hold;
3143         u64 lba;
3144         u32 dnum;
3145         u32 lb_size = scsi_debug_sector_size;
3146         u8 num;
3147         unsigned long iflags;
3148         int ret;
3149         int retval = 0;
3150
3151         lba = get_unaligned_be64(cmd + 2);
3152         num = cmd[13];          /* 1 to a maximum of 255 logical blocks */
3153         if (0 == num)
3154                 return 0;       /* degenerate case, not an error */
3155         if (scsi_debug_dif == SD_DIF_TYPE2_PROTECTION &&
3156             (cmd[1] & 0xe0)) {
3157                 mk_sense_invalid_opcode(scp);
3158                 return check_condition_result;
3159         }
3160         if ((scsi_debug_dif == SD_DIF_TYPE1_PROTECTION ||
3161              scsi_debug_dif == SD_DIF_TYPE3_PROTECTION) &&
3162             (cmd[1] & 0xe0) == 0)
3163                 sdev_printk(KERN_ERR, scp->device, "Unprotected WR "
3164                             "to DIF device\n");
3165
3166         /* inline check_device_access_params() */
3167         if (lba + num > sdebug_capacity) {
3168                 mk_sense_buffer(scp, ILLEGAL_REQUEST, LBA_OUT_OF_RANGE, 0);
3169                 return check_condition_result;
3170         }
3171         /* transfer length excessive (tie in to block limits VPD page) */
3172         if (num > sdebug_store_sectors) {
3173                 /* needs work to find which cdb byte 'num' comes from */
3174                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB, 0);
3175                 return check_condition_result;
3176         }
3177         dnum = 2 * num;
3178         arr = kzalloc(dnum * lb_size, GFP_ATOMIC);
3179         if (NULL == arr) {
3180                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC,
3181                                 INSUFF_RES_ASCQ);
3182                 return check_condition_result;
3183         }
3184
3185         write_lock_irqsave(&atomic_rw, iflags);
3186
3187         /* trick do_device_access() to fetch both compare and write buffers
3188          * from data-in into arr. Safe (atomic) since write_lock held. */
3189         fake_storep_hold = fake_storep;
3190         fake_storep = arr;
3191         ret = do_device_access(scp, 0, dnum, true);
3192         fake_storep = fake_storep_hold;
3193         if (ret == -1) {
3194                 retval = DID_ERROR << 16;
3195                 goto cleanup;
3196         } else if ((ret < (dnum * lb_size)) &&
3197                  (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
3198                 sdev_printk(KERN_INFO, scp->device, "%s: compare_write: cdb "
3199                             "indicated=%u, IO sent=%d bytes\n", my_name,
3200                             dnum * lb_size, ret);
3201         if (!comp_write_worker(lba, num, arr)) {
3202                 mk_sense_buffer(scp, MISCOMPARE, MISCOMPARE_VERIFY_ASC, 0);
3203                 retval = check_condition_result;
3204                 goto cleanup;
3205         }
3206         if (scsi_debug_lbp())
3207                 map_region(lba, num);
3208 cleanup:
3209         write_unlock_irqrestore(&atomic_rw, iflags);
3210         kfree(arr);
3211         return retval;
3212 }
3213
3214 struct unmap_block_desc {
3215         __be64  lba;
3216         __be32  blocks;
3217         __be32  __reserved;
3218 };
3219
3220 static int
3221 resp_unmap(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
3222 {
3223         unsigned char *buf;
3224         struct unmap_block_desc *desc;
3225         unsigned int i, payload_len, descriptors;
3226         int ret;
3227         unsigned long iflags;
3228
3229
3230         if (!scsi_debug_lbp())
3231                 return 0;       /* fib and say its done */
3232         payload_len = get_unaligned_be16(scp->cmnd + 7);
3233         BUG_ON(scsi_bufflen(scp) != payload_len);
3234
3235         descriptors = (payload_len - 8) / 16;
3236         if (descriptors > scsi_debug_unmap_max_desc) {
3237                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 7, -1);
3238                 return check_condition_result;
3239         }
3240
3241         buf = kmalloc(scsi_bufflen(scp), GFP_ATOMIC);
3242         if (!buf) {
3243                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC,
3244                                 INSUFF_RES_ASCQ);
3245                 return check_condition_result;
3246         }
3247
3248         scsi_sg_copy_to_buffer(scp, buf, scsi_bufflen(scp));
3249
3250         BUG_ON(get_unaligned_be16(&buf[0]) != payload_len - 2);
3251         BUG_ON(get_unaligned_be16(&buf[2]) != descriptors * 16);
3252
3253         desc = (void *)&buf[8];
3254
3255         write_lock_irqsave(&atomic_rw, iflags);
3256
3257         for (i = 0 ; i < descriptors ; i++) {
3258                 unsigned long long lba = get_unaligned_be64(&desc[i].lba);
3259                 unsigned int num = get_unaligned_be32(&desc[i].blocks);
3260
3261                 ret = check_device_access_params(scp, lba, num);
3262                 if (ret)
3263                         goto out;
3264
3265                 unmap_region(lba, num);
3266         }
3267
3268         ret = 0;
3269
3270 out:
3271         write_unlock_irqrestore(&atomic_rw, iflags);
3272         kfree(buf);
3273
3274         return ret;
3275 }
3276
3277 #define SDEBUG_GET_LBA_STATUS_LEN 32
3278
3279 static int
3280 resp_get_lba_status(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
3281 {
3282         u8 *cmd = scp->cmnd;
3283         u64 lba;
3284         u32 alloc_len, mapped, num;
3285         u8 arr[SDEBUG_GET_LBA_STATUS_LEN];
3286         int ret;
3287
3288         lba = get_unaligned_be64(cmd + 2);
3289         alloc_len = get_unaligned_be32(cmd + 10);
3290
3291         if (alloc_len < 24)
3292                 return 0;
3293
3294         ret = check_device_access_params(scp, lba, 1);
3295         if (ret)
3296                 return ret;
3297
3298         if (scsi_debug_lbp())
3299                 mapped = map_state(lba, &num);
3300         else {
3301                 mapped = 1;
3302                 /* following just in case virtual_gb changed */
3303                 sdebug_capacity = get_sdebug_capacity();
3304                 if (sdebug_capacity - lba <= 0xffffffff)
3305                         num = sdebug_capacity - lba;
3306                 else
3307                         num = 0xffffffff;
3308         }
3309
3310         memset(arr, 0, SDEBUG_GET_LBA_STATUS_LEN);
3311         put_unaligned_be32(20, arr);            /* Parameter Data Length */
3312         put_unaligned_be64(lba, arr + 8);       /* LBA */
3313         put_unaligned_be32(num, arr + 16);      /* Number of blocks */
3314         arr[20] = !mapped;              /* prov_stat=0: mapped; 1: dealloc */
3315
3316         return fill_from_dev_buffer(scp, arr, SDEBUG_GET_LBA_STATUS_LEN);
3317 }
3318
3319 #define SDEBUG_RLUN_ARR_SZ 256
3320
3321 static int resp_report_luns(struct scsi_cmnd * scp,
3322                             struct sdebug_dev_info * devip)
3323 {
3324         unsigned int alloc_len;
3325         int lun_cnt, i, upper, num, n, want_wlun, shortish;
3326         u64 lun;
3327         unsigned char *cmd = scp->cmnd;
3328         int select_report = (int)cmd[2];
3329         struct scsi_lun *one_lun;
3330         unsigned char arr[SDEBUG_RLUN_ARR_SZ];
3331         unsigned char * max_addr;
3332
3333         clear_luns_changed_on_target(devip);
3334         alloc_len = cmd[9] + (cmd[8] << 8) + (cmd[7] << 16) + (cmd[6] << 24);
3335         shortish = (alloc_len < 4);
3336         if (shortish || (select_report > 2)) {
3337                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, shortish ? 6 : 2, -1);
3338                 return check_condition_result;
3339         }
3340         /* can produce response with up to 16k luns (lun 0 to lun 16383) */
3341         memset(arr, 0, SDEBUG_RLUN_ARR_SZ);
3342         lun_cnt = scsi_debug_max_luns;
3343         if (1 == select_report)
3344                 lun_cnt = 0;
3345         else if (scsi_debug_no_lun_0 && (lun_cnt > 0))
3346                 --lun_cnt;
3347         want_wlun = (select_report > 0) ? 1 : 0;
3348         num = lun_cnt + want_wlun;
3349         arr[2] = ((sizeof(struct scsi_lun) * num) >> 8) & 0xff;
3350         arr[3] = (sizeof(struct scsi_lun) * num) & 0xff;
3351         n = min((int)((SDEBUG_RLUN_ARR_SZ - 8) /
3352                             sizeof(struct scsi_lun)), num);
3353         if (n < num) {
3354                 want_wlun = 0;
3355                 lun_cnt = n;
3356         }
3357         one_lun = (struct scsi_lun *) &arr[8];
3358         max_addr = arr + SDEBUG_RLUN_ARR_SZ;
3359         for (i = 0, lun = (scsi_debug_no_lun_0 ? 1 : 0);
3360              ((i < lun_cnt) && ((unsigned char *)(one_lun + i) < max_addr));
3361              i++, lun++) {
3362                 upper = (lun >> 8) & 0x3f;
3363                 if (upper)
3364                         one_lun[i].scsi_lun[0] =
3365                             (upper | (SAM2_LUN_ADDRESS_METHOD << 6));
3366                 one_lun[i].scsi_lun[1] = lun & 0xff;
3367         }
3368         if (want_wlun) {
3369                 one_lun[i].scsi_lun[0] = (SCSI_W_LUN_REPORT_LUNS >> 8) & 0xff;
3370                 one_lun[i].scsi_lun[1] = SCSI_W_LUN_REPORT_LUNS & 0xff;
3371                 i++;
3372         }
3373         alloc_len = (unsigned char *)(one_lun + i) - arr;
3374         return fill_from_dev_buffer(scp, arr,
3375                                     min((int)alloc_len, SDEBUG_RLUN_ARR_SZ));
3376 }
3377
3378 static int resp_xdwriteread(struct scsi_cmnd *scp, unsigned long long lba,
3379                             unsigned int num, struct sdebug_dev_info *devip)
3380 {
3381         int j;
3382         unsigned char *kaddr, *buf;
3383         unsigned int offset;
3384         struct scsi_data_buffer *sdb = scsi_in(scp);
3385         struct sg_mapping_iter miter;
3386
3387         /* better not to use temporary buffer. */
3388         buf = kmalloc(scsi_bufflen(scp), GFP_ATOMIC);
3389         if (!buf) {
3390                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC,
3391                                 INSUFF_RES_ASCQ);
3392                 return check_condition_result;
3393         }
3394
3395         scsi_sg_copy_to_buffer(scp, buf, scsi_bufflen(scp));
3396
3397         offset = 0;
3398         sg_miter_start(&miter, sdb->table.sgl, sdb->table.nents,
3399                         SG_MITER_ATOMIC | SG_MITER_TO_SG);
3400
3401         while (sg_miter_next(&miter)) {
3402                 kaddr = miter.addr;
3403                 for (j = 0; j < miter.length; j++)
3404                         *(kaddr + j) ^= *(buf + offset + j);
3405
3406                 offset += miter.length;
3407         }
3408         sg_miter_stop(&miter);
3409         kfree(buf);
3410
3411         return 0;
3412 }
3413
3414 static int
3415 resp_xdwriteread_10(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
3416 {
3417         u8 *cmd = scp->cmnd;
3418         u64 lba;
3419         u32 num;
3420         int errsts;
3421
3422         if (!scsi_bidi_cmnd(scp)) {
3423                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC,
3424                                 INSUFF_RES_ASCQ);
3425                 return check_condition_result;
3426         }
3427         errsts = resp_read_dt0(scp, devip);
3428         if (errsts)
3429                 return errsts;
3430         if (!(cmd[1] & 0x4)) {          /* DISABLE_WRITE is not set */
3431                 errsts = resp_write_dt0(scp, devip);
3432                 if (errsts)
3433                         return errsts;
3434         }
3435         lba = get_unaligned_be32(cmd + 2);
3436         num = get_unaligned_be16(cmd + 7);
3437         return resp_xdwriteread(scp, lba, num, devip);
3438 }
3439
3440 /* When timer or tasklet goes off this function is called. */
3441 static void sdebug_q_cmd_complete(unsigned long indx)
3442 {
3443         int qa_indx;
3444         int retiring = 0;
3445         unsigned long iflags;
3446         struct sdebug_queued_cmd *sqcp;
3447         struct scsi_cmnd *scp;
3448         struct sdebug_dev_info *devip;
3449
3450         atomic_inc(&sdebug_completions);
3451         qa_indx = indx;
3452         if ((qa_indx < 0) || (qa_indx >= SCSI_DEBUG_CANQUEUE)) {
3453                 pr_err("wild qa_indx=%d\n", qa_indx);
3454                 return;
3455         }
3456         spin_lock_irqsave(&queued_arr_lock, iflags);
3457         sqcp = &queued_arr[qa_indx];
3458         scp = sqcp->a_cmnd;
3459         if (NULL == scp) {
3460                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
3461                 pr_err("scp is NULL\n");
3462                 return;
3463         }
3464         devip = (struct sdebug_dev_info *)scp->device->hostdata;
3465         if (devip)
3466                 atomic_dec(&devip->num_in_q);
3467         else
3468                 pr_err("devip=NULL\n");
3469         if (atomic_read(&retired_max_queue) > 0)
3470                 retiring = 1;
3471
3472         sqcp->a_cmnd = NULL;
3473         if (!test_and_clear_bit(qa_indx, queued_in_use_bm)) {
3474                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
3475                 pr_err("Unexpected completion\n");
3476                 return;
3477         }
3478
3479         if (unlikely(retiring)) {       /* user has reduced max_queue */
3480                 int k, retval;
3481
3482                 retval = atomic_read(&retired_max_queue);
3483                 if (qa_indx >= retval) {
3484                         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3485                         pr_err("index %d too large\n", retval);
3486                         return;
3487                 }
3488                 k = find_last_bit(queued_in_use_bm, retval);
3489                 if ((k < scsi_debug_max_queue) || (k == retval))
3490                         atomic_set(&retired_max_queue, 0);
3491                 else
3492                         atomic_set(&retired_max_queue, k + 1);
3493         }
3494         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3495         scp->scsi_done(scp); /* callback to mid level */
3496 }
3497
3498 /* When high resolution timer goes off this function is called. */
3499 static enum hrtimer_restart
3500 sdebug_q_cmd_hrt_complete(struct hrtimer *timer)
3501 {
3502         int qa_indx;
3503         int retiring = 0;
3504         unsigned long iflags;
3505         struct sdebug_hrtimer *sd_hrtp = (struct sdebug_hrtimer *)timer;
3506         struct sdebug_queued_cmd *sqcp;
3507         struct scsi_cmnd *scp;
3508         struct sdebug_dev_info *devip;
3509
3510         atomic_inc(&sdebug_completions);
3511         qa_indx = sd_hrtp->qa_indx;
3512         if ((qa_indx < 0) || (qa_indx >= SCSI_DEBUG_CANQUEUE)) {
3513                 pr_err("wild qa_indx=%d\n", qa_indx);
3514                 goto the_end;
3515         }
3516         spin_lock_irqsave(&queued_arr_lock, iflags);
3517         sqcp = &queued_arr[qa_indx];
3518         scp = sqcp->a_cmnd;
3519         if (NULL == scp) {
3520                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
3521                 pr_err("scp is NULL\n");
3522                 goto the_end;
3523         }
3524         devip = (struct sdebug_dev_info *)scp->device->hostdata;
3525         if (devip)
3526                 atomic_dec(&devip->num_in_q);
3527         else
3528                 pr_err("devip=NULL\n");
3529         if (atomic_read(&retired_max_queue) > 0)
3530                 retiring = 1;
3531
3532         sqcp->a_cmnd = NULL;
3533         if (!test_and_clear_bit(qa_indx, queued_in_use_bm)) {
3534                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
3535                 pr_err("Unexpected completion\n");
3536                 goto the_end;
3537         }
3538
3539         if (unlikely(retiring)) {       /* user has reduced max_queue */
3540                 int k, retval;
3541
3542                 retval = atomic_read(&retired_max_queue);
3543                 if (qa_indx >= retval) {
3544                         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3545                         pr_err("index %d too large\n", retval);
3546                         goto the_end;
3547                 }
3548                 k = find_last_bit(queued_in_use_bm, retval);
3549                 if ((k < scsi_debug_max_queue) || (k == retval))
3550                         atomic_set(&retired_max_queue, 0);
3551                 else
3552                         atomic_set(&retired_max_queue, k + 1);
3553         }
3554         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3555         scp->scsi_done(scp); /* callback to mid level */
3556 the_end:
3557         return HRTIMER_NORESTART;
3558 }
3559
3560 static struct sdebug_dev_info *
3561 sdebug_device_create(struct sdebug_host_info *sdbg_host, gfp_t flags)
3562 {
3563         struct sdebug_dev_info *devip;
3564
3565         devip = kzalloc(sizeof(*devip), flags);
3566         if (devip) {
3567                 devip->sdbg_host = sdbg_host;
3568                 list_add_tail(&devip->dev_list, &sdbg_host->dev_info_list);
3569         }
3570         return devip;
3571 }
3572
3573 static struct sdebug_dev_info * devInfoReg(struct scsi_device * sdev)
3574 {
3575         struct sdebug_host_info * sdbg_host;
3576         struct sdebug_dev_info * open_devip = NULL;
3577         struct sdebug_dev_info * devip =
3578                         (struct sdebug_dev_info *)sdev->hostdata;
3579
3580         if (devip)
3581                 return devip;
3582         sdbg_host = *(struct sdebug_host_info **)shost_priv(sdev->host);
3583         if (!sdbg_host) {
3584                 pr_err("Host info NULL\n");
3585                 return NULL;
3586         }
3587         list_for_each_entry(devip, &sdbg_host->dev_info_list, dev_list) {
3588                 if ((devip->used) && (devip->channel == sdev->channel) &&
3589                     (devip->target == sdev->id) &&
3590                     (devip->lun == sdev->lun))
3591                         return devip;
3592                 else {
3593                         if ((!devip->used) && (!open_devip))
3594                                 open_devip = devip;
3595                 }
3596         }
3597         if (!open_devip) { /* try and make a new one */
3598                 open_devip = sdebug_device_create(sdbg_host, GFP_ATOMIC);
3599                 if (!open_devip) {
3600                         pr_err("out of memory at line %d\n", __LINE__);
3601                         return NULL;
3602                 }
3603         }
3604
3605         open_devip->channel = sdev->channel;
3606         open_devip->target = sdev->id;
3607         open_devip->lun = sdev->lun;
3608         open_devip->sdbg_host = sdbg_host;
3609         atomic_set(&open_devip->num_in_q, 0);
3610         set_bit(SDEBUG_UA_POR, open_devip->uas_bm);
3611         open_devip->used = true;
3612         return open_devip;
3613 }
3614
3615 static int scsi_debug_slave_alloc(struct scsi_device *sdp)
3616 {
3617         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
3618                 pr_info("slave_alloc <%u %u %u %llu>\n",
3619                        sdp->host->host_no, sdp->channel, sdp->id, sdp->lun);
3620         queue_flag_set_unlocked(QUEUE_FLAG_BIDI, sdp->request_queue);
3621         return 0;
3622 }
3623
3624 static int scsi_debug_slave_configure(struct scsi_device *sdp)
3625 {
3626         struct sdebug_dev_info *devip;
3627
3628         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
3629                 pr_info("slave_configure <%u %u %u %llu>\n",
3630                        sdp->host->host_no, sdp->channel, sdp->id, sdp->lun);
3631         if (sdp->host->max_cmd_len != SCSI_DEBUG_MAX_CMD_LEN)
3632                 sdp->host->max_cmd_len = SCSI_DEBUG_MAX_CMD_LEN;
3633         devip = devInfoReg(sdp);
3634         if (NULL == devip)
3635                 return 1;       /* no resources, will be marked offline */
3636         sdp->hostdata = devip;
3637         blk_queue_max_segment_size(sdp->request_queue, -1U);
3638         if (scsi_debug_no_uld)
3639                 sdp->no_uld_attach = 1;
3640         return 0;
3641 }
3642
3643 static void scsi_debug_slave_destroy(struct scsi_device *sdp)
3644 {
3645         struct sdebug_dev_info *devip =
3646                 (struct sdebug_dev_info *)sdp->hostdata;
3647
3648         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
3649                 pr_info("slave_destroy <%u %u %u %llu>\n",
3650                        sdp->host->host_no, sdp->channel, sdp->id, sdp->lun);
3651         if (devip) {
3652                 /* make this slot available for re-use */
3653                 devip->used = false;
3654                 sdp->hostdata = NULL;
3655         }
3656 }
3657
3658 /* Returns 1 if cmnd found (deletes its timer or tasklet), else returns 0 */
3659 static int stop_queued_cmnd(struct scsi_cmnd *cmnd)
3660 {
3661         unsigned long iflags;
3662         int k, qmax, r_qmax;
3663         struct sdebug_queued_cmd *sqcp;
3664         struct sdebug_dev_info *devip;
3665
3666         spin_lock_irqsave(&queued_arr_lock, iflags);
3667         qmax = scsi_debug_max_queue;
3668         r_qmax = atomic_read(&retired_max_queue);
3669         if (r_qmax > qmax)
3670                 qmax = r_qmax;
3671         for (k = 0; k < qmax; ++k) {
3672                 if (test_bit(k, queued_in_use_bm)) {
3673                         sqcp = &queued_arr[k];
3674                         if (cmnd == sqcp->a_cmnd) {
3675                                 devip = (struct sdebug_dev_info *)
3676                                         cmnd->device->hostdata;
3677                                 if (devip)
3678                                         atomic_dec(&devip->num_in_q);
3679                                 sqcp->a_cmnd = NULL;
3680                                 spin_unlock_irqrestore(&queued_arr_lock,
3681                                                        iflags);
3682                                 if (scsi_debug_ndelay > 0) {
3683                                         if (sqcp->sd_hrtp)
3684                                                 hrtimer_cancel(
3685                                                         &sqcp->sd_hrtp->hrt);
3686                                 } else if (scsi_debug_delay > 0) {
3687                                         if (sqcp->cmnd_timerp)
3688                                                 del_timer_sync(
3689                                                         sqcp->cmnd_timerp);
3690                                 } else if (scsi_debug_delay < 0) {
3691                                         if (sqcp->tletp)
3692                                                 tasklet_kill(sqcp->tletp);
3693                                 }
3694                                 clear_bit(k, queued_in_use_bm);
3695                                 return 1;
3696                         }
3697                 }
3698         }
3699         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3700         return 0;
3701 }
3702
3703 /* Deletes (stops) timers or tasklets of all queued commands */
3704 static void stop_all_queued(void)
3705 {
3706         unsigned long iflags;
3707         int k;
3708         struct sdebug_queued_cmd *sqcp;
3709         struct sdebug_dev_info *devip;
3710
3711         spin_lock_irqsave(&queued_arr_lock, iflags);
3712         for (k = 0; k < SCSI_DEBUG_CANQUEUE; ++k) {
3713                 if (test_bit(k, queued_in_use_bm)) {
3714                         sqcp = &queued_arr[k];
3715                         if (sqcp->a_cmnd) {
3716                                 devip = (struct sdebug_dev_info *)
3717                                         sqcp->a_cmnd->device->hostdata;
3718                                 if (devip)
3719                                         atomic_dec(&devip->num_in_q);
3720                                 sqcp->a_cmnd = NULL;
3721                                 spin_unlock_irqrestore(&queued_arr_lock,
3722                                                        iflags);
3723                                 if (scsi_debug_ndelay > 0) {
3724                                         if (sqcp->sd_hrtp)
3725                                                 hrtimer_cancel(
3726                                                         &sqcp->sd_hrtp->hrt);
3727                                 } else if (scsi_debug_delay > 0) {
3728                                         if (sqcp->cmnd_timerp)
3729                                                 del_timer_sync(
3730                                                         sqcp->cmnd_timerp);
3731                                 } else if (scsi_debug_delay < 0) {
3732                                         if (sqcp->tletp)
3733                                                 tasklet_kill(sqcp->tletp);
3734                                 }
3735                                 clear_bit(k, queued_in_use_bm);
3736                                 spin_lock_irqsave(&queued_arr_lock, iflags);
3737                         }
3738                 }
3739         }
3740         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3741 }
3742
3743 /* Free queued command memory on heap */
3744 static void free_all_queued(void)
3745 {
3746         unsigned long iflags;
3747         int k;
3748         struct sdebug_queued_cmd *sqcp;
3749
3750         spin_lock_irqsave(&queued_arr_lock, iflags);
3751         for (k = 0; k < SCSI_DEBUG_CANQUEUE; ++k) {
3752                 sqcp = &queued_arr[k];
3753                 kfree(sqcp->cmnd_timerp);
3754                 sqcp->cmnd_timerp = NULL;
3755                 kfree(sqcp->tletp);
3756                 sqcp->tletp = NULL;
3757                 kfree(sqcp->sd_hrtp);
3758                 sqcp->sd_hrtp = NULL;
3759         }
3760         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3761 }
3762
3763 static int scsi_debug_abort(struct scsi_cmnd *SCpnt)
3764 {
3765         ++num_aborts;
3766         if (SCpnt) {
3767                 if (SCpnt->device &&
3768                     (SCSI_DEBUG_OPT_ALL_NOISE & scsi_debug_opts))
3769                         sdev_printk(KERN_INFO, SCpnt->device, "%s\n",
3770                                     __func__);
3771                 stop_queued_cmnd(SCpnt);
3772         }
3773         return SUCCESS;
3774 }
3775
3776 static int scsi_debug_device_reset(struct scsi_cmnd * SCpnt)
3777 {
3778         struct sdebug_dev_info * devip;
3779
3780         ++num_dev_resets;
3781         if (SCpnt && SCpnt->device) {
3782                 struct scsi_device *sdp = SCpnt->device;
3783
3784                 if (SCSI_DEBUG_OPT_ALL_NOISE & scsi_debug_opts)
3785                         sdev_printk(KERN_INFO, sdp, "%s\n", __func__);
3786                 devip = devInfoReg(sdp);
3787                 if (devip)
3788                         set_bit(SDEBUG_UA_POR, devip->uas_bm);
3789         }
3790         return SUCCESS;
3791 }
3792
3793 static int scsi_debug_target_reset(struct scsi_cmnd *SCpnt)
3794 {
3795         struct sdebug_host_info *sdbg_host;
3796         struct sdebug_dev_info *devip;
3797         struct scsi_device *sdp;
3798         struct Scsi_Host *hp;
3799         int k = 0;
3800
3801         ++num_target_resets;
3802         if (!SCpnt)
3803                 goto lie;
3804         sdp = SCpnt->device;
3805         if (!sdp)
3806                 goto lie;
3807         if (SCSI_DEBUG_OPT_ALL_NOISE & scsi_debug_opts)
3808                 sdev_printk(KERN_INFO, sdp, "%s\n", __func__);
3809         hp = sdp->host;
3810         if (!hp)
3811                 goto lie;
3812         sdbg_host = *(struct sdebug_host_info **)shost_priv(hp);
3813         if (sdbg_host) {
3814                 list_for_each_entry(devip,
3815                                     &sdbg_host->dev_info_list,
3816                                     dev_list)
3817                         if (devip->target == sdp->id) {
3818                                 set_bit(SDEBUG_UA_BUS_RESET, devip->uas_bm);
3819                                 ++k;
3820                         }
3821         }
3822         if (SCSI_DEBUG_OPT_RESET_NOISE & scsi_debug_opts)
3823                 sdev_printk(KERN_INFO, sdp,
3824                             "%s: %d device(s) found in target\n", __func__, k);
3825 lie:
3826         return SUCCESS;
3827 }
3828
3829 static int scsi_debug_bus_reset(struct scsi_cmnd * SCpnt)
3830 {
3831         struct sdebug_host_info *sdbg_host;
3832         struct sdebug_dev_info *devip;
3833         struct scsi_device * sdp;
3834         struct Scsi_Host * hp;
3835         int k = 0;
3836
3837         ++num_bus_resets;
3838         if (!(SCpnt && SCpnt->device))
3839                 goto lie;
3840         sdp = SCpnt->device;
3841         if (SCSI_DEBUG_OPT_ALL_NOISE & scsi_debug_opts)
3842                 sdev_printk(KERN_INFO, sdp, "%s\n", __func__);
3843         hp = sdp->host;
3844         if (hp) {
3845                 sdbg_host = *(struct sdebug_host_info **)shost_priv(hp);
3846                 if (sdbg_host) {
3847                         list_for_each_entry(devip,
3848                                             &sdbg_host->dev_info_list,
3849                                             dev_list) {
3850                                 set_bit(SDEBUG_UA_BUS_RESET, devip->uas_bm);
3851                                 ++k;
3852                         }
3853                 }
3854         }
3855         if (SCSI_DEBUG_OPT_RESET_NOISE & scsi_debug_opts)
3856                 sdev_printk(KERN_INFO, sdp,
3857                             "%s: %d device(s) found in host\n", __func__, k);
3858 lie:
3859         return SUCCESS;
3860 }
3861
3862 static int scsi_debug_host_reset(struct scsi_cmnd * SCpnt)
3863 {
3864         struct sdebug_host_info * sdbg_host;
3865         struct sdebug_dev_info *devip;
3866         int k = 0;
3867
3868         ++num_host_resets;
3869         if ((SCpnt->device) && (SCSI_DEBUG_OPT_ALL_NOISE & scsi_debug_opts))
3870                 sdev_printk(KERN_INFO, SCpnt->device, "%s\n", __func__);
3871         spin_lock(&sdebug_host_list_lock);
3872         list_for_each_entry(sdbg_host, &sdebug_host_list, host_list) {
3873                 list_for_each_entry(devip, &sdbg_host->dev_info_list,
3874                                     dev_list) {
3875                         set_bit(SDEBUG_UA_BUS_RESET, devip->uas_bm);
3876                         ++k;
3877                 }
3878         }
3879         spin_unlock(&sdebug_host_list_lock);
3880         stop_all_queued();
3881         if (SCSI_DEBUG_OPT_RESET_NOISE & scsi_debug_opts)
3882                 sdev_printk(KERN_INFO, SCpnt->device,
3883                             "%s: %d device(s) found\n", __func__, k);
3884         return SUCCESS;
3885 }
3886
3887 static void __init sdebug_build_parts(unsigned char *ramp,
3888                                       unsigned long store_size)
3889 {
3890         struct partition * pp;
3891         int starts[SDEBUG_MAX_PARTS + 2];
3892         int sectors_per_part, num_sectors, k;
3893         int heads_by_sects, start_sec, end_sec;
3894
3895         /* assume partition table already zeroed */
3896         if ((scsi_debug_num_parts < 1) || (store_size < 1048576))
3897                 return;
3898         if (scsi_debug_num_parts > SDEBUG_MAX_PARTS) {
3899                 scsi_debug_num_parts = SDEBUG_MAX_PARTS;
3900                 pr_warn("reducing partitions to %d\n", SDEBUG_MAX_PARTS);
3901         }
3902         num_sectors = (int)sdebug_store_sectors;
3903         sectors_per_part = (num_sectors - sdebug_sectors_per)
3904                            / scsi_debug_num_parts;
3905         heads_by_sects = sdebug_heads * sdebug_sectors_per;
3906         starts[0] = sdebug_sectors_per;
3907         for (k = 1; k < scsi_debug_num_parts; ++k)
3908                 starts[k] = ((k * sectors_per_part) / heads_by_sects)
3909                             * heads_by_sects;
3910         starts[scsi_debug_num_parts] = num_sectors;
3911         starts[scsi_debug_num_parts + 1] = 0;
3912
3913         ramp[510] = 0x55;       /* magic partition markings */
3914         ramp[511] = 0xAA;
3915         pp = (struct partition *)(ramp + 0x1be);
3916         for (k = 0; starts[k + 1]; ++k, ++pp) {
3917                 start_sec = starts[k];
3918                 end_sec = starts[k + 1] - 1;
3919                 pp->boot_ind = 0;
3920
3921                 pp->cyl = start_sec / heads_by_sects;
3922                 pp->head = (start_sec - (pp->cyl * heads_by_sects))
3923                            / sdebug_sectors_per;
3924                 pp->sector = (start_sec % sdebug_sectors_per) + 1;
3925
3926                 pp->end_cyl = end_sec / heads_by_sects;
3927                 pp->end_head = (end_sec - (pp->end_cyl * heads_by_sects))
3928                                / sdebug_sectors_per;
3929                 pp->end_sector = (end_sec % sdebug_sectors_per) + 1;
3930
3931                 pp->start_sect = cpu_to_le32(start_sec);
3932                 pp->nr_sects = cpu_to_le32(end_sec - start_sec + 1);
3933                 pp->sys_ind = 0x83;     /* plain Linux partition */
3934         }
3935 }
3936
3937 static int
3938 schedule_resp(struct scsi_cmnd *cmnd, struct sdebug_dev_info *devip,
3939               int scsi_result, int delta_jiff)
3940 {
3941         unsigned long iflags;
3942         int k, num_in_q, qdepth, inject;
3943         struct sdebug_queued_cmd *sqcp = NULL;
3944         struct scsi_device *sdp = cmnd->device;
3945
3946         if (NULL == cmnd || NULL == devip) {
3947                 pr_warn("called with NULL cmnd or devip pointer\n");
3948                 /* no particularly good error to report back */
3949                 return SCSI_MLQUEUE_HOST_BUSY;
3950         }
3951         if ((scsi_result) && (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
3952                 sdev_printk(KERN_INFO, sdp, "%s: non-zero result=0x%x\n",
3953                             __func__, scsi_result);
3954         if (delta_jiff == 0)
3955                 goto respond_in_thread;
3956
3957         /* schedule the response at a later time if resources permit */
3958         spin_lock_irqsave(&queued_arr_lock, iflags);
3959         num_in_q = atomic_read(&devip->num_in_q);
3960         qdepth = cmnd->device->queue_depth;
3961         inject = 0;
3962         if ((qdepth > 0) && (num_in_q >= qdepth)) {
3963                 if (scsi_result) {
3964                         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3965                         goto respond_in_thread;
3966                 } else
3967                         scsi_result = device_qfull_result;
3968         } else if ((scsi_debug_every_nth != 0) &&
3969                    (SCSI_DEBUG_OPT_RARE_TSF & scsi_debug_opts) &&
3970                    (scsi_result == 0)) {
3971                 if ((num_in_q == (qdepth - 1)) &&
3972                     (atomic_inc_return(&sdebug_a_tsf) >=
3973                      abs(scsi_debug_every_nth))) {
3974                         atomic_set(&sdebug_a_tsf, 0);
3975                         inject = 1;
3976                         scsi_result = device_qfull_result;
3977                 }
3978         }
3979
3980         k = find_first_zero_bit(queued_in_use_bm, scsi_debug_max_queue);
3981         if (k >= scsi_debug_max_queue) {
3982                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
3983                 if (scsi_result)
3984                         goto respond_in_thread;
3985                 else if (SCSI_DEBUG_OPT_ALL_TSF & scsi_debug_opts)
3986                         scsi_result = device_qfull_result;
3987                 if (SCSI_DEBUG_OPT_Q_NOISE & scsi_debug_opts)
3988                         sdev_printk(KERN_INFO, sdp,
3989                                     "%s: max_queue=%d exceeded, %s\n",
3990                                     __func__, scsi_debug_max_queue,
3991                                     (scsi_result ?  "status: TASK SET FULL" :
3992                                                     "report: host busy"));
3993                 if (scsi_result)
3994                         goto respond_in_thread;
3995                 else
3996                         return SCSI_MLQUEUE_HOST_BUSY;
3997         }
3998         __set_bit(k, queued_in_use_bm);
3999         atomic_inc(&devip->num_in_q);
4000         sqcp = &queued_arr[k];
4001         sqcp->a_cmnd = cmnd;
4002         cmnd->result = scsi_result;
4003         spin_unlock_irqrestore(&queued_arr_lock, iflags);
4004         if (delta_jiff > 0) {
4005                 if (NULL == sqcp->cmnd_timerp) {
4006                         sqcp->cmnd_timerp = kmalloc(sizeof(struct timer_list),
4007                                                     GFP_ATOMIC);
4008                         if (NULL == sqcp->cmnd_timerp)
4009                                 return SCSI_MLQUEUE_HOST_BUSY;
4010                         init_timer(sqcp->cmnd_timerp);
4011                 }
4012                 sqcp->cmnd_timerp->function = sdebug_q_cmd_complete;
4013                 sqcp->cmnd_timerp->data = k;
4014                 sqcp->cmnd_timerp->expires = get_jiffies_64() + delta_jiff;
4015                 add_timer(sqcp->cmnd_timerp);
4016         } else if (scsi_debug_ndelay > 0) {
4017                 ktime_t kt = ktime_set(0, scsi_debug_ndelay);
4018                 struct sdebug_hrtimer *sd_hp = sqcp->sd_hrtp;
4019
4020                 if (NULL == sd_hp) {
4021                         sd_hp = kmalloc(sizeof(*sd_hp), GFP_ATOMIC);
4022                         if (NULL == sd_hp)
4023                                 return SCSI_MLQUEUE_HOST_BUSY;
4024                         sqcp->sd_hrtp = sd_hp;
4025                         hrtimer_init(&sd_hp->hrt, CLOCK_MONOTONIC,
4026                                      HRTIMER_MODE_REL);
4027                         sd_hp->hrt.function = sdebug_q_cmd_hrt_complete;
4028                         sd_hp->qa_indx = k;
4029                 }
4030                 hrtimer_start(&sd_hp->hrt, kt, HRTIMER_MODE_REL);
4031         } else {        /* delay < 0 */
4032                 if (NULL == sqcp->tletp) {
4033                         sqcp->tletp = kmalloc(sizeof(*sqcp->tletp),
4034                                               GFP_ATOMIC);
4035                         if (NULL == sqcp->tletp)
4036                                 return SCSI_MLQUEUE_HOST_BUSY;
4037                         tasklet_init(sqcp->tletp,
4038                                      sdebug_q_cmd_complete, k);
4039                 }
4040                 if (-1 == delta_jiff)
4041                         tasklet_hi_schedule(sqcp->tletp);
4042                 else
4043                         tasklet_schedule(sqcp->tletp);
4044         }
4045         if ((SCSI_DEBUG_OPT_Q_NOISE & scsi_debug_opts) &&
4046             (scsi_result == device_qfull_result))
4047                 sdev_printk(KERN_INFO, sdp,
4048                             "%s: num_in_q=%d +1, %s%s\n", __func__,
4049                             num_in_q, (inject ? "<inject> " : ""),
4050                             "status: TASK SET FULL");
4051         return 0;
4052
4053 respond_in_thread:      /* call back to mid-layer using invocation thread */
4054         cmnd->result = scsi_result;
4055         cmnd->scsi_done(cmnd);
4056         return 0;
4057 }
4058
4059 /* Note: The following macros create attribute files in the
4060    /sys/module/scsi_debug/parameters directory. Unfortunately this
4061    driver is unaware of a change and cannot trigger auxiliary actions
4062    as it can when the corresponding attribute in the
4063    /sys/bus/pseudo/drivers/scsi_debug directory is changed.
4064  */
4065 module_param_named(add_host, scsi_debug_add_host, int, S_IRUGO | S_IWUSR);
4066 module_param_named(ato, scsi_debug_ato, int, S_IRUGO);
4067 module_param_named(clustering, scsi_debug_clustering, bool, S_IRUGO | S_IWUSR);
4068 module_param_named(delay, scsi_debug_delay, int, S_IRUGO | S_IWUSR);
4069 module_param_named(dev_size_mb, scsi_debug_dev_size_mb, int, S_IRUGO);
4070 module_param_named(dif, scsi_debug_dif, int, S_IRUGO);
4071 module_param_named(dix, scsi_debug_dix, int, S_IRUGO);
4072 module_param_named(dsense, scsi_debug_dsense, int, S_IRUGO | S_IWUSR);
4073 module_param_named(every_nth, scsi_debug_every_nth, int, S_IRUGO | S_IWUSR);
4074 module_param_named(fake_rw, scsi_debug_fake_rw, int, S_IRUGO | S_IWUSR);
4075 module_param_named(guard, scsi_debug_guard, uint, S_IRUGO);
4076 module_param_named(host_lock, scsi_debug_host_lock, bool, S_IRUGO | S_IWUSR);
4077 module_param_named(lbpu, scsi_debug_lbpu, int, S_IRUGO);
4078 module_param_named(lbpws, scsi_debug_lbpws, int, S_IRUGO);
4079 module_param_named(lbpws10, scsi_debug_lbpws10, int, S_IRUGO);
4080 module_param_named(lbprz, scsi_debug_lbprz, int, S_IRUGO);
4081 module_param_named(lowest_aligned, scsi_debug_lowest_aligned, int, S_IRUGO);
4082 module_param_named(max_luns, scsi_debug_max_luns, int, S_IRUGO | S_IWUSR);
4083 module_param_named(max_queue, scsi_debug_max_queue, int, S_IRUGO | S_IWUSR);
4084 module_param_named(ndelay, scsi_debug_ndelay, int, S_IRUGO | S_IWUSR);
4085 module_param_named(no_lun_0, scsi_debug_no_lun_0, int, S_IRUGO | S_IWUSR);
4086 module_param_named(no_uld, scsi_debug_no_uld, int, S_IRUGO);
4087 module_param_named(num_parts, scsi_debug_num_parts, int, S_IRUGO);
4088 module_param_named(num_tgts, scsi_debug_num_tgts, int, S_IRUGO | S_IWUSR);
4089 module_param_named(opt_blks, scsi_debug_opt_blks, int, S_IRUGO);
4090 module_param_named(opts, scsi_debug_opts, int, S_IRUGO | S_IWUSR);
4091 module_param_named(physblk_exp, scsi_debug_physblk_exp, int, S_IRUGO);
4092 module_param_named(ptype, scsi_debug_ptype, int, S_IRUGO | S_IWUSR);
4093 module_param_named(removable, scsi_debug_removable, bool, S_IRUGO | S_IWUSR);
4094 module_param_named(scsi_level, scsi_debug_scsi_level, int, S_IRUGO);
4095 module_param_named(sector_size, scsi_debug_sector_size, int, S_IRUGO);
4096 module_param_named(strict, scsi_debug_strict, bool, S_IRUGO | S_IWUSR);
4097 module_param_named(unmap_alignment, scsi_debug_unmap_alignment, int, S_IRUGO);
4098 module_param_named(unmap_granularity, scsi_debug_unmap_granularity, int, S_IRUGO);
4099 module_param_named(unmap_max_blocks, scsi_debug_unmap_max_blocks, int, S_IRUGO);
4100 module_param_named(unmap_max_desc, scsi_debug_unmap_max_desc, int, S_IRUGO);
4101 module_param_named(virtual_gb, scsi_debug_virtual_gb, int, S_IRUGO | S_IWUSR);
4102 module_param_named(vpd_use_hostno, scsi_debug_vpd_use_hostno, int,
4103                    S_IRUGO | S_IWUSR);
4104 module_param_named(write_same_length, scsi_debug_write_same_length, int,
4105                    S_IRUGO | S_IWUSR);
4106
4107 MODULE_AUTHOR("Eric Youngdale + Douglas Gilbert");
4108 MODULE_DESCRIPTION("SCSI debug adapter driver");
4109 MODULE_LICENSE("GPL");
4110 MODULE_VERSION(SCSI_DEBUG_VERSION);
4111
4112 MODULE_PARM_DESC(add_host, "0..127 hosts allowed(def=1)");
4113 MODULE_PARM_DESC(ato, "application tag ownership: 0=disk 1=host (def=1)");
4114 MODULE_PARM_DESC(clustering, "when set enables larger transfers (def=0)");
4115 MODULE_PARM_DESC(delay, "response delay (def=1 jiffy); 0:imm, -1,-2:tiny");
4116 MODULE_PARM_DESC(dev_size_mb, "size in MiB of ram shared by devs(def=8)");
4117 MODULE_PARM_DESC(dif, "data integrity field type: 0-3 (def=0)");
4118 MODULE_PARM_DESC(dix, "data integrity extensions mask (def=0)");
4119 MODULE_PARM_DESC(dsense, "use descriptor sense format(def=0 -> fixed)");
4120 MODULE_PARM_DESC(every_nth, "timeout every nth command(def=0)");
4121 MODULE_PARM_DESC(fake_rw, "fake reads/writes instead of copying (def=0)");
4122 MODULE_PARM_DESC(guard, "protection checksum: 0=crc, 1=ip (def=0)");
4123 MODULE_PARM_DESC(host_lock, "use host_lock around all commands (def=0)");
4124 MODULE_PARM_DESC(lbpu, "enable LBP, support UNMAP command (def=0)");
4125 MODULE_PARM_DESC(lbpws, "enable LBP, support WRITE SAME(16) with UNMAP bit (def=0)");
4126 MODULE_PARM_DESC(lbpws10, "enable LBP, support WRITE SAME(10) with UNMAP bit (def=0)");
4127 MODULE_PARM_DESC(lbprz, "unmapped blocks return 0 on read (def=1)");
4128 MODULE_PARM_DESC(lowest_aligned, "lowest aligned lba (def=0)");
4129 MODULE_PARM_DESC(max_luns, "number of LUNs per target to simulate(def=1)");
4130 MODULE_PARM_DESC(max_queue, "max number of queued commands (1 to max(def))");
4131 MODULE_PARM_DESC(ndelay, "response delay in nanoseconds (def=0 -> ignore)");
4132 MODULE_PARM_DESC(no_lun_0, "no LU number 0 (def=0 -> have lun 0)");
4133 MODULE_PARM_DESC(no_uld, "stop ULD (e.g. sd driver) attaching (def=0))");
4134 MODULE_PARM_DESC(num_parts, "number of partitions(def=0)");
4135 MODULE_PARM_DESC(num_tgts, "number of targets per host to simulate(def=1)");
4136 MODULE_PARM_DESC(opt_blks, "optimal transfer length in block (def=64)");
4137 MODULE_PARM_DESC(opts, "1->noise, 2->medium_err, 4->timeout, 8->recovered_err... (def=0)");
4138 MODULE_PARM_DESC(physblk_exp, "physical block exponent (def=0)");
4139 MODULE_PARM_DESC(ptype, "SCSI peripheral type(def=0[disk])");
4140 MODULE_PARM_DESC(removable, "claim to have removable media (def=0)");
4141 MODULE_PARM_DESC(scsi_level, "SCSI level to simulate(def=6[SPC-4])");
4142 MODULE_PARM_DESC(sector_size, "logical block size in bytes (def=512)");
4143 MODULE_PARM_DESC(strict, "stricter checks: reserved field in cdb (def=0)");
4144 MODULE_PARM_DESC(unmap_alignment, "lowest aligned thin provisioning lba (def=0)");
4145 MODULE_PARM_DESC(unmap_granularity, "thin provisioning granularity in blocks (def=1)");
4146 MODULE_PARM_DESC(unmap_max_blocks, "max # of blocks can be unmapped in one cmd (def=0xffffffff)");
4147 MODULE_PARM_DESC(unmap_max_desc, "max # of ranges that can be unmapped in one cmd (def=256)");
4148 MODULE_PARM_DESC(virtual_gb, "virtual gigabyte (GiB) size (def=0 -> use dev_size_mb)");
4149 MODULE_PARM_DESC(vpd_use_hostno, "0 -> dev ids ignore hostno (def=1 -> unique dev ids)");
4150 MODULE_PARM_DESC(write_same_length, "Maximum blocks per WRITE SAME cmd (def=0xffff)");
4151
4152 static char sdebug_info[256];
4153
4154 static const char * scsi_debug_info(struct Scsi_Host * shp)
4155 {
4156         sprintf(sdebug_info, "scsi_debug, version %s [%s], "
4157                 "dev_size_mb=%d, opts=0x%x", SCSI_DEBUG_VERSION,
4158                 scsi_debug_version_date, scsi_debug_dev_size_mb,
4159                 scsi_debug_opts);
4160         return sdebug_info;
4161 }
4162
4163 /* 'echo <val> > /proc/scsi/scsi_debug/<host_id>' writes to opts */
4164 static int scsi_debug_write_info(struct Scsi_Host *host, char *buffer, int length)
4165 {
4166         char arr[16];
4167         int opts;
4168         int minLen = length > 15 ? 15 : length;
4169
4170         if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
4171                 return -EACCES;
4172         memcpy(arr, buffer, minLen);
4173         arr[minLen] = '\0';
4174         if (1 != sscanf(arr, "%d", &opts))
4175                 return -EINVAL;
4176         scsi_debug_opts = opts;
4177         if (scsi_debug_every_nth != 0)
4178                 atomic_set(&sdebug_cmnd_count, 0);
4179         return length;
4180 }
4181
4182 /* Output seen with 'cat /proc/scsi/scsi_debug/<host_id>'. It will be the
4183  * same for each scsi_debug host (if more than one). Some of the counters
4184  * output are not atomics so might be inaccurate in a busy system. */
4185 static int scsi_debug_show_info(struct seq_file *m, struct Scsi_Host *host)
4186 {
4187         int f, l;
4188         char b[32];
4189
4190         if (scsi_debug_every_nth > 0)
4191                 snprintf(b, sizeof(b), " (curr:%d)",
4192                          ((SCSI_DEBUG_OPT_RARE_TSF & scsi_debug_opts) ?
4193                                 atomic_read(&sdebug_a_tsf) :
4194                                 atomic_read(&sdebug_cmnd_count)));
4195         else
4196                 b[0] = '\0';
4197
4198         seq_printf(m, "scsi_debug adapter driver, version %s [%s]\n"
4199                 "num_tgts=%d, shared (ram) size=%d MB, opts=0x%x, "
4200                 "every_nth=%d%s\n"
4201                 "delay=%d, ndelay=%d, max_luns=%d, q_completions=%d\n"
4202                 "sector_size=%d bytes, cylinders=%d, heads=%d, sectors=%d\n"
4203                 "command aborts=%d; RESETs: device=%d, target=%d, bus=%d, "
4204                 "host=%d\ndix_reads=%d dix_writes=%d dif_errors=%d "
4205                 "usec_in_jiffy=%lu\n",
4206                 SCSI_DEBUG_VERSION, scsi_debug_version_date,
4207                 scsi_debug_num_tgts, scsi_debug_dev_size_mb, scsi_debug_opts,
4208                 scsi_debug_every_nth, b, scsi_debug_delay, scsi_debug_ndelay,
4209                 scsi_debug_max_luns, atomic_read(&sdebug_completions),
4210                 scsi_debug_sector_size, sdebug_cylinders_per, sdebug_heads,
4211                 sdebug_sectors_per, num_aborts, num_dev_resets,
4212                 num_target_resets, num_bus_resets, num_host_resets,
4213                 dix_reads, dix_writes, dif_errors, TICK_NSEC / 1000);
4214
4215         f = find_first_bit(queued_in_use_bm, scsi_debug_max_queue);
4216         if (f != scsi_debug_max_queue) {
4217                 l = find_last_bit(queued_in_use_bm, scsi_debug_max_queue);
4218                 seq_printf(m, "   %s BUSY: first,last bits set: %d,%d\n",
4219                            "queued_in_use_bm", f, l);
4220         }
4221         return 0;
4222 }
4223
4224 static ssize_t delay_show(struct device_driver *ddp, char *buf)
4225 {
4226         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_delay);
4227 }
4228 /* Returns -EBUSY if delay is being changed and commands are queued */
4229 static ssize_t delay_store(struct device_driver *ddp, const char *buf,
4230                            size_t count)
4231 {
4232         int delay, res;
4233
4234         if ((count > 0) && (1 == sscanf(buf, "%d", &delay))) {
4235                 res = count;
4236                 if (scsi_debug_delay != delay) {
4237                         unsigned long iflags;
4238                         int k;
4239
4240                         spin_lock_irqsave(&queued_arr_lock, iflags);
4241                         k = find_first_bit(queued_in_use_bm,
4242                                            scsi_debug_max_queue);
4243                         if (k != scsi_debug_max_queue)
4244                                 res = -EBUSY;   /* have queued commands */
4245                         else {
4246                                 scsi_debug_delay = delay;
4247                                 scsi_debug_ndelay = 0;
4248                         }
4249                         spin_unlock_irqrestore(&queued_arr_lock, iflags);
4250                 }
4251                 return res;
4252         }
4253         return -EINVAL;
4254 }
4255 static DRIVER_ATTR_RW(delay);
4256
4257 static ssize_t ndelay_show(struct device_driver *ddp, char *buf)
4258 {
4259         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_ndelay);
4260 }
4261 /* Returns -EBUSY if ndelay is being changed and commands are queued */
4262 /* If > 0 and accepted then scsi_debug_delay is set to DELAY_OVERRIDDEN */
4263 static ssize_t ndelay_store(struct device_driver *ddp, const char *buf,
4264                            size_t count)
4265 {
4266         unsigned long iflags;
4267         int ndelay, res, k;
4268
4269         if ((count > 0) && (1 == sscanf(buf, "%d", &ndelay)) &&
4270             (ndelay >= 0) && (ndelay < 1000000000)) {
4271                 res = count;
4272                 if (scsi_debug_ndelay != ndelay) {
4273                         spin_lock_irqsave(&queued_arr_lock, iflags);
4274                         k = find_first_bit(queued_in_use_bm,
4275                                            scsi_debug_max_queue);
4276                         if (k != scsi_debug_max_queue)
4277                                 res = -EBUSY;   /* have queued commands */
4278                         else {
4279                                 scsi_debug_ndelay = ndelay;
4280                                 scsi_debug_delay = ndelay ? DELAY_OVERRIDDEN
4281                                                           : DEF_DELAY;
4282                         }
4283                         spin_unlock_irqrestore(&queued_arr_lock, iflags);
4284                 }
4285                 return res;
4286         }
4287         return -EINVAL;
4288 }
4289 static DRIVER_ATTR_RW(ndelay);
4290
4291 static ssize_t opts_show(struct device_driver *ddp, char *buf)
4292 {
4293         return scnprintf(buf, PAGE_SIZE, "0x%x\n", scsi_debug_opts);
4294 }
4295
4296 static ssize_t opts_store(struct device_driver *ddp, const char *buf,
4297                           size_t count)
4298 {
4299         int opts;
4300         char work[20];
4301
4302         if (1 == sscanf(buf, "%10s", work)) {
4303                 if (0 == strncasecmp(work,"0x", 2)) {
4304                         if (1 == sscanf(&work[2], "%x", &opts))
4305                                 goto opts_done;
4306                 } else {
4307                         if (1 == sscanf(work, "%d", &opts))
4308                                 goto opts_done;
4309                 }
4310         }
4311         return -EINVAL;
4312 opts_done:
4313         scsi_debug_opts = opts;
4314         if (SCSI_DEBUG_OPT_RECOVERED_ERR & opts)
4315                 sdebug_any_injecting_opt = true;
4316         else if (SCSI_DEBUG_OPT_TRANSPORT_ERR & opts)
4317                 sdebug_any_injecting_opt = true;
4318         else if (SCSI_DEBUG_OPT_DIF_ERR & opts)
4319                 sdebug_any_injecting_opt = true;
4320         else if (SCSI_DEBUG_OPT_DIX_ERR & opts)
4321                 sdebug_any_injecting_opt = true;
4322         else if (SCSI_DEBUG_OPT_SHORT_TRANSFER & opts)
4323                 sdebug_any_injecting_opt = true;
4324         atomic_set(&sdebug_cmnd_count, 0);
4325         atomic_set(&sdebug_a_tsf, 0);
4326         return count;
4327 }
4328 static DRIVER_ATTR_RW(opts);
4329
4330 static ssize_t ptype_show(struct device_driver *ddp, char *buf)
4331 {
4332         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_ptype);
4333 }
4334 static ssize_t ptype_store(struct device_driver *ddp, const char *buf,
4335                            size_t count)
4336 {
4337         int n;
4338
4339         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4340                 scsi_debug_ptype = n;
4341                 return count;
4342         }
4343         return -EINVAL;
4344 }
4345 static DRIVER_ATTR_RW(ptype);
4346
4347 static ssize_t dsense_show(struct device_driver *ddp, char *buf)
4348 {
4349         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_dsense);
4350 }
4351 static ssize_t dsense_store(struct device_driver *ddp, const char *buf,
4352                             size_t count)
4353 {
4354         int n;
4355
4356         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4357                 scsi_debug_dsense = n;
4358                 return count;
4359         }
4360         return -EINVAL;
4361 }
4362 static DRIVER_ATTR_RW(dsense);
4363
4364 static ssize_t fake_rw_show(struct device_driver *ddp, char *buf)
4365 {
4366         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_fake_rw);
4367 }
4368 static ssize_t fake_rw_store(struct device_driver *ddp, const char *buf,
4369                              size_t count)
4370 {
4371         int n;
4372
4373         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4374                 n = (n > 0);
4375                 scsi_debug_fake_rw = (scsi_debug_fake_rw > 0);
4376                 if (scsi_debug_fake_rw != n) {
4377                         if ((0 == n) && (NULL == fake_storep)) {
4378                                 unsigned long sz =
4379                                         (unsigned long)scsi_debug_dev_size_mb *
4380                                         1048576;
4381
4382                                 fake_storep = vmalloc(sz);
4383                                 if (NULL == fake_storep) {
4384                                         pr_err("out of memory, 9\n");
4385                                         return -ENOMEM;
4386                                 }
4387                                 memset(fake_storep, 0, sz);
4388                         }
4389                         scsi_debug_fake_rw = n;
4390                 }
4391                 return count;
4392         }
4393         return -EINVAL;
4394 }
4395 static DRIVER_ATTR_RW(fake_rw);
4396
4397 static ssize_t no_lun_0_show(struct device_driver *ddp, char *buf)
4398 {
4399         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_no_lun_0);
4400 }
4401 static ssize_t no_lun_0_store(struct device_driver *ddp, const char *buf,
4402                               size_t count)
4403 {
4404         int n;
4405
4406         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4407                 scsi_debug_no_lun_0 = n;
4408                 return count;
4409         }
4410         return -EINVAL;
4411 }
4412 static DRIVER_ATTR_RW(no_lun_0);
4413
4414 static ssize_t num_tgts_show(struct device_driver *ddp, char *buf)
4415 {
4416         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_num_tgts);
4417 }
4418 static ssize_t num_tgts_store(struct device_driver *ddp, const char *buf,
4419                               size_t count)
4420 {
4421         int n;
4422
4423         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4424                 scsi_debug_num_tgts = n;
4425                 sdebug_max_tgts_luns();
4426                 return count;
4427         }
4428         return -EINVAL;
4429 }
4430 static DRIVER_ATTR_RW(num_tgts);
4431
4432 static ssize_t dev_size_mb_show(struct device_driver *ddp, char *buf)
4433 {
4434         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_dev_size_mb);
4435 }
4436 static DRIVER_ATTR_RO(dev_size_mb);
4437
4438 static ssize_t num_parts_show(struct device_driver *ddp, char *buf)
4439 {
4440         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_num_parts);
4441 }
4442 static DRIVER_ATTR_RO(num_parts);
4443
4444 static ssize_t every_nth_show(struct device_driver *ddp, char *buf)
4445 {
4446         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_every_nth);
4447 }
4448 static ssize_t every_nth_store(struct device_driver *ddp, const char *buf,
4449                                size_t count)
4450 {
4451         int nth;
4452
4453         if ((count > 0) && (1 == sscanf(buf, "%d", &nth))) {
4454                 scsi_debug_every_nth = nth;
4455                 atomic_set(&sdebug_cmnd_count, 0);
4456                 return count;
4457         }
4458         return -EINVAL;
4459 }
4460 static DRIVER_ATTR_RW(every_nth);
4461
4462 static ssize_t max_luns_show(struct device_driver *ddp, char *buf)
4463 {
4464         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_max_luns);
4465 }
4466 static ssize_t max_luns_store(struct device_driver *ddp, const char *buf,
4467                               size_t count)
4468 {
4469         int n;
4470         bool changed;
4471
4472         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4473                 changed = (scsi_debug_max_luns != n);
4474                 scsi_debug_max_luns = n;
4475                 sdebug_max_tgts_luns();
4476                 if (changed && (scsi_debug_scsi_level >= 5)) {  /* >= SPC-3 */
4477                         struct sdebug_host_info *sdhp;
4478                         struct sdebug_dev_info *dp;
4479
4480                         spin_lock(&sdebug_host_list_lock);
4481                         list_for_each_entry(sdhp, &sdebug_host_list,
4482                                             host_list) {
4483                                 list_for_each_entry(dp, &sdhp->dev_info_list,
4484                                                     dev_list) {
4485                                         set_bit(SDEBUG_UA_LUNS_CHANGED,
4486                                                 dp->uas_bm);
4487                                 }
4488                         }
4489                         spin_unlock(&sdebug_host_list_lock);
4490                 }
4491                 return count;
4492         }
4493         return -EINVAL;
4494 }
4495 static DRIVER_ATTR_RW(max_luns);
4496
4497 static ssize_t max_queue_show(struct device_driver *ddp, char *buf)
4498 {
4499         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_max_queue);
4500 }
4501 /* N.B. max_queue can be changed while there are queued commands. In flight
4502  * commands beyond the new max_queue will be completed. */
4503 static ssize_t max_queue_store(struct device_driver *ddp, const char *buf,
4504                                size_t count)
4505 {
4506         unsigned long iflags;
4507         int n, k;
4508
4509         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n > 0) &&
4510             (n <= SCSI_DEBUG_CANQUEUE)) {
4511                 spin_lock_irqsave(&queued_arr_lock, iflags);
4512                 k = find_last_bit(queued_in_use_bm, SCSI_DEBUG_CANQUEUE);
4513                 scsi_debug_max_queue = n;
4514                 if (SCSI_DEBUG_CANQUEUE == k)
4515                         atomic_set(&retired_max_queue, 0);
4516                 else if (k >= n)
4517                         atomic_set(&retired_max_queue, k + 1);
4518                 else
4519                         atomic_set(&retired_max_queue, 0);
4520                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
4521                 return count;
4522         }
4523         return -EINVAL;
4524 }
4525 static DRIVER_ATTR_RW(max_queue);
4526
4527 static ssize_t no_uld_show(struct device_driver *ddp, char *buf)
4528 {
4529         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_no_uld);
4530 }
4531 static DRIVER_ATTR_RO(no_uld);
4532
4533 static ssize_t scsi_level_show(struct device_driver *ddp, char *buf)
4534 {
4535         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_scsi_level);
4536 }
4537 static DRIVER_ATTR_RO(scsi_level);
4538
4539 static ssize_t virtual_gb_show(struct device_driver *ddp, char *buf)
4540 {
4541         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_virtual_gb);
4542 }
4543 static ssize_t virtual_gb_store(struct device_driver *ddp, const char *buf,
4544                                 size_t count)
4545 {
4546         int n;
4547         bool changed;
4548
4549         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4550                 changed = (scsi_debug_virtual_gb != n);
4551                 scsi_debug_virtual_gb = n;
4552                 sdebug_capacity = get_sdebug_capacity();
4553                 if (changed) {
4554                         struct sdebug_host_info *sdhp;
4555                         struct sdebug_dev_info *dp;
4556
4557                         spin_lock(&sdebug_host_list_lock);
4558                         list_for_each_entry(sdhp, &sdebug_host_list,
4559                                             host_list) {
4560                                 list_for_each_entry(dp, &sdhp->dev_info_list,
4561                                                     dev_list) {
4562                                         set_bit(SDEBUG_UA_CAPACITY_CHANGED,
4563                                                 dp->uas_bm);
4564                                 }
4565                         }
4566                         spin_unlock(&sdebug_host_list_lock);
4567                 }
4568                 return count;
4569         }
4570         return -EINVAL;
4571 }
4572 static DRIVER_ATTR_RW(virtual_gb);
4573
4574 static ssize_t add_host_show(struct device_driver *ddp, char *buf)
4575 {
4576         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_add_host);
4577 }
4578
4579 static ssize_t add_host_store(struct device_driver *ddp, const char *buf,
4580                               size_t count)
4581 {
4582         int delta_hosts;
4583
4584         if (sscanf(buf, "%d", &delta_hosts) != 1)
4585                 return -EINVAL;
4586         if (delta_hosts > 0) {
4587                 do {
4588                         sdebug_add_adapter();
4589                 } while (--delta_hosts);
4590         } else if (delta_hosts < 0) {
4591                 do {
4592                         sdebug_remove_adapter();
4593                 } while (++delta_hosts);
4594         }
4595         return count;
4596 }
4597 static DRIVER_ATTR_RW(add_host);
4598
4599 static ssize_t vpd_use_hostno_show(struct device_driver *ddp, char *buf)
4600 {
4601         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_vpd_use_hostno);
4602 }
4603 static ssize_t vpd_use_hostno_store(struct device_driver *ddp, const char *buf,
4604                                     size_t count)
4605 {
4606         int n;
4607
4608         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4609                 scsi_debug_vpd_use_hostno = n;
4610                 return count;
4611         }
4612         return -EINVAL;
4613 }
4614 static DRIVER_ATTR_RW(vpd_use_hostno);
4615
4616 static ssize_t sector_size_show(struct device_driver *ddp, char *buf)
4617 {
4618         return scnprintf(buf, PAGE_SIZE, "%u\n", scsi_debug_sector_size);
4619 }
4620 static DRIVER_ATTR_RO(sector_size);
4621
4622 static ssize_t dix_show(struct device_driver *ddp, char *buf)
4623 {
4624         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_dix);
4625 }
4626 static DRIVER_ATTR_RO(dix);
4627
4628 static ssize_t dif_show(struct device_driver *ddp, char *buf)
4629 {
4630         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_dif);
4631 }
4632 static DRIVER_ATTR_RO(dif);
4633
4634 static ssize_t guard_show(struct device_driver *ddp, char *buf)
4635 {
4636         return scnprintf(buf, PAGE_SIZE, "%u\n", scsi_debug_guard);
4637 }
4638 static DRIVER_ATTR_RO(guard);
4639
4640 static ssize_t ato_show(struct device_driver *ddp, char *buf)
4641 {
4642         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_ato);
4643 }
4644 static DRIVER_ATTR_RO(ato);
4645
4646 static ssize_t map_show(struct device_driver *ddp, char *buf)
4647 {
4648         ssize_t count;
4649
4650         if (!scsi_debug_lbp())
4651                 return scnprintf(buf, PAGE_SIZE, "0-%u\n",
4652                                  sdebug_store_sectors);
4653
4654         count = scnprintf(buf, PAGE_SIZE - 1, "%*pbl",
4655                           (int)map_size, map_storep);
4656         buf[count++] = '\n';
4657         buf[count] = '\0';
4658
4659         return count;
4660 }
4661 static DRIVER_ATTR_RO(map);
4662
4663 static ssize_t removable_show(struct device_driver *ddp, char *buf)
4664 {
4665         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_removable ? 1 : 0);
4666 }
4667 static ssize_t removable_store(struct device_driver *ddp, const char *buf,
4668                                size_t count)
4669 {
4670         int n;
4671
4672         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4673                 scsi_debug_removable = (n > 0);
4674                 return count;
4675         }
4676         return -EINVAL;
4677 }
4678 static DRIVER_ATTR_RW(removable);
4679
4680 static ssize_t host_lock_show(struct device_driver *ddp, char *buf)
4681 {
4682         return scnprintf(buf, PAGE_SIZE, "%d\n", !!scsi_debug_host_lock);
4683 }
4684 /* Returns -EBUSY if host_lock is being changed and commands are queued */
4685 static ssize_t host_lock_store(struct device_driver *ddp, const char *buf,
4686                                size_t count)
4687 {
4688         int n, res;
4689
4690         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4691                 bool new_host_lock = (n > 0);
4692
4693                 res = count;
4694                 if (new_host_lock != scsi_debug_host_lock) {
4695                         unsigned long iflags;
4696                         int k;
4697
4698                         spin_lock_irqsave(&queued_arr_lock, iflags);
4699                         k = find_first_bit(queued_in_use_bm,
4700                                            scsi_debug_max_queue);
4701                         if (k != scsi_debug_max_queue)
4702                                 res = -EBUSY;   /* have queued commands */
4703                         else
4704                                 scsi_debug_host_lock = new_host_lock;
4705                         spin_unlock_irqrestore(&queued_arr_lock, iflags);
4706                 }
4707                 return res;
4708         }
4709         return -EINVAL;
4710 }
4711 static DRIVER_ATTR_RW(host_lock);
4712
4713 static ssize_t strict_show(struct device_driver *ddp, char *buf)
4714 {
4715         return scnprintf(buf, PAGE_SIZE, "%d\n", !!scsi_debug_strict);
4716 }
4717 static ssize_t strict_store(struct device_driver *ddp, const char *buf,
4718                             size_t count)
4719 {
4720         int n;
4721
4722         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4723                 scsi_debug_strict = (n > 0);
4724                 return count;
4725         }
4726         return -EINVAL;
4727 }
4728 static DRIVER_ATTR_RW(strict);
4729
4730
4731 /* Note: The following array creates attribute files in the
4732    /sys/bus/pseudo/drivers/scsi_debug directory. The advantage of these
4733    files (over those found in the /sys/module/scsi_debug/parameters
4734    directory) is that auxiliary actions can be triggered when an attribute
4735    is changed. For example see: sdebug_add_host_store() above.
4736  */
4737
4738 static struct attribute *sdebug_drv_attrs[] = {
4739         &driver_attr_delay.attr,
4740         &driver_attr_opts.attr,
4741         &driver_attr_ptype.attr,
4742         &driver_attr_dsense.attr,
4743         &driver_attr_fake_rw.attr,
4744         &driver_attr_no_lun_0.attr,
4745         &driver_attr_num_tgts.attr,
4746         &driver_attr_dev_size_mb.attr,
4747         &driver_attr_num_parts.attr,
4748         &driver_attr_every_nth.attr,
4749         &driver_attr_max_luns.attr,
4750         &driver_attr_max_queue.attr,
4751         &driver_attr_no_uld.attr,
4752         &driver_attr_scsi_level.attr,
4753         &driver_attr_virtual_gb.attr,
4754         &driver_attr_add_host.attr,
4755         &driver_attr_vpd_use_hostno.attr,
4756         &driver_attr_sector_size.attr,
4757         &driver_attr_dix.attr,
4758         &driver_attr_dif.attr,
4759         &driver_attr_guard.attr,
4760         &driver_attr_ato.attr,
4761         &driver_attr_map.attr,
4762         &driver_attr_removable.attr,
4763         &driver_attr_host_lock.attr,
4764         &driver_attr_ndelay.attr,
4765         &driver_attr_strict.attr,
4766         NULL,
4767 };
4768 ATTRIBUTE_GROUPS(sdebug_drv);
4769
4770 static struct device *pseudo_primary;
4771
4772 static int __init scsi_debug_init(void)
4773 {
4774         unsigned long sz;
4775         int host_to_add;
4776         int k;
4777         int ret;
4778
4779         atomic_set(&sdebug_cmnd_count, 0);
4780         atomic_set(&sdebug_completions, 0);
4781         atomic_set(&retired_max_queue, 0);
4782
4783         if (scsi_debug_ndelay >= 1000000000) {
4784                 pr_warn("ndelay must be less than 1 second, ignored\n");
4785                 scsi_debug_ndelay = 0;
4786         } else if (scsi_debug_ndelay > 0)
4787                 scsi_debug_delay = DELAY_OVERRIDDEN;
4788
4789         switch (scsi_debug_sector_size) {
4790         case  512:
4791         case 1024:
4792         case 2048:
4793         case 4096:
4794                 break;
4795         default:
4796                 pr_err("invalid sector_size %d\n", scsi_debug_sector_size);
4797                 return -EINVAL;
4798         }
4799
4800         switch (scsi_debug_dif) {
4801
4802         case SD_DIF_TYPE0_PROTECTION:
4803         case SD_DIF_TYPE1_PROTECTION:
4804         case SD_DIF_TYPE2_PROTECTION:
4805         case SD_DIF_TYPE3_PROTECTION:
4806                 break;
4807
4808         default:
4809                 pr_err("dif must be 0, 1, 2 or 3\n");
4810                 return -EINVAL;
4811         }
4812
4813         if (scsi_debug_guard > 1) {
4814                 pr_err("guard must be 0 or 1\n");
4815                 return -EINVAL;
4816         }
4817
4818         if (scsi_debug_ato > 1) {
4819                 pr_err("ato must be 0 or 1\n");
4820                 return -EINVAL;
4821         }
4822
4823         if (scsi_debug_physblk_exp > 15) {
4824                 pr_err("invalid physblk_exp %u\n", scsi_debug_physblk_exp);
4825                 return -EINVAL;
4826         }
4827
4828         if (scsi_debug_lowest_aligned > 0x3fff) {
4829                 pr_err("lowest_aligned too big: %u\n",
4830                         scsi_debug_lowest_aligned);
4831                 return -EINVAL;
4832         }
4833
4834         if (scsi_debug_dev_size_mb < 1)
4835                 scsi_debug_dev_size_mb = 1;  /* force minimum 1 MB ramdisk */
4836         sz = (unsigned long)scsi_debug_dev_size_mb * 1048576;
4837         sdebug_store_sectors = sz / scsi_debug_sector_size;
4838         sdebug_capacity = get_sdebug_capacity();
4839
4840         /* play around with geometry, don't waste too much on track 0 */
4841         sdebug_heads = 8;
4842         sdebug_sectors_per = 32;
4843         if (scsi_debug_dev_size_mb >= 16)
4844                 sdebug_heads = 32;
4845         else if (scsi_debug_dev_size_mb >= 256)
4846                 sdebug_heads = 64;
4847         sdebug_cylinders_per = (unsigned long)sdebug_capacity /
4848                                (sdebug_sectors_per * sdebug_heads);
4849         if (sdebug_cylinders_per >= 1024) {
4850                 /* other LLDs do this; implies >= 1GB ram disk ... */
4851                 sdebug_heads = 255;
4852                 sdebug_sectors_per = 63;
4853                 sdebug_cylinders_per = (unsigned long)sdebug_capacity /
4854                                (sdebug_sectors_per * sdebug_heads);
4855         }
4856
4857         if (0 == scsi_debug_fake_rw) {
4858                 fake_storep = vmalloc(sz);
4859                 if (NULL == fake_storep) {
4860                         pr_err("out of memory, 1\n");
4861                         return -ENOMEM;
4862                 }
4863                 memset(fake_storep, 0, sz);
4864                 if (scsi_debug_num_parts > 0)
4865                         sdebug_build_parts(fake_storep, sz);
4866         }
4867
4868         if (scsi_debug_dix) {
4869                 int dif_size;
4870
4871                 dif_size = sdebug_store_sectors * sizeof(struct sd_dif_tuple);
4872                 dif_storep = vmalloc(dif_size);
4873
4874                 pr_err("dif_storep %u bytes @ %p\n", dif_size, dif_storep);
4875
4876                 if (dif_storep == NULL) {
4877                         pr_err("out of mem. (DIX)\n");
4878                         ret = -ENOMEM;
4879                         goto free_vm;
4880                 }
4881
4882                 memset(dif_storep, 0xff, dif_size);
4883         }
4884
4885         /* Logical Block Provisioning */
4886         if (scsi_debug_lbp()) {
4887                 scsi_debug_unmap_max_blocks =
4888                         clamp(scsi_debug_unmap_max_blocks, 0U, 0xffffffffU);
4889
4890                 scsi_debug_unmap_max_desc =
4891                         clamp(scsi_debug_unmap_max_desc, 0U, 256U);
4892
4893                 scsi_debug_unmap_granularity =
4894                         clamp(scsi_debug_unmap_granularity, 1U, 0xffffffffU);
4895
4896                 if (scsi_debug_unmap_alignment &&
4897                     scsi_debug_unmap_granularity <=
4898                     scsi_debug_unmap_alignment) {
4899                         pr_err("ERR: unmap_granularity <= unmap_alignment\n");
4900                         return -EINVAL;
4901                 }
4902
4903                 map_size = lba_to_map_index(sdebug_store_sectors - 1) + 1;
4904                 map_storep = vmalloc(BITS_TO_LONGS(map_size) * sizeof(long));
4905
4906                 pr_info("%lu provisioning blocks\n", map_size);
4907
4908                 if (map_storep == NULL) {
4909                         pr_err("out of mem. (MAP)\n");
4910                         ret = -ENOMEM;
4911                         goto free_vm;
4912                 }
4913
4914                 bitmap_zero(map_storep, map_size);
4915
4916                 /* Map first 1KB for partition table */
4917                 if (scsi_debug_num_parts)
4918                         map_region(0, 2);
4919         }
4920
4921         pseudo_primary = root_device_register("pseudo_0");
4922         if (IS_ERR(pseudo_primary)) {
4923                 pr_warn("root_device_register() error\n");
4924                 ret = PTR_ERR(pseudo_primary);
4925                 goto free_vm;
4926         }
4927         ret = bus_register(&pseudo_lld_bus);
4928         if (ret < 0) {
4929                 pr_warn("bus_register error: %d\n", ret);
4930                 goto dev_unreg;
4931         }
4932         ret = driver_register(&sdebug_driverfs_driver);
4933         if (ret < 0) {
4934                 pr_warn("driver_register error: %d\n", ret);
4935                 goto bus_unreg;
4936         }
4937
4938         host_to_add = scsi_debug_add_host;
4939         scsi_debug_add_host = 0;
4940
4941         for (k = 0; k < host_to_add; k++) {
4942                 if (sdebug_add_adapter()) {
4943                         pr_err("sdebug_add_adapter failed k=%d\n", k);
4944                         break;
4945                 }
4946         }
4947
4948         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
4949                 pr_info("built %d host(s)\n", scsi_debug_add_host);
4950
4951         return 0;
4952
4953 bus_unreg:
4954         bus_unregister(&pseudo_lld_bus);
4955 dev_unreg:
4956         root_device_unregister(pseudo_primary);
4957 free_vm:
4958         if (map_storep)
4959                 vfree(map_storep);
4960         if (dif_storep)
4961                 vfree(dif_storep);
4962         vfree(fake_storep);
4963
4964         return ret;
4965 }
4966
4967 static void __exit scsi_debug_exit(void)
4968 {
4969         int k = scsi_debug_add_host;
4970
4971         stop_all_queued();
4972         free_all_queued();
4973         for (; k; k--)
4974                 sdebug_remove_adapter();
4975         driver_unregister(&sdebug_driverfs_driver);
4976         bus_unregister(&pseudo_lld_bus);
4977         root_device_unregister(pseudo_primary);
4978
4979         if (dif_storep)
4980                 vfree(dif_storep);
4981
4982         vfree(fake_storep);
4983 }
4984
4985 device_initcall(scsi_debug_init);
4986 module_exit(scsi_debug_exit);
4987
4988 static void sdebug_release_adapter(struct device * dev)
4989 {
4990         struct sdebug_host_info *sdbg_host;
4991
4992         sdbg_host = to_sdebug_host(dev);
4993         kfree(sdbg_host);
4994 }
4995
4996 static int sdebug_add_adapter(void)
4997 {
4998         int k, devs_per_host;
4999         int error = 0;
5000         struct sdebug_host_info *sdbg_host;
5001         struct sdebug_dev_info *sdbg_devinfo, *tmp;
5002
5003         sdbg_host = kzalloc(sizeof(*sdbg_host),GFP_KERNEL);
5004         if (NULL == sdbg_host) {
5005                 pr_err("out of memory at line %d\n", __LINE__);
5006                 return -ENOMEM;
5007         }
5008
5009         INIT_LIST_HEAD(&sdbg_host->dev_info_list);
5010
5011         devs_per_host = scsi_debug_num_tgts * scsi_debug_max_luns;
5012         for (k = 0; k < devs_per_host; k++) {
5013                 sdbg_devinfo = sdebug_device_create(sdbg_host, GFP_KERNEL);
5014                 if (!sdbg_devinfo) {
5015                         pr_err("out of memory at line %d\n", __LINE__);
5016                         error = -ENOMEM;
5017                         goto clean;
5018                 }
5019         }
5020
5021         spin_lock(&sdebug_host_list_lock);
5022         list_add_tail(&sdbg_host->host_list, &sdebug_host_list);
5023         spin_unlock(&sdebug_host_list_lock);
5024
5025         sdbg_host->dev.bus = &pseudo_lld_bus;
5026         sdbg_host->dev.parent = pseudo_primary;
5027         sdbg_host->dev.release = &sdebug_release_adapter;
5028         dev_set_name(&sdbg_host->dev, "adapter%d", scsi_debug_add_host);
5029
5030         error = device_register(&sdbg_host->dev);
5031
5032         if (error)
5033                 goto clean;
5034
5035         ++scsi_debug_add_host;
5036         return error;
5037
5038 clean:
5039         list_for_each_entry_safe(sdbg_devinfo, tmp, &sdbg_host->dev_info_list,
5040                                  dev_list) {
5041                 list_del(&sdbg_devinfo->dev_list);
5042                 kfree(sdbg_devinfo);
5043         }
5044
5045         kfree(sdbg_host);
5046         return error;
5047 }
5048
5049 static void sdebug_remove_adapter(void)
5050 {
5051         struct sdebug_host_info * sdbg_host = NULL;
5052
5053         spin_lock(&sdebug_host_list_lock);
5054         if (!list_empty(&sdebug_host_list)) {
5055                 sdbg_host = list_entry(sdebug_host_list.prev,
5056                                        struct sdebug_host_info, host_list);
5057                 list_del(&sdbg_host->host_list);
5058         }
5059         spin_unlock(&sdebug_host_list_lock);
5060
5061         if (!sdbg_host)
5062                 return;
5063
5064         device_unregister(&sdbg_host->dev);
5065         --scsi_debug_add_host;
5066 }
5067
5068 static int
5069 sdebug_change_qdepth(struct scsi_device *sdev, int qdepth)
5070 {
5071         int num_in_q = 0;
5072         unsigned long iflags;
5073         struct sdebug_dev_info *devip;
5074
5075         spin_lock_irqsave(&queued_arr_lock, iflags);
5076         devip = (struct sdebug_dev_info *)sdev->hostdata;
5077         if (NULL == devip) {
5078                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
5079                 return  -ENODEV;
5080         }
5081         num_in_q = atomic_read(&devip->num_in_q);
5082         spin_unlock_irqrestore(&queued_arr_lock, iflags);
5083
5084         if (qdepth < 1)
5085                 qdepth = 1;
5086         /* allow to exceed max host queued_arr elements for testing */
5087         if (qdepth > SCSI_DEBUG_CANQUEUE + 10)
5088                 qdepth = SCSI_DEBUG_CANQUEUE + 10;
5089         scsi_change_queue_depth(sdev, qdepth);
5090
5091         if (SCSI_DEBUG_OPT_Q_NOISE & scsi_debug_opts) {
5092                 sdev_printk(KERN_INFO, sdev,
5093                             "%s: qdepth=%d, num_in_q=%d\n",
5094                             __func__, qdepth, num_in_q);
5095         }
5096         return sdev->queue_depth;
5097 }
5098
5099 static int
5100 check_inject(struct scsi_cmnd *scp)
5101 {
5102         struct sdebug_scmd_extra_t *ep = scsi_cmd_priv(scp);
5103
5104         memset(ep, 0, sizeof(struct sdebug_scmd_extra_t));
5105
5106         if (atomic_inc_return(&sdebug_cmnd_count) >=
5107             abs(scsi_debug_every_nth)) {
5108                 atomic_set(&sdebug_cmnd_count, 0);
5109                 if (scsi_debug_every_nth < -1)
5110                         scsi_debug_every_nth = -1;
5111                 if (SCSI_DEBUG_OPT_TIMEOUT & scsi_debug_opts)
5112                         return 1; /* ignore command causing timeout */
5113                 else if (SCSI_DEBUG_OPT_MAC_TIMEOUT & scsi_debug_opts &&
5114                          scsi_medium_access_command(scp))
5115                         return 1; /* time out reads and writes */
5116                 if (sdebug_any_injecting_opt) {
5117                         int opts = scsi_debug_opts;
5118
5119                         if (SCSI_DEBUG_OPT_RECOVERED_ERR & opts)
5120                                 ep->inj_recovered = true;
5121                         else if (SCSI_DEBUG_OPT_TRANSPORT_ERR & opts)
5122                                 ep->inj_transport = true;
5123                         else if (SCSI_DEBUG_OPT_DIF_ERR & opts)
5124                                 ep->inj_dif = true;
5125                         else if (SCSI_DEBUG_OPT_DIX_ERR & opts)
5126                                 ep->inj_dix = true;
5127                         else if (SCSI_DEBUG_OPT_SHORT_TRANSFER & opts)
5128                                 ep->inj_short = true;
5129                 }
5130         }
5131         return 0;
5132 }
5133
5134 static int
5135 scsi_debug_queuecommand(struct scsi_cmnd *scp)
5136 {
5137         u8 sdeb_i;
5138         struct scsi_device *sdp = scp->device;
5139         const struct opcode_info_t *oip;
5140         const struct opcode_info_t *r_oip;
5141         struct sdebug_dev_info *devip;
5142         u8 *cmd = scp->cmnd;
5143         int (*r_pfp)(struct scsi_cmnd *, struct sdebug_dev_info *);
5144         int k, na;
5145         int errsts = 0;
5146         int errsts_no_connect = DID_NO_CONNECT << 16;
5147         u32 flags;
5148         u16 sa;
5149         u8 opcode = cmd[0];
5150         bool has_wlun_rl;
5151         bool debug = !!(SCSI_DEBUG_OPT_NOISE & scsi_debug_opts);
5152
5153         scsi_set_resid(scp, 0);
5154         if (debug && !(SCSI_DEBUG_OPT_NO_CDB_NOISE & scsi_debug_opts)) {
5155                 char b[120];
5156                 int n, len, sb;
5157
5158                 len = scp->cmd_len;
5159                 sb = (int)sizeof(b);
5160                 if (len > 32)
5161                         strcpy(b, "too long, over 32 bytes");
5162                 else {
5163                         for (k = 0, n = 0; k < len && n < sb; ++k)
5164                                 n += scnprintf(b + n, sb - n, "%02x ",
5165                                                (u32)cmd[k]);
5166                 }
5167                 sdev_printk(KERN_INFO, sdp, "%s: cmd %s\n", my_name, b);
5168         }
5169         has_wlun_rl = (sdp->lun == SCSI_W_LUN_REPORT_LUNS);
5170         if ((sdp->lun >= scsi_debug_max_luns) && !has_wlun_rl)
5171                 return schedule_resp(scp, NULL, errsts_no_connect, 0);
5172
5173         sdeb_i = opcode_ind_arr[opcode];        /* fully mapped */
5174         oip = &opcode_info_arr[sdeb_i];         /* safe if table consistent */
5175         devip = (struct sdebug_dev_info *)sdp->hostdata;
5176         if (!devip) {
5177                 devip = devInfoReg(sdp);
5178                 if (NULL == devip)
5179                         return schedule_resp(scp, NULL, errsts_no_connect, 0);
5180         }
5181         na = oip->num_attached;
5182         r_pfp = oip->pfp;
5183         if (na) {       /* multiple commands with this opcode */
5184                 r_oip = oip;
5185                 if (FF_SA & r_oip->flags) {
5186                         if (F_SA_LOW & oip->flags)
5187                                 sa = 0x1f & cmd[1];
5188                         else
5189                                 sa = get_unaligned_be16(cmd + 8);
5190                         for (k = 0; k <= na; oip = r_oip->arrp + k++) {
5191                                 if (opcode == oip->opcode && sa == oip->sa)
5192                                         break;
5193                         }
5194                 } else {   /* since no service action only check opcode */
5195                         for (k = 0; k <= na; oip = r_oip->arrp + k++) {
5196                                 if (opcode == oip->opcode)
5197                                         break;
5198                         }
5199                 }
5200                 if (k > na) {
5201                         if (F_SA_LOW & r_oip->flags)
5202                                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 1, 4);
5203                         else if (F_SA_HIGH & r_oip->flags)
5204                                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 8, 7);
5205                         else
5206                                 mk_sense_invalid_opcode(scp);
5207                         goto check_cond;
5208                 }
5209         }       /* else (when na==0) we assume the oip is a match */
5210         flags = oip->flags;
5211         if (F_INV_OP & flags) {
5212                 mk_sense_invalid_opcode(scp);
5213                 goto check_cond;
5214         }
5215         if (has_wlun_rl && !(F_RL_WLUN_OK & flags)) {
5216                 if (debug)
5217                         sdev_printk(KERN_INFO, sdp, "scsi_debug: Opcode: "
5218                                     "0x%x not supported for wlun\n", opcode);
5219                 mk_sense_invalid_opcode(scp);
5220                 goto check_cond;
5221         }
5222         if (scsi_debug_strict) {        /* check cdb against mask */
5223                 u8 rem;
5224                 int j;
5225
5226                 for (k = 1; k < oip->len_mask[0] && k < 16; ++k) {
5227                         rem = ~oip->len_mask[k] & cmd[k];
5228                         if (rem) {
5229                                 for (j = 7; j >= 0; --j, rem <<= 1) {
5230                                         if (0x80 & rem)
5231                                                 break;
5232                                 }
5233                                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, k, j);
5234                                 goto check_cond;
5235                         }
5236                 }
5237         }
5238         if (!(F_SKIP_UA & flags) &&
5239             SDEBUG_NUM_UAS != find_first_bit(devip->uas_bm, SDEBUG_NUM_UAS)) {
5240                 errsts = check_readiness(scp, UAS_ONLY, devip);
5241                 if (errsts)
5242                         goto check_cond;
5243         }
5244         if ((F_M_ACCESS & flags) && devip->stopped) {
5245                 mk_sense_buffer(scp, NOT_READY, LOGICAL_UNIT_NOT_READY, 0x2);
5246                 if (debug)
5247                         sdev_printk(KERN_INFO, sdp, "%s reports: Not ready: "
5248                                     "%s\n", my_name, "initializing command "
5249                                     "required");
5250                 errsts = check_condition_result;
5251                 goto fini;
5252         }
5253         if (scsi_debug_fake_rw && (F_FAKE_RW & flags))
5254                 goto fini;
5255         if (scsi_debug_every_nth) {
5256                 if (check_inject(scp))
5257                         return 0;       /* ignore command: make trouble */
5258         }
5259         if (oip->pfp)   /* if this command has a resp_* function, call it */
5260                 errsts = oip->pfp(scp, devip);
5261         else if (r_pfp) /* if leaf function ptr NULL, try the root's */
5262                 errsts = r_pfp(scp, devip);
5263
5264 fini:
5265         return schedule_resp(scp, devip, errsts,
5266                              ((F_DELAY_OVERR & flags) ? 0 : scsi_debug_delay));
5267 check_cond:
5268         return schedule_resp(scp, devip, check_condition_result, 0);
5269 }
5270
5271 static int
5272 sdebug_queuecommand_lock_or_not(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
5273 {
5274         if (scsi_debug_host_lock) {
5275                 unsigned long iflags;
5276                 int rc;
5277
5278                 spin_lock_irqsave(shost->host_lock, iflags);
5279                 rc = scsi_debug_queuecommand(cmd);
5280                 spin_unlock_irqrestore(shost->host_lock, iflags);
5281                 return rc;
5282         } else
5283                 return scsi_debug_queuecommand(cmd);
5284 }
5285
5286 static struct scsi_host_template sdebug_driver_template = {
5287         .show_info =            scsi_debug_show_info,
5288         .write_info =           scsi_debug_write_info,
5289         .proc_name =            sdebug_proc_name,
5290         .name =                 "SCSI DEBUG",
5291         .info =                 scsi_debug_info,
5292         .slave_alloc =          scsi_debug_slave_alloc,
5293         .slave_configure =      scsi_debug_slave_configure,
5294         .slave_destroy =        scsi_debug_slave_destroy,
5295         .ioctl =                scsi_debug_ioctl,
5296         .queuecommand =         sdebug_queuecommand_lock_or_not,
5297         .change_queue_depth =   sdebug_change_qdepth,
5298         .eh_abort_handler =     scsi_debug_abort,
5299         .eh_device_reset_handler = scsi_debug_device_reset,
5300         .eh_target_reset_handler = scsi_debug_target_reset,
5301         .eh_bus_reset_handler = scsi_debug_bus_reset,
5302         .eh_host_reset_handler = scsi_debug_host_reset,
5303         .can_queue =            SCSI_DEBUG_CANQUEUE,
5304         .this_id =              7,
5305         .sg_tablesize =         SCSI_MAX_SG_CHAIN_SEGMENTS,
5306         .cmd_per_lun =          DEF_CMD_PER_LUN,
5307         .max_sectors =          -1U,
5308         .use_clustering =       DISABLE_CLUSTERING,
5309         .module =               THIS_MODULE,
5310         .track_queue_depth =    1,
5311         .cmd_size =             sizeof(struct sdebug_scmd_extra_t),
5312 };
5313
5314 static int sdebug_driver_probe(struct device * dev)
5315 {
5316         int error = 0;
5317         int opts;
5318         struct sdebug_host_info *sdbg_host;
5319         struct Scsi_Host *hpnt;
5320         int host_prot;
5321
5322         sdbg_host = to_sdebug_host(dev);
5323
5324         sdebug_driver_template.can_queue = scsi_debug_max_queue;
5325         if (scsi_debug_clustering)
5326                 sdebug_driver_template.use_clustering = ENABLE_CLUSTERING;
5327         hpnt = scsi_host_alloc(&sdebug_driver_template, sizeof(sdbg_host));
5328         if (NULL == hpnt) {
5329                 pr_err("scsi_host_alloc failed\n");
5330                 error = -ENODEV;
5331                 return error;
5332         }
5333
5334         sdbg_host->shost = hpnt;
5335         *((struct sdebug_host_info **)hpnt->hostdata) = sdbg_host;
5336         if ((hpnt->this_id >= 0) && (scsi_debug_num_tgts > hpnt->this_id))
5337                 hpnt->max_id = scsi_debug_num_tgts + 1;
5338         else
5339                 hpnt->max_id = scsi_debug_num_tgts;
5340         hpnt->max_lun = SCSI_W_LUN_REPORT_LUNS; /* = scsi_debug_max_luns; */
5341
5342         host_prot = 0;
5343
5344         switch (scsi_debug_dif) {
5345
5346         case SD_DIF_TYPE1_PROTECTION:
5347                 host_prot = SHOST_DIF_TYPE1_PROTECTION;
5348                 if (scsi_debug_dix)
5349                         host_prot |= SHOST_DIX_TYPE1_PROTECTION;
5350                 break;
5351
5352         case SD_DIF_TYPE2_PROTECTION:
5353                 host_prot = SHOST_DIF_TYPE2_PROTECTION;
5354                 if (scsi_debug_dix)
5355                         host_prot |= SHOST_DIX_TYPE2_PROTECTION;
5356                 break;
5357
5358         case SD_DIF_TYPE3_PROTECTION:
5359                 host_prot = SHOST_DIF_TYPE3_PROTECTION;
5360                 if (scsi_debug_dix)
5361                         host_prot |= SHOST_DIX_TYPE3_PROTECTION;
5362                 break;
5363
5364         default:
5365                 if (scsi_debug_dix)
5366                         host_prot |= SHOST_DIX_TYPE0_PROTECTION;
5367                 break;
5368         }
5369
5370         scsi_host_set_prot(hpnt, host_prot);
5371
5372         pr_info("host protection%s%s%s%s%s%s%s\n",
5373                (host_prot & SHOST_DIF_TYPE1_PROTECTION) ? " DIF1" : "",
5374                (host_prot & SHOST_DIF_TYPE2_PROTECTION) ? " DIF2" : "",
5375                (host_prot & SHOST_DIF_TYPE3_PROTECTION) ? " DIF3" : "",
5376                (host_prot & SHOST_DIX_TYPE0_PROTECTION) ? " DIX0" : "",
5377                (host_prot & SHOST_DIX_TYPE1_PROTECTION) ? " DIX1" : "",
5378                (host_prot & SHOST_DIX_TYPE2_PROTECTION) ? " DIX2" : "",
5379                (host_prot & SHOST_DIX_TYPE3_PROTECTION) ? " DIX3" : "");
5380
5381         if (scsi_debug_guard == 1)
5382                 scsi_host_set_guard(hpnt, SHOST_DIX_GUARD_IP);
5383         else
5384                 scsi_host_set_guard(hpnt, SHOST_DIX_GUARD_CRC);
5385
5386         opts = scsi_debug_opts;
5387         if (SCSI_DEBUG_OPT_RECOVERED_ERR & opts)
5388                 sdebug_any_injecting_opt = true;
5389         else if (SCSI_DEBUG_OPT_TRANSPORT_ERR & opts)
5390                 sdebug_any_injecting_opt = true;
5391         else if (SCSI_DEBUG_OPT_DIF_ERR & opts)
5392                 sdebug_any_injecting_opt = true;
5393         else if (SCSI_DEBUG_OPT_DIX_ERR & opts)
5394                 sdebug_any_injecting_opt = true;
5395         else if (SCSI_DEBUG_OPT_SHORT_TRANSFER & opts)
5396                 sdebug_any_injecting_opt = true;
5397
5398         error = scsi_add_host(hpnt, &sdbg_host->dev);
5399         if (error) {
5400                 pr_err("scsi_add_host failed\n");
5401                 error = -ENODEV;
5402                 scsi_host_put(hpnt);
5403         } else
5404                 scsi_scan_host(hpnt);
5405
5406         return error;
5407 }
5408
5409 static int sdebug_driver_remove(struct device * dev)
5410 {
5411         struct sdebug_host_info *sdbg_host;
5412         struct sdebug_dev_info *sdbg_devinfo, *tmp;
5413
5414         sdbg_host = to_sdebug_host(dev);
5415
5416         if (!sdbg_host) {
5417                 pr_err("Unable to locate host info\n");
5418                 return -ENODEV;
5419         }
5420
5421         scsi_remove_host(sdbg_host->shost);
5422
5423         list_for_each_entry_safe(sdbg_devinfo, tmp, &sdbg_host->dev_info_list,
5424                                  dev_list) {
5425                 list_del(&sdbg_devinfo->dev_list);
5426                 kfree(sdbg_devinfo);
5427         }
5428
5429         scsi_host_put(sdbg_host->shost);
5430         return 0;
5431 }
5432
5433 static int pseudo_lld_bus_match(struct device *dev,
5434                                 struct device_driver *dev_driver)
5435 {
5436         return 1;
5437 }
5438
5439 static struct bus_type pseudo_lld_bus = {
5440         .name = "pseudo",
5441         .match = pseudo_lld_bus_match,
5442         .probe = sdebug_driver_probe,
5443         .remove = sdebug_driver_remove,
5444         .drv_groups = sdebug_drv_groups,
5445 };