drivers/scsi/scsi_debug.c

   1 /*
   2  * vvvvvvvvvvvvvvvvvvvvvvv Original vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
   3  *  Copyright (C) 1992  Eric Youngdale
   4  *  Simulate a host adapter with 2 disks attached.  Do a lot of checking
   5  *  to make sure that we are not getting blocks mixed up, and PANIC if
   6  *  anything out of the ordinary is seen.
   7  * ^^^^^^^^^^^^^^^^^^^^^^^ Original ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   8  *
   9  *  This version is more generic, simulating a variable number of disk
  10  *  (or disk like devices) sharing a common amount of RAM. To be more
  11  *  realistic, the simulated devices have the transport attributes of
  12  *  SAS disks.
  13  *
  14  *
  15  *  For documentation see http://sg.danny.cz/sg/sdebug26.html
  16  *
  17  *   D. Gilbert (dpg) work for Magneto-Optical device test [20010421]
  18  *   dpg: work for devfs large number of disks [20010809]
  19  *        forked for lk 2.5 series [20011216, 20020101]
  20  *        use vmalloc() more inquiry+mode_sense [20020302]
  21  *        add timers for delayed responses [20020721]
  22  *   Patrick Mansfield <patmans@us.ibm.com> max_luns+scsi_level [20021031]
  23  *   Mike Anderson <andmike@us.ibm.com> sysfs work [20021118]
  24  *   dpg: change style of boot options to "scsi_debug.num_tgts=2" and
  25  *        module options to "modprobe scsi_debug num_tgts=2" [20021221]
  26  */
  27
  28
  29 #define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
  30
  31 #include <linux/module.h>
  32
  33 #include <linux/kernel.h>
  34 #include <linux/errno.h>
  35 #include <linux/timer.h>
  36 #include <linux/slab.h>
  37 #include <linux/types.h>
  38 #include <linux/string.h>
  39 #include <linux/genhd.h>
  40 #include <linux/fs.h>
  41 #include <linux/init.h>
  42 #include <linux/proc_fs.h>
  43 #include <linux/vmalloc.h>
  44 #include <linux/moduleparam.h>
  45 #include <linux/scatterlist.h>
  46 #include <linux/blkdev.h>
  47 #include <linux/crc-t10dif.h>
  48 #include <linux/spinlock.h>
  49 #include <linux/interrupt.h>
  50 #include <linux/atomic.h>
  51 #include <linux/hrtimer.h>
  52
  53 #include <net/checksum.h>
  54
  55 #include <asm/unaligned.h>
  56
  57 #include <scsi/scsi.h>
  58 #include <scsi/scsi_cmnd.h>
  59 #include <scsi/scsi_device.h>
  60 #include <scsi/scsi_host.h>
  61 #include <scsi/scsicam.h>
  62 #include <scsi/scsi_eh.h>
  63 #include <scsi/scsi_tcq.h>
  64 #include <scsi/scsi_dbg.h>
  65
  66 #include "sd.h"
  67 #include "scsi_logging.h"
  68
  69 #define SCSI_DEBUG_VERSION "1.85"
  70 static const char *scsi_debug_version_date = "20141022";
  71
  72 #define MY_NAME "scsi_debug"
  73
  74 /* Additional Sense Code (ASC) */
  75 #define NO_ADDITIONAL_SENSE 0x0
  76 #define LOGICAL_UNIT_NOT_READY 0x4
  77 #define LOGICAL_UNIT_COMMUNICATION_FAILURE 0x8
  78 #define UNRECOVERED_READ_ERR 0x11
  79 #define PARAMETER_LIST_LENGTH_ERR 0x1a
  80 #define INVALID_OPCODE 0x20
  81 #define LBA_OUT_OF_RANGE 0x21
  82 #define INVALID_FIELD_IN_CDB 0x24
  83 #define INVALID_FIELD_IN_PARAM_LIST 0x26
  84 #define UA_RESET_ASC 0x29
  85 #define UA_CHANGED_ASC 0x2a
  86 #define TARGET_CHANGED_ASC 0x3f
  87 #define LUNS_CHANGED_ASCQ 0x0e
  88 #define INSUFF_RES_ASC 0x55
  89 #define INSUFF_RES_ASCQ 0x3
  90 #define POWER_ON_RESET_ASCQ 0x0
  91 #define BUS_RESET_ASCQ 0x2      /* scsi bus reset occurred */
  92 #define MODE_CHANGED_ASCQ 0x1   /* mode parameters changed */
  93 #define CAPACITY_CHANGED_ASCQ 0x9
  94 #define SAVING_PARAMS_UNSUP 0x39
  95 #define TRANSPORT_PROBLEM 0x4b
  96 #define THRESHOLD_EXCEEDED 0x5d
  97 #define LOW_POWER_COND_ON 0x5e
  98 #define MISCOMPARE_VERIFY_ASC 0x1d
  99 #define MICROCODE_CHANGED_ASCQ 0x1      /* with TARGET_CHANGED_ASC */
 100 #define MICROCODE_CHANGED_WO_RESET_ASCQ 0x16
 101
 102 /* Additional Sense Code Qualifier (ASCQ) */
 103 #define ACK_NAK_TO 0x3
 104
 105
 106 /* Default values for driver parameters */
 107 #define DEF_NUM_HOST   1
 108 #define DEF_NUM_TGTS   1
 109 #define DEF_MAX_LUNS   1
 110 /* With these defaults, this driver will make 1 host with 1 target
 111  * (id 0) containing 1 logical unit (lun 0). That is 1 device.
 112  */
 113 #define DEF_ATO 1
 114 #define DEF_DELAY   1           /* if > 0 unit is a jiffy */
 115 #define DEF_DEV_SIZE_MB   8
 116 #define DEF_DIF 0
 117 #define DEF_DIX 0
 118 #define DEF_D_SENSE   0
 119 #define DEF_EVERY_NTH   0
 120 #define DEF_FAKE_RW     0
 121 #define DEF_GUARD 0
 122 #define DEF_HOST_LOCK 0
 123 #define DEF_LBPU 0
 124 #define DEF_LBPWS 0
 125 #define DEF_LBPWS10 0
 126 #define DEF_LBPRZ 1
 127 #define DEF_LOWEST_ALIGNED 0
 128 #define DEF_NDELAY   0          /* if > 0 unit is a nanosecond */
 129 #define DEF_NO_LUN_0   0
 130 #define DEF_NUM_PARTS   0
 131 #define DEF_OPTS   0
 132 #define DEF_OPT_BLKS 64
 133 #define DEF_PHYSBLK_EXP 0
 134 #define DEF_PTYPE   0
 135 #define DEF_REMOVABLE false
 136 #define DEF_SCSI_LEVEL   6    /* INQUIRY, byte2 [6->SPC-4] */
 137 #define DEF_SECTOR_SIZE 512
 138 #define DEF_UNMAP_ALIGNMENT 0
 139 #define DEF_UNMAP_GRANULARITY 1
 140 #define DEF_UNMAP_MAX_BLOCKS 0xFFFFFFFF
 141 #define DEF_UNMAP_MAX_DESC 256
 142 #define DEF_VIRTUAL_GB   0
 143 #define DEF_VPD_USE_HOSTNO 1
 144 #define DEF_WRITESAME_LENGTH 0xFFFF
 145 #define DEF_STRICT 0
 146 #define DELAY_OVERRIDDEN -9999
 147
 148 /* bit mask values for scsi_debug_opts */
 149 #define SCSI_DEBUG_OPT_NOISE   1
 150 #define SCSI_DEBUG_OPT_MEDIUM_ERR   2
 151 #define SCSI_DEBUG_OPT_TIMEOUT   4
 152 #define SCSI_DEBUG_OPT_RECOVERED_ERR   8
 153 #define SCSI_DEBUG_OPT_TRANSPORT_ERR   16
 154 #define SCSI_DEBUG_OPT_DIF_ERR   32
 155 #define SCSI_DEBUG_OPT_DIX_ERR   64
 156 #define SCSI_DEBUG_OPT_MAC_TIMEOUT  128
 157 #define SCSI_DEBUG_OPT_SHORT_TRANSFER   0x100
 158 #define SCSI_DEBUG_OPT_Q_NOISE  0x200
 159 #define SCSI_DEBUG_OPT_ALL_TSF  0x400
 160 #define SCSI_DEBUG_OPT_RARE_TSF 0x800
 161 #define SCSI_DEBUG_OPT_N_WCE    0x1000
 162 #define SCSI_DEBUG_OPT_RESET_NOISE 0x2000
 163 #define SCSI_DEBUG_OPT_NO_CDB_NOISE 0x4000
 164 #define SCSI_DEBUG_OPT_ALL_NOISE (0x1 | 0x200 | 0x2000)
 165 /* When "every_nth" > 0 then modulo "every_nth" commands:
 166  *   - a no response is simulated if SCSI_DEBUG_OPT_TIMEOUT is set
 167  *   - a RECOVERED_ERROR is simulated on successful read and write
 168  *     commands if SCSI_DEBUG_OPT_RECOVERED_ERR is set.
 169  *   - a TRANSPORT_ERROR is simulated on successful read and write
 170  *     commands if SCSI_DEBUG_OPT_TRANSPORT_ERR is set.
 171  *
 172  * When "every_nth" < 0 then after "- every_nth" commands:
 173  *   - a no response is simulated if SCSI_DEBUG_OPT_TIMEOUT is set
 174  *   - a RECOVERED_ERROR is simulated on successful read and write
 175  *     commands if SCSI_DEBUG_OPT_RECOVERED_ERR is set.
 176  *   - a TRANSPORT_ERROR is simulated on successful read and write
 177  *     commands if SCSI_DEBUG_OPT_TRANSPORT_ERR is set.
 178  * This will continue until some other action occurs (e.g. the user
 179  * writing a new value (other than -1 or 1) to every_nth via sysfs).
 180  */
 181
 182 /* As indicated in SAM-5 and SPC-4 Unit Attentions (UAs)are returned in
 183  * priority order. In the subset implemented here lower numbers have higher
 184  * priority. The UA numbers should be a sequence starting from 0 with
 185  * SDEBUG_NUM_UAS being 1 higher than the highest numbered UA. */
 186 #define SDEBUG_UA_POR 0         /* Power on, reset, or bus device reset */
 187 #define SDEBUG_UA_BUS_RESET 1
 188 #define SDEBUG_UA_MODE_CHANGED 2
 189 #define SDEBUG_UA_CAPACITY_CHANGED 3
 190 #define SDEBUG_UA_LUNS_CHANGED 4
 191 #define SDEBUG_UA_MICROCODE_CHANGED 5   /* simulate firmware change */
 192 #define SDEBUG_UA_MICROCODE_CHANGED_WO_RESET 6
 193 #define SDEBUG_NUM_UAS 7
 194
 195 /* for check_readiness() */
 196 #define UAS_ONLY 1      /* check for UAs only */
 197 #define UAS_TUR 0       /* if no UAs then check if media access possible */
 198
 199 /* when 1==SCSI_DEBUG_OPT_MEDIUM_ERR, a medium error is simulated at this
 200  * sector on read commands: */
 201 #define OPT_MEDIUM_ERR_ADDR   0x1234 /* that's sector 4660 in decimal */
 202 #define OPT_MEDIUM_ERR_NUM    10     /* number of consecutive medium errs */
 203
 204 /* If REPORT LUNS has luns >= 256 it can choose "flat space" (value 1)
 205  * or "peripheral device" addressing (value 0) */
 206 #define SAM2_LUN_ADDRESS_METHOD 0
 207
 208 /* SCSI_DEBUG_CANQUEUE is the maximum number of commands that can be queued
 209  * (for response) at one time. Can be reduced by max_queue option. Command
 210  * responses are not queued when delay=0 and ndelay=0. The per-device
 211  * DEF_CMD_PER_LUN can be changed via sysfs:
 212  * /sys/class/scsi_device/<h:c:t:l>/device/queue_depth but cannot exceed
 213  * SCSI_DEBUG_CANQUEUE. */
 214 #define SCSI_DEBUG_CANQUEUE_WORDS  9    /* a WORD is bits in a long */
 215 #define SCSI_DEBUG_CANQUEUE  (SCSI_DEBUG_CANQUEUE_WORDS * BITS_PER_LONG)
 216 #define DEF_CMD_PER_LUN  255
 217
 218 #if DEF_CMD_PER_LUN > SCSI_DEBUG_CANQUEUE
 219 #warning "Expect DEF_CMD_PER_LUN <= SCSI_DEBUG_CANQUEUE"
 220 #endif
 221
 222 /* SCSI opcodes (first byte of cdb) mapped onto these indexes */
 223 enum sdeb_opcode_index {
 224         SDEB_I_INVALID_OPCODE = 0,
 225         SDEB_I_INQUIRY = 1,
 226         SDEB_I_REPORT_LUNS = 2,
 227         SDEB_I_REQUEST_SENSE = 3,
 228         SDEB_I_TEST_UNIT_READY = 4,
 229         SDEB_I_MODE_SENSE = 5,          /* 6, 10 */
 230         SDEB_I_MODE_SELECT = 6,         /* 6, 10 */
 231         SDEB_I_LOG_SENSE = 7,
 232         SDEB_I_READ_CAPACITY = 8,       /* 10; 16 is in SA_IN(16) */
 233         SDEB_I_READ = 9,                /* 6, 10, 12, 16 */
 234         SDEB_I_WRITE = 10,              /* 6, 10, 12, 16 */
 235         SDEB_I_START_STOP = 11,
 236         SDEB_I_SERV_ACT_IN = 12,        /* 12, 16 */
 237         SDEB_I_SERV_ACT_OUT = 13,       /* 12, 16 */
 238         SDEB_I_MAINT_IN = 14,
 239         SDEB_I_MAINT_OUT = 15,
 240         SDEB_I_VERIFY = 16,             /* 10 only */
 241         SDEB_I_VARIABLE_LEN = 17,
 242         SDEB_I_RESERVE = 18,            /* 6, 10 */
 243         SDEB_I_RELEASE = 19,            /* 6, 10 */
 244         SDEB_I_ALLOW_REMOVAL = 20,      /* PREVENT ALLOW MEDIUM REMOVAL */
 245         SDEB_I_REZERO_UNIT = 21,        /* REWIND in SSC */
 246         SDEB_I_ATA_PT = 22,             /* 12, 16 */
 247         SDEB_I_SEND_DIAG = 23,
 248         SDEB_I_UNMAP = 24,
 249         SDEB_I_XDWRITEREAD = 25,        /* 10 only */
 250         SDEB_I_WRITE_BUFFER = 26,
 251         SDEB_I_WRITE_SAME = 27,         /* 10, 16 */
 252         SDEB_I_SYNC_CACHE = 28,         /* 10 only */
 253         SDEB_I_COMP_WRITE = 29,
 254         SDEB_I_LAST_ELEMENT = 30,       /* keep this last */
 255 };
 256
 257 static const unsigned char opcode_ind_arr[256] = {
 258 /* 0x0; 0x0->0x1f: 6 byte cdbs */
 259         SDEB_I_TEST_UNIT_READY, SDEB_I_REZERO_UNIT, 0, SDEB_I_REQUEST_SENSE,
 260             0, 0, 0, 0,
 261         SDEB_I_READ, 0, SDEB_I_WRITE, 0, 0, 0, 0, 0,
 262         0, 0, SDEB_I_INQUIRY, 0, 0, SDEB_I_MODE_SELECT, SDEB_I_RESERVE,
 263             SDEB_I_RELEASE,
 264         0, 0, SDEB_I_MODE_SENSE, SDEB_I_START_STOP, 0, SDEB_I_SEND_DIAG,
 265             SDEB_I_ALLOW_REMOVAL, 0,
 266 /* 0x20; 0x20->0x3f: 10 byte cdbs */
 267         0, 0, 0, 0, 0, SDEB_I_READ_CAPACITY, 0, 0,
 268         SDEB_I_READ, 0, SDEB_I_WRITE, 0, 0, 0, 0, SDEB_I_VERIFY,
 269         0, 0, 0, 0, 0, SDEB_I_SYNC_CACHE, 0, 0,
 270         0, 0, 0, SDEB_I_WRITE_BUFFER, 0, 0, 0, 0,
 271 /* 0x40; 0x40->0x5f: 10 byte cdbs */
 272         0, SDEB_I_WRITE_SAME, SDEB_I_UNMAP, 0, 0, 0, 0, 0,
 273         0, 0, 0, 0, 0, SDEB_I_LOG_SENSE, 0, 0,
 274         0, 0, 0, SDEB_I_XDWRITEREAD, 0, SDEB_I_MODE_SELECT, SDEB_I_RESERVE,
 275             SDEB_I_RELEASE,
 276         0, 0, SDEB_I_MODE_SENSE, 0, 0, 0, 0, 0,
 277 /* 0x60; 0x60->0x7d are reserved */
 278         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 279         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 280         0, SDEB_I_VARIABLE_LEN,
 281 /* 0x80; 0x80->0x9f: 16 byte cdbs */
 282         0, 0, 0, 0, 0, SDEB_I_ATA_PT, 0, 0,
 283         SDEB_I_READ, SDEB_I_COMP_WRITE, SDEB_I_WRITE, 0, 0, 0, 0, 0,
 284         0, 0, 0, SDEB_I_WRITE_SAME, 0, 0, 0, 0,
 285         0, 0, 0, 0, 0, 0, SDEB_I_SERV_ACT_IN, SDEB_I_SERV_ACT_OUT,
 286 /* 0xa0; 0xa0->0xbf: 12 byte cdbs */
 287         SDEB_I_REPORT_LUNS, SDEB_I_ATA_PT, 0, SDEB_I_MAINT_IN,
 288              SDEB_I_MAINT_OUT, 0, 0, 0,
 289         SDEB_I_READ, SDEB_I_SERV_ACT_OUT, SDEB_I_WRITE, SDEB_I_SERV_ACT_IN,
 290              0, 0, 0, 0,
 291         0, 0, 0, 0, 0, 0, 0, 0,
 292         0, 0, 0, 0, 0, 0, 0, 0,
 293 /* 0xc0; 0xc0->0xff: vendor specific */
 294         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 295         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 296         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 297         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 298 };
 299
 300 #define F_D_IN                  1
 301 #define F_D_OUT                 2
 302 #define F_D_OUT_MAYBE           4       /* WRITE SAME, NDOB bit */
 303 #define F_D_UNKN                8
 304 #define F_RL_WLUN_OK            0x10
 305 #define F_SKIP_UA               0x20
 306 #define F_DELAY_OVERR           0x40
 307 #define F_SA_LOW                0x80    /* cdb byte 1, bits 4 to 0 */
 308 #define F_SA_HIGH               0x100   /* as used by variable length cdbs */
 309 #define F_INV_OP                0x200
 310 #define F_FAKE_RW               0x400
 311 #define F_M_ACCESS              0x800   /* media access */
 312
 313 #define FF_RESPOND (F_RL_WLUN_OK | F_SKIP_UA | F_DELAY_OVERR)
 314 #define FF_DIRECT_IO (F_M_ACCESS | F_FAKE_RW)
 315 #define FF_SA (F_SA_HIGH | F_SA_LOW)
 316
 317 struct sdebug_dev_info;
 318 static int resp_inquiry(struct scsi_cmnd *, struct sdebug_dev_info *);
 319 static int resp_report_luns(struct scsi_cmnd *, struct sdebug_dev_info *);
 320 static int resp_requests(struct scsi_cmnd *, struct sdebug_dev_info *);
 321 static int resp_mode_sense(struct scsi_cmnd *, struct sdebug_dev_info *);
 322 static int resp_mode_select(struct scsi_cmnd *, struct sdebug_dev_info *);
 323 static int resp_log_sense(struct scsi_cmnd *, struct sdebug_dev_info *);
 324 static int resp_readcap(struct scsi_cmnd *, struct sdebug_dev_info *);
 325 static int resp_read_dt0(struct scsi_cmnd *, struct sdebug_dev_info *);
 326 static int resp_write_dt0(struct scsi_cmnd *, struct sdebug_dev_info *);
 327 static int resp_start_stop(struct scsi_cmnd *, struct sdebug_dev_info *);
 328 static int resp_readcap16(struct scsi_cmnd *, struct sdebug_dev_info *);
 329 static int resp_get_lba_status(struct scsi_cmnd *, struct sdebug_dev_info *);
 330 static int resp_report_tgtpgs(struct scsi_cmnd *, struct sdebug_dev_info *);
 331 static int resp_unmap(struct scsi_cmnd *, struct sdebug_dev_info *);
 332 static int resp_rsup_opcodes(struct scsi_cmnd *, struct sdebug_dev_info *);
 333 static int resp_rsup_tmfs(struct scsi_cmnd *, struct sdebug_dev_info *);
 334 static int resp_write_same_10(struct scsi_cmnd *, struct sdebug_dev_info *);
 335 static int resp_write_same_16(struct scsi_cmnd *, struct sdebug_dev_info *);
 336 static int resp_xdwriteread_10(struct scsi_cmnd *, struct sdebug_dev_info *);
 337 static int resp_comp_write(struct scsi_cmnd *, struct sdebug_dev_info *);
 338 static int resp_write_buffer(struct scsi_cmnd *, struct sdebug_dev_info *);
 339
 340 struct opcode_info_t {
 341         u8 num_attached;        /* 0 if this is it (i.e. a leaf); use 0xff
 342                                  * for terminating element */
 343         u8 opcode;              /* if num_attached > 0, preferred */
 344         u16 sa;                 /* service action */
 345         u32 flags;              /* OR-ed set of SDEB_F_* */
 346         int (*pfp)(struct scsi_cmnd *, struct sdebug_dev_info *);
 347         const struct opcode_info_t *arrp;  /* num_attached elements or NULL */
 348         u8 len_mask[16];        /* len=len_mask[0], then mask for cdb[1]... */
 349                                 /* ignore cdb bytes after position 15 */
 350 };
 351
 352 static const struct opcode_info_t msense_iarr[1] = {
 353         {0, 0x1a, 0, F_D_IN, NULL, NULL,
 354             {6,  0xe8, 0xff, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 355 };
 356
 357 static const struct opcode_info_t mselect_iarr[1] = {
 358         {0, 0x15, 0, F_D_OUT, NULL, NULL,
 359             {6,  0xf1, 0, 0, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 360 };
 361
 362 static const struct opcode_info_t read_iarr[3] = {
 363         {0, 0x28, 0, F_D_IN | FF_DIRECT_IO, resp_read_dt0, NULL,/* READ(10) */
 364             {10,  0xff, 0xff, 0xff, 0xff, 0xff, 0x1f, 0xff, 0xff, 0xc7, 0, 0,
 365              0, 0, 0, 0} },
 366         {0, 0x8, 0, F_D_IN | FF_DIRECT_IO, resp_read_dt0, NULL, /* READ(6) */
 367             {6,  0xff, 0xff, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 368         {0, 0xa8, 0, F_D_IN | FF_DIRECT_IO, resp_read_dt0, NULL,/* READ(12) */
 369             {12,  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x9f,
 370              0xc7, 0, 0, 0, 0} },
 371 };
 372
 373 static const struct opcode_info_t write_iarr[3] = {
 374         {0, 0x2a, 0, F_D_OUT | FF_DIRECT_IO, resp_write_dt0, NULL,   /* 10 */
 375             {10,  0xfb, 0xff, 0xff, 0xff, 0xff, 0x1f, 0xff, 0xff, 0xc7, 0, 0,
 376              0, 0, 0, 0} },
 377         {0, 0xa, 0, F_D_OUT | FF_DIRECT_IO, resp_write_dt0, NULL,    /* 6 */
 378             {6,  0xff, 0xff, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 379         {0, 0xaa, 0, F_D_OUT | FF_DIRECT_IO, resp_write_dt0, NULL,   /* 12 */
 380             {12,  0xfb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x9f,
 381              0xc7, 0, 0, 0, 0} },
 382 };
 383
 384 static const struct opcode_info_t sa_in_iarr[1] = {
 385         {0, 0x9e, 0x12, F_SA_LOW | F_D_IN, resp_get_lba_status, NULL,
 386             {16,  0x12, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 387              0xff, 0xff, 0xff, 0, 0xc7} },
 388 };
 389
 390 static const struct opcode_info_t vl_iarr[1] = {        /* VARIABLE LENGTH */
 391         {0, 0x7f, 0xb, F_SA_HIGH | F_D_OUT | FF_DIRECT_IO, resp_write_dt0,
 392             NULL, {32,  0xc7, 0, 0, 0, 0, 0x1f, 0x18, 0x0, 0xb, 0xfa,
 393                    0, 0xff, 0xff, 0xff, 0xff} },        /* WRITE(32) */
 394 };
 395
 396 static const struct opcode_info_t maint_in_iarr[2] = {
 397         {0, 0xa3, 0xc, F_SA_LOW | F_D_IN, resp_rsup_opcodes, NULL,
 398             {12,  0xc, 0x87, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0,
 399              0xc7, 0, 0, 0, 0} },
 400         {0, 0xa3, 0xd, F_SA_LOW | F_D_IN, resp_rsup_tmfs, NULL,
 401             {12,  0xd, 0x80, 0, 0, 0, 0xff, 0xff, 0xff, 0xff, 0, 0xc7, 0, 0,
 402              0, 0} },
 403 };
 404
 405 static const struct opcode_info_t write_same_iarr[1] = {
 406         {0, 0x93, 0, F_D_OUT_MAYBE | FF_DIRECT_IO, resp_write_same_16, NULL,
 407             {16,  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 408              0xff, 0xff, 0xff, 0x1f, 0xc7} },
 409 };
 410
 411 static const struct opcode_info_t reserve_iarr[1] = {
 412         {0, 0x16, 0, F_D_OUT, NULL, NULL,       /* RESERVE(6) */
 413             {6,  0x1f, 0xff, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 414 };
 415
 416 static const struct opcode_info_t release_iarr[1] = {
 417         {0, 0x17, 0, F_D_OUT, NULL, NULL,       /* RELEASE(6) */
 418             {6,  0x1f, 0xff, 0, 0, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 419 };
 420
 421
 422 /* This array is accessed via SDEB_I_* values. Make sure all are mapped,
 423  * plus the terminating elements for logic that scans this table such as
 424  * REPORT SUPPORTED OPERATION CODES. */
 425 static const struct opcode_info_t opcode_info_arr[SDEB_I_LAST_ELEMENT + 1] = {
 426 /* 0 */
 427         {0, 0, 0, F_INV_OP | FF_RESPOND, NULL, NULL,
 428             {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 429         {0, 0x12, 0, FF_RESPOND | F_D_IN, resp_inquiry, NULL,
 430             {6,  0xe3, 0xff, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 431         {0, 0xa0, 0, FF_RESPOND | F_D_IN, resp_report_luns, NULL,
 432             {12,  0xe3, 0xff, 0, 0, 0, 0xff, 0xff, 0xff, 0xff, 0, 0xc7, 0, 0,
 433              0, 0} },
 434         {0, 0x3, 0, FF_RESPOND | F_D_IN, resp_requests, NULL,
 435             {6,  0xe1, 0, 0, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 436         {0, 0x0, 0, F_M_ACCESS | F_RL_WLUN_OK, NULL, NULL,/* TEST UNIT READY */
 437             {6,  0, 0, 0, 0, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 438         {1, 0x5a, 0, F_D_IN, resp_mode_sense, msense_iarr,
 439             {10,  0xf8, 0xff, 0xff, 0, 0, 0, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0,
 440              0} },
 441         {1, 0x55, 0, F_D_OUT, resp_mode_select, mselect_iarr,
 442             {10,  0xf1, 0, 0, 0, 0, 0, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0} },
 443         {0, 0x4d, 0, F_D_IN, resp_log_sense, NULL,
 444             {10,  0xe3, 0xff, 0xff, 0, 0xff, 0xff, 0xff, 0xff, 0xc7, 0, 0, 0,
 445              0, 0, 0} },
 446         {0, 0x25, 0, F_D_IN, resp_readcap, NULL,
 447             {10,  0xe1, 0xff, 0xff, 0xff, 0xff, 0, 0, 0x1, 0xc7, 0, 0, 0, 0,
 448              0, 0} },
 449         {3, 0x88, 0, F_D_IN | FF_DIRECT_IO, resp_read_dt0, read_iarr,
 450             {16,  0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 451              0xff, 0xff, 0xff, 0x9f, 0xc7} },           /* READ(16) */
 452 /* 10 */
 453         {3, 0x8a, 0, F_D_OUT | FF_DIRECT_IO, resp_write_dt0, write_iarr,
 454             {16,  0xfa, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 455              0xff, 0xff, 0xff, 0x9f, 0xc7} },           /* WRITE(16) */
 456         {0, 0x1b, 0, 0, resp_start_stop, NULL,          /* START STOP UNIT */
 457             {6,  0x1, 0, 0xf, 0xf7, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 458         {1, 0x9e, 0x10, F_SA_LOW | F_D_IN, resp_readcap16, sa_in_iarr,
 459             {16,  0x10, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 460              0xff, 0xff, 0xff, 0x1, 0xc7} },    /* READ CAPACITY(16) */
 461         {0, 0, 0, F_INV_OP | FF_RESPOND, NULL, NULL, /* SA OUT */
 462             {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 463         {2, 0xa3, 0xa, F_SA_LOW | F_D_IN, resp_report_tgtpgs, maint_in_iarr,
 464             {12,  0xea, 0, 0, 0, 0, 0xff, 0xff, 0xff, 0xff, 0, 0xc7, 0, 0, 0,
 465              0} },
 466         {0, 0, 0, F_INV_OP | FF_RESPOND, NULL, NULL, /* MAINT OUT */
 467             {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 468         {0, 0x2f, 0, F_D_OUT_MAYBE | FF_DIRECT_IO, NULL, NULL, /* VERIFY(10) */
 469             {10,  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xc7,
 470              0, 0, 0, 0, 0, 0} },
 471         {1, 0x7f, 0x9, F_SA_HIGH | F_D_IN | FF_DIRECT_IO, resp_read_dt0,
 472             vl_iarr, {32,  0xc7, 0, 0, 0, 0, 0x1f, 0x18, 0x0, 0x9, 0xfe, 0,
 473                       0xff, 0xff, 0xff, 0xff} },/* VARIABLE LENGTH, READ(32) */
 474         {1, 0x56, 0, F_D_OUT, NULL, reserve_iarr, /* RESERVE(10) */
 475             {10,  0xff, 0xff, 0xff, 0, 0, 0, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0,
 476              0} },
 477         {1, 0x57, 0, F_D_OUT, NULL, release_iarr, /* RELEASE(10) */
 478             {10,  0x13, 0xff, 0xff, 0, 0, 0, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0,
 479              0} },
 480 /* 20 */
 481         {0, 0x1e, 0, 0, NULL, NULL, /* ALLOW REMOVAL */
 482             {6,  0, 0, 0, 0x3, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 483         {0, 0x1, 0, 0, resp_start_stop, NULL, /* REWIND ?? */
 484             {6,  0x1, 0, 0, 0, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 485         {0, 0, 0, F_INV_OP | FF_RESPOND, NULL, NULL, /* ATA_PT */
 486             {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 487         {0, 0x1d, F_D_OUT, 0, NULL, NULL,       /* SEND DIAGNOSTIC */
 488             {6,  0xf7, 0, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 489         {0, 0x42, 0, F_D_OUT | FF_DIRECT_IO, resp_unmap, NULL, /* UNMAP */
 490             {10,  0x1, 0, 0, 0, 0, 0x1f, 0xff, 0xff, 0xc7, 0, 0, 0, 0, 0, 0} },
 491         {0, 0x53, 0, F_D_IN | F_D_OUT | FF_DIRECT_IO, resp_xdwriteread_10,
 492             NULL, {10,  0xff, 0xff, 0xff, 0xff, 0xff, 0x1f, 0xff, 0xff, 0xc7,
 493                    0, 0, 0, 0, 0, 0} },
 494         {0, 0x3b, 0, F_D_OUT_MAYBE, resp_write_buffer, NULL,
 495             {10,  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xc7, 0, 0,
 496              0, 0, 0, 0} },                     /* WRITE_BUFFER */
 497         {1, 0x41, 0, F_D_OUT_MAYBE | FF_DIRECT_IO, resp_write_same_10,
 498             write_same_iarr, {10,  0xff, 0xff, 0xff, 0xff, 0xff, 0x1f, 0xff,
 499                               0xff, 0xc7, 0, 0, 0, 0, 0, 0} },
 500         {0, 0x35, 0, F_DELAY_OVERR | FF_DIRECT_IO, NULL, NULL, /* SYNC_CACHE */
 501             {10,  0x7, 0xff, 0xff, 0xff, 0xff, 0x1f, 0xff, 0xff, 0xc7, 0, 0,
 502              0, 0, 0, 0} },
 503         {0, 0x89, 0, F_D_OUT | FF_DIRECT_IO, resp_comp_write, NULL,
 504             {16,  0xf8, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0, 0,
 505              0, 0xff, 0x1f, 0xc7} },            /* COMPARE AND WRITE */
 506
 507 /* 30 */
 508         {0xff, 0, 0, 0, NULL, NULL,             /* terminating element */
 509             {0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0} },
 510 };
 511
 512 struct sdebug_scmd_extra_t {
 513         bool inj_recovered;
 514         bool inj_transport;
 515         bool inj_dif;
 516         bool inj_dix;
 517         bool inj_short;
 518 };
 519
 520 static int scsi_debug_add_host = DEF_NUM_HOST;
 521 static int scsi_debug_ato = DEF_ATO;
 522 static int scsi_debug_delay = DEF_DELAY;
 523 static int scsi_debug_dev_size_mb = DEF_DEV_SIZE_MB;
 524 static int scsi_debug_dif = DEF_DIF;
 525 static int scsi_debug_dix = DEF_DIX;
 526 static int scsi_debug_dsense = DEF_D_SENSE;
 527 static int scsi_debug_every_nth = DEF_EVERY_NTH;
 528 static int scsi_debug_fake_rw = DEF_FAKE_RW;
 529 static unsigned int scsi_debug_guard = DEF_GUARD;
 530 static int scsi_debug_lowest_aligned = DEF_LOWEST_ALIGNED;
 531 static int scsi_debug_max_luns = DEF_MAX_LUNS;
 532 static int scsi_debug_max_queue = SCSI_DEBUG_CANQUEUE;
 533 static atomic_t retired_max_queue;      /* if > 0 then was prior max_queue */
 534 static int scsi_debug_ndelay = DEF_NDELAY;
 535 static int scsi_debug_no_lun_0 = DEF_NO_LUN_0;
 536 static int scsi_debug_no_uld = 0;
 537 static int scsi_debug_num_parts = DEF_NUM_PARTS;
 538 static int scsi_debug_num_tgts = DEF_NUM_TGTS; /* targets per host */
 539 static int scsi_debug_opt_blks = DEF_OPT_BLKS;
 540 static int scsi_debug_opts = DEF_OPTS;
 541 static int scsi_debug_physblk_exp = DEF_PHYSBLK_EXP;
 542 static int scsi_debug_ptype = DEF_PTYPE; /* SCSI peripheral type (0==disk) */
 543 static int scsi_debug_scsi_level = DEF_SCSI_LEVEL;
 544 static int scsi_debug_sector_size = DEF_SECTOR_SIZE;
 545 static int scsi_debug_virtual_gb = DEF_VIRTUAL_GB;
 546 static int scsi_debug_vpd_use_hostno = DEF_VPD_USE_HOSTNO;
 547 static unsigned int scsi_debug_lbpu = DEF_LBPU;
 548 static unsigned int scsi_debug_lbpws = DEF_LBPWS;
 549 static unsigned int scsi_debug_lbpws10 = DEF_LBPWS10;
 550 static unsigned int scsi_debug_lbprz = DEF_LBPRZ;
 551 static unsigned int scsi_debug_unmap_alignment = DEF_UNMAP_ALIGNMENT;
 552 static unsigned int scsi_debug_unmap_granularity = DEF_UNMAP_GRANULARITY;
 553 static unsigned int scsi_debug_unmap_max_blocks = DEF_UNMAP_MAX_BLOCKS;
 554 static unsigned int scsi_debug_unmap_max_desc = DEF_UNMAP_MAX_DESC;
 555 static unsigned int scsi_debug_write_same_length = DEF_WRITESAME_LENGTH;
 556 static bool scsi_debug_removable = DEF_REMOVABLE;
 557 static bool scsi_debug_clustering;
 558 static bool scsi_debug_host_lock = DEF_HOST_LOCK;
 559 static bool scsi_debug_strict = DEF_STRICT;
 560 static bool sdebug_any_injecting_opt;
 561
 562 static atomic_t sdebug_cmnd_count;
 563 static atomic_t sdebug_completions;
 564 static atomic_t sdebug_a_tsf;           /* counter of 'almost' TSFs */
 565
 566 #define DEV_READONLY(TGT)      (0)
 567
 568 static unsigned int sdebug_store_sectors;
 569 static sector_t sdebug_capacity;        /* in sectors */
 570
 571 /* old BIOS stuff, kernel may get rid of them but some mode sense pages
 572    may still need them */
 573 static int sdebug_heads;                /* heads per disk */
 574 static int sdebug_cylinders_per;        /* cylinders per surface */
 575 static int sdebug_sectors_per;          /* sectors per cylinder */
 576
 577 #define SDEBUG_MAX_PARTS 4
 578
 579 #define SCSI_DEBUG_MAX_CMD_LEN 32
 580
 581 static unsigned int scsi_debug_lbp(void)
 582 {
 583         return ((0 == scsi_debug_fake_rw) &&
 584                 (scsi_debug_lbpu | scsi_debug_lbpws | scsi_debug_lbpws10));
 585 }
 586
 587 struct sdebug_dev_info {
 588         struct list_head dev_list;
 589         unsigned int channel;
 590         unsigned int target;
 591         u64 lun;
 592         struct sdebug_host_info *sdbg_host;
 593         unsigned long uas_bm[1];
 594         atomic_t num_in_q;
 595         char stopped;           /* TODO: should be atomic */
 596         bool used;
 597 };
 598
 599 struct sdebug_host_info {
 600         struct list_head host_list;
 601         struct Scsi_Host *shost;
 602         struct device dev;
 603         struct list_head dev_info_list;
 604 };
 605
 606 #define to_sdebug_host(d)       \
 607         container_of(d, struct sdebug_host_info, dev)
 608
 609 static LIST_HEAD(sdebug_host_list);
 610 static DEFINE_SPINLOCK(sdebug_host_list_lock);
 611
 612
 613 struct sdebug_hrtimer {         /* ... is derived from hrtimer */
 614         struct hrtimer hrt;     /* must be first element */
 615         int qa_indx;
 616 };
 617
 618 struct sdebug_queued_cmd {
 619         /* in_use flagged by a bit in queued_in_use_bm[] */
 620         struct timer_list *cmnd_timerp;
 621         struct tasklet_struct *tletp;
 622         struct sdebug_hrtimer *sd_hrtp;
 623         struct scsi_cmnd * a_cmnd;
 624 };
 625 static struct sdebug_queued_cmd queued_arr[SCSI_DEBUG_CANQUEUE];
 626 static unsigned long queued_in_use_bm[SCSI_DEBUG_CANQUEUE_WORDS];
 627
 628
 629 static unsigned char * fake_storep;     /* ramdisk storage */
 630 static struct sd_dif_tuple *dif_storep; /* protection info */
 631 static void *map_storep;                /* provisioning map */
 632
 633 static unsigned long map_size;
 634 static int num_aborts;
 635 static int num_dev_resets;
 636 static int num_target_resets;
 637 static int num_bus_resets;
 638 static int num_host_resets;
 639 static int dix_writes;
 640 static int dix_reads;
 641 static int dif_errors;
 642
 643 static DEFINE_SPINLOCK(queued_arr_lock);
 644 static DEFINE_RWLOCK(atomic_rw);
 645
 646 static char sdebug_proc_name[] = MY_NAME;
 647 static const char *my_name = MY_NAME;
 648
 649 static struct bus_type pseudo_lld_bus;
 650
 651 static struct device_driver sdebug_driverfs_driver = {
 652         .name           = sdebug_proc_name,
 653         .bus            = &pseudo_lld_bus,
 654 };
 655
 656 static const int check_condition_result =
 657                 (DRIVER_SENSE << 24) | SAM_STAT_CHECK_CONDITION;
 658
 659 static const int illegal_condition_result =
 660         (DRIVER_SENSE << 24) | (DID_ABORT << 16) | SAM_STAT_CHECK_CONDITION;
 661
 662 static const int device_qfull_result =
 663         (DID_OK << 16) | (COMMAND_COMPLETE << 8) | SAM_STAT_TASK_SET_FULL;
 664
 665 static unsigned char caching_pg[] = {0x8, 18, 0x14, 0, 0xff, 0xff, 0, 0,
 666                                      0xff, 0xff, 0xff, 0xff, 0x80, 0x14, 0, 0,
 667                                      0, 0, 0, 0};
 668 static unsigned char ctrl_m_pg[] = {0xa, 10, 2, 0, 0, 0, 0, 0,
 669                                     0, 0, 0x2, 0x4b};
 670 static unsigned char iec_m_pg[] = {0x1c, 0xa, 0x08, 0, 0, 0, 0, 0,
 671                                    0, 0, 0x0, 0x0};
 672
 673 static void *fake_store(unsigned long long lba)
 674 {
 675         lba = do_div(lba, sdebug_store_sectors);
 676
 677         return fake_storep + lba * scsi_debug_sector_size;
 678 }
 679
 680 static struct sd_dif_tuple *dif_store(sector_t sector)
 681 {
 682         sector = do_div(sector, sdebug_store_sectors);
 683
 684         return dif_storep + sector;
 685 }
 686
 687 static int sdebug_add_adapter(void);
 688 static void sdebug_remove_adapter(void);
 689
 690 static void sdebug_max_tgts_luns(void)
 691 {
 692         struct sdebug_host_info *sdbg_host;
 693         struct Scsi_Host *hpnt;
 694
 695         spin_lock(&sdebug_host_list_lock);
 696         list_for_each_entry(sdbg_host, &sdebug_host_list, host_list) {
 697                 hpnt = sdbg_host->shost;
 698                 if ((hpnt->this_id >= 0) &&
 699                     (scsi_debug_num_tgts > hpnt->this_id))
 700                         hpnt->max_id = scsi_debug_num_tgts + 1;
 701                 else
 702                         hpnt->max_id = scsi_debug_num_tgts;
 703                 /* scsi_debug_max_luns; */
 704                 hpnt->max_lun = SCSI_W_LUN_REPORT_LUNS + 1;
 705         }
 706         spin_unlock(&sdebug_host_list_lock);
 707 }
 708
 709 enum sdeb_cmd_data {SDEB_IN_DATA = 0, SDEB_IN_CDB = 1};
 710
 711 /* Set in_bit to -1 to indicate no bit position of invalid field */
 712 static void
 713 mk_sense_invalid_fld(struct scsi_cmnd *scp, enum sdeb_cmd_data c_d,
 714                      int in_byte, int in_bit)
 715 {
 716         unsigned char *sbuff;
 717         u8 sks[4];
 718         int sl, asc;
 719
 720         sbuff = scp->sense_buffer;
 721         if (!sbuff) {
 722                 sdev_printk(KERN_ERR, scp->device,
 723                             "%s: sense_buffer is NULL\n", __func__);
 724                 return;
 725         }
 726         asc = c_d ? INVALID_FIELD_IN_CDB : INVALID_FIELD_IN_PARAM_LIST;
 727         memset(sbuff, 0, SCSI_SENSE_BUFFERSIZE);
 728         scsi_build_sense_buffer(scsi_debug_dsense, sbuff, ILLEGAL_REQUEST,
 729                                 asc, 0);
 730         memset(sks, 0, sizeof(sks));
 731         sks[0] = 0x80;
 732         if (c_d)
 733                 sks[0] |= 0x40;
 734         if (in_bit >= 0) {
 735                 sks[0] |= 0x8;
 736                 sks[0] |= 0x7 & in_bit;
 737         }
 738         put_unaligned_be16(in_byte, sks + 1);
 739         if (scsi_debug_dsense) {
 740                 sl = sbuff[7] + 8;
 741                 sbuff[7] = sl;
 742                 sbuff[sl] = 0x2;
 743                 sbuff[sl + 1] = 0x6;
 744                 memcpy(sbuff + sl + 4, sks, 3);
 745         } else
 746                 memcpy(sbuff + 15, sks, 3);
 747         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
 748                 sdev_printk(KERN_INFO, scp->device, "%s:  [sense_key,asc,ascq"
 749                             "]: [0x5,0x%x,0x0] %c byte=%d, bit=%d\n",
 750                             my_name, asc, c_d ? 'C' : 'D', in_byte, in_bit);
 751 }
 752
 753 static void mk_sense_buffer(struct scsi_cmnd *scp, int key, int asc, int asq)
 754 {
 755         unsigned char *sbuff;
 756
 757         sbuff = scp->sense_buffer;
 758         if (!sbuff) {
 759                 sdev_printk(KERN_ERR, scp->device,
 760                             "%s: sense_buffer is NULL\n", __func__);
 761                 return;
 762         }
 763         memset(sbuff, 0, SCSI_SENSE_BUFFERSIZE);
 764
 765         scsi_build_sense_buffer(scsi_debug_dsense, sbuff, key, asc, asq);
 766
 767         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
 768                 sdev_printk(KERN_INFO, scp->device,
 769                             "%s:  [sense_key,asc,ascq]: [0x%x,0x%x,0x%x]\n",
 770                             my_name, key, asc, asq);
 771 }
 772
 773 static void
 774 mk_sense_invalid_opcode(struct scsi_cmnd *scp)
 775 {
 776         mk_sense_buffer(scp, ILLEGAL_REQUEST, INVALID_OPCODE, 0);
 777 }
 778
 779 static int scsi_debug_ioctl(struct scsi_device *dev, int cmd, void __user *arg)
 780 {
 781         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts) {
 782                 if (0x1261 == cmd)
 783                         sdev_printk(KERN_INFO, dev,
 784                                     "%s: BLKFLSBUF [0x1261]\n", __func__);
 785                 else if (0x5331 == cmd)
 786                         sdev_printk(KERN_INFO, dev,
 787                                     "%s: CDROM_GET_CAPABILITY [0x5331]\n",
 788                                     __func__);
 789                 else
 790                         sdev_printk(KERN_INFO, dev, "%s: cmd=0x%x\n",
 791                                     __func__, cmd);
 792         }
 793         return -EINVAL;
 794         /* return -ENOTTY; // correct return but upsets fdisk */
 795 }
 796
 797 static void clear_luns_changed_on_target(struct sdebug_dev_info *devip)
 798 {
 799         struct sdebug_host_info *sdhp;
 800         struct sdebug_dev_info *dp;
 801
 802         spin_lock(&sdebug_host_list_lock);
 803         list_for_each_entry(sdhp, &sdebug_host_list, host_list) {
 804                 list_for_each_entry(dp, &sdhp->dev_info_list, dev_list) {
 805                         if ((devip->sdbg_host == dp->sdbg_host) &&
 806                             (devip->target == dp->target))
 807                                 clear_bit(SDEBUG_UA_LUNS_CHANGED, dp->uas_bm);
 808                 }
 809         }
 810         spin_unlock(&sdebug_host_list_lock);
 811 }
 812
 813 static int check_readiness(struct scsi_cmnd *SCpnt, int uas_only,
 814                            struct sdebug_dev_info * devip)
 815 {
 816         int k;
 817         bool debug = !!(SCSI_DEBUG_OPT_NOISE & scsi_debug_opts);
 818
 819         k = find_first_bit(devip->uas_bm, SDEBUG_NUM_UAS);
 820         if (k != SDEBUG_NUM_UAS) {
 821                 const char *cp = NULL;
 822
 823                 switch (k) {
 824                 case SDEBUG_UA_POR:
 825                         mk_sense_buffer(SCpnt, UNIT_ATTENTION,
 826                                         UA_RESET_ASC, POWER_ON_RESET_ASCQ);
 827                         if (debug)
 828                                 cp = "power on reset";
 829                         break;
 830                 case SDEBUG_UA_BUS_RESET:
 831                         mk_sense_buffer(SCpnt, UNIT_ATTENTION,
 832                                         UA_RESET_ASC, BUS_RESET_ASCQ);
 833                         if (debug)
 834                                 cp = "bus reset";
 835                         break;
 836                 case SDEBUG_UA_MODE_CHANGED:
 837                         mk_sense_buffer(SCpnt, UNIT_ATTENTION,
 838                                         UA_CHANGED_ASC, MODE_CHANGED_ASCQ);
 839                         if (debug)
 840                                 cp = "mode parameters changed";
 841                         break;
 842                 case SDEBUG_UA_CAPACITY_CHANGED:
 843                         mk_sense_buffer(SCpnt, UNIT_ATTENTION,
 844                                         UA_CHANGED_ASC, CAPACITY_CHANGED_ASCQ);
 845                         if (debug)
 846                                 cp = "capacity data changed";
 847                         break;
 848                 case SDEBUG_UA_MICROCODE_CHANGED:
 849                         mk_sense_buffer(SCpnt, UNIT_ATTENTION,
 850                                  TARGET_CHANGED_ASC, MICROCODE_CHANGED_ASCQ);
 851                         if (debug)
 852                                 cp = "microcode has been changed";
 853                         break;
 854                 case SDEBUG_UA_MICROCODE_CHANGED_WO_RESET:
 855                         mk_sense_buffer(SCpnt, UNIT_ATTENTION,
 856                                         TARGET_CHANGED_ASC,
 857                                         MICROCODE_CHANGED_WO_RESET_ASCQ);
 858                         if (debug)
 859                                 cp = "microcode has been changed without reset";
 860                         break;
 861                 case SDEBUG_UA_LUNS_CHANGED:
 862                         /*
 863                          * SPC-3 behavior is to report a UNIT ATTENTION with
 864                          * ASC/ASCQ REPORTED LUNS DATA HAS CHANGED on every LUN
 865                          * on the target, until a REPORT LUNS command is
 866                          * received.  SPC-4 behavior is to report it only once.
 867                          * NOTE:  scsi_debug_scsi_level does not use the same
 868                          * values as struct scsi_device->scsi_level.
 869                          */
 870                         if (scsi_debug_scsi_level >= 6) /* SPC-4 and above */
 871                                 clear_luns_changed_on_target(devip);
 872                         mk_sense_buffer(SCpnt, UNIT_ATTENTION,
 873                                         TARGET_CHANGED_ASC,
 874                                         LUNS_CHANGED_ASCQ);
 875                         if (debug)
 876                                 cp = "reported luns data has changed";
 877                         break;
 878                 default:
 879                         pr_warn("%s: unexpected unit attention code=%d\n",
 880                                 __func__, k);
 881                         if (debug)
 882                                 cp = "unknown";
 883                         break;
 884                 }
 885                 clear_bit(k, devip->uas_bm);
 886                 if (debug)
 887                         sdev_printk(KERN_INFO, SCpnt->device,
 888                                    "%s reports: Unit attention: %s\n",
 889                                    my_name, cp);
 890                 return check_condition_result;
 891         }
 892         if ((UAS_TUR == uas_only) && devip->stopped) {
 893                 mk_sense_buffer(SCpnt, NOT_READY, LOGICAL_UNIT_NOT_READY,
 894                                 0x2);
 895                 if (debug)
 896                         sdev_printk(KERN_INFO, SCpnt->device,
 897                                     "%s reports: Not ready: %s\n", my_name,
 898                                     "initializing command required");
 899                 return check_condition_result;
 900         }
 901         return 0;
 902 }
 903
 904 /* Returns 0 if ok else (DID_ERROR << 16). Sets scp->resid . */
 905 static int fill_from_dev_buffer(struct scsi_cmnd *scp, unsigned char *arr,
 906                                 int arr_len)
 907 {
 908         int act_len;
 909         struct scsi_data_buffer *sdb = scsi_in(scp);
 910
 911         if (!sdb->length)
 912                 return 0;
 913         if (!(scsi_bidi_cmnd(scp) || scp->sc_data_direction == DMA_FROM_DEVICE))
 914                 return (DID_ERROR << 16);
 915
 916         act_len = sg_copy_from_buffer(sdb->table.sgl, sdb->table.nents,
 917                                       arr, arr_len);
 918         sdb->resid = scsi_bufflen(scp) - act_len;
 919
 920         return 0;
 921 }
 922
 923 /* Returns number of bytes fetched into 'arr' or -1 if error. */
 924 static int fetch_to_dev_buffer(struct scsi_cmnd *scp, unsigned char *arr,
 925                                int arr_len)
 926 {
 927         if (!scsi_bufflen(scp))
 928                 return 0;
 929         if (!(scsi_bidi_cmnd(scp) || scp->sc_data_direction == DMA_TO_DEVICE))
 930                 return -1;
 931
 932         return scsi_sg_copy_to_buffer(scp, arr, arr_len);
 933 }
 934
 935
 936 static const char * inq_vendor_id = "Linux   ";
 937 static const char * inq_product_id = "scsi_debug      ";
 938 static const char *inq_product_rev = "0184";    /* version less '.' */
 939
 940 /* Device identification VPD page. Returns number of bytes placed in arr */
 941 static int inquiry_evpd_83(unsigned char * arr, int port_group_id,
 942                            int target_dev_id, int dev_id_num,
 943                            const char * dev_id_str,
 944                            int dev_id_str_len)
 945 {
 946         int num, port_a;
 947         char b[32];
 948
 949         port_a = target_dev_id + 1;
 950         /* T10 vendor identifier field format (faked) */
 951         arr[0] = 0x2;   /* ASCII */
 952         arr[1] = 0x1;
 953         arr[2] = 0x0;
 954         memcpy(&arr[4], inq_vendor_id, 8);
 955         memcpy(&arr[12], inq_product_id, 16);
 956         memcpy(&arr[28], dev_id_str, dev_id_str_len);
 957         num = 8 + 16 + dev_id_str_len;
 958         arr[3] = num;
 959         num += 4;
 960         if (dev_id_num >= 0) {
 961                 /* NAA-5, Logical unit identifier (binary) */
 962                 arr[num++] = 0x1;       /* binary (not necessarily sas) */
 963                 arr[num++] = 0x3;       /* PIV=0, lu, naa */
 964                 arr[num++] = 0x0;
 965                 arr[num++] = 0x8;
 966                 arr[num++] = 0x53;  /* naa-5 ieee company id=0x333333 (fake) */
 967                 arr[num++] = 0x33;
 968                 arr[num++] = 0x33;
 969                 arr[num++] = 0x30;
 970                 arr[num++] = (dev_id_num >> 24);
 971                 arr[num++] = (dev_id_num >> 16) & 0xff;
 972                 arr[num++] = (dev_id_num >> 8) & 0xff;
 973                 arr[num++] = dev_id_num & 0xff;
 974                 /* Target relative port number */
 975                 arr[num++] = 0x61;      /* proto=sas, binary */
 976                 arr[num++] = 0x94;      /* PIV=1, target port, rel port */
 977                 arr[num++] = 0x0;       /* reserved */
 978                 arr[num++] = 0x4;       /* length */
 979                 arr[num++] = 0x0;       /* reserved */
 980                 arr[num++] = 0x0;       /* reserved */
 981                 arr[num++] = 0x0;
 982                 arr[num++] = 0x1;       /* relative port A */
 983         }
 984         /* NAA-5, Target port identifier */
 985         arr[num++] = 0x61;      /* proto=sas, binary */
 986         arr[num++] = 0x93;      /* piv=1, target port, naa */
 987         arr[num++] = 0x0;
 988         arr[num++] = 0x8;
 989         arr[num++] = 0x52;      /* naa-5, company id=0x222222 (fake) */
 990         arr[num++] = 0x22;
 991         arr[num++] = 0x22;
 992         arr[num++] = 0x20;
 993         arr[num++] = (port_a >> 24);
 994         arr[num++] = (port_a >> 16) & 0xff;
 995         arr[num++] = (port_a >> 8) & 0xff;
 996         arr[num++] = port_a & 0xff;
 997         /* NAA-5, Target port group identifier */
 998         arr[num++] = 0x61;      /* proto=sas, binary */
 999         arr[num++] = 0x95;      /* piv=1, target port group id */
1000         arr[num++] = 0x0;
1001         arr[num++] = 0x4;
1002         arr[num++] = 0;
1003         arr[num++] = 0;
1004         arr[num++] = (port_group_id >> 8) & 0xff;
1005         arr[num++] = port_group_id & 0xff;
1006         /* NAA-5, Target device identifier */
1007         arr[num++] = 0x61;      /* proto=sas, binary */
1008         arr[num++] = 0xa3;      /* piv=1, target device, naa */
1009         arr[num++] = 0x0;
1010         arr[num++] = 0x8;
1011         arr[num++] = 0x52;      /* naa-5, company id=0x222222 (fake) */
1012         arr[num++] = 0x22;
1013         arr[num++] = 0x22;
1014         arr[num++] = 0x20;
1015         arr[num++] = (target_dev_id >> 24);
1016         arr[num++] = (target_dev_id >> 16) & 0xff;
1017         arr[num++] = (target_dev_id >> 8) & 0xff;
1018         arr[num++] = target_dev_id & 0xff;
1019         /* SCSI name string: Target device identifier */
1020         arr[num++] = 0x63;      /* proto=sas, UTF-8 */
1021         arr[num++] = 0xa8;      /* piv=1, target device, SCSI name string */
1022         arr[num++] = 0x0;
1023         arr[num++] = 24;
1024         memcpy(arr + num, "naa.52222220", 12);
1025         num += 12;
1026         snprintf(b, sizeof(b), "%08X", target_dev_id);
1027         memcpy(arr + num, b, 8);
1028         num += 8;
1029         memset(arr + num, 0, 4);
1030         num += 4;
1031         return num;
1032 }
1033
1034
1035 static unsigned char vpd84_data[] = {
1036 /* from 4th byte */ 0x22,0x22,0x22,0x0,0xbb,0x0,
1037     0x22,0x22,0x22,0x0,0xbb,0x1,
1038     0x22,0x22,0x22,0x0,0xbb,0x2,
1039 };
1040
1041 /*  Software interface identification VPD page */
1042 static int inquiry_evpd_84(unsigned char * arr)
1043 {
1044         memcpy(arr, vpd84_data, sizeof(vpd84_data));
1045         return sizeof(vpd84_data);
1046 }
1047
1048 /* Management network addresses VPD page */
1049 static int inquiry_evpd_85(unsigned char * arr)
1050 {
1051         int num = 0;
1052         const char * na1 = "https://www.kernel.org/config";
1053         const char * na2 = "http://www.kernel.org/log";
1054         int plen, olen;
1055
1056         arr[num++] = 0x1;       /* lu, storage config */
1057         arr[num++] = 0x0;       /* reserved */
1058         arr[num++] = 0x0;
1059         olen = strlen(na1);
1060         plen = olen + 1;
1061         if (plen % 4)
1062                 plen = ((plen / 4) + 1) * 4;
1063         arr[num++] = plen;      /* length, null termianted, padded */
1064         memcpy(arr + num, na1, olen);
1065         memset(arr + num + olen, 0, plen - olen);
1066         num += plen;
1067
1068         arr[num++] = 0x4;       /* lu, logging */
1069         arr[num++] = 0x0;       /* reserved */
1070         arr[num++] = 0x0;
1071         olen = strlen(na2);
1072         plen = olen + 1;
1073         if (plen % 4)
1074                 plen = ((plen / 4) + 1) * 4;
1075         arr[num++] = plen;      /* length, null terminated, padded */
1076         memcpy(arr + num, na2, olen);
1077         memset(arr + num + olen, 0, plen - olen);
1078         num += plen;
1079
1080         return num;
1081 }
1082
1083 /* SCSI ports VPD page */
1084 static int inquiry_evpd_88(unsigned char * arr, int target_dev_id)
1085 {
1086         int num = 0;
1087         int port_a, port_b;
1088
1089         port_a = target_dev_id + 1;
1090         port_b = port_a + 1;
1091         arr[num++] = 0x0;       /* reserved */
1092         arr[num++] = 0x0;       /* reserved */
1093         arr[num++] = 0x0;
1094         arr[num++] = 0x1;       /* relative port 1 (primary) */
1095         memset(arr + num, 0, 6);
1096         num += 6;
1097         arr[num++] = 0x0;
1098         arr[num++] = 12;        /* length tp descriptor */
1099         /* naa-5 target port identifier (A) */
1100         arr[num++] = 0x61;      /* proto=sas, binary */
1101         arr[num++] = 0x93;      /* PIV=1, target port, NAA */
1102         arr[num++] = 0x0;       /* reserved */
1103         arr[num++] = 0x8;       /* length */
1104         arr[num++] = 0x52;      /* NAA-5, company_id=0x222222 (fake) */
1105         arr[num++] = 0x22;
1106         arr[num++] = 0x22;
1107         arr[num++] = 0x20;
1108         arr[num++] = (port_a >> 24);
1109         arr[num++] = (port_a >> 16) & 0xff;
1110         arr[num++] = (port_a >> 8) & 0xff;
1111         arr[num++] = port_a & 0xff;
1112
1113         arr[num++] = 0x0;       /* reserved */
1114         arr[num++] = 0x0;       /* reserved */
1115         arr[num++] = 0x0;
1116         arr[num++] = 0x2;       /* relative port 2 (secondary) */
1117         memset(arr + num, 0, 6);
1118         num += 6;
1119         arr[num++] = 0x0;
1120         arr[num++] = 12;        /* length tp descriptor */
1121         /* naa-5 target port identifier (B) */
1122         arr[num++] = 0x61;      /* proto=sas, binary */
1123         arr[num++] = 0x93;      /* PIV=1, target port, NAA */
1124         arr[num++] = 0x0;       /* reserved */
1125         arr[num++] = 0x8;       /* length */
1126         arr[num++] = 0x52;      /* NAA-5, company_id=0x222222 (fake) */
1127         arr[num++] = 0x22;
1128         arr[num++] = 0x22;
1129         arr[num++] = 0x20;
1130         arr[num++] = (port_b >> 24);
1131         arr[num++] = (port_b >> 16) & 0xff;
1132         arr[num++] = (port_b >> 8) & 0xff;
1133         arr[num++] = port_b & 0xff;
1134
1135         return num;
1136 }
1137
1138
1139 static unsigned char vpd89_data[] = {
1140 /* from 4th byte */ 0,0,0,0,
1141 'l','i','n','u','x',' ',' ',' ',
1142 'S','A','T',' ','s','c','s','i','_','d','e','b','u','g',' ',' ',
1143 '1','2','3','4',
1144 0x34,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,
1145 0xec,0,0,0,
1146 0x5a,0xc,0xff,0x3f,0x37,0xc8,0x10,0,0,0,0,0,0x3f,0,0,0,
1147 0,0,0,0,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x20,0x20,0x20,0x20,
1148 0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0,0,0,0x40,0x4,0,0x2e,0x33,
1149 0x38,0x31,0x20,0x20,0x20,0x20,0x54,0x53,0x38,0x33,0x30,0x30,0x33,0x31,
1150 0x53,0x41,
1151 0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
1152 0x20,0x20,
1153 0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,0x20,
1154 0x10,0x80,
1155 0,0,0,0x2f,0,0,0,0x2,0,0x2,0x7,0,0xff,0xff,0x1,0,
1156 0x3f,0,0xc1,0xff,0x3e,0,0x10,0x1,0xb0,0xf8,0x50,0x9,0,0,0x7,0,
1157 0x3,0,0x78,0,0x78,0,0xf0,0,0x78,0,0,0,0,0,0,0,
1158 0,0,0,0,0,0,0,0,0x2,0,0,0,0,0,0,0,
1159 0x7e,0,0x1b,0,0x6b,0x34,0x1,0x7d,0x3,0x40,0x69,0x34,0x1,0x3c,0x3,0x40,
1160 0x7f,0x40,0,0,0,0,0xfe,0xfe,0,0,0,0,0,0xfe,0,0,
1161 0,0,0,0,0,0,0,0,0xb0,0xf8,0x50,0x9,0,0,0,0,
1162 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1163 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1164 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1165 0x1,0,0xb0,0xf8,0x50,0x9,0xb0,0xf8,0x50,0x9,0x20,0x20,0x2,0,0xb6,0x42,
1166 0,0x80,0x8a,0,0x6,0x3c,0xa,0x3c,0xff,0xff,0xc6,0x7,0,0x1,0,0x8,
1167 0xf0,0xf,0,0x10,0x2,0,0x30,0,0,0,0,0,0,0,0x6,0xfe,
1168 0,0,0x2,0,0x50,0,0x8a,0,0x4f,0x95,0,0,0x21,0,0xb,0,
1169 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1170 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1171 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1172 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1173 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1174 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1175 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1176 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1177 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1178 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1179 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1180 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0xa5,0x51,
1181 };
1182
1183 /* ATA Information VPD page */
1184 static int inquiry_evpd_89(unsigned char * arr)
1185 {
1186         memcpy(arr, vpd89_data, sizeof(vpd89_data));
1187         return sizeof(vpd89_data);
1188 }
1189
1190
1191 static unsigned char vpdb0_data[] = {
1192         /* from 4th byte */ 0,0,0,4, 0,0,0x4,0, 0,0,0,64,
1193         0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1194         0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1195         0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
1196 };
1197
1198 /* Block limits VPD page (SBC-3) */
1199 static int inquiry_evpd_b0(unsigned char * arr)
1200 {
1201         unsigned int gran;
1202
1203         memcpy(arr, vpdb0_data, sizeof(vpdb0_data));
1204
1205         /* Optimal transfer length granularity */
1206         gran = 1 << scsi_debug_physblk_exp;
1207         arr[2] = (gran >> 8) & 0xff;
1208         arr[3] = gran & 0xff;
1209
1210         /* Maximum Transfer Length */
1211         if (sdebug_store_sectors > 0x400) {
1212                 arr[4] = (sdebug_store_sectors >> 24) & 0xff;
1213                 arr[5] = (sdebug_store_sectors >> 16) & 0xff;
1214                 arr[6] = (sdebug_store_sectors >> 8) & 0xff;
1215                 arr[7] = sdebug_store_sectors & 0xff;
1216         }
1217
1218         /* Optimal Transfer Length */
1219         put_unaligned_be32(scsi_debug_opt_blks, &arr[8]);
1220
1221         if (scsi_debug_lbpu) {
1222                 /* Maximum Unmap LBA Count */
1223                 put_unaligned_be32(scsi_debug_unmap_max_blocks, &arr[16]);
1224
1225                 /* Maximum Unmap Block Descriptor Count */
1226                 put_unaligned_be32(scsi_debug_unmap_max_desc, &arr[20]);
1227         }
1228
1229         /* Unmap Granularity Alignment */
1230         if (scsi_debug_unmap_alignment) {
1231                 put_unaligned_be32(scsi_debug_unmap_alignment, &arr[28]);
1232                 arr[28] |= 0x80; /* UGAVALID */
1233         }
1234
1235         /* Optimal Unmap Granularity */
1236         put_unaligned_be32(scsi_debug_unmap_granularity, &arr[24]);
1237
1238         /* Maximum WRITE SAME Length */
1239         put_unaligned_be64(scsi_debug_write_same_length, &arr[32]);
1240
1241         return 0x3c; /* Mandatory page length for Logical Block Provisioning */
1242
1243         return sizeof(vpdb0_data);
1244 }
1245
1246 /* Block device characteristics VPD page (SBC-3) */
1247 static int inquiry_evpd_b1(unsigned char *arr)
1248 {
1249         memset(arr, 0, 0x3c);
1250         arr[0] = 0;
1251         arr[1] = 1;     /* non rotating medium (e.g. solid state) */
1252         arr[2] = 0;
1253         arr[3] = 5;     /* less than 1.8" */
1254
1255         return 0x3c;
1256 }
1257
1258 /* Logical block provisioning VPD page (SBC-3) */
1259 static int inquiry_evpd_b2(unsigned char *arr)
1260 {
1261         memset(arr, 0, 0x4);
1262         arr[0] = 0;                     /* threshold exponent */
1263
1264         if (scsi_debug_lbpu)
1265                 arr[1] = 1 << 7;
1266
1267         if (scsi_debug_lbpws)
1268                 arr[1] |= 1 << 6;
1269
1270         if (scsi_debug_lbpws10)
1271                 arr[1] |= 1 << 5;
1272
1273         if (scsi_debug_lbprz)
1274                 arr[1] |= 1 << 2;
1275
1276         return 0x4;
1277 }
1278
1279 #define SDEBUG_LONG_INQ_SZ 96
1280 #define SDEBUG_MAX_INQ_ARR_SZ 584
1281
1282 static int resp_inquiry(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
1283 {
1284         unsigned char pq_pdt;
1285         unsigned char * arr;
1286         unsigned char *cmd = scp->cmnd;
1287         int alloc_len, n, ret;
1288         bool have_wlun;
1289
1290         alloc_len = (cmd[3] << 8) + cmd[4];
1291         arr = kzalloc(SDEBUG_MAX_INQ_ARR_SZ, GFP_ATOMIC);
1292         if (! arr)
1293                 return DID_REQUEUE << 16;
1294         have_wlun = (scp->device->lun == SCSI_W_LUN_REPORT_LUNS);
1295         if (have_wlun)
1296                 pq_pdt = 0x1e;  /* present, wlun */
1297         else if (scsi_debug_no_lun_0 && (0 == devip->lun))
1298                 pq_pdt = 0x7f;  /* not present, no device type */
1299         else
1300                 pq_pdt = (scsi_debug_ptype & 0x1f);
1301         arr[0] = pq_pdt;
1302         if (0x2 & cmd[1]) {  /* CMDDT bit set */
1303                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 1, 1);
1304                 kfree(arr);
1305                 return check_condition_result;
1306         } else if (0x1 & cmd[1]) {  /* EVPD bit set */
1307                 int lu_id_num, port_group_id, target_dev_id, len;
1308                 char lu_id_str[6];
1309                 int host_no = devip->sdbg_host->shost->host_no;
1310
1311                 port_group_id = (((host_no + 1) & 0x7f) << 8) +
1312                     (devip->channel & 0x7f);
1313                 if (0 == scsi_debug_vpd_use_hostno)
1314                         host_no = 0;
1315                 lu_id_num = have_wlun ? -1 : (((host_no + 1) * 2000) +
1316                             (devip->target * 1000) + devip->lun);
1317                 target_dev_id = ((host_no + 1) * 2000) +
1318                                  (devip->target * 1000) - 3;
1319                 len = scnprintf(lu_id_str, 6, "%d", lu_id_num);
1320                 if (0 == cmd[2]) { /* supported vital product data pages */
1321                         arr[1] = cmd[2];        /*sanity */
1322                         n = 4;
1323                         arr[n++] = 0x0;   /* this page */
1324                         arr[n++] = 0x80;  /* unit serial number */
1325                         arr[n++] = 0x83;  /* device identification */
1326                         arr[n++] = 0x84;  /* software interface ident. */
1327                         arr[n++] = 0x85;  /* management network addresses */
1328                         arr[n++] = 0x86;  /* extended inquiry */
1329                         arr[n++] = 0x87;  /* mode page policy */
1330                         arr[n++] = 0x88;  /* SCSI ports */
1331                         arr[n++] = 0x89;  /* ATA information */
1332                         arr[n++] = 0xb0;  /* Block limits (SBC) */
1333                         arr[n++] = 0xb1;  /* Block characteristics (SBC) */
1334                         if (scsi_debug_lbp()) /* Logical Block Prov. (SBC) */
1335                                 arr[n++] = 0xb2;
1336                         arr[3] = n - 4;   /* number of supported VPD pages */
1337                 } else if (0x80 == cmd[2]) { /* unit serial number */
1338                         arr[1] = cmd[2];        /*sanity */
1339                         arr[3] = len;
1340                         memcpy(&arr[4], lu_id_str, len);
1341                 } else if (0x83 == cmd[2]) { /* device identification */
1342                         arr[1] = cmd[2];        /*sanity */
1343                         arr[3] = inquiry_evpd_83(&arr[4], port_group_id,
1344                                                  target_dev_id, lu_id_num,
1345                                                  lu_id_str, len);
1346                 } else if (0x84 == cmd[2]) { /* Software interface ident. */
1347                         arr[1] = cmd[2];        /*sanity */
1348                         arr[3] = inquiry_evpd_84(&arr[4]);
1349                 } else if (0x85 == cmd[2]) { /* Management network addresses */
1350                         arr[1] = cmd[2];        /*sanity */
1351                         arr[3] = inquiry_evpd_85(&arr[4]);
1352                 } else if (0x86 == cmd[2]) { /* extended inquiry */
1353                         arr[1] = cmd[2];        /*sanity */
1354                         arr[3] = 0x3c;  /* number of following entries */
1355                         if (scsi_debug_dif == SD_DIF_TYPE3_PROTECTION)
1356                                 arr[4] = 0x4;   /* SPT: GRD_CHK:1 */
1357                         else if (scsi_debug_dif)
1358                                 arr[4] = 0x5;   /* SPT: GRD_CHK:1, REF_CHK:1 */
1359                         else
1360                                 arr[4] = 0x0;   /* no protection stuff */
1361                         arr[5] = 0x7;   /* head of q, ordered + simple q's */
1362                 } else if (0x87 == cmd[2]) { /* mode page policy */
1363                         arr[1] = cmd[2];        /*sanity */
1364                         arr[3] = 0x8;   /* number of following entries */
1365                         arr[4] = 0x2;   /* disconnect-reconnect mp */
1366                         arr[6] = 0x80;  /* mlus, shared */
1367                         arr[8] = 0x18;   /* protocol specific lu */
1368                         arr[10] = 0x82;  /* mlus, per initiator port */
1369                 } else if (0x88 == cmd[2]) { /* SCSI Ports */
1370                         arr[1] = cmd[2];        /*sanity */
1371                         arr[3] = inquiry_evpd_88(&arr[4], target_dev_id);
1372                 } else if (0x89 == cmd[2]) { /* ATA information */
1373                         arr[1] = cmd[2];        /*sanity */
1374                         n = inquiry_evpd_89(&arr[4]);
1375                         arr[2] = (n >> 8);
1376                         arr[3] = (n & 0xff);
1377                 } else if (0xb0 == cmd[2]) { /* Block limits (SBC) */
1378                         arr[1] = cmd[2];        /*sanity */
1379                         arr[3] = inquiry_evpd_b0(&arr[4]);
1380                 } else if (0xb1 == cmd[2]) { /* Block characteristics (SBC) */
1381                         arr[1] = cmd[2];        /*sanity */
1382                         arr[3] = inquiry_evpd_b1(&arr[4]);
1383                 } else if (0xb2 == cmd[2]) { /* Logical Block Prov. (SBC) */
1384                         arr[1] = cmd[2];        /*sanity */
1385                         arr[3] = inquiry_evpd_b2(&arr[4]);
1386                 } else {
1387                         mk_sense_invalid_fld(scp, SDEB_IN_CDB, 2, -1);
1388                         kfree(arr);
1389                         return check_condition_result;
1390                 }
1391                 len = min(((arr[2] << 8) + arr[3]) + 4, alloc_len);
1392                 ret = fill_from_dev_buffer(scp, arr,
1393                             min(len, SDEBUG_MAX_INQ_ARR_SZ));
1394                 kfree(arr);
1395                 return ret;
1396         }
1397         /* drops through here for a standard inquiry */
1398         arr[1] = scsi_debug_removable ? 0x80 : 0;       /* Removable disk */
1399         arr[2] = scsi_debug_scsi_level;
1400         arr[3] = 2;    /* response_data_format==2 */
1401         arr[4] = SDEBUG_LONG_INQ_SZ - 5;
1402         arr[5] = scsi_debug_dif ? 1 : 0; /* PROTECT bit */
1403         if (0 == scsi_debug_vpd_use_hostno)
1404                 arr[5] = 0x10; /* claim: implicit TGPS */
1405         arr[6] = 0x10; /* claim: MultiP */
1406         /* arr[6] |= 0x40; ... claim: EncServ (enclosure services) */
1407         arr[7] = 0xa; /* claim: LINKED + CMDQUE */
1408         memcpy(&arr[8], inq_vendor_id, 8);
1409         memcpy(&arr[16], inq_product_id, 16);
1410         memcpy(&arr[32], inq_product_rev, 4);
1411         /* version descriptors (2 bytes each) follow */
1412         arr[58] = 0x0; arr[59] = 0xa2;  /* SAM-5 rev 4 */
1413         arr[60] = 0x4; arr[61] = 0x68;  /* SPC-4 rev 37 */
1414         n = 62;
1415         if (scsi_debug_ptype == 0) {
1416                 arr[n++] = 0x4; arr[n++] = 0xc5; /* SBC-4 rev 36 */
1417         } else if (scsi_debug_ptype == 1) {
1418                 arr[n++] = 0x5; arr[n++] = 0x25; /* SSC-4 rev 3 */
1419         }
1420         arr[n++] = 0x20; arr[n++] = 0xe6;  /* SPL-3 rev 7 */
1421         ret = fill_from_dev_buffer(scp, arr,
1422                             min(alloc_len, SDEBUG_LONG_INQ_SZ));
1423         kfree(arr);
1424         return ret;
1425 }
1426
1427 static int resp_requests(struct scsi_cmnd * scp,
1428                          struct sdebug_dev_info * devip)
1429 {
1430         unsigned char * sbuff;
1431         unsigned char *cmd = scp->cmnd;
1432         unsigned char arr[SCSI_SENSE_BUFFERSIZE];
1433         bool dsense;
1434         int len = 18;
1435
1436         memset(arr, 0, sizeof(arr));
1437         dsense = !!(cmd[1] & 1);
1438         sbuff = scp->sense_buffer;
1439         if ((iec_m_pg[2] & 0x4) && (6 == (iec_m_pg[3] & 0xf))) {
1440                 if (dsense) {
1441                         arr[0] = 0x72;
1442                         arr[1] = 0x0;           /* NO_SENSE in sense_key */
1443                         arr[2] = THRESHOLD_EXCEEDED;
1444                         arr[3] = 0xff;          /* TEST set and MRIE==6 */
1445                         len = 8;
1446                 } else {
1447                         arr[0] = 0x70;
1448                         arr[2] = 0x0;           /* NO_SENSE in sense_key */
1449                         arr[7] = 0xa;           /* 18 byte sense buffer */
1450                         arr[12] = THRESHOLD_EXCEEDED;
1451                         arr[13] = 0xff;         /* TEST set and MRIE==6 */
1452                 }
1453         } else {
1454                 memcpy(arr, sbuff, SCSI_SENSE_BUFFERSIZE);
1455                 if (arr[0] >= 0x70 && dsense == scsi_debug_dsense)
1456                         ;       /* have sense and formats match */
1457                 else if (arr[0] <= 0x70) {
1458                         if (dsense) {
1459                                 memset(arr, 0, 8);
1460                                 arr[0] = 0x72;
1461                                 len = 8;
1462                         } else {
1463                                 memset(arr, 0, 18);
1464                                 arr[0] = 0x70;
1465                                 arr[7] = 0xa;
1466                         }
1467                 } else if (dsense) {
1468                         memset(arr, 0, 8);
1469                         arr[0] = 0x72;
1470                         arr[1] = sbuff[2];     /* sense key */
1471                         arr[2] = sbuff[12];    /* asc */
1472                         arr[3] = sbuff[13];    /* ascq */
1473                         len = 8;
1474                 } else {
1475                         memset(arr, 0, 18);
1476                         arr[0] = 0x70;
1477                         arr[2] = sbuff[1];
1478                         arr[7] = 0xa;
1479                         arr[12] = sbuff[1];
1480                         arr[13] = sbuff[3];
1481                 }
1482
1483         }
1484         mk_sense_buffer(scp, 0, NO_ADDITIONAL_SENSE, 0);
1485         return fill_from_dev_buffer(scp, arr, len);
1486 }
1487
1488 static int resp_start_stop(struct scsi_cmnd * scp,
1489                            struct sdebug_dev_info * devip)
1490 {
1491         unsigned char *cmd = scp->cmnd;
1492         int power_cond, start;
1493
1494         power_cond = (cmd[4] & 0xf0) >> 4;
1495         if (power_cond) {
1496                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 4, 7);
1497                 return check_condition_result;
1498         }
1499         start = cmd[4] & 1;
1500         if (start == devip->stopped)
1501                 devip->stopped = !start;
1502         return 0;
1503 }
1504
1505 static sector_t get_sdebug_capacity(void)
1506 {
1507         if (scsi_debug_virtual_gb > 0)
1508                 return (sector_t)scsi_debug_virtual_gb *
1509                         (1073741824 / scsi_debug_sector_size);
1510         else
1511                 return sdebug_store_sectors;
1512 }
1513
1514 #define SDEBUG_READCAP_ARR_SZ 8
1515 static int resp_readcap(struct scsi_cmnd * scp,
1516                         struct sdebug_dev_info * devip)
1517 {
1518         unsigned char arr[SDEBUG_READCAP_ARR_SZ];
1519         unsigned int capac;
1520
1521         /* following just in case virtual_gb changed */
1522         sdebug_capacity = get_sdebug_capacity();
1523         memset(arr, 0, SDEBUG_READCAP_ARR_SZ);
1524         if (sdebug_capacity < 0xffffffff) {
1525                 capac = (unsigned int)sdebug_capacity - 1;
1526                 arr[0] = (capac >> 24);
1527                 arr[1] = (capac >> 16) & 0xff;
1528                 arr[2] = (capac >> 8) & 0xff;
1529                 arr[3] = capac & 0xff;
1530         } else {
1531                 arr[0] = 0xff;
1532                 arr[1] = 0xff;
1533                 arr[2] = 0xff;
1534                 arr[3] = 0xff;
1535         }
1536         arr[6] = (scsi_debug_sector_size >> 8) & 0xff;
1537         arr[7] = scsi_debug_sector_size & 0xff;
1538         return fill_from_dev_buffer(scp, arr, SDEBUG_READCAP_ARR_SZ);
1539 }
1540
1541 #define SDEBUG_READCAP16_ARR_SZ 32
1542 static int resp_readcap16(struct scsi_cmnd * scp,
1543                           struct sdebug_dev_info * devip)
1544 {
1545         unsigned char *cmd = scp->cmnd;
1546         unsigned char arr[SDEBUG_READCAP16_ARR_SZ];
1547         unsigned long long capac;
1548         int k, alloc_len;
1549
1550         alloc_len = ((cmd[10] << 24) + (cmd[11] << 16) + (cmd[12] << 8)
1551                      + cmd[13]);
1552         /* following just in case virtual_gb changed */
1553         sdebug_capacity = get_sdebug_capacity();
1554         memset(arr, 0, SDEBUG_READCAP16_ARR_SZ);
1555         capac = sdebug_capacity - 1;
1556         for (k = 0; k < 8; ++k, capac >>= 8)
1557                 arr[7 - k] = capac & 0xff;
1558         arr[8] = (scsi_debug_sector_size >> 24) & 0xff;
1559         arr[9] = (scsi_debug_sector_size >> 16) & 0xff;
1560         arr[10] = (scsi_debug_sector_size >> 8) & 0xff;
1561         arr[11] = scsi_debug_sector_size & 0xff;
1562         arr[13] = scsi_debug_physblk_exp & 0xf;
1563         arr[14] = (scsi_debug_lowest_aligned >> 8) & 0x3f;
1564
1565         if (scsi_debug_lbp()) {
1566                 arr[14] |= 0x80; /* LBPME */
1567                 if (scsi_debug_lbprz)
1568                         arr[14] |= 0x40; /* LBPRZ */
1569         }
1570
1571         arr[15] = scsi_debug_lowest_aligned & 0xff;
1572
1573         if (scsi_debug_dif) {
1574                 arr[12] = (scsi_debug_dif - 1) << 1; /* P_TYPE */
1575                 arr[12] |= 1; /* PROT_EN */
1576         }
1577
1578         return fill_from_dev_buffer(scp, arr,
1579                                     min(alloc_len, SDEBUG_READCAP16_ARR_SZ));
1580 }
1581
1582 #define SDEBUG_MAX_TGTPGS_ARR_SZ 1412
1583
1584 static int resp_report_tgtpgs(struct scsi_cmnd * scp,
1585                               struct sdebug_dev_info * devip)
1586 {
1587         unsigned char *cmd = scp->cmnd;
1588         unsigned char * arr;
1589         int host_no = devip->sdbg_host->shost->host_no;
1590         int n, ret, alen, rlen;
1591         int port_group_a, port_group_b, port_a, port_b;
1592
1593         alen = ((cmd[6] << 24) + (cmd[7] << 16) + (cmd[8] << 8)
1594                 + cmd[9]);
1595
1596         arr = kzalloc(SDEBUG_MAX_TGTPGS_ARR_SZ, GFP_ATOMIC);
1597         if (! arr)
1598                 return DID_REQUEUE << 16;
1599         /*
1600          * EVPD page 0x88 states we have two ports, one
1601          * real and a fake port with no device connected.
1602          * So we create two port groups with one port each
1603          * and set the group with port B to unavailable.
1604          */
1605         port_a = 0x1; /* relative port A */
1606         port_b = 0x2; /* relative port B */
1607         port_group_a = (((host_no + 1) & 0x7f) << 8) +
1608             (devip->channel & 0x7f);
1609         port_group_b = (((host_no + 1) & 0x7f) << 8) +
1610             (devip->channel & 0x7f) + 0x80;
1611
1612         /*
1613          * The asymmetric access state is cycled according to the host_id.
1614          */
1615         n = 4;
1616         if (0 == scsi_debug_vpd_use_hostno) {
1617             arr[n++] = host_no % 3; /* Asymm access state */
1618             arr[n++] = 0x0F; /* claim: all states are supported */
1619         } else {
1620             arr[n++] = 0x0; /* Active/Optimized path */
1621             arr[n++] = 0x01; /* claim: only support active/optimized paths */
1622         }
1623         arr[n++] = (port_group_a >> 8) & 0xff;
1624         arr[n++] = port_group_a & 0xff;
1625         arr[n++] = 0;    /* Reserved */
1626         arr[n++] = 0;    /* Status code */
1627         arr[n++] = 0;    /* Vendor unique */
1628         arr[n++] = 0x1;  /* One port per group */
1629         arr[n++] = 0;    /* Reserved */
1630         arr[n++] = 0;    /* Reserved */
1631         arr[n++] = (port_a >> 8) & 0xff;
1632         arr[n++] = port_a & 0xff;
1633         arr[n++] = 3;    /* Port unavailable */
1634         arr[n++] = 0x08; /* claim: only unavailalbe paths are supported */
1635         arr[n++] = (port_group_b >> 8) & 0xff;
1636         arr[n++] = port_group_b & 0xff;
1637         arr[n++] = 0;    /* Reserved */
1638         arr[n++] = 0;    /* Status code */
1639         arr[n++] = 0;    /* Vendor unique */
1640         arr[n++] = 0x1;  /* One port per group */
1641         arr[n++] = 0;    /* Reserved */
1642         arr[n++] = 0;    /* Reserved */
1643         arr[n++] = (port_b >> 8) & 0xff;
1644         arr[n++] = port_b & 0xff;
1645
1646         rlen = n - 4;
1647         arr[0] = (rlen >> 24) & 0xff;
1648         arr[1] = (rlen >> 16) & 0xff;
1649         arr[2] = (rlen >> 8) & 0xff;
1650         arr[3] = rlen & 0xff;
1651
1652         /*
1653          * Return the smallest value of either
1654          * - The allocated length
1655          * - The constructed command length
1656          * - The maximum array size
1657          */
1658         rlen = min(alen,n);
1659         ret = fill_from_dev_buffer(scp, arr,
1660                                    min(rlen, SDEBUG_MAX_TGTPGS_ARR_SZ));
1661         kfree(arr);
1662         return ret;
1663 }
1664
1665 static int
1666 resp_rsup_opcodes(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
1667 {
1668         bool rctd;
1669         u8 reporting_opts, req_opcode, sdeb_i, supp;
1670         u16 req_sa, u;
1671         u32 alloc_len, a_len;
1672         int k, offset, len, errsts, count, bump, na;
1673         const struct opcode_info_t *oip;
1674         const struct opcode_info_t *r_oip;
1675         u8 *arr;
1676         u8 *cmd = scp->cmnd;
1677
1678         rctd = !!(cmd[2] & 0x80);
1679         reporting_opts = cmd[2] & 0x7;
1680         req_opcode = cmd[3];
1681         req_sa = get_unaligned_be16(cmd + 4);
1682         alloc_len = get_unaligned_be32(cmd + 6);
1683         if (alloc_len < 4 || alloc_len > 0xffff) {
1684                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 6, -1);
1685                 return check_condition_result;
1686         }
1687         if (alloc_len > 8192)
1688                 a_len = 8192;
1689         else
1690                 a_len = alloc_len;
1691         arr = kzalloc((a_len < 256) ? 320 : a_len + 64, GFP_ATOMIC);
1692         if (NULL == arr) {
1693                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC,
1694                                 INSUFF_RES_ASCQ);
1695                 return check_condition_result;
1696         }
1697         switch (reporting_opts) {
1698         case 0: /* all commands */
1699                 /* count number of commands */
1700                 for (count = 0, oip = opcode_info_arr;
1701                      oip->num_attached != 0xff; ++oip) {
1702                         if (F_INV_OP & oip->flags)
1703                                 continue;
1704                         count += (oip->num_attached + 1);
1705                 }
1706                 bump = rctd ? 20 : 8;
1707                 put_unaligned_be32(count * bump, arr);
1708                 for (offset = 4, oip = opcode_info_arr;
1709                      oip->num_attached != 0xff && offset < a_len; ++oip) {
1710                         if (F_INV_OP & oip->flags)
1711                                 continue;
1712                         na = oip->num_attached;
1713                         arr[offset] = oip->opcode;
1714                         put_unaligned_be16(oip->sa, arr + offset + 2);
1715                         if (rctd)
1716                                 arr[offset + 5] |= 0x2;
1717                         if (FF_SA & oip->flags)
1718                                 arr[offset + 5] |= 0x1;
1719                         put_unaligned_be16(oip->len_mask[0], arr + offset + 6);
1720                         if (rctd)
1721                                 put_unaligned_be16(0xa, arr + offset + 8);
1722                         r_oip = oip;
1723                         for (k = 0, oip = oip->arrp; k < na; ++k, ++oip) {
1724                                 if (F_INV_OP & oip->flags)
1725                                         continue;
1726                                 offset += bump;
1727                                 arr[offset] = oip->opcode;
1728                                 put_unaligned_be16(oip->sa, arr + offset + 2);
1729                                 if (rctd)
1730                                         arr[offset + 5] |= 0x2;
1731                                 if (FF_SA & oip->flags)
1732                                         arr[offset + 5] |= 0x1;
1733                                 put_unaligned_be16(oip->len_mask[0],
1734                                                    arr + offset + 6);
1735                                 if (rctd)
1736                                         put_unaligned_be16(0xa,
1737                                                            arr + offset + 8);
1738                         }
1739                         oip = r_oip;
1740                         offset += bump;
1741                 }
1742                 break;
1743         case 1: /* one command: opcode only */
1744         case 2: /* one command: opcode plus service action */
1745         case 3: /* one command: if sa==0 then opcode only else opcode+sa */
1746                 sdeb_i = opcode_ind_arr[req_opcode];
1747                 oip = &opcode_info_arr[sdeb_i];
1748                 if (F_INV_OP & oip->flags) {
1749                         supp = 1;
1750                         offset = 4;
1751                 } else {
1752                         if (1 == reporting_opts) {
1753                                 if (FF_SA & oip->flags) {
1754                                         mk_sense_invalid_fld(scp, SDEB_IN_CDB,
1755                                                              2, 2);
1756                                         kfree(arr);
1757                                         return check_condition_result;
1758                                 }
1759                                 req_sa = 0;
1760                         } else if (2 == reporting_opts &&
1761                                    0 == (FF_SA & oip->flags)) {
1762                                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 4, -1);
1763                                 kfree(arr);     /* point at requested sa */
1764                                 return check_condition_result;
1765                         }
1766                         if (0 == (FF_SA & oip->flags) &&
1767                             req_opcode == oip->opcode)
1768                                 supp = 3;
1769                         else if (0 == (FF_SA & oip->flags)) {
1770                                 na = oip->num_attached;
1771                                 for (k = 0, oip = oip->arrp; k < na;
1772                                      ++k, ++oip) {
1773                                         if (req_opcode == oip->opcode)
1774                                                 break;
1775                                 }
1776                                 supp = (k >= na) ? 1 : 3;
1777                         } else if (req_sa != oip->sa) {
1778                                 na = oip->num_attached;
1779                                 for (k = 0, oip = oip->arrp; k < na;
1780                                      ++k, ++oip) {
1781                                         if (req_sa == oip->sa)
1782                                                 break;
1783                                 }
1784                                 supp = (k >= na) ? 1 : 3;
1785                         } else
1786                                 supp = 3;
1787                         if (3 == supp) {
1788                                 u = oip->len_mask[0];
1789                                 put_unaligned_be16(u, arr + 2);
1790                                 arr[4] = oip->opcode;
1791                                 for (k = 1; k < u; ++k)
1792                                         arr[4 + k] = (k < 16) ?
1793                                                  oip->len_mask[k] : 0xff;
1794                                 offset = 4 + u;
1795                         } else
1796                                 offset = 4;
1797                 }
1798                 arr[1] = (rctd ? 0x80 : 0) | supp;
1799                 if (rctd) {
1800                         put_unaligned_be16(0xa, arr + offset);
1801                         offset += 12;
1802                 }
1803                 break;
1804         default:
1805                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 2, 2);
1806                 kfree(arr);
1807                 return check_condition_result;
1808         }
1809         offset = (offset < a_len) ? offset : a_len;
1810         len = (offset < alloc_len) ? offset : alloc_len;
1811         errsts = fill_from_dev_buffer(scp, arr, len);
1812         kfree(arr);
1813         return errsts;
1814 }
1815
1816 static int
1817 resp_rsup_tmfs(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
1818 {
1819         bool repd;
1820         u32 alloc_len, len;
1821         u8 arr[16];
1822         u8 *cmd = scp->cmnd;
1823
1824         memset(arr, 0, sizeof(arr));
1825         repd = !!(cmd[2] & 0x80);
1826         alloc_len = get_unaligned_be32(cmd + 6);
1827         if (alloc_len < 4) {
1828                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 6, -1);
1829                 return check_condition_result;
1830         }
1831         arr[0] = 0xc8;          /* ATS | ATSS | LURS */
1832         arr[1] = 0x1;           /* ITNRS */
1833         if (repd) {
1834                 arr[3] = 0xc;
1835                 len = 16;
1836         } else
1837                 len = 4;
1838
1839         len = (len < alloc_len) ? len : alloc_len;
1840         return fill_from_dev_buffer(scp, arr, len);
1841 }
1842
1843 /* <<Following mode page info copied from ST318451LW>> */
1844
1845 static int resp_err_recov_pg(unsigned char * p, int pcontrol, int target)
1846 {       /* Read-Write Error Recovery page for mode_sense */
1847         unsigned char err_recov_pg[] = {0x1, 0xa, 0xc0, 11, 240, 0, 0, 0,
1848                                         5, 0, 0xff, 0xff};
1849
1850         memcpy(p, err_recov_pg, sizeof(err_recov_pg));
1851         if (1 == pcontrol)
1852                 memset(p + 2, 0, sizeof(err_recov_pg) - 2);
1853         return sizeof(err_recov_pg);
1854 }
1855
1856 static int resp_disconnect_pg(unsigned char * p, int pcontrol, int target)
1857 {       /* Disconnect-Reconnect page for mode_sense */
1858         unsigned char disconnect_pg[] = {0x2, 0xe, 128, 128, 0, 10, 0, 0,
1859                                          0, 0, 0, 0, 0, 0, 0, 0};
1860
1861         memcpy(p, disconnect_pg, sizeof(disconnect_pg));
1862         if (1 == pcontrol)
1863                 memset(p + 2, 0, sizeof(disconnect_pg) - 2);
1864         return sizeof(disconnect_pg);
1865 }
1866
1867 static int resp_format_pg(unsigned char * p, int pcontrol, int target)
1868 {       /* Format device page for mode_sense */
1869         unsigned char format_pg[] = {0x3, 0x16, 0, 0, 0, 0, 0, 0,
1870                                      0, 0, 0, 0, 0, 0, 0, 0,
1871                                      0, 0, 0, 0, 0x40, 0, 0, 0};
1872
1873         memcpy(p, format_pg, sizeof(format_pg));
1874         p[10] = (sdebug_sectors_per >> 8) & 0xff;
1875         p[11] = sdebug_sectors_per & 0xff;
1876         p[12] = (scsi_debug_sector_size >> 8) & 0xff;
1877         p[13] = scsi_debug_sector_size & 0xff;
1878         if (scsi_debug_removable)
1879                 p[20] |= 0x20; /* should agree with INQUIRY */
1880         if (1 == pcontrol)
1881                 memset(p + 2, 0, sizeof(format_pg) - 2);
1882         return sizeof(format_pg);
1883 }
1884
1885 static int resp_caching_pg(unsigned char * p, int pcontrol, int target)
1886 {       /* Caching page for mode_sense */
1887         unsigned char ch_caching_pg[] = {/* 0x8, 18, */ 0x4, 0, 0, 0, 0, 0,
1888                 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
1889         unsigned char d_caching_pg[] = {0x8, 18, 0x14, 0, 0xff, 0xff, 0, 0,
1890                 0xff, 0xff, 0xff, 0xff, 0x80, 0x14, 0, 0,     0, 0, 0, 0};
1891
1892         if (SCSI_DEBUG_OPT_N_WCE & scsi_debug_opts)
1893                 caching_pg[2] &= ~0x4;  /* set WCE=0 (default WCE=1) */
1894         memcpy(p, caching_pg, sizeof(caching_pg));
1895         if (1 == pcontrol)
1896                 memcpy(p + 2, ch_caching_pg, sizeof(ch_caching_pg));
1897         else if (2 == pcontrol)
1898                 memcpy(p, d_caching_pg, sizeof(d_caching_pg));
1899         return sizeof(caching_pg);
1900 }
1901
1902 static int resp_ctrl_m_pg(unsigned char * p, int pcontrol, int target)
1903 {       /* Control mode page for mode_sense */
1904         unsigned char ch_ctrl_m_pg[] = {/* 0xa, 10, */ 0x6, 0, 0, 0, 0, 0,
1905                                         0, 0, 0, 0};
1906         unsigned char d_ctrl_m_pg[] = {0xa, 10, 2, 0, 0, 0, 0, 0,
1907                                      0, 0, 0x2, 0x4b};
1908
1909         if (scsi_debug_dsense)
1910                 ctrl_m_pg[2] |= 0x4;
1911         else
1912                 ctrl_m_pg[2] &= ~0x4;
1913
1914         if (scsi_debug_ato)
1915                 ctrl_m_pg[5] |= 0x80; /* ATO=1 */
1916
1917         memcpy(p, ctrl_m_pg, sizeof(ctrl_m_pg));
1918         if (1 == pcontrol)
1919                 memcpy(p + 2, ch_ctrl_m_pg, sizeof(ch_ctrl_m_pg));
1920         else if (2 == pcontrol)
1921                 memcpy(p, d_ctrl_m_pg, sizeof(d_ctrl_m_pg));
1922         return sizeof(ctrl_m_pg);
1923 }
1924
1925
1926 static int resp_iec_m_pg(unsigned char * p, int pcontrol, int target)
1927 {       /* Informational Exceptions control mode page for mode_sense */
1928         unsigned char ch_iec_m_pg[] = {/* 0x1c, 0xa, */ 0x4, 0xf, 0, 0, 0, 0,
1929                                        0, 0, 0x0, 0x0};
1930         unsigned char d_iec_m_pg[] = {0x1c, 0xa, 0x08, 0, 0, 0, 0, 0,
1931                                       0, 0, 0x0, 0x0};
1932
1933         memcpy(p, iec_m_pg, sizeof(iec_m_pg));
1934         if (1 == pcontrol)
1935                 memcpy(p + 2, ch_iec_m_pg, sizeof(ch_iec_m_pg));
1936         else if (2 == pcontrol)
1937                 memcpy(p, d_iec_m_pg, sizeof(d_iec_m_pg));
1938         return sizeof(iec_m_pg);
1939 }
1940
1941 static int resp_sas_sf_m_pg(unsigned char * p, int pcontrol, int target)
1942 {       /* SAS SSP mode page - short format for mode_sense */
1943         unsigned char sas_sf_m_pg[] = {0x19, 0x6,
1944                 0x6, 0x0, 0x7, 0xd0, 0x0, 0x0};
1945
1946         memcpy(p, sas_sf_m_pg, sizeof(sas_sf_m_pg));
1947         if (1 == pcontrol)
1948                 memset(p + 2, 0, sizeof(sas_sf_m_pg) - 2);
1949         return sizeof(sas_sf_m_pg);
1950 }
1951
1952
1953 static int resp_sas_pcd_m_spg(unsigned char * p, int pcontrol, int target,
1954                               int target_dev_id)
1955 {       /* SAS phy control and discover mode page for mode_sense */
1956         unsigned char sas_pcd_m_pg[] = {0x59, 0x1, 0, 0x64, 0, 0x6, 0, 2,
1957                     0, 0, 0, 0, 0x10, 0x9, 0x8, 0x0,
1958                     0x52, 0x22, 0x22, 0x20, 0x0, 0x0, 0x0, 0x0,
1959                     0x51, 0x11, 0x11, 0x10, 0x0, 0x0, 0x0, 0x1,
1960                     0x2, 0, 0, 0, 0, 0, 0, 0,
1961                     0x88, 0x99, 0, 0, 0, 0, 0, 0,
1962                     0, 0, 0, 0, 0, 0, 0, 0,
1963                     0, 1, 0, 0, 0x10, 0x9, 0x8, 0x0,
1964                     0x52, 0x22, 0x22, 0x20, 0x0, 0x0, 0x0, 0x0,
1965                     0x51, 0x11, 0x11, 0x10, 0x0, 0x0, 0x0, 0x1,
1966                     0x3, 0, 0, 0, 0, 0, 0, 0,
1967                     0x88, 0x99, 0, 0, 0, 0, 0, 0,
1968                     0, 0, 0, 0, 0, 0, 0, 0,
1969                 };
1970         int port_a, port_b;
1971
1972         port_a = target_dev_id + 1;
1973         port_b = port_a + 1;
1974         memcpy(p, sas_pcd_m_pg, sizeof(sas_pcd_m_pg));
1975         p[20] = (port_a >> 24);
1976         p[21] = (port_a >> 16) & 0xff;
1977         p[22] = (port_a >> 8) & 0xff;
1978         p[23] = port_a & 0xff;
1979         p[48 + 20] = (port_b >> 24);
1980         p[48 + 21] = (port_b >> 16) & 0xff;
1981         p[48 + 22] = (port_b >> 8) & 0xff;
1982         p[48 + 23] = port_b & 0xff;
1983         if (1 == pcontrol)
1984                 memset(p + 4, 0, sizeof(sas_pcd_m_pg) - 4);
1985         return sizeof(sas_pcd_m_pg);
1986 }
1987
1988 static int resp_sas_sha_m_spg(unsigned char * p, int pcontrol)
1989 {       /* SAS SSP shared protocol specific port mode subpage */
1990         unsigned char sas_sha_m_pg[] = {0x59, 0x2, 0, 0xc, 0, 0x6, 0x10, 0,
1991                     0, 0, 0, 0, 0, 0, 0, 0,
1992                 };
1993
1994         memcpy(p, sas_sha_m_pg, sizeof(sas_sha_m_pg));
1995         if (1 == pcontrol)
1996                 memset(p + 4, 0, sizeof(sas_sha_m_pg) - 4);
1997         return sizeof(sas_sha_m_pg);
1998 }
1999
2000 #define SDEBUG_MAX_MSENSE_SZ 256
2001
2002 static int
2003 resp_mode_sense(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
2004 {
2005         unsigned char dbd, llbaa;
2006         int pcontrol, pcode, subpcode, bd_len;
2007         unsigned char dev_spec;
2008         int k, alloc_len, msense_6, offset, len, target_dev_id;
2009         int target = scp->device->id;
2010         unsigned char * ap;
2011         unsigned char arr[SDEBUG_MAX_MSENSE_SZ];
2012         unsigned char *cmd = scp->cmnd;
2013
2014         dbd = !!(cmd[1] & 0x8);
2015         pcontrol = (cmd[2] & 0xc0) >> 6;
2016         pcode = cmd[2] & 0x3f;
2017         subpcode = cmd[3];
2018         msense_6 = (MODE_SENSE == cmd[0]);
2019         llbaa = msense_6 ? 0 : !!(cmd[1] & 0x10);
2020         if ((0 == scsi_debug_ptype) && (0 == dbd))
2021                 bd_len = llbaa ? 16 : 8;
2022         else
2023                 bd_len = 0;
2024         alloc_len = msense_6 ? cmd[4] : ((cmd[7] << 8) | cmd[8]);
2025         memset(arr, 0, SDEBUG_MAX_MSENSE_SZ);
2026         if (0x3 == pcontrol) {  /* Saving values not supported */
2027                 mk_sense_buffer(scp, ILLEGAL_REQUEST, SAVING_PARAMS_UNSUP, 0);
2028                 return check_condition_result;
2029         }
2030         target_dev_id = ((devip->sdbg_host->shost->host_no + 1) * 2000) +
2031                         (devip->target * 1000) - 3;
2032         /* set DPOFUA bit for disks */
2033         if (0 == scsi_debug_ptype)
2034                 dev_spec = (DEV_READONLY(target) ? 0x80 : 0x0) | 0x10;
2035         else
2036                 dev_spec = 0x0;
2037         if (msense_6) {
2038                 arr[2] = dev_spec;
2039                 arr[3] = bd_len;
2040                 offset = 4;
2041         } else {
2042                 arr[3] = dev_spec;
2043                 if (16 == bd_len)
2044                         arr[4] = 0x1;   /* set LONGLBA bit */
2045                 arr[7] = bd_len;        /* assume 255 or less */
2046                 offset = 8;
2047         }
2048         ap = arr + offset;
2049         if ((bd_len > 0) && (!sdebug_capacity))
2050                 sdebug_capacity = get_sdebug_capacity();
2051
2052         if (8 == bd_len) {
2053                 if (sdebug_capacity > 0xfffffffe) {
2054                         ap[0] = 0xff;
2055                         ap[1] = 0xff;
2056                         ap[2] = 0xff;
2057                         ap[3] = 0xff;
2058                 } else {
2059                         ap[0] = (sdebug_capacity >> 24) & 0xff;
2060                         ap[1] = (sdebug_capacity >> 16) & 0xff;
2061                         ap[2] = (sdebug_capacity >> 8) & 0xff;
2062                         ap[3] = sdebug_capacity & 0xff;
2063                 }
2064                 ap[6] = (scsi_debug_sector_size >> 8) & 0xff;
2065                 ap[7] = scsi_debug_sector_size & 0xff;
2066                 offset += bd_len;
2067                 ap = arr + offset;
2068         } else if (16 == bd_len) {
2069                 unsigned long long capac = sdebug_capacity;
2070
2071                 for (k = 0; k < 8; ++k, capac >>= 8)
2072                         ap[7 - k] = capac & 0xff;
2073                 ap[12] = (scsi_debug_sector_size >> 24) & 0xff;
2074                 ap[13] = (scsi_debug_sector_size >> 16) & 0xff;
2075                 ap[14] = (scsi_debug_sector_size >> 8) & 0xff;
2076                 ap[15] = scsi_debug_sector_size & 0xff;
2077                 offset += bd_len;
2078                 ap = arr + offset;
2079         }
2080
2081         if ((subpcode > 0x0) && (subpcode < 0xff) && (0x19 != pcode)) {
2082                 /* TODO: Control Extension page */
2083                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 3, -1);
2084                 return check_condition_result;
2085         }
2086         switch (pcode) {
2087         case 0x1:       /* Read-Write error recovery page, direct access */
2088                 len = resp_err_recov_pg(ap, pcontrol, target);
2089                 offset += len;
2090                 break;
2091         case 0x2:       /* Disconnect-Reconnect page, all devices */
2092                 len = resp_disconnect_pg(ap, pcontrol, target);
2093                 offset += len;
2094                 break;
2095         case 0x3:       /* Format device page, direct access */
2096                 len = resp_format_pg(ap, pcontrol, target);
2097                 offset += len;
2098                 break;
2099         case 0x8:       /* Caching page, direct access */
2100                 len = resp_caching_pg(ap, pcontrol, target);
2101                 offset += len;
2102                 break;
2103         case 0xa:       /* Control Mode page, all devices */
2104                 len = resp_ctrl_m_pg(ap, pcontrol, target);
2105                 offset += len;
2106                 break;
2107         case 0x19:      /* if spc==1 then sas phy, control+discover */
2108                 if ((subpcode > 0x2) && (subpcode < 0xff)) {
2109                         mk_sense_invalid_fld(scp, SDEB_IN_CDB, 3, -1);
2110                         return check_condition_result;
2111                 }
2112                 len = 0;
2113                 if ((0x0 == subpcode) || (0xff == subpcode))
2114                         len += resp_sas_sf_m_pg(ap + len, pcontrol, target);
2115                 if ((0x1 == subpcode) || (0xff == subpcode))
2116                         len += resp_sas_pcd_m_spg(ap + len, pcontrol, target,
2117                                                   target_dev_id);
2118                 if ((0x2 == subpcode) || (0xff == subpcode))
2119                         len += resp_sas_sha_m_spg(ap + len, pcontrol);
2120                 offset += len;
2121                 break;
2122         case 0x1c:      /* Informational Exceptions Mode page, all devices */
2123                 len = resp_iec_m_pg(ap, pcontrol, target);
2124                 offset += len;
2125                 break;
2126         case 0x3f:      /* Read all Mode pages */
2127                 if ((0 == subpcode) || (0xff == subpcode)) {
2128                         len = resp_err_recov_pg(ap, pcontrol, target);
2129                         len += resp_disconnect_pg(ap + len, pcontrol, target);
2130                         len += resp_format_pg(ap + len, pcontrol, target);
2131                         len += resp_caching_pg(ap + len, pcontrol, target);
2132                         len += resp_ctrl_m_pg(ap + len, pcontrol, target);
2133                         len += resp_sas_sf_m_pg(ap + len, pcontrol, target);
2134                         if (0xff == subpcode) {
2135                                 len += resp_sas_pcd_m_spg(ap + len, pcontrol,
2136                                                   target, target_dev_id);
2137                                 len += resp_sas_sha_m_spg(ap + len, pcontrol);
2138                         }
2139                         len += resp_iec_m_pg(ap + len, pcontrol, target);
2140                 } else {
2141                         mk_sense_invalid_fld(scp, SDEB_IN_CDB, 3, -1);
2142                         return check_condition_result;
2143                 }
2144                 offset += len;
2145                 break;
2146         default:
2147                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 2, 5);
2148                 return check_condition_result;
2149         }
2150         if (msense_6)
2151                 arr[0] = offset - 1;
2152         else {
2153                 arr[0] = ((offset - 2) >> 8) & 0xff;
2154                 arr[1] = (offset - 2) & 0xff;
2155         }
2156         return fill_from_dev_buffer(scp, arr, min(alloc_len, offset));
2157 }
2158
2159 #define SDEBUG_MAX_MSELECT_SZ 512
2160
2161 static int
2162 resp_mode_select(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
2163 {
2164         int pf, sp, ps, md_len, bd_len, off, spf, pg_len;
2165         int param_len, res, mpage;
2166         unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
2167         unsigned char *cmd = scp->cmnd;
2168         int mselect6 = (MODE_SELECT == cmd[0]);
2169
2170         memset(arr, 0, sizeof(arr));
2171         pf = cmd[1] & 0x10;
2172         sp = cmd[1] & 0x1;
2173         param_len = mselect6 ? cmd[4] : ((cmd[7] << 8) + cmd[8]);
2174         if ((0 == pf) || sp || (param_len > SDEBUG_MAX_MSELECT_SZ)) {
2175                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, mselect6 ? 4 : 7, -1);
2176                 return check_condition_result;
2177         }
2178         res = fetch_to_dev_buffer(scp, arr, param_len);
2179         if (-1 == res)
2180                 return (DID_ERROR << 16);
2181         else if ((res < param_len) &&
2182                  (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
2183                 sdev_printk(KERN_INFO, scp->device,
2184                             "%s: cdb indicated=%d, IO sent=%d bytes\n",
2185                             __func__, param_len, res);
2186         md_len = mselect6 ? (arr[0] + 1) : ((arr[0] << 8) + arr[1] + 2);
2187         bd_len = mselect6 ? arr[3] : ((arr[6] << 8) + arr[7]);
2188         if (md_len > 2) {
2189                 mk_sense_invalid_fld(scp, SDEB_IN_DATA, 0, -1);
2190                 return check_condition_result;
2191         }
2192         off = bd_len + (mselect6 ? 4 : 8);
2193         mpage = arr[off] & 0x3f;
2194         ps = !!(arr[off] & 0x80);
2195         if (ps) {
2196                 mk_sense_invalid_fld(scp, SDEB_IN_DATA, off, 7);
2197                 return check_condition_result;
2198         }
2199         spf = !!(arr[off] & 0x40);
2200         pg_len = spf ? ((arr[off + 2] << 8) + arr[off + 3] + 4) :
2201                        (arr[off + 1] + 2);
2202         if ((pg_len + off) > param_len) {
2203                 mk_sense_buffer(scp, ILLEGAL_REQUEST,
2204                                 PARAMETER_LIST_LENGTH_ERR, 0);
2205                 return check_condition_result;
2206         }
2207         switch (mpage) {
2208         case 0x8:      /* Caching Mode page */
2209                 if (caching_pg[1] == arr[off + 1]) {
2210                         memcpy(caching_pg + 2, arr + off + 2,
2211                                sizeof(caching_pg) - 2);
2212                         goto set_mode_changed_ua;
2213                 }
2214                 break;
2215         case 0xa:      /* Control Mode page */
2216                 if (ctrl_m_pg[1] == arr[off + 1]) {
2217                         memcpy(ctrl_m_pg + 2, arr + off + 2,
2218                                sizeof(ctrl_m_pg) - 2);
2219                         scsi_debug_dsense = !!(ctrl_m_pg[2] & 0x4);
2220                         goto set_mode_changed_ua;
2221                 }
2222                 break;
2223         case 0x1c:      /* Informational Exceptions Mode page */
2224                 if (iec_m_pg[1] == arr[off + 1]) {
2225                         memcpy(iec_m_pg + 2, arr + off + 2,
2226                                sizeof(iec_m_pg) - 2);
2227                         goto set_mode_changed_ua;
2228                 }
2229                 break;
2230         default:
2231                 break;
2232         }
2233         mk_sense_invalid_fld(scp, SDEB_IN_DATA, off, 5);
2234         return check_condition_result;
2235 set_mode_changed_ua:
2236         set_bit(SDEBUG_UA_MODE_CHANGED, devip->uas_bm);
2237         return 0;
2238 }
2239
2240 static int resp_temp_l_pg(unsigned char * arr)
2241 {
2242         unsigned char temp_l_pg[] = {0x0, 0x0, 0x3, 0x2, 0x0, 38,
2243                                      0x0, 0x1, 0x3, 0x2, 0x0, 65,
2244                 };
2245
2246         memcpy(arr, temp_l_pg, sizeof(temp_l_pg));
2247         return sizeof(temp_l_pg);
2248 }
2249
2250 static int resp_ie_l_pg(unsigned char * arr)
2251 {
2252         unsigned char ie_l_pg[] = {0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 38,
2253                 };
2254
2255         memcpy(arr, ie_l_pg, sizeof(ie_l_pg));
2256         if (iec_m_pg[2] & 0x4) {        /* TEST bit set */
2257                 arr[4] = THRESHOLD_EXCEEDED;
2258                 arr[5] = 0xff;
2259         }
2260         return sizeof(ie_l_pg);
2261 }
2262
2263 #define SDEBUG_MAX_LSENSE_SZ 512
2264
2265 static int resp_log_sense(struct scsi_cmnd * scp,
2266                           struct sdebug_dev_info * devip)
2267 {
2268         int ppc, sp, pcontrol, pcode, subpcode, alloc_len, len, n;
2269         unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
2270         unsigned char *cmd = scp->cmnd;
2271
2272         memset(arr, 0, sizeof(arr));
2273         ppc = cmd[1] & 0x2;
2274         sp = cmd[1] & 0x1;
2275         if (ppc || sp) {
2276                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 1, ppc ? 1 : 0);
2277                 return check_condition_result;
2278         }
2279         pcontrol = (cmd[2] & 0xc0) >> 6;
2280         pcode = cmd[2] & 0x3f;
2281         subpcode = cmd[3] & 0xff;
2282         alloc_len = (cmd[7] << 8) + cmd[8];
2283         arr[0] = pcode;
2284         if (0 == subpcode) {
2285                 switch (pcode) {
2286                 case 0x0:       /* Supported log pages log page */
2287                         n = 4;
2288                         arr[n++] = 0x0;         /* this page */
2289                         arr[n++] = 0xd;         /* Temperature */
2290                         arr[n++] = 0x2f;        /* Informational exceptions */
2291                         arr[3] = n - 4;
2292                         break;
2293                 case 0xd:       /* Temperature log page */
2294                         arr[3] = resp_temp_l_pg(arr + 4);
2295                         break;
2296                 case 0x2f:      /* Informational exceptions log page */
2297                         arr[3] = resp_ie_l_pg(arr + 4);
2298                         break;
2299                 default:
2300                         mk_sense_invalid_fld(scp, SDEB_IN_CDB, 2, 5);
2301                         return check_condition_result;
2302                 }
2303         } else if (0xff == subpcode) {
2304                 arr[0] |= 0x40;
2305                 arr[1] = subpcode;
2306                 switch (pcode) {
2307                 case 0x0:       /* Supported log pages and subpages log page */
2308                         n = 4;
2309                         arr[n++] = 0x0;
2310                         arr[n++] = 0x0;         /* 0,0 page */
2311                         arr[n++] = 0x0;
2312                         arr[n++] = 0xff;        /* this page */
2313                         arr[n++] = 0xd;
2314                         arr[n++] = 0x0;         /* Temperature */
2315                         arr[n++] = 0x2f;
2316                         arr[n++] = 0x0; /* Informational exceptions */
2317                         arr[3] = n - 4;
2318                         break;
2319                 case 0xd:       /* Temperature subpages */
2320                         n = 4;
2321                         arr[n++] = 0xd;
2322                         arr[n++] = 0x0;         /* Temperature */
2323                         arr[3] = n - 4;
2324                         break;
2325                 case 0x2f:      /* Informational exceptions subpages */
2326                         n = 4;
2327                         arr[n++] = 0x2f;
2328                         arr[n++] = 0x0;         /* Informational exceptions */
2329                         arr[3] = n - 4;
2330                         break;
2331                 default:
2332                         mk_sense_invalid_fld(scp, SDEB_IN_CDB, 2, 5);
2333                         return check_condition_result;
2334                 }
2335         } else {
2336                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 3, -1);
2337                 return check_condition_result;
2338         }
2339         len = min(((arr[2] << 8) + arr[3]) + 4, alloc_len);
2340         return fill_from_dev_buffer(scp, arr,
2341                     min(len, SDEBUG_MAX_INQ_ARR_SZ));
2342 }
2343
2344 static int check_device_access_params(struct scsi_cmnd *scp,
2345                                       unsigned long long lba, unsigned int num)
2346 {
2347         if (lba + num > sdebug_capacity) {
2348                 mk_sense_buffer(scp, ILLEGAL_REQUEST, LBA_OUT_OF_RANGE, 0);
2349                 return check_condition_result;
2350         }
2351         /* transfer length excessive (tie in to block limits VPD page) */
2352         if (num > sdebug_store_sectors) {
2353                 /* needs work to find which cdb byte 'num' comes from */
2354                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB, 0);
2355                 return check_condition_result;
2356         }
2357         return 0;
2358 }
2359
2360 /* Returns number of bytes copied or -1 if error. */
2361 static int
2362 do_device_access(struct scsi_cmnd *scmd, u64 lba, u32 num, bool do_write)
2363 {
2364         int ret;
2365         u64 block, rest = 0;
2366         struct scsi_data_buffer *sdb;
2367         enum dma_data_direction dir;
2368
2369         if (do_write) {
2370                 sdb = scsi_out(scmd);
2371                 dir = DMA_TO_DEVICE;
2372         } else {
2373                 sdb = scsi_in(scmd);
2374                 dir = DMA_FROM_DEVICE;
2375         }
2376
2377         if (!sdb->length)
2378                 return 0;
2379         if (!(scsi_bidi_cmnd(scmd) || scmd->sc_data_direction == dir))
2380                 return -1;
2381
2382         block = do_div(lba, sdebug_store_sectors);
2383         if (block + num > sdebug_store_sectors)
2384                 rest = block + num - sdebug_store_sectors;
2385
2386         ret = sg_copy_buffer(sdb->table.sgl, sdb->table.nents,
2387                    fake_storep + (block * scsi_debug_sector_size),
2388                    (num - rest) * scsi_debug_sector_size, 0, do_write);
2389         if (ret != (num - rest) * scsi_debug_sector_size)
2390                 return ret;
2391
2392         if (rest) {
2393                 ret += sg_copy_buffer(sdb->table.sgl, sdb->table.nents,
2394                             fake_storep, rest * scsi_debug_sector_size,
2395                             (num - rest) * scsi_debug_sector_size, do_write);
2396         }
2397
2398         return ret;
2399 }
2400
2401 /* If fake_store(lba,num) compares equal to arr(num), then copy top half of
2402  * arr into fake_store(lba,num) and return true. If comparison fails then
2403  * return false. */
2404 static bool
2405 comp_write_worker(u64 lba, u32 num, const u8 *arr)
2406 {
2407         bool res;
2408         u64 block, rest = 0;
2409         u32 store_blks = sdebug_store_sectors;
2410         u32 lb_size = scsi_debug_sector_size;
2411
2412         block = do_div(lba, store_blks);
2413         if (block + num > store_blks)
2414                 rest = block + num - store_blks;
2415
2416         res = !memcmp(fake_storep + (block * lb_size), arr,
2417                       (num - rest) * lb_size);
2418         if (!res)
2419                 return res;
2420         if (rest)
2421                 res = memcmp(fake_storep, arr + ((num - rest) * lb_size),
2422                              rest * lb_size);
2423         if (!res)
2424                 return res;
2425         arr += num * lb_size;
2426         memcpy(fake_storep + (block * lb_size), arr, (num - rest) * lb_size);
2427         if (rest)
2428                 memcpy(fake_storep, arr + ((num - rest) * lb_size),
2429                        rest * lb_size);
2430         return res;
2431 }
2432
2433 static __be16 dif_compute_csum(const void *buf, int len)
2434 {
2435         __be16 csum;
2436
2437         if (scsi_debug_guard)
2438                 csum = (__force __be16)ip_compute_csum(buf, len);
2439         else
2440                 csum = cpu_to_be16(crc_t10dif(buf, len));
2441
2442         return csum;
2443 }
2444
2445 static int dif_verify(struct sd_dif_tuple *sdt, const void *data,
2446                       sector_t sector, u32 ei_lba)
2447 {
2448         __be16 csum = dif_compute_csum(data, scsi_debug_sector_size);
2449
2450         if (sdt->guard_tag != csum) {
2451                 pr_err("GUARD check failed on sector %lu rcvd 0x%04x, data 0x%04x\n",
2452                         (unsigned long)sector,
2453                         be16_to_cpu(sdt->guard_tag),
2454                         be16_to_cpu(csum));
2455                 return 0x01;
2456         }
2457         if (scsi_debug_dif == SD_DIF_TYPE1_PROTECTION &&
2458             be32_to_cpu(sdt->ref_tag) != (sector & 0xffffffff)) {
2459                 pr_err("REF check failed on sector %lu\n",
2460                         (unsigned long)sector);
2461                 return 0x03;
2462         }
2463         if (scsi_debug_dif == SD_DIF_TYPE2_PROTECTION &&
2464             be32_to_cpu(sdt->ref_tag) != ei_lba) {
2465                 pr_err("REF check failed on sector %lu\n",
2466                         (unsigned long)sector);
2467                 return 0x03;
2468         }
2469         return 0;
2470 }
2471
2472 static void dif_copy_prot(struct scsi_cmnd *SCpnt, sector_t sector,
2473                           unsigned int sectors, bool read)
2474 {
2475         size_t resid;
2476         void *paddr;
2477         const void *dif_store_end = dif_storep + sdebug_store_sectors;
2478         struct sg_mapping_iter miter;
2479
2480         /* Bytes of protection data to copy into sgl */
2481         resid = sectors * sizeof(*dif_storep);
2482
2483         sg_miter_start(&miter, scsi_prot_sglist(SCpnt),
2484                         scsi_prot_sg_count(SCpnt), SG_MITER_ATOMIC |
2485                         (read ? SG_MITER_TO_SG : SG_MITER_FROM_SG));
2486
2487         while (sg_miter_next(&miter) && resid > 0) {
2488                 size_t len = min(miter.length, resid);
2489                 void *start = dif_store(sector);
2490                 size_t rest = 0;
2491
2492                 if (dif_store_end < start + len)
2493                         rest = start + len - dif_store_end;
2494
2495                 paddr = miter.addr;
2496
2497                 if (read)
2498                         memcpy(paddr, start, len - rest);
2499                 else
2500                         memcpy(start, paddr, len - rest);
2501
2502                 if (rest) {
2503                         if (read)
2504                                 memcpy(paddr + len - rest, dif_storep, rest);
2505                         else
2506                                 memcpy(dif_storep, paddr + len - rest, rest);
2507                 }
2508
2509                 sector += len / sizeof(*dif_storep);
2510                 resid -= len;
2511         }
2512         sg_miter_stop(&miter);
2513 }
2514
2515 static int prot_verify_read(struct scsi_cmnd *SCpnt, sector_t start_sec,
2516                             unsigned int sectors, u32 ei_lba)
2517 {
2518         unsigned int i;
2519         struct sd_dif_tuple *sdt;
2520         sector_t sector;
2521
2522         for (i = 0; i < sectors; i++, ei_lba++) {
2523                 int ret;
2524
2525                 sector = start_sec + i;
2526                 sdt = dif_store(sector);
2527
2528                 if (sdt->app_tag == cpu_to_be16(0xffff))
2529                         continue;
2530
2531                 ret = dif_verify(sdt, fake_store(sector), sector, ei_lba);
2532                 if (ret) {
2533                         dif_errors++;
2534                         return ret;
2535                 }
2536         }
2537
2538         dif_copy_prot(SCpnt, start_sec, sectors, true);
2539         dix_reads++;
2540
2541         return 0;
2542 }
2543
2544 static int
2545 resp_read_dt0(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
2546 {
2547         u8 *cmd = scp->cmnd;
2548         u64 lba;
2549         u32 num;
2550         u32 ei_lba;
2551         unsigned long iflags;
2552         int ret;
2553         bool check_prot;
2554
2555         switch (cmd[0]) {
2556         case READ_16:
2557                 ei_lba = 0;
2558                 lba = get_unaligned_be64(cmd + 2);
2559                 num = get_unaligned_be32(cmd + 10);
2560                 check_prot = true;
2561                 break;
2562         case READ_10:
2563                 ei_lba = 0;
2564                 lba = get_unaligned_be32(cmd + 2);
2565                 num = get_unaligned_be16(cmd + 7);
2566                 check_prot = true;
2567                 break;
2568         case READ_6:
2569                 ei_lba = 0;
2570                 lba = (u32)cmd[3] | (u32)cmd[2] << 8 |
2571                       (u32)(cmd[1] & 0x1f) << 16;
2572                 num = (0 == cmd[4]) ? 256 : cmd[4];
2573                 check_prot = true;
2574                 break;
2575         case READ_12:
2576                 ei_lba = 0;
2577                 lba = get_unaligned_be32(cmd + 2);
2578                 num = get_unaligned_be32(cmd + 6);
2579                 check_prot = true;
2580                 break;
2581         case XDWRITEREAD_10:
2582                 ei_lba = 0;
2583                 lba = get_unaligned_be32(cmd + 2);
2584                 num = get_unaligned_be16(cmd + 7);
2585                 check_prot = false;
2586                 break;
2587         default:        /* assume READ(32) */
2588                 lba = get_unaligned_be64(cmd + 12);
2589                 ei_lba = get_unaligned_be32(cmd + 20);
2590                 num = get_unaligned_be32(cmd + 28);
2591                 check_prot = false;
2592                 break;
2593         }
2594         if (check_prot) {
2595                 if (scsi_debug_dif == SD_DIF_TYPE2_PROTECTION &&
2596                     (cmd[1] & 0xe0)) {
2597                         mk_sense_invalid_opcode(scp);
2598                         return check_condition_result;
2599                 }
2600                 if ((scsi_debug_dif == SD_DIF_TYPE1_PROTECTION ||
2601                      scsi_debug_dif == SD_DIF_TYPE3_PROTECTION) &&
2602                     (cmd[1] & 0xe0) == 0)
2603                         sdev_printk(KERN_ERR, scp->device, "Unprotected RD "
2604                                     "to DIF device\n");
2605         }
2606         if (sdebug_any_injecting_opt) {
2607                 struct sdebug_scmd_extra_t *ep = scsi_cmd_priv(scp);
2608
2609                 if (ep->inj_short)
2610                         num /= 2;
2611         }
2612
2613         /* inline check_device_access_params() */
2614         if (lba + num > sdebug_capacity) {
2615                 mk_sense_buffer(scp, ILLEGAL_REQUEST, LBA_OUT_OF_RANGE, 0);
2616                 return check_condition_result;
2617         }
2618         /* transfer length excessive (tie in to block limits VPD page) */
2619         if (num > sdebug_store_sectors) {
2620                 /* needs work to find which cdb byte 'num' comes from */
2621                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB, 0);
2622                 return check_condition_result;
2623         }
2624
2625         if ((SCSI_DEBUG_OPT_MEDIUM_ERR & scsi_debug_opts) &&
2626             (lba <= (OPT_MEDIUM_ERR_ADDR + OPT_MEDIUM_ERR_NUM - 1)) &&
2627             ((lba + num) > OPT_MEDIUM_ERR_ADDR)) {
2628                 /* claim unrecoverable read error */
2629                 mk_sense_buffer(scp, MEDIUM_ERROR, UNRECOVERED_READ_ERR, 0);
2630                 /* set info field and valid bit for fixed descriptor */
2631                 if (0x70 == (scp->sense_buffer[0] & 0x7f)) {
2632                         scp->sense_buffer[0] |= 0x80;   /* Valid bit */
2633                         ret = (lba < OPT_MEDIUM_ERR_ADDR)
2634                               ? OPT_MEDIUM_ERR_ADDR : (int)lba;
2635                         put_unaligned_be32(ret, scp->sense_buffer + 3);
2636                 }
2637                 scsi_set_resid(scp, scsi_bufflen(scp));
2638                 return check_condition_result;
2639         }
2640
2641         read_lock_irqsave(&atomic_rw, iflags);
2642
2643         /* DIX + T10 DIF */
2644         if (scsi_debug_dix && scsi_prot_sg_count(scp)) {
2645                 int prot_ret = prot_verify_read(scp, lba, num, ei_lba);
2646
2647                 if (prot_ret) {
2648                         read_unlock_irqrestore(&atomic_rw, iflags);
2649                         mk_sense_buffer(scp, ABORTED_COMMAND, 0x10, prot_ret);
2650                         return illegal_condition_result;
2651                 }
2652         }
2653
2654         ret = do_device_access(scp, lba, num, false);
2655         read_unlock_irqrestore(&atomic_rw, iflags);
2656         if (ret == -1)
2657                 return DID_ERROR << 16;
2658
2659         scsi_in(scp)->resid = scsi_bufflen(scp) - ret;
2660
2661         if (sdebug_any_injecting_opt) {
2662                 struct sdebug_scmd_extra_t *ep = scsi_cmd_priv(scp);
2663
2664                 if (ep->inj_recovered) {
2665                         mk_sense_buffer(scp, RECOVERED_ERROR,
2666                                         THRESHOLD_EXCEEDED, 0);
2667                         return check_condition_result;
2668                 } else if (ep->inj_transport) {
2669                         mk_sense_buffer(scp, ABORTED_COMMAND,
2670                                         TRANSPORT_PROBLEM, ACK_NAK_TO);
2671                         return check_condition_result;
2672                 } else if (ep->inj_dif) {
2673                         /* Logical block guard check failed */
2674                         mk_sense_buffer(scp, ABORTED_COMMAND, 0x10, 1);
2675                         return illegal_condition_result;
2676                 } else if (ep->inj_dix) {
2677                         mk_sense_buffer(scp, ILLEGAL_REQUEST, 0x10, 1);
2678                         return illegal_condition_result;
2679                 }
2680         }
2681         return 0;
2682 }
2683
2684 static void dump_sector(unsigned char *buf, int len)
2685 {
2686         int i, j, n;
2687
2688         pr_err(">>> Sector Dump <<<\n");
2689         for (i = 0 ; i < len ; i += 16) {
2690                 char b[128];
2691
2692                 for (j = 0, n = 0; j < 16; j++) {
2693                         unsigned char c = buf[i+j];
2694
2695                         if (c >= 0x20 && c < 0x7e)
2696                                 n += scnprintf(b + n, sizeof(b) - n,
2697                                                " %c ", buf[i+j]);
2698                         else
2699                                 n += scnprintf(b + n, sizeof(b) - n,
2700                                                "%02x ", buf[i+j]);
2701                 }
2702                 pr_err("%04d: %s\n", i, b);
2703         }
2704 }
2705
2706 static int prot_verify_write(struct scsi_cmnd *SCpnt, sector_t start_sec,
2707                              unsigned int sectors, u32 ei_lba)
2708 {
2709         int ret;
2710         struct sd_dif_tuple *sdt;
2711         void *daddr;
2712         sector_t sector = start_sec;
2713         int ppage_offset;
2714         int dpage_offset;
2715         struct sg_mapping_iter diter;
2716         struct sg_mapping_iter piter;
2717
2718         BUG_ON(scsi_sg_count(SCpnt) == 0);
2719         BUG_ON(scsi_prot_sg_count(SCpnt) == 0);
2720
2721         sg_miter_start(&piter, scsi_prot_sglist(SCpnt),
2722                         scsi_prot_sg_count(SCpnt),
2723                         SG_MITER_ATOMIC | SG_MITER_FROM_SG);
2724         sg_miter_start(&diter, scsi_sglist(SCpnt), scsi_sg_count(SCpnt),
2725                         SG_MITER_ATOMIC | SG_MITER_FROM_SG);
2726
2727         /* For each protection page */
2728         while (sg_miter_next(&piter)) {
2729                 dpage_offset = 0;
2730                 if (WARN_ON(!sg_miter_next(&diter))) {
2731                         ret = 0x01;
2732                         goto out;
2733                 }
2734
2735                 for (ppage_offset = 0; ppage_offset < piter.length;
2736                      ppage_offset += sizeof(struct sd_dif_tuple)) {
2737                         /* If we're at the end of the current
2738                          * data page advance to the next one
2739                          */
2740                         if (dpage_offset >= diter.length) {
2741                                 if (WARN_ON(!sg_miter_next(&diter))) {
2742                                         ret = 0x01;
2743                                         goto out;
2744                                 }
2745                                 dpage_offset = 0;
2746                         }
2747
2748                         sdt = piter.addr + ppage_offset;
2749                         daddr = diter.addr + dpage_offset;
2750
2751                         ret = dif_verify(sdt, daddr, sector, ei_lba);
2752                         if (ret) {
2753                                 dump_sector(daddr, scsi_debug_sector_size);
2754                                 goto out;
2755                         }
2756
2757                         sector++;
2758                         ei_lba++;
2759                         dpage_offset += scsi_debug_sector_size;
2760                 }
2761                 diter.consumed = dpage_offset;
2762                 sg_miter_stop(&diter);
2763         }
2764         sg_miter_stop(&piter);
2765
2766         dif_copy_prot(SCpnt, start_sec, sectors, false);
2767         dix_writes++;
2768
2769         return 0;
2770
2771 out:
2772         dif_errors++;
2773         sg_miter_stop(&diter);
2774         sg_miter_stop(&piter);
2775         return ret;
2776 }
2777
2778 static unsigned long lba_to_map_index(sector_t lba)
2779 {
2780         if (scsi_debug_unmap_alignment) {
2781                 lba += scsi_debug_unmap_granularity -
2782                         scsi_debug_unmap_alignment;
2783         }
2784         do_div(lba, scsi_debug_unmap_granularity);
2785
2786         return lba;
2787 }
2788
2789 static sector_t map_index_to_lba(unsigned long index)
2790 {
2791         sector_t lba = index * scsi_debug_unmap_granularity;
2792
2793         if (scsi_debug_unmap_alignment) {
2794                 lba -= scsi_debug_unmap_granularity -
2795                         scsi_debug_unmap_alignment;
2796         }
2797
2798         return lba;
2799 }
2800
2801 static unsigned int map_state(sector_t lba, unsigned int *num)
2802 {
2803         sector_t end;
2804         unsigned int mapped;
2805         unsigned long index;
2806         unsigned long next;
2807
2808         index = lba_to_map_index(lba);
2809         mapped = test_bit(index, map_storep);
2810
2811         if (mapped)
2812                 next = find_next_zero_bit(map_storep, map_size, index);
2813         else
2814                 next = find_next_bit(map_storep, map_size, index);
2815
2816         end = min_t(sector_t, sdebug_store_sectors,  map_index_to_lba(next));
2817         *num = end - lba;
2818
2819         return mapped;
2820 }
2821
2822 static void map_region(sector_t lba, unsigned int len)
2823 {
2824         sector_t end = lba + len;
2825
2826         while (lba < end) {
2827                 unsigned long index = lba_to_map_index(lba);
2828
2829                 if (index < map_size)
2830                         set_bit(index, map_storep);
2831
2832                 lba = map_index_to_lba(index + 1);
2833         }
2834 }
2835
2836 static void unmap_region(sector_t lba, unsigned int len)
2837 {
2838         sector_t end = lba + len;
2839
2840         while (lba < end) {
2841                 unsigned long index = lba_to_map_index(lba);
2842
2843                 if (lba == map_index_to_lba(index) &&
2844                     lba + scsi_debug_unmap_granularity <= end &&
2845                     index < map_size) {
2846                         clear_bit(index, map_storep);
2847                         if (scsi_debug_lbprz) {
2848                                 memset(fake_storep +
2849                                        lba * scsi_debug_sector_size, 0,
2850                                        scsi_debug_sector_size *
2851                                        scsi_debug_unmap_granularity);
2852                         }
2853                         if (dif_storep) {
2854                                 memset(dif_storep + lba, 0xff,
2855                                        sizeof(*dif_storep) *
2856                                        scsi_debug_unmap_granularity);
2857                         }
2858                 }
2859                 lba = map_index_to_lba(index + 1);
2860         }
2861 }
2862
2863 static int
2864 resp_write_dt0(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
2865 {
2866         u8 *cmd = scp->cmnd;
2867         u64 lba;
2868         u32 num;
2869         u32 ei_lba;
2870         unsigned long iflags;
2871         int ret;
2872         bool check_prot;
2873
2874         switch (cmd[0]) {
2875         case WRITE_16:
2876                 ei_lba = 0;
2877                 lba = get_unaligned_be64(cmd + 2);
2878                 num = get_unaligned_be32(cmd + 10);
2879                 check_prot = true;
2880                 break;
2881         case WRITE_10:
2882                 ei_lba = 0;
2883                 lba = get_unaligned_be32(cmd + 2);
2884                 num = get_unaligned_be16(cmd + 7);
2885                 check_prot = true;
2886                 break;
2887         case WRITE_6:
2888                 ei_lba = 0;
2889                 lba = (u32)cmd[3] | (u32)cmd[2] << 8 |
2890                       (u32)(cmd[1] & 0x1f) << 16;
2891                 num = (0 == cmd[4]) ? 256 : cmd[4];
2892                 check_prot = true;
2893                 break;
2894         case WRITE_12:
2895                 ei_lba = 0;
2896                 lba = get_unaligned_be32(cmd + 2);
2897                 num = get_unaligned_be32(cmd + 6);
2898                 check_prot = true;
2899                 break;
2900         case 0x53:      /* XDWRITEREAD(10) */
2901                 ei_lba = 0;
2902                 lba = get_unaligned_be32(cmd + 2);
2903                 num = get_unaligned_be16(cmd + 7);
2904                 check_prot = false;
2905                 break;
2906         default:        /* assume WRITE(32) */
2907                 lba = get_unaligned_be64(cmd + 12);
2908                 ei_lba = get_unaligned_be32(cmd + 20);
2909                 num = get_unaligned_be32(cmd + 28);
2910                 check_prot = false;
2911                 break;
2912         }
2913         if (check_prot) {
2914                 if (scsi_debug_dif == SD_DIF_TYPE2_PROTECTION &&
2915                     (cmd[1] & 0xe0)) {
2916                         mk_sense_invalid_opcode(scp);
2917                         return check_condition_result;
2918                 }
2919                 if ((scsi_debug_dif == SD_DIF_TYPE1_PROTECTION ||
2920                      scsi_debug_dif == SD_DIF_TYPE3_PROTECTION) &&
2921                     (cmd[1] & 0xe0) == 0)
2922                         sdev_printk(KERN_ERR, scp->device, "Unprotected WR "
2923                                     "to DIF device\n");
2924         }
2925
2926         /* inline check_device_access_params() */
2927         if (lba + num > sdebug_capacity) {
2928                 mk_sense_buffer(scp, ILLEGAL_REQUEST, LBA_OUT_OF_RANGE, 0);
2929                 return check_condition_result;
2930         }
2931         /* transfer length excessive (tie in to block limits VPD page) */
2932         if (num > sdebug_store_sectors) {
2933                 /* needs work to find which cdb byte 'num' comes from */
2934                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB, 0);
2935                 return check_condition_result;
2936         }
2937
2938         write_lock_irqsave(&atomic_rw, iflags);
2939
2940         /* DIX + T10 DIF */
2941         if (scsi_debug_dix && scsi_prot_sg_count(scp)) {
2942                 int prot_ret = prot_verify_write(scp, lba, num, ei_lba);
2943
2944                 if (prot_ret) {
2945                         write_unlock_irqrestore(&atomic_rw, iflags);
2946                         mk_sense_buffer(scp, ILLEGAL_REQUEST, 0x10, prot_ret);
2947                         return illegal_condition_result;
2948                 }
2949         }
2950
2951         ret = do_device_access(scp, lba, num, true);
2952         if (scsi_debug_lbp())
2953                 map_region(lba, num);
2954         write_unlock_irqrestore(&atomic_rw, iflags);
2955         if (-1 == ret)
2956                 return (DID_ERROR << 16);
2957         else if ((ret < (num * scsi_debug_sector_size)) &&
2958                  (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
2959                 sdev_printk(KERN_INFO, scp->device,
2960                             "%s: write: cdb indicated=%u, IO sent=%d bytes\n",
2961                             my_name, num * scsi_debug_sector_size, ret);
2962
2963         if (sdebug_any_injecting_opt) {
2964                 struct sdebug_scmd_extra_t *ep = scsi_cmd_priv(scp);
2965
2966                 if (ep->inj_recovered) {
2967                         mk_sense_buffer(scp, RECOVERED_ERROR,
2968                                         THRESHOLD_EXCEEDED, 0);
2969                         return check_condition_result;
2970                 } else if (ep->inj_dif) {
2971                         /* Logical block guard check failed */
2972                         mk_sense_buffer(scp, ABORTED_COMMAND, 0x10, 1);
2973                         return illegal_condition_result;
2974                 } else if (ep->inj_dix) {
2975                         mk_sense_buffer(scp, ILLEGAL_REQUEST, 0x10, 1);
2976                         return illegal_condition_result;
2977                 }
2978         }
2979         return 0;
2980 }
2981
2982 static int
2983 resp_write_same(struct scsi_cmnd *scp, u64 lba, u32 num, u32 ei_lba,
2984                 bool unmap, bool ndob)
2985 {
2986         unsigned long iflags;
2987         unsigned long long i;
2988         int ret;
2989
2990         ret = check_device_access_params(scp, lba, num);
2991         if (ret)
2992                 return ret;
2993
2994         write_lock_irqsave(&atomic_rw, iflags);
2995
2996         if (unmap && scsi_debug_lbp()) {
2997                 unmap_region(lba, num);
2998                 goto out;
2999         }
3000
3001         /* if ndob then zero 1 logical block, else fetch 1 logical block */
3002         if (ndob) {
3003                 memset(fake_storep + (lba * scsi_debug_sector_size), 0,
3004                        scsi_debug_sector_size);
3005                 ret = 0;
3006         } else
3007                 ret = fetch_to_dev_buffer(scp, fake_storep +
3008                                                (lba * scsi_debug_sector_size),
3009                                           scsi_debug_sector_size);
3010
3011         if (-1 == ret) {
3012                 write_unlock_irqrestore(&atomic_rw, iflags);
3013                 return (DID_ERROR << 16);
3014         } else if ((ret < (num * scsi_debug_sector_size)) &&
3015                  (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
3016                 sdev_printk(KERN_INFO, scp->device,
3017                             "%s: %s: cdb indicated=%u, IO sent=%d bytes\n",
3018                             my_name, "write same",
3019                             num * scsi_debug_sector_size, ret);
3020
3021         /* Copy first sector to remaining blocks */
3022         for (i = 1 ; i < num ; i++)
3023                 memcpy(fake_storep + ((lba + i) * scsi_debug_sector_size),
3024                        fake_storep + (lba * scsi_debug_sector_size),
3025                        scsi_debug_sector_size);
3026
3027         if (scsi_debug_lbp())
3028                 map_region(lba, num);
3029 out:
3030         write_unlock_irqrestore(&atomic_rw, iflags);
3031
3032         return 0;
3033 }
3034
3035 static int
3036 resp_write_same_10(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
3037 {
3038         u8 *cmd = scp->cmnd;
3039         u32 lba;
3040         u16 num;
3041         u32 ei_lba = 0;
3042         bool unmap = false;
3043
3044         if (cmd[1] & 0x8) {
3045                 if (scsi_debug_lbpws10 == 0) {
3046                         mk_sense_invalid_fld(scp, SDEB_IN_CDB, 1, 3);
3047                         return check_condition_result;
3048                 } else
3049                         unmap = true;
3050         }
3051         lba = get_unaligned_be32(cmd + 2);
3052         num = get_unaligned_be16(cmd + 7);
3053         if (num > scsi_debug_write_same_length) {
3054                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 7, -1);
3055                 return check_condition_result;
3056         }
3057         return resp_write_same(scp, lba, num, ei_lba, unmap, false);
3058 }
3059
3060 static int
3061 resp_write_same_16(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
3062 {
3063         u8 *cmd = scp->cmnd;
3064         u64 lba;
3065         u32 num;
3066         u32 ei_lba = 0;
3067         bool unmap = false;
3068         bool ndob = false;
3069
3070         if (cmd[1] & 0x8) {     /* UNMAP */
3071                 if (scsi_debug_lbpws == 0) {
3072                         mk_sense_invalid_fld(scp, SDEB_IN_CDB, 1, 3);
3073                         return check_condition_result;
3074                 } else
3075                         unmap = true;
3076         }
3077         if (cmd[1] & 0x1)  /* NDOB (no data-out buffer, assumes zeroes) */
3078                 ndob = true;
3079         lba = get_unaligned_be64(cmd + 2);
3080         num = get_unaligned_be32(cmd + 10);
3081         if (num > scsi_debug_write_same_length) {
3082                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 10, -1);
3083                 return check_condition_result;
3084         }
3085         return resp_write_same(scp, lba, num, ei_lba, unmap, ndob);
3086 }
3087
3088 /* Note the mode field is in the same position as the (lower) service action
3089  * field. For the Report supported operation codes command, SPC-4 suggests
3090  * each mode of this command should be reported separately; for future. */
3091 static int
3092 resp_write_buffer(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
3093 {
3094         u8 *cmd = scp->cmnd;
3095         struct scsi_device *sdp = scp->device;
3096         struct sdebug_dev_info *dp;
3097         u8 mode;
3098
3099         mode = cmd[1] & 0x1f;
3100         switch (mode) {
3101         case 0x4:       /* download microcode (MC) and activate (ACT) */
3102                 /* set UAs on this device only */
3103                 set_bit(SDEBUG_UA_BUS_RESET, devip->uas_bm);
3104                 set_bit(SDEBUG_UA_MICROCODE_CHANGED, devip->uas_bm);
3105                 break;
3106         case 0x5:       /* download MC, save and ACT */
3107                 set_bit(SDEBUG_UA_MICROCODE_CHANGED_WO_RESET, devip->uas_bm);
3108                 break;
3109         case 0x6:       /* download MC with offsets and ACT */
3110                 /* set UAs on most devices (LUs) in this target */
3111                 list_for_each_entry(dp,
3112                                     &devip->sdbg_host->dev_info_list,
3113                                     dev_list)
3114                         if (dp->target == sdp->id) {
3115                                 set_bit(SDEBUG_UA_BUS_RESET, dp->uas_bm);
3116                                 if (devip != dp)
3117                                         set_bit(SDEBUG_UA_MICROCODE_CHANGED,
3118                                                 dp->uas_bm);
3119                         }
3120                 break;
3121         case 0x7:       /* download MC with offsets, save, and ACT */
3122                 /* set UA on all devices (LUs) in this target */
3123                 list_for_each_entry(dp,
3124                                     &devip->sdbg_host->dev_info_list,
3125                                     dev_list)
3126                         if (dp->target == sdp->id)
3127                                 set_bit(SDEBUG_UA_MICROCODE_CHANGED_WO_RESET,
3128                                         dp->uas_bm);
3129                 break;
3130         default:
3131                 /* do nothing for this command for other mode values */
3132                 break;
3133         }
3134         return 0;
3135 }
3136
3137 static int
3138 resp_comp_write(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
3139 {
3140         u8 *cmd = scp->cmnd;
3141         u8 *arr;
3142         u8 *fake_storep_hold;
3143         u64 lba;
3144         u32 dnum;
3145         u32 lb_size = scsi_debug_sector_size;
3146         u8 num;
3147         unsigned long iflags;
3148         int ret;
3149         int retval = 0;
3150
3151         lba = get_unaligned_be64(cmd + 2);
3152         num = cmd[13];          /* 1 to a maximum of 255 logical blocks */
3153         if (0 == num)
3154                 return 0;       /* degenerate case, not an error */
3155         if (scsi_debug_dif == SD_DIF_TYPE2_PROTECTION &&
3156             (cmd[1] & 0xe0)) {
3157                 mk_sense_invalid_opcode(scp);
3158                 return check_condition_result;
3159         }
3160         if ((scsi_debug_dif == SD_DIF_TYPE1_PROTECTION ||
3161              scsi_debug_dif == SD_DIF_TYPE3_PROTECTION) &&
3162             (cmd[1] & 0xe0) == 0)
3163                 sdev_printk(KERN_ERR, scp->device, "Unprotected WR "
3164                             "to DIF device\n");
3165
3166         /* inline check_device_access_params() */
3167         if (lba + num > sdebug_capacity) {
3168                 mk_sense_buffer(scp, ILLEGAL_REQUEST, LBA_OUT_OF_RANGE, 0);
3169                 return check_condition_result;
3170         }
3171         /* transfer length excessive (tie in to block limits VPD page) */
3172         if (num > sdebug_store_sectors) {
3173                 /* needs work to find which cdb byte 'num' comes from */
3174                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB, 0);
3175                 return check_condition_result;
3176         }
3177         dnum = 2 * num;
3178         arr = kzalloc(dnum * lb_size, GFP_ATOMIC);
3179         if (NULL == arr) {
3180                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC,
3181                                 INSUFF_RES_ASCQ);
3182                 return check_condition_result;
3183         }
3184
3185         write_lock_irqsave(&atomic_rw, iflags);
3186
3187         /* trick do_device_access() to fetch both compare and write buffers
3188          * from data-in into arr. Safe (atomic) since write_lock held. */
3189         fake_storep_hold = fake_storep;
3190         fake_storep = arr;
3191         ret = do_device_access(scp, 0, dnum, true);
3192         fake_storep = fake_storep_hold;
3193         if (ret == -1) {
3194                 retval = DID_ERROR << 16;
3195                 goto cleanup;
3196         } else if ((ret < (dnum * lb_size)) &&
3197                  (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
3198                 sdev_printk(KERN_INFO, scp->device, "%s: compare_write: cdb "
3199                             "indicated=%u, IO sent=%d bytes\n", my_name,
3200                             dnum * lb_size, ret);
3201         if (!comp_write_worker(lba, num, arr)) {
3202                 mk_sense_buffer(scp, MISCOMPARE, MISCOMPARE_VERIFY_ASC, 0);
3203                 retval = check_condition_result;
3204                 goto cleanup;
3205         }
3206         if (scsi_debug_lbp())
3207                 map_region(lba, num);
3208 cleanup:
3209         write_unlock_irqrestore(&atomic_rw, iflags);
3210         kfree(arr);
3211         return retval;
3212 }
3213
3214 struct unmap_block_desc {
3215         __be64  lba;
3216         __be32  blocks;
3217         __be32  __reserved;
3218 };
3219
3220 static int
3221 resp_unmap(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
3222 {
3223         unsigned char *buf;
3224         struct unmap_block_desc *desc;
3225         unsigned int i, payload_len, descriptors;
3226         int ret;
3227         unsigned long iflags;
3228
3229
3230         if (!scsi_debug_lbp())
3231                 return 0;       /* fib and say its done */
3232         payload_len = get_unaligned_be16(scp->cmnd + 7);
3233         BUG_ON(scsi_bufflen(scp) != payload_len);
3234
3235         descriptors = (payload_len - 8) / 16;
3236         if (descriptors > scsi_debug_unmap_max_desc) {
3237                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 7, -1);
3238                 return check_condition_result;
3239         }
3240
3241         buf = kmalloc(scsi_bufflen(scp), GFP_ATOMIC);
3242         if (!buf) {
3243                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC,
3244                                 INSUFF_RES_ASCQ);
3245                 return check_condition_result;
3246         }
3247
3248         scsi_sg_copy_to_buffer(scp, buf, scsi_bufflen(scp));
3249
3250         BUG_ON(get_unaligned_be16(&buf[0]) != payload_len - 2);
3251         BUG_ON(get_unaligned_be16(&buf[2]) != descriptors * 16);
3252
3253         desc = (void *)&buf[8];
3254
3255         write_lock_irqsave(&atomic_rw, iflags);
3256
3257         for (i = 0 ; i < descriptors ; i++) {
3258                 unsigned long long lba = get_unaligned_be64(&desc[i].lba);
3259                 unsigned int num = get_unaligned_be32(&desc[i].blocks);
3260
3261                 ret = check_device_access_params(scp, lba, num);
3262                 if (ret)
3263                         goto out;
3264
3265                 unmap_region(lba, num);
3266         }
3267
3268         ret = 0;
3269
3270 out:
3271         write_unlock_irqrestore(&atomic_rw, iflags);
3272         kfree(buf);
3273
3274         return ret;
3275 }
3276
3277 #define SDEBUG_GET_LBA_STATUS_LEN 32
3278
3279 static int
3280 resp_get_lba_status(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
3281 {
3282         u8 *cmd = scp->cmnd;
3283         u64 lba;
3284         u32 alloc_len, mapped, num;
3285         u8 arr[SDEBUG_GET_LBA_STATUS_LEN];
3286         int ret;
3287
3288         lba = get_unaligned_be64(cmd + 2);
3289         alloc_len = get_unaligned_be32(cmd + 10);
3290
3291         if (alloc_len < 24)
3292                 return 0;
3293
3294         ret = check_device_access_params(scp, lba, 1);
3295         if (ret)
3296                 return ret;
3297
3298         if (scsi_debug_lbp())
3299                 mapped = map_state(lba, &num);
3300         else {
3301                 mapped = 1;
3302                 /* following just in case virtual_gb changed */
3303                 sdebug_capacity = get_sdebug_capacity();
3304                 if (sdebug_capacity - lba <= 0xffffffff)
3305                         num = sdebug_capacity - lba;
3306                 else
3307                         num = 0xffffffff;
3308         }
3309
3310         memset(arr, 0, SDEBUG_GET_LBA_STATUS_LEN);
3311         put_unaligned_be32(20, arr);            /* Parameter Data Length */
3312         put_unaligned_be64(lba, arr + 8);       /* LBA */
3313         put_unaligned_be32(num, arr + 16);      /* Number of blocks */
3314         arr[20] = !mapped;              /* prov_stat=0: mapped; 1: dealloc */
3315
3316         return fill_from_dev_buffer(scp, arr, SDEBUG_GET_LBA_STATUS_LEN);
3317 }
3318
3319 #define SDEBUG_RLUN_ARR_SZ 256
3320
3321 static int resp_report_luns(struct scsi_cmnd * scp,
3322                             struct sdebug_dev_info * devip)
3323 {
3324         unsigned int alloc_len;
3325         int lun_cnt, i, upper, num, n, want_wlun, shortish;
3326         u64 lun;
3327         unsigned char *cmd = scp->cmnd;
3328         int select_report = (int)cmd[2];
3329         struct scsi_lun *one_lun;
3330         unsigned char arr[SDEBUG_RLUN_ARR_SZ];
3331         unsigned char * max_addr;
3332
3333         clear_luns_changed_on_target(devip);
3334         alloc_len = cmd[9] + (cmd[8] << 8) + (cmd[7] << 16) + (cmd[6] << 24);
3335         shortish = (alloc_len < 4);
3336         if (shortish || (select_report > 2)) {
3337                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, shortish ? 6 : 2, -1);
3338                 return check_condition_result;
3339         }
3340         /* can produce response with up to 16k luns (lun 0 to lun 16383) */
3341         memset(arr, 0, SDEBUG_RLUN_ARR_SZ);
3342         lun_cnt = scsi_debug_max_luns;
3343         if (1 == select_report)
3344                 lun_cnt = 0;
3345         else if (scsi_debug_no_lun_0 && (lun_cnt > 0))
3346                 --lun_cnt;
3347         want_wlun = (select_report > 0) ? 1 : 0;
3348         num = lun_cnt + want_wlun;
3349         arr[2] = ((sizeof(struct scsi_lun) * num) >> 8) & 0xff;
3350         arr[3] = (sizeof(struct scsi_lun) * num) & 0xff;
3351         n = min((int)((SDEBUG_RLUN_ARR_SZ - 8) /
3352                             sizeof(struct scsi_lun)), num);
3353         if (n < num) {
3354                 want_wlun = 0;
3355                 lun_cnt = n;
3356         }
3357         one_lun = (struct scsi_lun *) &arr[8];
3358         max_addr = arr + SDEBUG_RLUN_ARR_SZ;
3359         for (i = 0, lun = (scsi_debug_no_lun_0 ? 1 : 0);
3360              ((i < lun_cnt) && ((unsigned char *)(one_lun + i) < max_addr));
3361              i++, lun++) {
3362                 upper = (lun >> 8) & 0x3f;
3363                 if (upper)
3364                         one_lun[i].scsi_lun[0] =
3365                             (upper | (SAM2_LUN_ADDRESS_METHOD << 6));
3366                 one_lun[i].scsi_lun[1] = lun & 0xff;
3367         }
3368         if (want_wlun) {
3369                 one_lun[i].scsi_lun[0] = (SCSI_W_LUN_REPORT_LUNS >> 8) & 0xff;
3370                 one_lun[i].scsi_lun[1] = SCSI_W_LUN_REPORT_LUNS & 0xff;
3371                 i++;
3372         }
3373         alloc_len = (unsigned char *)(one_lun + i) - arr;
3374         return fill_from_dev_buffer(scp, arr,
3375                                     min((int)alloc_len, SDEBUG_RLUN_ARR_SZ));
3376 }
3377
3378 static int resp_xdwriteread(struct scsi_cmnd *scp, unsigned long long lba,
3379                             unsigned int num, struct sdebug_dev_info *devip)
3380 {
3381         int j;
3382         unsigned char *kaddr, *buf;
3383         unsigned int offset;
3384         struct scsi_data_buffer *sdb = scsi_in(scp);
3385         struct sg_mapping_iter miter;
3386
3387         /* better not to use temporary buffer. */
3388         buf = kmalloc(scsi_bufflen(scp), GFP_ATOMIC);
3389         if (!buf) {
3390                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC,
3391                                 INSUFF_RES_ASCQ);
3392                 return check_condition_result;
3393         }
3394
3395         scsi_sg_copy_to_buffer(scp, buf, scsi_bufflen(scp));
3396
3397         offset = 0;
3398         sg_miter_start(&miter, sdb->table.sgl, sdb->table.nents,
3399                         SG_MITER_ATOMIC | SG_MITER_TO_SG);
3400
3401         while (sg_miter_next(&miter)) {
3402                 kaddr = miter.addr;
3403                 for (j = 0; j < miter.length; j++)
3404                         *(kaddr + j) ^= *(buf + offset + j);
3405
3406                 offset += miter.length;
3407         }
3408         sg_miter_stop(&miter);
3409         kfree(buf);
3410
3411         return 0;
3412 }
3413
3414 static int
3415 resp_xdwriteread_10(struct scsi_cmnd *scp, struct sdebug_dev_info *devip)
3416 {
3417         u8 *cmd = scp->cmnd;
3418         u64 lba;
3419         u32 num;
3420         int errsts;
3421
3422         if (!scsi_bidi_cmnd(scp)) {
3423                 mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC,
3424                                 INSUFF_RES_ASCQ);
3425                 return check_condition_result;
3426         }
3427         errsts = resp_read_dt0(scp, devip);
3428         if (errsts)
3429                 return errsts;
3430         if (!(cmd[1] & 0x4)) {          /* DISABLE_WRITE is not set */
3431                 errsts = resp_write_dt0(scp, devip);
3432                 if (errsts)
3433                         return errsts;
3434         }
3435         lba = get_unaligned_be32(cmd + 2);
3436         num = get_unaligned_be16(cmd + 7);
3437         return resp_xdwriteread(scp, lba, num, devip);
3438 }
3439
3440 /* When timer or tasklet goes off this function is called. */
3441 static void sdebug_q_cmd_complete(unsigned long indx)
3442 {
3443         int qa_indx;
3444         int retiring = 0;
3445         unsigned long iflags;
3446         struct sdebug_queued_cmd *sqcp;
3447         struct scsi_cmnd *scp;
3448         struct sdebug_dev_info *devip;
3449
3450         atomic_inc(&sdebug_completions);
3451         qa_indx = indx;
3452         if ((qa_indx < 0) || (qa_indx >= SCSI_DEBUG_CANQUEUE)) {
3453                 pr_err("wild qa_indx=%d\n", qa_indx);
3454                 return;
3455         }
3456         spin_lock_irqsave(&queued_arr_lock, iflags);
3457         sqcp = &queued_arr[qa_indx];
3458         scp = sqcp->a_cmnd;
3459         if (NULL == scp) {
3460                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
3461                 pr_err("scp is NULL\n");
3462                 return;
3463         }
3464         devip = (struct sdebug_dev_info *)scp->device->hostdata;
3465         if (devip)
3466                 atomic_dec(&devip->num_in_q);
3467         else
3468                 pr_err("devip=NULL\n");
3469         if (atomic_read(&retired_max_queue) > 0)
3470                 retiring = 1;
3471
3472         sqcp->a_cmnd = NULL;
3473         if (!test_and_clear_bit(qa_indx, queued_in_use_bm)) {
3474                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
3475                 pr_err("Unexpected completion\n");
3476                 return;
3477         }
3478
3479         if (unlikely(retiring)) {       /* user has reduced max_queue */
3480                 int k, retval;
3481
3482                 retval = atomic_read(&retired_max_queue);
3483                 if (qa_indx >= retval) {
3484                         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3485                         pr_err("index %d too large\n", retval);
3486                         return;
3487                 }
3488                 k = find_last_bit(queued_in_use_bm, retval);
3489                 if ((k < scsi_debug_max_queue) || (k == retval))
3490                         atomic_set(&retired_max_queue, 0);
3491                 else
3492                         atomic_set(&retired_max_queue, k + 1);
3493         }
3494         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3495         scp->scsi_done(scp); /* callback to mid level */
3496 }
3497
3498 /* When high resolution timer goes off this function is called. */
3499 static enum hrtimer_restart
3500 sdebug_q_cmd_hrt_complete(struct hrtimer *timer)
3501 {
3502         int qa_indx;
3503         int retiring = 0;
3504         unsigned long iflags;
3505         struct sdebug_hrtimer *sd_hrtp = (struct sdebug_hrtimer *)timer;
3506         struct sdebug_queued_cmd *sqcp;
3507         struct scsi_cmnd *scp;
3508         struct sdebug_dev_info *devip;
3509
3510         atomic_inc(&sdebug_completions);
3511         qa_indx = sd_hrtp->qa_indx;
3512         if ((qa_indx < 0) || (qa_indx >= SCSI_DEBUG_CANQUEUE)) {
3513                 pr_err("wild qa_indx=%d\n", qa_indx);
3514                 goto the_end;
3515         }
3516         spin_lock_irqsave(&queued_arr_lock, iflags);
3517         sqcp = &queued_arr[qa_indx];
3518         scp = sqcp->a_cmnd;
3519         if (NULL == scp) {
3520                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
3521                 pr_err("scp is NULL\n");
3522                 goto the_end;
3523         }
3524         devip = (struct sdebug_dev_info *)scp->device->hostdata;
3525         if (devip)
3526                 atomic_dec(&devip->num_in_q);
3527         else
3528                 pr_err("devip=NULL\n");
3529         if (atomic_read(&retired_max_queue) > 0)
3530                 retiring = 1;
3531
3532         sqcp->a_cmnd = NULL;
3533         if (!test_and_clear_bit(qa_indx, queued_in_use_bm)) {
3534                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
3535                 pr_err("Unexpected completion\n");
3536                 goto the_end;
3537         }
3538
3539         if (unlikely(retiring)) {       /* user has reduced max_queue */
3540                 int k, retval;
3541
3542                 retval = atomic_read(&retired_max_queue);
3543                 if (qa_indx >= retval) {
3544                         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3545                         pr_err("index %d too large\n", retval);
3546                         goto the_end;
3547                 }
3548                 k = find_last_bit(queued_in_use_bm, retval);
3549                 if ((k < scsi_debug_max_queue) || (k == retval))
3550                         atomic_set(&retired_max_queue, 0);
3551                 else
3552                         atomic_set(&retired_max_queue, k + 1);
3553         }
3554         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3555         scp->scsi_done(scp); /* callback to mid level */
3556 the_end:
3557         return HRTIMER_NORESTART;
3558 }
3559
3560 static struct sdebug_dev_info *
3561 sdebug_device_create(struct sdebug_host_info *sdbg_host, gfp_t flags)
3562 {
3563         struct sdebug_dev_info *devip;
3564
3565         devip = kzalloc(sizeof(*devip), flags);
3566         if (devip) {
3567                 devip->sdbg_host = sdbg_host;
3568                 list_add_tail(&devip->dev_list, &sdbg_host->dev_info_list);
3569         }
3570         return devip;
3571 }
3572
3573 static struct sdebug_dev_info * devInfoReg(struct scsi_device * sdev)
3574 {
3575         struct sdebug_host_info * sdbg_host;
3576         struct sdebug_dev_info * open_devip = NULL;
3577         struct sdebug_dev_info * devip =
3578                         (struct sdebug_dev_info *)sdev->hostdata;
3579
3580         if (devip)
3581                 return devip;
3582         sdbg_host = *(struct sdebug_host_info **)shost_priv(sdev->host);
3583         if (!sdbg_host) {
3584                 pr_err("Host info NULL\n");
3585                 return NULL;
3586         }
3587         list_for_each_entry(devip, &sdbg_host->dev_info_list, dev_list) {
3588                 if ((devip->used) && (devip->channel == sdev->channel) &&
3589                     (devip->target == sdev->id) &&
3590                     (devip->lun == sdev->lun))
3591                         return devip;
3592                 else {
3593                         if ((!devip->used) && (!open_devip))
3594                                 open_devip = devip;
3595                 }
3596         }
3597         if (!open_devip) { /* try and make a new one */
3598                 open_devip = sdebug_device_create(sdbg_host, GFP_ATOMIC);
3599                 if (!open_devip) {
3600                         pr_err("out of memory at line %d\n", __LINE__);
3601                         return NULL;
3602                 }
3603         }
3604
3605         open_devip->channel = sdev->channel;
3606         open_devip->target = sdev->id;
3607         open_devip->lun = sdev->lun;
3608         open_devip->sdbg_host = sdbg_host;
3609         atomic_set(&open_devip->num_in_q, 0);
3610         set_bit(SDEBUG_UA_POR, open_devip->uas_bm);
3611         open_devip->used = true;
3612         return open_devip;
3613 }
3614
3615 static int scsi_debug_slave_alloc(struct scsi_device *sdp)
3616 {
3617         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
3618                 pr_info("slave_alloc <%u %u %u %llu>\n",
3619                        sdp->host->host_no, sdp->channel, sdp->id, sdp->lun);
3620         queue_flag_set_unlocked(QUEUE_FLAG_BIDI, sdp->request_queue);
3621         return 0;
3622 }
3623
3624 static int scsi_debug_slave_configure(struct scsi_device *sdp)
3625 {
3626         struct sdebug_dev_info *devip;
3627
3628         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
3629                 pr_info("slave_configure <%u %u %u %llu>\n",
3630                        sdp->host->host_no, sdp->channel, sdp->id, sdp->lun);
3631         if (sdp->host->max_cmd_len != SCSI_DEBUG_MAX_CMD_LEN)
3632                 sdp->host->max_cmd_len = SCSI_DEBUG_MAX_CMD_LEN;
3633         devip = devInfoReg(sdp);
3634         if (NULL == devip)
3635                 return 1;       /* no resources, will be marked offline */
3636         sdp->hostdata = devip;
3637         blk_queue_max_segment_size(sdp->request_queue, -1U);
3638         if (scsi_debug_no_uld)
3639                 sdp->no_uld_attach = 1;
3640         return 0;
3641 }
3642
3643 static void scsi_debug_slave_destroy(struct scsi_device *sdp)
3644 {
3645         struct sdebug_dev_info *devip =
3646                 (struct sdebug_dev_info *)sdp->hostdata;
3647
3648         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
3649                 pr_info("slave_destroy <%u %u %u %llu>\n",
3650                        sdp->host->host_no, sdp->channel, sdp->id, sdp->lun);
3651         if (devip) {
3652                 /* make this slot available for re-use */
3653                 devip->used = false;
3654                 sdp->hostdata = NULL;
3655         }
3656 }
3657
3658 /* Returns 1 if cmnd found (deletes its timer or tasklet), else returns 0 */
3659 static int stop_queued_cmnd(struct scsi_cmnd *cmnd)
3660 {
3661         unsigned long iflags;
3662         int k, qmax, r_qmax;
3663         struct sdebug_queued_cmd *sqcp;
3664         struct sdebug_dev_info *devip;
3665
3666         spin_lock_irqsave(&queued_arr_lock, iflags);
3667         qmax = scsi_debug_max_queue;
3668         r_qmax = atomic_read(&retired_max_queue);
3669         if (r_qmax > qmax)
3670                 qmax = r_qmax;
3671         for (k = 0; k < qmax; ++k) {
3672                 if (test_bit(k, queued_in_use_bm)) {
3673                         sqcp = &queued_arr[k];
3674                         if (cmnd == sqcp->a_cmnd) {
3675                                 devip = (struct sdebug_dev_info *)
3676                                         cmnd->device->hostdata;
3677                                 if (devip)
3678                                         atomic_dec(&devip->num_in_q);
3679                                 sqcp->a_cmnd = NULL;
3680                                 spin_unlock_irqrestore(&queued_arr_lock,
3681                                                        iflags);
3682                                 if (scsi_debug_ndelay > 0) {
3683                                         if (sqcp->sd_hrtp)
3684                                                 hrtimer_cancel(
3685                                                         &sqcp->sd_hrtp->hrt);
3686                                 } else if (scsi_debug_delay > 0) {
3687                                         if (sqcp->cmnd_timerp)
3688                                                 del_timer_sync(
3689                                                         sqcp->cmnd_timerp);
3690                                 } else if (scsi_debug_delay < 0) {
3691                                         if (sqcp->tletp)
3692                                                 tasklet_kill(sqcp->tletp);
3693                                 }
3694                                 clear_bit(k, queued_in_use_bm);
3695                                 return 1;
3696                         }
3697                 }
3698         }
3699         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3700         return 0;
3701 }
3702
3703 /* Deletes (stops) timers or tasklets of all queued commands */
3704 static void stop_all_queued(void)
3705 {
3706         unsigned long iflags;
3707         int k;
3708         struct sdebug_queued_cmd *sqcp;
3709         struct sdebug_dev_info *devip;
3710
3711         spin_lock_irqsave(&queued_arr_lock, iflags);
3712         for (k = 0; k < SCSI_DEBUG_CANQUEUE; ++k) {
3713                 if (test_bit(k, queued_in_use_bm)) {
3714                         sqcp = &queued_arr[k];
3715                         if (sqcp->a_cmnd) {
3716                                 devip = (struct sdebug_dev_info *)
3717                                         sqcp->a_cmnd->device->hostdata;
3718                                 if (devip)
3719                                         atomic_dec(&devip->num_in_q);
3720                                 sqcp->a_cmnd = NULL;
3721                                 spin_unlock_irqrestore(&queued_arr_lock,
3722                                                        iflags);
3723                                 if (scsi_debug_ndelay > 0) {
3724                                         if (sqcp->sd_hrtp)
3725                                                 hrtimer_cancel(
3726                                                         &sqcp->sd_hrtp->hrt);
3727                                 } else if (scsi_debug_delay > 0) {
3728                                         if (sqcp->cmnd_timerp)
3729                                                 del_timer_sync(
3730                                                         sqcp->cmnd_timerp);
3731                                 } else if (scsi_debug_delay < 0) {
3732                                         if (sqcp->tletp)
3733                                                 tasklet_kill(sqcp->tletp);
3734                                 }
3735                                 clear_bit(k, queued_in_use_bm);
3736                                 spin_lock_irqsave(&queued_arr_lock, iflags);
3737                         }
3738                 }
3739         }
3740         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3741 }
3742
3743 /* Free queued command memory on heap */
3744 static void free_all_queued(void)
3745 {
3746         unsigned long iflags;
3747         int k;
3748         struct sdebug_queued_cmd *sqcp;
3749
3750         spin_lock_irqsave(&queued_arr_lock, iflags);
3751         for (k = 0; k < SCSI_DEBUG_CANQUEUE; ++k) {
3752                 sqcp = &queued_arr[k];
3753                 kfree(sqcp->cmnd_timerp);
3754                 sqcp->cmnd_timerp = NULL;
3755                 kfree(sqcp->tletp);
3756                 sqcp->tletp = NULL;
3757                 kfree(sqcp->sd_hrtp);
3758                 sqcp->sd_hrtp = NULL;
3759         }
3760         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3761 }
3762
3763 static int scsi_debug_abort(struct scsi_cmnd *SCpnt)
3764 {
3765         ++num_aborts;
3766         if (SCpnt) {
3767                 if (SCpnt->device &&
3768                     (SCSI_DEBUG_OPT_ALL_NOISE & scsi_debug_opts))
3769                         sdev_printk(KERN_INFO, SCpnt->device, "%s\n",
3770                                     __func__);
3771                 stop_queued_cmnd(SCpnt);
3772         }
3773         return SUCCESS;
3774 }
3775
3776 static int scsi_debug_device_reset(struct scsi_cmnd * SCpnt)
3777 {
3778         struct sdebug_dev_info * devip;
3779
3780         ++num_dev_resets;
3781         if (SCpnt && SCpnt->device) {
3782                 struct scsi_device *sdp = SCpnt->device;
3783
3784                 if (SCSI_DEBUG_OPT_ALL_NOISE & scsi_debug_opts)
3785                         sdev_printk(KERN_INFO, sdp, "%s\n", __func__);
3786                 devip = devInfoReg(sdp);
3787                 if (devip)
3788                         set_bit(SDEBUG_UA_POR, devip->uas_bm);
3789         }
3790         return SUCCESS;
3791 }
3792
3793 static int scsi_debug_target_reset(struct scsi_cmnd *SCpnt)
3794 {
3795         struct sdebug_host_info *sdbg_host;
3796         struct sdebug_dev_info *devip;
3797         struct scsi_device *sdp;
3798         struct Scsi_Host *hp;
3799         int k = 0;
3800
3801         ++num_target_resets;
3802         if (!SCpnt)
3803                 goto lie;
3804         sdp = SCpnt->device;
3805         if (!sdp)
3806                 goto lie;
3807         if (SCSI_DEBUG_OPT_ALL_NOISE & scsi_debug_opts)
3808                 sdev_printk(KERN_INFO, sdp, "%s\n", __func__);
3809         hp = sdp->host;
3810         if (!hp)
3811                 goto lie;
3812         sdbg_host = *(struct sdebug_host_info **)shost_priv(hp);
3813         if (sdbg_host) {
3814                 list_for_each_entry(devip,
3815                                     &sdbg_host->dev_info_list,
3816                                     dev_list)
3817                         if (devip->target == sdp->id) {
3818                                 set_bit(SDEBUG_UA_BUS_RESET, devip->uas_bm);
3819                                 ++k;
3820                         }
3821         }
3822         if (SCSI_DEBUG_OPT_RESET_NOISE & scsi_debug_opts)
3823                 sdev_printk(KERN_INFO, sdp,
3824                             "%s: %d device(s) found in target\n", __func__, k);
3825 lie:
3826         return SUCCESS;
3827 }
3828
3829 static int scsi_debug_bus_reset(struct scsi_cmnd * SCpnt)
3830 {
3831         struct sdebug_host_info *sdbg_host;
3832         struct sdebug_dev_info *devip;
3833         struct scsi_device * sdp;
3834         struct Scsi_Host * hp;
3835         int k = 0;
3836
3837         ++num_bus_resets;
3838         if (!(SCpnt && SCpnt->device))
3839                 goto lie;
3840         sdp = SCpnt->device;
3841         if (SCSI_DEBUG_OPT_ALL_NOISE & scsi_debug_opts)
3842                 sdev_printk(KERN_INFO, sdp, "%s\n", __func__);
3843         hp = sdp->host;
3844         if (hp) {
3845                 sdbg_host = *(struct sdebug_host_info **)shost_priv(hp);
3846                 if (sdbg_host) {
3847                         list_for_each_entry(devip,
3848                                             &sdbg_host->dev_info_list,
3849                                             dev_list) {
3850                                 set_bit(SDEBUG_UA_BUS_RESET, devip->uas_bm);
3851                                 ++k;
3852                         }
3853                 }
3854         }
3855         if (SCSI_DEBUG_OPT_RESET_NOISE & scsi_debug_opts)
3856                 sdev_printk(KERN_INFO, sdp,
3857                             "%s: %d device(s) found in host\n", __func__, k);
3858 lie:
3859         return SUCCESS;
3860 }
3861
3862 static int scsi_debug_host_reset(struct scsi_cmnd * SCpnt)
3863 {
3864         struct sdebug_host_info * sdbg_host;
3865         struct sdebug_dev_info *devip;
3866         int k = 0;
3867
3868         ++num_host_resets;
3869         if ((SCpnt->device) && (SCSI_DEBUG_OPT_ALL_NOISE & scsi_debug_opts))
3870                 sdev_printk(KERN_INFO, SCpnt->device, "%s\n", __func__);
3871         spin_lock(&sdebug_host_list_lock);
3872         list_for_each_entry(sdbg_host, &sdebug_host_list, host_list) {
3873                 list_for_each_entry(devip, &sdbg_host->dev_info_list,
3874                                     dev_list) {
3875                         set_bit(SDEBUG_UA_BUS_RESET, devip->uas_bm);
3876                         ++k;
3877                 }
3878         }
3879         spin_unlock(&sdebug_host_list_lock);
3880         stop_all_queued();
3881         if (SCSI_DEBUG_OPT_RESET_NOISE & scsi_debug_opts)
3882                 sdev_printk(KERN_INFO, SCpnt->device,
3883                             "%s: %d device(s) found\n", __func__, k);
3884         return SUCCESS;
3885 }
3886
3887 static void __init sdebug_build_parts(unsigned char *ramp,
3888                                       unsigned long store_size)
3889 {
3890         struct partition * pp;
3891         int starts[SDEBUG_MAX_PARTS + 2];
3892         int sectors_per_part, num_sectors, k;
3893         int heads_by_sects, start_sec, end_sec;
3894
3895         /* assume partition table already zeroed */
3896         if ((scsi_debug_num_parts < 1) || (store_size < 1048576))
3897                 return;
3898         if (scsi_debug_num_parts > SDEBUG_MAX_PARTS) {
3899                 scsi_debug_num_parts = SDEBUG_MAX_PARTS;
3900                 pr_warn("reducing partitions to %d\n", SDEBUG_MAX_PARTS);
3901         }
3902         num_sectors = (int)sdebug_store_sectors;
3903         sectors_per_part = (num_sectors - sdebug_sectors_per)
3904                            / scsi_debug_num_parts;
3905         heads_by_sects = sdebug_heads * sdebug_sectors_per;
3906         starts[0] = sdebug_sectors_per;
3907         for (k = 1; k < scsi_debug_num_parts; ++k)
3908                 starts[k] = ((k * sectors_per_part) / heads_by_sects)
3909                             * heads_by_sects;
3910         starts[scsi_debug_num_parts] = num_sectors;
3911         starts[scsi_debug_num_parts + 1] = 0;
3912
3913         ramp[510] = 0x55;       /* magic partition markings */
3914         ramp[511] = 0xAA;
3915         pp = (struct partition *)(ramp + 0x1be);
3916         for (k = 0; starts[k + 1]; ++k, ++pp) {
3917                 start_sec = starts[k];
3918                 end_sec = starts[k + 1] - 1;
3919                 pp->boot_ind = 0;
3920
3921                 pp->cyl = start_sec / heads_by_sects;
3922                 pp->head = (start_sec - (pp->cyl * heads_by_sects))
3923                            / sdebug_sectors_per;
3924                 pp->sector = (start_sec % sdebug_sectors_per) + 1;
3925
3926                 pp->end_cyl = end_sec / heads_by_sects;
3927                 pp->end_head = (end_sec - (pp->end_cyl * heads_by_sects))
3928                                / sdebug_sectors_per;
3929                 pp->end_sector = (end_sec % sdebug_sectors_per) + 1;
3930
3931                 pp->start_sect = cpu_to_le32(start_sec);
3932                 pp->nr_sects = cpu_to_le32(end_sec - start_sec + 1);
3933                 pp->sys_ind = 0x83;     /* plain Linux partition */
3934         }
3935 }
3936
3937 static int
3938 schedule_resp(struct scsi_cmnd *cmnd, struct sdebug_dev_info *devip,
3939               int scsi_result, int delta_jiff)
3940 {
3941         unsigned long iflags;
3942         int k, num_in_q, qdepth, inject;
3943         struct sdebug_queued_cmd *sqcp = NULL;
3944         struct scsi_device *sdp;
3945
3946         /* this should never happen */
3947         if (WARN_ON(!cmnd))
3948                 return SCSI_MLQUEUE_HOST_BUSY;
3949
3950         if (NULL == devip) {
3951                 pr_warn("called devip == NULL\n");
3952                 /* no particularly good error to report back */
3953                 return SCSI_MLQUEUE_HOST_BUSY;
3954         }
3955
3956         sdp = cmnd->device;
3957
3958         if ((scsi_result) && (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts))
3959                 sdev_printk(KERN_INFO, sdp, "%s: non-zero result=0x%x\n",
3960                             __func__, scsi_result);
3961         if (delta_jiff == 0)
3962                 goto respond_in_thread;
3963
3964         /* schedule the response at a later time if resources permit */
3965         spin_lock_irqsave(&queued_arr_lock, iflags);
3966         num_in_q = atomic_read(&devip->num_in_q);
3967         qdepth = cmnd->device->queue_depth;
3968         inject = 0;
3969         if ((qdepth > 0) && (num_in_q >= qdepth)) {
3970                 if (scsi_result) {
3971                         spin_unlock_irqrestore(&queued_arr_lock, iflags);
3972                         goto respond_in_thread;
3973                 } else
3974                         scsi_result = device_qfull_result;
3975         } else if ((scsi_debug_every_nth != 0) &&
3976                    (SCSI_DEBUG_OPT_RARE_TSF & scsi_debug_opts) &&
3977                    (scsi_result == 0)) {
3978                 if ((num_in_q == (qdepth - 1)) &&
3979                     (atomic_inc_return(&sdebug_a_tsf) >=
3980                      abs(scsi_debug_every_nth))) {
3981                         atomic_set(&sdebug_a_tsf, 0);
3982                         inject = 1;
3983                         scsi_result = device_qfull_result;
3984                 }
3985         }
3986
3987         k = find_first_zero_bit(queued_in_use_bm, scsi_debug_max_queue);
3988         if (k >= scsi_debug_max_queue) {
3989                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
3990                 if (scsi_result)
3991                         goto respond_in_thread;
3992                 else if (SCSI_DEBUG_OPT_ALL_TSF & scsi_debug_opts)
3993                         scsi_result = device_qfull_result;
3994                 if (SCSI_DEBUG_OPT_Q_NOISE & scsi_debug_opts)
3995                         sdev_printk(KERN_INFO, sdp,
3996                                     "%s: max_queue=%d exceeded, %s\n",
3997                                     __func__, scsi_debug_max_queue,
3998                                     (scsi_result ?  "status: TASK SET FULL" :
3999                                                     "report: host busy"));
4000                 if (scsi_result)
4001                         goto respond_in_thread;
4002                 else
4003                         return SCSI_MLQUEUE_HOST_BUSY;
4004         }
4005         __set_bit(k, queued_in_use_bm);
4006         atomic_inc(&devip->num_in_q);
4007         sqcp = &queued_arr[k];
4008         sqcp->a_cmnd = cmnd;
4009         cmnd->result = scsi_result;
4010         spin_unlock_irqrestore(&queued_arr_lock, iflags);
4011         if (delta_jiff > 0) {
4012                 if (NULL == sqcp->cmnd_timerp) {
4013                         sqcp->cmnd_timerp = kmalloc(sizeof(struct timer_list),
4014                                                     GFP_ATOMIC);
4015                         if (NULL == sqcp->cmnd_timerp)
4016                                 return SCSI_MLQUEUE_HOST_BUSY;
4017                         init_timer(sqcp->cmnd_timerp);
4018                 }
4019                 sqcp->cmnd_timerp->function = sdebug_q_cmd_complete;
4020                 sqcp->cmnd_timerp->data = k;
4021                 sqcp->cmnd_timerp->expires = get_jiffies_64() + delta_jiff;
4022                 add_timer(sqcp->cmnd_timerp);
4023         } else if (scsi_debug_ndelay > 0) {
4024                 ktime_t kt = ktime_set(0, scsi_debug_ndelay);
4025                 struct sdebug_hrtimer *sd_hp = sqcp->sd_hrtp;
4026
4027                 if (NULL == sd_hp) {
4028                         sd_hp = kmalloc(sizeof(*sd_hp), GFP_ATOMIC);
4029                         if (NULL == sd_hp)
4030                                 return SCSI_MLQUEUE_HOST_BUSY;
4031                         sqcp->sd_hrtp = sd_hp;
4032                         hrtimer_init(&sd_hp->hrt, CLOCK_MONOTONIC,
4033                                      HRTIMER_MODE_REL);
4034                         sd_hp->hrt.function = sdebug_q_cmd_hrt_complete;
4035                         sd_hp->qa_indx = k;
4036                 }
4037                 hrtimer_start(&sd_hp->hrt, kt, HRTIMER_MODE_REL);
4038         } else {        /* delay < 0 */
4039                 if (NULL == sqcp->tletp) {
4040                         sqcp->tletp = kmalloc(sizeof(*sqcp->tletp),
4041                                               GFP_ATOMIC);
4042                         if (NULL == sqcp->tletp)
4043                                 return SCSI_MLQUEUE_HOST_BUSY;
4044                         tasklet_init(sqcp->tletp,
4045                                      sdebug_q_cmd_complete, k);
4046                 }
4047                 if (-1 == delta_jiff)
4048                         tasklet_hi_schedule(sqcp->tletp);
4049                 else
4050                         tasklet_schedule(sqcp->tletp);
4051         }
4052         if ((SCSI_DEBUG_OPT_Q_NOISE & scsi_debug_opts) &&
4053             (scsi_result == device_qfull_result))
4054                 sdev_printk(KERN_INFO, sdp,
4055                             "%s: num_in_q=%d +1, %s%s\n", __func__,
4056                             num_in_q, (inject ? "<inject> " : ""),
4057                             "status: TASK SET FULL");
4058         return 0;
4059
4060 respond_in_thread:      /* call back to mid-layer using invocation thread */
4061         cmnd->result = scsi_result;
4062         cmnd->scsi_done(cmnd);
4063         return 0;
4064 }
4065
4066 /* Note: The following macros create attribute files in the
4067    /sys/module/scsi_debug/parameters directory. Unfortunately this
4068    driver is unaware of a change and cannot trigger auxiliary actions
4069    as it can when the corresponding attribute in the
4070    /sys/bus/pseudo/drivers/scsi_debug directory is changed.
4071  */
4072 module_param_named(add_host, scsi_debug_add_host, int, S_IRUGO | S_IWUSR);
4073 module_param_named(ato, scsi_debug_ato, int, S_IRUGO);
4074 module_param_named(clustering, scsi_debug_clustering, bool, S_IRUGO | S_IWUSR);
4075 module_param_named(delay, scsi_debug_delay, int, S_IRUGO | S_IWUSR);
4076 module_param_named(dev_size_mb, scsi_debug_dev_size_mb, int, S_IRUGO);
4077 module_param_named(dif, scsi_debug_dif, int, S_IRUGO);
4078 module_param_named(dix, scsi_debug_dix, int, S_IRUGO);
4079 module_param_named(dsense, scsi_debug_dsense, int, S_IRUGO | S_IWUSR);
4080 module_param_named(every_nth, scsi_debug_every_nth, int, S_IRUGO | S_IWUSR);
4081 module_param_named(fake_rw, scsi_debug_fake_rw, int, S_IRUGO | S_IWUSR);
4082 module_param_named(guard, scsi_debug_guard, uint, S_IRUGO);
4083 module_param_named(host_lock, scsi_debug_host_lock, bool, S_IRUGO | S_IWUSR);
4084 module_param_named(lbpu, scsi_debug_lbpu, int, S_IRUGO);
4085 module_param_named(lbpws, scsi_debug_lbpws, int, S_IRUGO);
4086 module_param_named(lbpws10, scsi_debug_lbpws10, int, S_IRUGO);
4087 module_param_named(lbprz, scsi_debug_lbprz, int, S_IRUGO);
4088 module_param_named(lowest_aligned, scsi_debug_lowest_aligned, int, S_IRUGO);
4089 module_param_named(max_luns, scsi_debug_max_luns, int, S_IRUGO | S_IWUSR);
4090 module_param_named(max_queue, scsi_debug_max_queue, int, S_IRUGO | S_IWUSR);
4091 module_param_named(ndelay, scsi_debug_ndelay, int, S_IRUGO | S_IWUSR);
4092 module_param_named(no_lun_0, scsi_debug_no_lun_0, int, S_IRUGO | S_IWUSR);
4093 module_param_named(no_uld, scsi_debug_no_uld, int, S_IRUGO);
4094 module_param_named(num_parts, scsi_debug_num_parts, int, S_IRUGO);
4095 module_param_named(num_tgts, scsi_debug_num_tgts, int, S_IRUGO | S_IWUSR);
4096 module_param_named(opt_blks, scsi_debug_opt_blks, int, S_IRUGO);
4097 module_param_named(opts, scsi_debug_opts, int, S_IRUGO | S_IWUSR);
4098 module_param_named(physblk_exp, scsi_debug_physblk_exp, int, S_IRUGO);
4099 module_param_named(ptype, scsi_debug_ptype, int, S_IRUGO | S_IWUSR);
4100 module_param_named(removable, scsi_debug_removable, bool, S_IRUGO | S_IWUSR);
4101 module_param_named(scsi_level, scsi_debug_scsi_level, int, S_IRUGO);
4102 module_param_named(sector_size, scsi_debug_sector_size, int, S_IRUGO);
4103 module_param_named(strict, scsi_debug_strict, bool, S_IRUGO | S_IWUSR);
4104 module_param_named(unmap_alignment, scsi_debug_unmap_alignment, int, S_IRUGO);
4105 module_param_named(unmap_granularity, scsi_debug_unmap_granularity, int, S_IRUGO);
4106 module_param_named(unmap_max_blocks, scsi_debug_unmap_max_blocks, int, S_IRUGO);
4107 module_param_named(unmap_max_desc, scsi_debug_unmap_max_desc, int, S_IRUGO);
4108 module_param_named(virtual_gb, scsi_debug_virtual_gb, int, S_IRUGO | S_IWUSR);
4109 module_param_named(vpd_use_hostno, scsi_debug_vpd_use_hostno, int,
4110                    S_IRUGO | S_IWUSR);
4111 module_param_named(write_same_length, scsi_debug_write_same_length, int,
4112                    S_IRUGO | S_IWUSR);
4113
4114 MODULE_AUTHOR("Eric Youngdale + Douglas Gilbert");
4115 MODULE_DESCRIPTION("SCSI debug adapter driver");
4116 MODULE_LICENSE("GPL");
4117 MODULE_VERSION(SCSI_DEBUG_VERSION);
4118
4119 MODULE_PARM_DESC(add_host, "0..127 hosts allowed(def=1)");
4120 MODULE_PARM_DESC(ato, "application tag ownership: 0=disk 1=host (def=1)");
4121 MODULE_PARM_DESC(clustering, "when set enables larger transfers (def=0)");
4122 MODULE_PARM_DESC(delay, "response delay (def=1 jiffy); 0:imm, -1,-2:tiny");
4123 MODULE_PARM_DESC(dev_size_mb, "size in MiB of ram shared by devs(def=8)");
4124 MODULE_PARM_DESC(dif, "data integrity field type: 0-3 (def=0)");
4125 MODULE_PARM_DESC(dix, "data integrity extensions mask (def=0)");
4126 MODULE_PARM_DESC(dsense, "use descriptor sense format(def=0 -> fixed)");
4127 MODULE_PARM_DESC(every_nth, "timeout every nth command(def=0)");
4128 MODULE_PARM_DESC(fake_rw, "fake reads/writes instead of copying (def=0)");
4129 MODULE_PARM_DESC(guard, "protection checksum: 0=crc, 1=ip (def=0)");
4130 MODULE_PARM_DESC(host_lock, "use host_lock around all commands (def=0)");
4131 MODULE_PARM_DESC(lbpu, "enable LBP, support UNMAP command (def=0)");
4132 MODULE_PARM_DESC(lbpws, "enable LBP, support WRITE SAME(16) with UNMAP bit (def=0)");
4133 MODULE_PARM_DESC(lbpws10, "enable LBP, support WRITE SAME(10) with UNMAP bit (def=0)");
4134 MODULE_PARM_DESC(lbprz, "unmapped blocks return 0 on read (def=1)");
4135 MODULE_PARM_DESC(lowest_aligned, "lowest aligned lba (def=0)");
4136 MODULE_PARM_DESC(max_luns, "number of LUNs per target to simulate(def=1)");
4137 MODULE_PARM_DESC(max_queue, "max number of queued commands (1 to max(def))");
4138 MODULE_PARM_DESC(ndelay, "response delay in nanoseconds (def=0 -> ignore)");
4139 MODULE_PARM_DESC(no_lun_0, "no LU number 0 (def=0 -> have lun 0)");
4140 MODULE_PARM_DESC(no_uld, "stop ULD (e.g. sd driver) attaching (def=0))");
4141 MODULE_PARM_DESC(num_parts, "number of partitions(def=0)");
4142 MODULE_PARM_DESC(num_tgts, "number of targets per host to simulate(def=1)");
4143 MODULE_PARM_DESC(opt_blks, "optimal transfer length in block (def=64)");
4144 MODULE_PARM_DESC(opts, "1->noise, 2->medium_err, 4->timeout, 8->recovered_err... (def=0)");
4145 MODULE_PARM_DESC(physblk_exp, "physical block exponent (def=0)");
4146 MODULE_PARM_DESC(ptype, "SCSI peripheral type(def=0[disk])");
4147 MODULE_PARM_DESC(removable, "claim to have removable media (def=0)");
4148 MODULE_PARM_DESC(scsi_level, "SCSI level to simulate(def=6[SPC-4])");
4149 MODULE_PARM_DESC(sector_size, "logical block size in bytes (def=512)");
4150 MODULE_PARM_DESC(strict, "stricter checks: reserved field in cdb (def=0)");
4151 MODULE_PARM_DESC(unmap_alignment, "lowest aligned thin provisioning lba (def=0)");
4152 MODULE_PARM_DESC(unmap_granularity, "thin provisioning granularity in blocks (def=1)");
4153 MODULE_PARM_DESC(unmap_max_blocks, "max # of blocks can be unmapped in one cmd (def=0xffffffff)");
4154 MODULE_PARM_DESC(unmap_max_desc, "max # of ranges that can be unmapped in one cmd (def=256)");
4155 MODULE_PARM_DESC(virtual_gb, "virtual gigabyte (GiB) size (def=0 -> use dev_size_mb)");
4156 MODULE_PARM_DESC(vpd_use_hostno, "0 -> dev ids ignore hostno (def=1 -> unique dev ids)");
4157 MODULE_PARM_DESC(write_same_length, "Maximum blocks per WRITE SAME cmd (def=0xffff)");
4158
4159 static char sdebug_info[256];
4160
4161 static const char * scsi_debug_info(struct Scsi_Host * shp)
4162 {
4163         sprintf(sdebug_info, "scsi_debug, version %s [%s], "
4164                 "dev_size_mb=%d, opts=0x%x", SCSI_DEBUG_VERSION,
4165                 scsi_debug_version_date, scsi_debug_dev_size_mb,
4166                 scsi_debug_opts);
4167         return sdebug_info;
4168 }
4169
4170 /* 'echo <val> > /proc/scsi/scsi_debug/<host_id>' writes to opts */
4171 static int scsi_debug_write_info(struct Scsi_Host *host, char *buffer, int length)
4172 {
4173         char arr[16];
4174         int opts;
4175         int minLen = length > 15 ? 15 : length;
4176
4177         if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO))
4178                 return -EACCES;
4179         memcpy(arr, buffer, minLen);
4180         arr[minLen] = '\0';
4181         if (1 != sscanf(arr, "%d", &opts))
4182                 return -EINVAL;
4183         scsi_debug_opts = opts;
4184         if (scsi_debug_every_nth != 0)
4185                 atomic_set(&sdebug_cmnd_count, 0);
4186         return length;
4187 }
4188
4189 /* Output seen with 'cat /proc/scsi/scsi_debug/<host_id>'. It will be the
4190  * same for each scsi_debug host (if more than one). Some of the counters
4191  * output are not atomics so might be inaccurate in a busy system. */
4192 static int scsi_debug_show_info(struct seq_file *m, struct Scsi_Host *host)
4193 {
4194         int f, l;
4195         char b[32];
4196
4197         if (scsi_debug_every_nth > 0)
4198                 snprintf(b, sizeof(b), " (curr:%d)",
4199                          ((SCSI_DEBUG_OPT_RARE_TSF & scsi_debug_opts) ?
4200                                 atomic_read(&sdebug_a_tsf) :
4201                                 atomic_read(&sdebug_cmnd_count)));
4202         else
4203                 b[0] = '\0';
4204
4205         seq_printf(m, "scsi_debug adapter driver, version %s [%s]\n"
4206                 "num_tgts=%d, shared (ram) size=%d MB, opts=0x%x, "
4207                 "every_nth=%d%s\n"
4208                 "delay=%d, ndelay=%d, max_luns=%d, q_completions=%d\n"
4209                 "sector_size=%d bytes, cylinders=%d, heads=%d, sectors=%d\n"
4210                 "command aborts=%d; RESETs: device=%d, target=%d, bus=%d, "
4211                 "host=%d\ndix_reads=%d dix_writes=%d dif_errors=%d "
4212                 "usec_in_jiffy=%lu\n",
4213                 SCSI_DEBUG_VERSION, scsi_debug_version_date,
4214                 scsi_debug_num_tgts, scsi_debug_dev_size_mb, scsi_debug_opts,
4215                 scsi_debug_every_nth, b, scsi_debug_delay, scsi_debug_ndelay,
4216                 scsi_debug_max_luns, atomic_read(&sdebug_completions),
4217                 scsi_debug_sector_size, sdebug_cylinders_per, sdebug_heads,
4218                 sdebug_sectors_per, num_aborts, num_dev_resets,
4219                 num_target_resets, num_bus_resets, num_host_resets,
4220                 dix_reads, dix_writes, dif_errors, TICK_NSEC / 1000);
4221
4222         f = find_first_bit(queued_in_use_bm, scsi_debug_max_queue);
4223         if (f != scsi_debug_max_queue) {
4224                 l = find_last_bit(queued_in_use_bm, scsi_debug_max_queue);
4225                 seq_printf(m, "   %s BUSY: first,last bits set: %d,%d\n",
4226                            "queued_in_use_bm", f, l);
4227         }
4228         return 0;
4229 }
4230
4231 static ssize_t delay_show(struct device_driver *ddp, char *buf)
4232 {
4233         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_delay);
4234 }
4235 /* Returns -EBUSY if delay is being changed and commands are queued */
4236 static ssize_t delay_store(struct device_driver *ddp, const char *buf,
4237                            size_t count)
4238 {
4239         int delay, res;
4240
4241         if ((count > 0) && (1 == sscanf(buf, "%d", &delay))) {
4242                 res = count;
4243                 if (scsi_debug_delay != delay) {
4244                         unsigned long iflags;
4245                         int k;
4246
4247                         spin_lock_irqsave(&queued_arr_lock, iflags);
4248                         k = find_first_bit(queued_in_use_bm,
4249                                            scsi_debug_max_queue);
4250                         if (k != scsi_debug_max_queue)
4251                                 res = -EBUSY;   /* have queued commands */
4252                         else {
4253                                 scsi_debug_delay = delay;
4254                                 scsi_debug_ndelay = 0;
4255                         }
4256                         spin_unlock_irqrestore(&queued_arr_lock, iflags);
4257                 }
4258                 return res;
4259         }
4260         return -EINVAL;
4261 }
4262 static DRIVER_ATTR_RW(delay);
4263
4264 static ssize_t ndelay_show(struct device_driver *ddp, char *buf)
4265 {
4266         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_ndelay);
4267 }
4268 /* Returns -EBUSY if ndelay is being changed and commands are queued */
4269 /* If > 0 and accepted then scsi_debug_delay is set to DELAY_OVERRIDDEN */
4270 static ssize_t ndelay_store(struct device_driver *ddp, const char *buf,
4271                            size_t count)
4272 {
4273         unsigned long iflags;
4274         int ndelay, res, k;
4275
4276         if ((count > 0) && (1 == sscanf(buf, "%d", &ndelay)) &&
4277             (ndelay >= 0) && (ndelay < 1000000000)) {
4278                 res = count;
4279                 if (scsi_debug_ndelay != ndelay) {
4280                         spin_lock_irqsave(&queued_arr_lock, iflags);
4281                         k = find_first_bit(queued_in_use_bm,
4282                                            scsi_debug_max_queue);
4283                         if (k != scsi_debug_max_queue)
4284                                 res = -EBUSY;   /* have queued commands */
4285                         else {
4286                                 scsi_debug_ndelay = ndelay;
4287                                 scsi_debug_delay = ndelay ? DELAY_OVERRIDDEN
4288                                                           : DEF_DELAY;
4289                         }
4290                         spin_unlock_irqrestore(&queued_arr_lock, iflags);
4291                 }
4292                 return res;
4293         }
4294         return -EINVAL;
4295 }
4296 static DRIVER_ATTR_RW(ndelay);
4297
4298 static ssize_t opts_show(struct device_driver *ddp, char *buf)
4299 {
4300         return scnprintf(buf, PAGE_SIZE, "0x%x\n", scsi_debug_opts);
4301 }
4302
4303 static ssize_t opts_store(struct device_driver *ddp, const char *buf,
4304                           size_t count)
4305 {
4306         int opts;
4307         char work[20];
4308
4309         if (1 == sscanf(buf, "%10s", work)) {
4310                 if (0 == strncasecmp(work,"0x", 2)) {
4311                         if (1 == sscanf(&work[2], "%x", &opts))
4312                                 goto opts_done;
4313                 } else {
4314                         if (1 == sscanf(work, "%d", &opts))
4315                                 goto opts_done;
4316                 }
4317         }
4318         return -EINVAL;
4319 opts_done:
4320         scsi_debug_opts = opts;
4321         if (SCSI_DEBUG_OPT_RECOVERED_ERR & opts)
4322                 sdebug_any_injecting_opt = true;
4323         else if (SCSI_DEBUG_OPT_TRANSPORT_ERR & opts)
4324                 sdebug_any_injecting_opt = true;
4325         else if (SCSI_DEBUG_OPT_DIF_ERR & opts)
4326                 sdebug_any_injecting_opt = true;
4327         else if (SCSI_DEBUG_OPT_DIX_ERR & opts)
4328                 sdebug_any_injecting_opt = true;
4329         else if (SCSI_DEBUG_OPT_SHORT_TRANSFER & opts)
4330                 sdebug_any_injecting_opt = true;
4331         atomic_set(&sdebug_cmnd_count, 0);
4332         atomic_set(&sdebug_a_tsf, 0);
4333         return count;
4334 }
4335 static DRIVER_ATTR_RW(opts);
4336
4337 static ssize_t ptype_show(struct device_driver *ddp, char *buf)
4338 {
4339         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_ptype);
4340 }
4341 static ssize_t ptype_store(struct device_driver *ddp, const char *buf,
4342                            size_t count)
4343 {
4344         int n;
4345
4346         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4347                 scsi_debug_ptype = n;
4348                 return count;
4349         }
4350         return -EINVAL;
4351 }
4352 static DRIVER_ATTR_RW(ptype);
4353
4354 static ssize_t dsense_show(struct device_driver *ddp, char *buf)
4355 {
4356         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_dsense);
4357 }
4358 static ssize_t dsense_store(struct device_driver *ddp, const char *buf,
4359                             size_t count)
4360 {
4361         int n;
4362
4363         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4364                 scsi_debug_dsense = n;
4365                 return count;
4366         }
4367         return -EINVAL;
4368 }
4369 static DRIVER_ATTR_RW(dsense);
4370
4371 static ssize_t fake_rw_show(struct device_driver *ddp, char *buf)
4372 {
4373         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_fake_rw);
4374 }
4375 static ssize_t fake_rw_store(struct device_driver *ddp, const char *buf,
4376                              size_t count)
4377 {
4378         int n;
4379
4380         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4381                 n = (n > 0);
4382                 scsi_debug_fake_rw = (scsi_debug_fake_rw > 0);
4383                 if (scsi_debug_fake_rw != n) {
4384                         if ((0 == n) && (NULL == fake_storep)) {
4385                                 unsigned long sz =
4386                                         (unsigned long)scsi_debug_dev_size_mb *
4387                                         1048576;
4388
4389                                 fake_storep = vmalloc(sz);
4390                                 if (NULL == fake_storep) {
4391                                         pr_err("out of memory, 9\n");
4392                                         return -ENOMEM;
4393                                 }
4394                                 memset(fake_storep, 0, sz);
4395                         }
4396                         scsi_debug_fake_rw = n;
4397                 }
4398                 return count;
4399         }
4400         return -EINVAL;
4401 }
4402 static DRIVER_ATTR_RW(fake_rw);
4403
4404 static ssize_t no_lun_0_show(struct device_driver *ddp, char *buf)
4405 {
4406         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_no_lun_0);
4407 }
4408 static ssize_t no_lun_0_store(struct device_driver *ddp, const char *buf,
4409                               size_t count)
4410 {
4411         int n;
4412
4413         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4414                 scsi_debug_no_lun_0 = n;
4415                 return count;
4416         }
4417         return -EINVAL;
4418 }
4419 static DRIVER_ATTR_RW(no_lun_0);
4420
4421 static ssize_t num_tgts_show(struct device_driver *ddp, char *buf)
4422 {
4423         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_num_tgts);
4424 }
4425 static ssize_t num_tgts_store(struct device_driver *ddp, const char *buf,
4426                               size_t count)
4427 {
4428         int n;
4429
4430         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4431                 scsi_debug_num_tgts = n;
4432                 sdebug_max_tgts_luns();
4433                 return count;
4434         }
4435         return -EINVAL;
4436 }
4437 static DRIVER_ATTR_RW(num_tgts);
4438
4439 static ssize_t dev_size_mb_show(struct device_driver *ddp, char *buf)
4440 {
4441         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_dev_size_mb);
4442 }
4443 static DRIVER_ATTR_RO(dev_size_mb);
4444
4445 static ssize_t num_parts_show(struct device_driver *ddp, char *buf)
4446 {
4447         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_num_parts);
4448 }
4449 static DRIVER_ATTR_RO(num_parts);
4450
4451 static ssize_t every_nth_show(struct device_driver *ddp, char *buf)
4452 {
4453         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_every_nth);
4454 }
4455 static ssize_t every_nth_store(struct device_driver *ddp, const char *buf,
4456                                size_t count)
4457 {
4458         int nth;
4459
4460         if ((count > 0) && (1 == sscanf(buf, "%d", &nth))) {
4461                 scsi_debug_every_nth = nth;
4462                 atomic_set(&sdebug_cmnd_count, 0);
4463                 return count;
4464         }
4465         return -EINVAL;
4466 }
4467 static DRIVER_ATTR_RW(every_nth);
4468
4469 static ssize_t max_luns_show(struct device_driver *ddp, char *buf)
4470 {
4471         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_max_luns);
4472 }
4473 static ssize_t max_luns_store(struct device_driver *ddp, const char *buf,
4474                               size_t count)
4475 {
4476         int n;
4477         bool changed;
4478
4479         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4480                 changed = (scsi_debug_max_luns != n);
4481                 scsi_debug_max_luns = n;
4482                 sdebug_max_tgts_luns();
4483                 if (changed && (scsi_debug_scsi_level >= 5)) {  /* >= SPC-3 */
4484                         struct sdebug_host_info *sdhp;
4485                         struct sdebug_dev_info *dp;
4486
4487                         spin_lock(&sdebug_host_list_lock);
4488                         list_for_each_entry(sdhp, &sdebug_host_list,
4489                                             host_list) {
4490                                 list_for_each_entry(dp, &sdhp->dev_info_list,
4491                                                     dev_list) {
4492                                         set_bit(SDEBUG_UA_LUNS_CHANGED,
4493                                                 dp->uas_bm);
4494                                 }
4495                         }
4496                         spin_unlock(&sdebug_host_list_lock);
4497                 }
4498                 return count;
4499         }
4500         return -EINVAL;
4501 }
4502 static DRIVER_ATTR_RW(max_luns);
4503
4504 static ssize_t max_queue_show(struct device_driver *ddp, char *buf)
4505 {
4506         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_max_queue);
4507 }
4508 /* N.B. max_queue can be changed while there are queued commands. In flight
4509  * commands beyond the new max_queue will be completed. */
4510 static ssize_t max_queue_store(struct device_driver *ddp, const char *buf,
4511                                size_t count)
4512 {
4513         unsigned long iflags;
4514         int n, k;
4515
4516         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n > 0) &&
4517             (n <= SCSI_DEBUG_CANQUEUE)) {
4518                 spin_lock_irqsave(&queued_arr_lock, iflags);
4519                 k = find_last_bit(queued_in_use_bm, SCSI_DEBUG_CANQUEUE);
4520                 scsi_debug_max_queue = n;
4521                 if (SCSI_DEBUG_CANQUEUE == k)
4522                         atomic_set(&retired_max_queue, 0);
4523                 else if (k >= n)
4524                         atomic_set(&retired_max_queue, k + 1);
4525                 else
4526                         atomic_set(&retired_max_queue, 0);
4527                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
4528                 return count;
4529         }
4530         return -EINVAL;
4531 }
4532 static DRIVER_ATTR_RW(max_queue);
4533
4534 static ssize_t no_uld_show(struct device_driver *ddp, char *buf)
4535 {
4536         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_no_uld);
4537 }
4538 static DRIVER_ATTR_RO(no_uld);
4539
4540 static ssize_t scsi_level_show(struct device_driver *ddp, char *buf)
4541 {
4542         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_scsi_level);
4543 }
4544 static DRIVER_ATTR_RO(scsi_level);
4545
4546 static ssize_t virtual_gb_show(struct device_driver *ddp, char *buf)
4547 {
4548         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_virtual_gb);
4549 }
4550 static ssize_t virtual_gb_store(struct device_driver *ddp, const char *buf,
4551                                 size_t count)
4552 {
4553         int n;
4554         bool changed;
4555
4556         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4557                 changed = (scsi_debug_virtual_gb != n);
4558                 scsi_debug_virtual_gb = n;
4559                 sdebug_capacity = get_sdebug_capacity();
4560                 if (changed) {
4561                         struct sdebug_host_info *sdhp;
4562                         struct sdebug_dev_info *dp;
4563
4564                         spin_lock(&sdebug_host_list_lock);
4565                         list_for_each_entry(sdhp, &sdebug_host_list,
4566                                             host_list) {
4567                                 list_for_each_entry(dp, &sdhp->dev_info_list,
4568                                                     dev_list) {
4569                                         set_bit(SDEBUG_UA_CAPACITY_CHANGED,
4570                                                 dp->uas_bm);
4571                                 }
4572                         }
4573                         spin_unlock(&sdebug_host_list_lock);
4574                 }
4575                 return count;
4576         }
4577         return -EINVAL;
4578 }
4579 static DRIVER_ATTR_RW(virtual_gb);
4580
4581 static ssize_t add_host_show(struct device_driver *ddp, char *buf)
4582 {
4583         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_add_host);
4584 }
4585
4586 static ssize_t add_host_store(struct device_driver *ddp, const char *buf,
4587                               size_t count)
4588 {
4589         int delta_hosts;
4590
4591         if (sscanf(buf, "%d", &delta_hosts) != 1)
4592                 return -EINVAL;
4593         if (delta_hosts > 0) {
4594                 do {
4595                         sdebug_add_adapter();
4596                 } while (--delta_hosts);
4597         } else if (delta_hosts < 0) {
4598                 do {
4599                         sdebug_remove_adapter();
4600                 } while (++delta_hosts);
4601         }
4602         return count;
4603 }
4604 static DRIVER_ATTR_RW(add_host);
4605
4606 static ssize_t vpd_use_hostno_show(struct device_driver *ddp, char *buf)
4607 {
4608         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_vpd_use_hostno);
4609 }
4610 static ssize_t vpd_use_hostno_store(struct device_driver *ddp, const char *buf,
4611                                     size_t count)
4612 {
4613         int n;
4614
4615         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4616                 scsi_debug_vpd_use_hostno = n;
4617                 return count;
4618         }
4619         return -EINVAL;
4620 }
4621 static DRIVER_ATTR_RW(vpd_use_hostno);
4622
4623 static ssize_t sector_size_show(struct device_driver *ddp, char *buf)
4624 {
4625         return scnprintf(buf, PAGE_SIZE, "%u\n", scsi_debug_sector_size);
4626 }
4627 static DRIVER_ATTR_RO(sector_size);
4628
4629 static ssize_t dix_show(struct device_driver *ddp, char *buf)
4630 {
4631         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_dix);
4632 }
4633 static DRIVER_ATTR_RO(dix);
4634
4635 static ssize_t dif_show(struct device_driver *ddp, char *buf)
4636 {
4637         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_dif);
4638 }
4639 static DRIVER_ATTR_RO(dif);
4640
4641 static ssize_t guard_show(struct device_driver *ddp, char *buf)
4642 {
4643         return scnprintf(buf, PAGE_SIZE, "%u\n", scsi_debug_guard);
4644 }
4645 static DRIVER_ATTR_RO(guard);
4646
4647 static ssize_t ato_show(struct device_driver *ddp, char *buf)
4648 {
4649         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_ato);
4650 }
4651 static DRIVER_ATTR_RO(ato);
4652
4653 static ssize_t map_show(struct device_driver *ddp, char *buf)
4654 {
4655         ssize_t count;
4656
4657         if (!scsi_debug_lbp())
4658                 return scnprintf(buf, PAGE_SIZE, "0-%u\n",
4659                                  sdebug_store_sectors);
4660
4661         count = scnprintf(buf, PAGE_SIZE - 1, "%*pbl",
4662                           (int)map_size, map_storep);
4663         buf[count++] = '\n';
4664         buf[count] = '\0';
4665
4666         return count;
4667 }
4668 static DRIVER_ATTR_RO(map);
4669
4670 static ssize_t removable_show(struct device_driver *ddp, char *buf)
4671 {
4672         return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_removable ? 1 : 0);
4673 }
4674 static ssize_t removable_store(struct device_driver *ddp, const char *buf,
4675                                size_t count)
4676 {
4677         int n;
4678
4679         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4680                 scsi_debug_removable = (n > 0);
4681                 return count;
4682         }
4683         return -EINVAL;
4684 }
4685 static DRIVER_ATTR_RW(removable);
4686
4687 static ssize_t host_lock_show(struct device_driver *ddp, char *buf)
4688 {
4689         return scnprintf(buf, PAGE_SIZE, "%d\n", !!scsi_debug_host_lock);
4690 }
4691 /* Returns -EBUSY if host_lock is being changed and commands are queued */
4692 static ssize_t host_lock_store(struct device_driver *ddp, const char *buf,
4693                                size_t count)
4694 {
4695         int n, res;
4696
4697         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4698                 bool new_host_lock = (n > 0);
4699
4700                 res = count;
4701                 if (new_host_lock != scsi_debug_host_lock) {
4702                         unsigned long iflags;
4703                         int k;
4704
4705                         spin_lock_irqsave(&queued_arr_lock, iflags);
4706                         k = find_first_bit(queued_in_use_bm,
4707                                            scsi_debug_max_queue);
4708                         if (k != scsi_debug_max_queue)
4709                                 res = -EBUSY;   /* have queued commands */
4710                         else
4711                                 scsi_debug_host_lock = new_host_lock;
4712                         spin_unlock_irqrestore(&queued_arr_lock, iflags);
4713                 }
4714                 return res;
4715         }
4716         return -EINVAL;
4717 }
4718 static DRIVER_ATTR_RW(host_lock);
4719
4720 static ssize_t strict_show(struct device_driver *ddp, char *buf)
4721 {
4722         return scnprintf(buf, PAGE_SIZE, "%d\n", !!scsi_debug_strict);
4723 }
4724 static ssize_t strict_store(struct device_driver *ddp, const char *buf,
4725                             size_t count)
4726 {
4727         int n;
4728
4729         if ((count > 0) && (1 == sscanf(buf, "%d", &n)) && (n >= 0)) {
4730                 scsi_debug_strict = (n > 0);
4731                 return count;
4732         }
4733         return -EINVAL;
4734 }
4735 static DRIVER_ATTR_RW(strict);
4736
4737
4738 /* Note: The following array creates attribute files in the
4739    /sys/bus/pseudo/drivers/scsi_debug directory. The advantage of these
4740    files (over those found in the /sys/module/scsi_debug/parameters
4741    directory) is that auxiliary actions can be triggered when an attribute
4742    is changed. For example see: sdebug_add_host_store() above.
4743  */
4744
4745 static struct attribute *sdebug_drv_attrs[] = {
4746         &driver_attr_delay.attr,
4747         &driver_attr_opts.attr,
4748         &driver_attr_ptype.attr,
4749         &driver_attr_dsense.attr,
4750         &driver_attr_fake_rw.attr,
4751         &driver_attr_no_lun_0.attr,
4752         &driver_attr_num_tgts.attr,
4753         &driver_attr_dev_size_mb.attr,
4754         &driver_attr_num_parts.attr,
4755         &driver_attr_every_nth.attr,
4756         &driver_attr_max_luns.attr,
4757         &driver_attr_max_queue.attr,
4758         &driver_attr_no_uld.attr,
4759         &driver_attr_scsi_level.attr,
4760         &driver_attr_virtual_gb.attr,
4761         &driver_attr_add_host.attr,
4762         &driver_attr_vpd_use_hostno.attr,
4763         &driver_attr_sector_size.attr,
4764         &driver_attr_dix.attr,
4765         &driver_attr_dif.attr,
4766         &driver_attr_guard.attr,
4767         &driver_attr_ato.attr,
4768         &driver_attr_map.attr,
4769         &driver_attr_removable.attr,
4770         &driver_attr_host_lock.attr,
4771         &driver_attr_ndelay.attr,
4772         &driver_attr_strict.attr,
4773         NULL,
4774 };
4775 ATTRIBUTE_GROUPS(sdebug_drv);
4776
4777 static struct device *pseudo_primary;
4778
4779 static int __init scsi_debug_init(void)
4780 {
4781         unsigned long sz;
4782         int host_to_add;
4783         int k;
4784         int ret;
4785
4786         atomic_set(&sdebug_cmnd_count, 0);
4787         atomic_set(&sdebug_completions, 0);
4788         atomic_set(&retired_max_queue, 0);
4789
4790         if (scsi_debug_ndelay >= 1000000000) {
4791                 pr_warn("ndelay must be less than 1 second, ignored\n");
4792                 scsi_debug_ndelay = 0;
4793         } else if (scsi_debug_ndelay > 0)
4794                 scsi_debug_delay = DELAY_OVERRIDDEN;
4795
4796         switch (scsi_debug_sector_size) {
4797         case  512:
4798         case 1024:
4799         case 2048:
4800         case 4096:
4801                 break;
4802         default:
4803                 pr_err("invalid sector_size %d\n", scsi_debug_sector_size);
4804                 return -EINVAL;
4805         }
4806
4807         switch (scsi_debug_dif) {
4808
4809         case SD_DIF_TYPE0_PROTECTION:
4810         case SD_DIF_TYPE1_PROTECTION:
4811         case SD_DIF_TYPE2_PROTECTION:
4812         case SD_DIF_TYPE3_PROTECTION:
4813                 break;
4814
4815         default:
4816                 pr_err("dif must be 0, 1, 2 or 3\n");
4817                 return -EINVAL;
4818         }
4819
4820         if (scsi_debug_guard > 1) {
4821                 pr_err("guard must be 0 or 1\n");
4822                 return -EINVAL;
4823         }
4824
4825         if (scsi_debug_ato > 1) {
4826                 pr_err("ato must be 0 or 1\n");
4827                 return -EINVAL;
4828         }
4829
4830         if (scsi_debug_physblk_exp > 15) {
4831                 pr_err("invalid physblk_exp %u\n", scsi_debug_physblk_exp);
4832                 return -EINVAL;
4833         }
4834
4835         if (scsi_debug_lowest_aligned > 0x3fff) {
4836                 pr_err("lowest_aligned too big: %u\n",
4837                         scsi_debug_lowest_aligned);
4838                 return -EINVAL;
4839         }
4840
4841         if (scsi_debug_dev_size_mb < 1)
4842                 scsi_debug_dev_size_mb = 1;  /* force minimum 1 MB ramdisk */
4843         sz = (unsigned long)scsi_debug_dev_size_mb * 1048576;
4844         sdebug_store_sectors = sz / scsi_debug_sector_size;
4845         sdebug_capacity = get_sdebug_capacity();
4846
4847         /* play around with geometry, don't waste too much on track 0 */
4848         sdebug_heads = 8;
4849         sdebug_sectors_per = 32;
4850         if (scsi_debug_dev_size_mb >= 16)
4851                 sdebug_heads = 32;
4852         else if (scsi_debug_dev_size_mb >= 256)
4853                 sdebug_heads = 64;
4854         sdebug_cylinders_per = (unsigned long)sdebug_capacity /
4855                                (sdebug_sectors_per * sdebug_heads);
4856         if (sdebug_cylinders_per >= 1024) {
4857                 /* other LLDs do this; implies >= 1GB ram disk ... */
4858                 sdebug_heads = 255;
4859                 sdebug_sectors_per = 63;
4860                 sdebug_cylinders_per = (unsigned long)sdebug_capacity /
4861                                (sdebug_sectors_per * sdebug_heads);
4862         }
4863
4864         if (0 == scsi_debug_fake_rw) {
4865                 fake_storep = vmalloc(sz);
4866                 if (NULL == fake_storep) {
4867                         pr_err("out of memory, 1\n");
4868                         return -ENOMEM;
4869                 }
4870                 memset(fake_storep, 0, sz);
4871                 if (scsi_debug_num_parts > 0)
4872                         sdebug_build_parts(fake_storep, sz);
4873         }
4874
4875         if (scsi_debug_dix) {
4876                 int dif_size;
4877
4878                 dif_size = sdebug_store_sectors * sizeof(struct sd_dif_tuple);
4879                 dif_storep = vmalloc(dif_size);
4880
4881                 pr_err("dif_storep %u bytes @ %p\n", dif_size, dif_storep);
4882
4883                 if (dif_storep == NULL) {
4884                         pr_err("out of mem. (DIX)\n");
4885                         ret = -ENOMEM;
4886                         goto free_vm;
4887                 }
4888
4889                 memset(dif_storep, 0xff, dif_size);
4890         }
4891
4892         /* Logical Block Provisioning */
4893         if (scsi_debug_lbp()) {
4894                 scsi_debug_unmap_max_blocks =
4895                         clamp(scsi_debug_unmap_max_blocks, 0U, 0xffffffffU);
4896
4897                 scsi_debug_unmap_max_desc =
4898                         clamp(scsi_debug_unmap_max_desc, 0U, 256U);
4899
4900                 scsi_debug_unmap_granularity =
4901                         clamp(scsi_debug_unmap_granularity, 1U, 0xffffffffU);
4902
4903                 if (scsi_debug_unmap_alignment &&
4904                     scsi_debug_unmap_granularity <=
4905                     scsi_debug_unmap_alignment) {
4906                         pr_err("ERR: unmap_granularity <= unmap_alignment\n");
4907                         return -EINVAL;
4908                 }
4909
4910                 map_size = lba_to_map_index(sdebug_store_sectors - 1) + 1;
4911                 map_storep = vmalloc(BITS_TO_LONGS(map_size) * sizeof(long));
4912
4913                 pr_info("%lu provisioning blocks\n", map_size);
4914
4915                 if (map_storep == NULL) {
4916                         pr_err("out of mem. (MAP)\n");
4917                         ret = -ENOMEM;
4918                         goto free_vm;
4919                 }
4920
4921                 bitmap_zero(map_storep, map_size);
4922
4923                 /* Map first 1KB for partition table */
4924                 if (scsi_debug_num_parts)
4925                         map_region(0, 2);
4926         }
4927
4928         pseudo_primary = root_device_register("pseudo_0");
4929         if (IS_ERR(pseudo_primary)) {
4930                 pr_warn("root_device_register() error\n");
4931                 ret = PTR_ERR(pseudo_primary);
4932                 goto free_vm;
4933         }
4934         ret = bus_register(&pseudo_lld_bus);
4935         if (ret < 0) {
4936                 pr_warn("bus_register error: %d\n", ret);
4937                 goto dev_unreg;
4938         }
4939         ret = driver_register(&sdebug_driverfs_driver);
4940         if (ret < 0) {
4941                 pr_warn("driver_register error: %d\n", ret);
4942                 goto bus_unreg;
4943         }
4944
4945         host_to_add = scsi_debug_add_host;
4946         scsi_debug_add_host = 0;
4947
4948         for (k = 0; k < host_to_add; k++) {
4949                 if (sdebug_add_adapter()) {
4950                         pr_err("sdebug_add_adapter failed k=%d\n", k);
4951                         break;
4952                 }
4953         }
4954
4955         if (SCSI_DEBUG_OPT_NOISE & scsi_debug_opts)
4956                 pr_info("built %d host(s)\n", scsi_debug_add_host);
4957
4958         return 0;
4959
4960 bus_unreg:
4961         bus_unregister(&pseudo_lld_bus);
4962 dev_unreg:
4963         root_device_unregister(pseudo_primary);
4964 free_vm:
4965         vfree(map_storep);
4966         vfree(dif_storep);
4967         vfree(fake_storep);
4968
4969         return ret;
4970 }
4971
4972 static void __exit scsi_debug_exit(void)
4973 {
4974         int k = scsi_debug_add_host;
4975
4976         stop_all_queued();
4977         free_all_queued();
4978         for (; k; k--)
4979                 sdebug_remove_adapter();
4980         driver_unregister(&sdebug_driverfs_driver);
4981         bus_unregister(&pseudo_lld_bus);
4982         root_device_unregister(pseudo_primary);
4983
4984         vfree(map_storep);
4985         vfree(dif_storep);
4986         vfree(fake_storep);
4987 }
4988
4989 device_initcall(scsi_debug_init);
4990 module_exit(scsi_debug_exit);
4991
4992 static void sdebug_release_adapter(struct device * dev)
4993 {
4994         struct sdebug_host_info *sdbg_host;
4995
4996         sdbg_host = to_sdebug_host(dev);
4997         kfree(sdbg_host);
4998 }
4999
5000 static int sdebug_add_adapter(void)
5001 {
5002         int k, devs_per_host;
5003         int error = 0;
5004         struct sdebug_host_info *sdbg_host;
5005         struct sdebug_dev_info *sdbg_devinfo, *tmp;
5006
5007         sdbg_host = kzalloc(sizeof(*sdbg_host),GFP_KERNEL);
5008         if (NULL == sdbg_host) {
5009                 pr_err("out of memory at line %d\n", __LINE__);
5010                 return -ENOMEM;
5011         }
5012
5013         INIT_LIST_HEAD(&sdbg_host->dev_info_list);
5014
5015         devs_per_host = scsi_debug_num_tgts * scsi_debug_max_luns;
5016         for (k = 0; k < devs_per_host; k++) {
5017                 sdbg_devinfo = sdebug_device_create(sdbg_host, GFP_KERNEL);
5018                 if (!sdbg_devinfo) {
5019                         pr_err("out of memory at line %d\n", __LINE__);
5020                         error = -ENOMEM;
5021                         goto clean;
5022                 }
5023         }
5024
5025         spin_lock(&sdebug_host_list_lock);
5026         list_add_tail(&sdbg_host->host_list, &sdebug_host_list);
5027         spin_unlock(&sdebug_host_list_lock);
5028
5029         sdbg_host->dev.bus = &pseudo_lld_bus;
5030         sdbg_host->dev.parent = pseudo_primary;
5031         sdbg_host->dev.release = &sdebug_release_adapter;
5032         dev_set_name(&sdbg_host->dev, "adapter%d", scsi_debug_add_host);
5033
5034         error = device_register(&sdbg_host->dev);
5035
5036         if (error)
5037                 goto clean;
5038
5039         ++scsi_debug_add_host;
5040         return error;
5041
5042 clean:
5043         list_for_each_entry_safe(sdbg_devinfo, tmp, &sdbg_host->dev_info_list,
5044                                  dev_list) {
5045                 list_del(&sdbg_devinfo->dev_list);
5046                 kfree(sdbg_devinfo);
5047         }
5048
5049         kfree(sdbg_host);
5050         return error;
5051 }
5052
5053 static void sdebug_remove_adapter(void)
5054 {
5055         struct sdebug_host_info * sdbg_host = NULL;
5056
5057         spin_lock(&sdebug_host_list_lock);
5058         if (!list_empty(&sdebug_host_list)) {
5059                 sdbg_host = list_entry(sdebug_host_list.prev,
5060                                        struct sdebug_host_info, host_list);
5061                 list_del(&sdbg_host->host_list);
5062         }
5063         spin_unlock(&sdebug_host_list_lock);
5064
5065         if (!sdbg_host)
5066                 return;
5067
5068         device_unregister(&sdbg_host->dev);
5069         --scsi_debug_add_host;
5070 }
5071
5072 static int
5073 sdebug_change_qdepth(struct scsi_device *sdev, int qdepth)
5074 {
5075         int num_in_q = 0;
5076         unsigned long iflags;
5077         struct sdebug_dev_info *devip;
5078
5079         spin_lock_irqsave(&queued_arr_lock, iflags);
5080         devip = (struct sdebug_dev_info *)sdev->hostdata;
5081         if (NULL == devip) {
5082                 spin_unlock_irqrestore(&queued_arr_lock, iflags);
5083                 return  -ENODEV;
5084         }
5085         num_in_q = atomic_read(&devip->num_in_q);
5086         spin_unlock_irqrestore(&queued_arr_lock, iflags);
5087
5088         if (qdepth < 1)
5089                 qdepth = 1;
5090         /* allow to exceed max host queued_arr elements for testing */
5091         if (qdepth > SCSI_DEBUG_CANQUEUE + 10)
5092                 qdepth = SCSI_DEBUG_CANQUEUE + 10;
5093         scsi_change_queue_depth(sdev, qdepth);
5094
5095         if (SCSI_DEBUG_OPT_Q_NOISE & scsi_debug_opts) {
5096                 sdev_printk(KERN_INFO, sdev,
5097                             "%s: qdepth=%d, num_in_q=%d\n",
5098                             __func__, qdepth, num_in_q);
5099         }
5100         return sdev->queue_depth;
5101 }
5102
5103 static int
5104 check_inject(struct scsi_cmnd *scp)
5105 {
5106         struct sdebug_scmd_extra_t *ep = scsi_cmd_priv(scp);
5107
5108         memset(ep, 0, sizeof(struct sdebug_scmd_extra_t));
5109
5110         if (atomic_inc_return(&sdebug_cmnd_count) >=
5111             abs(scsi_debug_every_nth)) {
5112                 atomic_set(&sdebug_cmnd_count, 0);
5113                 if (scsi_debug_every_nth < -1)
5114                         scsi_debug_every_nth = -1;
5115                 if (SCSI_DEBUG_OPT_TIMEOUT & scsi_debug_opts)
5116                         return 1; /* ignore command causing timeout */
5117                 else if (SCSI_DEBUG_OPT_MAC_TIMEOUT & scsi_debug_opts &&
5118                          scsi_medium_access_command(scp))
5119                         return 1; /* time out reads and writes */
5120                 if (sdebug_any_injecting_opt) {
5121                         int opts = scsi_debug_opts;
5122
5123                         if (SCSI_DEBUG_OPT_RECOVERED_ERR & opts)
5124                                 ep->inj_recovered = true;
5125                         else if (SCSI_DEBUG_OPT_TRANSPORT_ERR & opts)
5126                                 ep->inj_transport = true;
5127                         else if (SCSI_DEBUG_OPT_DIF_ERR & opts)
5128                                 ep->inj_dif = true;
5129                         else if (SCSI_DEBUG_OPT_DIX_ERR & opts)
5130                                 ep->inj_dix = true;
5131                         else if (SCSI_DEBUG_OPT_SHORT_TRANSFER & opts)
5132                                 ep->inj_short = true;
5133                 }
5134         }
5135         return 0;
5136 }
5137
5138 static int
5139 scsi_debug_queuecommand(struct scsi_cmnd *scp)
5140 {
5141         u8 sdeb_i;
5142         struct scsi_device *sdp = scp->device;
5143         const struct opcode_info_t *oip;
5144         const struct opcode_info_t *r_oip;
5145         struct sdebug_dev_info *devip;
5146         u8 *cmd = scp->cmnd;
5147         int (*r_pfp)(struct scsi_cmnd *, struct sdebug_dev_info *);
5148         int k, na;
5149         int errsts = 0;
5150         int errsts_no_connect = DID_NO_CONNECT << 16;
5151         u32 flags;
5152         u16 sa;
5153         u8 opcode = cmd[0];
5154         bool has_wlun_rl;
5155         bool debug = !!(SCSI_DEBUG_OPT_NOISE & scsi_debug_opts);
5156
5157         scsi_set_resid(scp, 0);
5158         if (debug && !(SCSI_DEBUG_OPT_NO_CDB_NOISE & scsi_debug_opts)) {
5159                 char b[120];
5160                 int n, len, sb;
5161
5162                 len = scp->cmd_len;
5163                 sb = (int)sizeof(b);
5164                 if (len > 32)
5165                         strcpy(b, "too long, over 32 bytes");
5166                 else {
5167                         for (k = 0, n = 0; k < len && n < sb; ++k)
5168                                 n += scnprintf(b + n, sb - n, "%02x ",
5169                                                (u32)cmd[k]);
5170                 }
5171                 sdev_printk(KERN_INFO, sdp, "%s: cmd %s\n", my_name, b);
5172         }
5173         has_wlun_rl = (sdp->lun == SCSI_W_LUN_REPORT_LUNS);
5174         if ((sdp->lun >= scsi_debug_max_luns) && !has_wlun_rl)
5175                 return schedule_resp(scp, NULL, errsts_no_connect, 0);
5176
5177         sdeb_i = opcode_ind_arr[opcode];        /* fully mapped */
5178         oip = &opcode_info_arr[sdeb_i];         /* safe if table consistent */
5179         devip = (struct sdebug_dev_info *)sdp->hostdata;
5180         if (!devip) {
5181                 devip = devInfoReg(sdp);
5182                 if (NULL == devip)
5183                         return schedule_resp(scp, NULL, errsts_no_connect, 0);
5184         }
5185         na = oip->num_attached;
5186         r_pfp = oip->pfp;
5187         if (na) {       /* multiple commands with this opcode */
5188                 r_oip = oip;
5189                 if (FF_SA & r_oip->flags) {
5190                         if (F_SA_LOW & oip->flags)
5191                                 sa = 0x1f & cmd[1];
5192                         else
5193                                 sa = get_unaligned_be16(cmd + 8);
5194                         for (k = 0; k <= na; oip = r_oip->arrp + k++) {
5195                                 if (opcode == oip->opcode && sa == oip->sa)
5196                                         break;
5197                         }
5198                 } else {   /* since no service action only check opcode */
5199                         for (k = 0; k <= na; oip = r_oip->arrp + k++) {
5200                                 if (opcode == oip->opcode)
5201                                         break;
5202                         }
5203                 }
5204                 if (k > na) {
5205                         if (F_SA_LOW & r_oip->flags)
5206                                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 1, 4);
5207                         else if (F_SA_HIGH & r_oip->flags)
5208                                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, 8, 7);
5209                         else
5210                                 mk_sense_invalid_opcode(scp);
5211                         goto check_cond;
5212                 }
5213         }       /* else (when na==0) we assume the oip is a match */
5214         flags = oip->flags;
5215         if (F_INV_OP & flags) {
5216                 mk_sense_invalid_opcode(scp);
5217                 goto check_cond;
5218         }
5219         if (has_wlun_rl && !(F_RL_WLUN_OK & flags)) {
5220                 if (debug)
5221                         sdev_printk(KERN_INFO, sdp, "scsi_debug: Opcode: "
5222                                     "0x%x not supported for wlun\n", opcode);
5223                 mk_sense_invalid_opcode(scp);
5224                 goto check_cond;
5225         }
5226         if (scsi_debug_strict) {        /* check cdb against mask */
5227                 u8 rem;
5228                 int j;
5229
5230                 for (k = 1; k < oip->len_mask[0] && k < 16; ++k) {
5231                         rem = ~oip->len_mask[k] & cmd[k];
5232                         if (rem) {
5233                                 for (j = 7; j >= 0; --j, rem <<= 1) {
5234                                         if (0x80 & rem)
5235                                                 break;
5236                                 }
5237                                 mk_sense_invalid_fld(scp, SDEB_IN_CDB, k, j);
5238                                 goto check_cond;
5239                         }
5240                 }
5241         }
5242         if (!(F_SKIP_UA & flags) &&
5243             SDEBUG_NUM_UAS != find_first_bit(devip->uas_bm, SDEBUG_NUM_UAS)) {
5244                 errsts = check_readiness(scp, UAS_ONLY, devip);
5245                 if (errsts)
5246                         goto check_cond;
5247         }
5248         if ((F_M_ACCESS & flags) && devip->stopped) {
5249                 mk_sense_buffer(scp, NOT_READY, LOGICAL_UNIT_NOT_READY, 0x2);
5250                 if (debug)
5251                         sdev_printk(KERN_INFO, sdp, "%s reports: Not ready: "
5252                                     "%s\n", my_name, "initializing command "
5253                                     "required");
5254                 errsts = check_condition_result;
5255                 goto fini;
5256         }
5257         if (scsi_debug_fake_rw && (F_FAKE_RW & flags))
5258                 goto fini;
5259         if (scsi_debug_every_nth) {
5260                 if (check_inject(scp))
5261                         return 0;       /* ignore command: make trouble */
5262         }
5263         if (oip->pfp)   /* if this command has a resp_* function, call it */
5264                 errsts = oip->pfp(scp, devip);
5265         else if (r_pfp) /* if leaf function ptr NULL, try the root's */
5266                 errsts = r_pfp(scp, devip);
5267
5268 fini:
5269         return schedule_resp(scp, devip, errsts,
5270                              ((F_DELAY_OVERR & flags) ? 0 : scsi_debug_delay));
5271 check_cond:
5272         return schedule_resp(scp, devip, check_condition_result, 0);
5273 }
5274
5275 static int
5276 sdebug_queuecommand_lock_or_not(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
5277 {
5278         if (scsi_debug_host_lock) {
5279                 unsigned long iflags;
5280                 int rc;
5281
5282                 spin_lock_irqsave(shost->host_lock, iflags);
5283                 rc = scsi_debug_queuecommand(cmd);
5284                 spin_unlock_irqrestore(shost->host_lock, iflags);
5285                 return rc;
5286         } else
5287                 return scsi_debug_queuecommand(cmd);
5288 }
5289
5290 static struct scsi_host_template sdebug_driver_template = {
5291         .show_info =            scsi_debug_show_info,
5292         .write_info =           scsi_debug_write_info,
5293         .proc_name =            sdebug_proc_name,
5294         .name =                 "SCSI DEBUG",
5295         .info =                 scsi_debug_info,
5296         .slave_alloc =          scsi_debug_slave_alloc,
5297         .slave_configure =      scsi_debug_slave_configure,
5298         .slave_destroy =        scsi_debug_slave_destroy,
5299         .ioctl =                scsi_debug_ioctl,
5300         .queuecommand =         sdebug_queuecommand_lock_or_not,
5301         .change_queue_depth =   sdebug_change_qdepth,
5302         .eh_abort_handler =     scsi_debug_abort,
5303         .eh_device_reset_handler = scsi_debug_device_reset,
5304         .eh_target_reset_handler = scsi_debug_target_reset,
5305         .eh_bus_reset_handler = scsi_debug_bus_reset,
5306         .eh_host_reset_handler = scsi_debug_host_reset,
5307         .can_queue =            SCSI_DEBUG_CANQUEUE,
5308         .this_id =              7,
5309         .sg_tablesize =         SCSI_MAX_SG_CHAIN_SEGMENTS,
5310         .cmd_per_lun =          DEF_CMD_PER_LUN,
5311         .max_sectors =          -1U,
5312         .use_clustering =       DISABLE_CLUSTERING,
5313         .module =               THIS_MODULE,
5314         .track_queue_depth =    1,
5315         .cmd_size =             sizeof(struct sdebug_scmd_extra_t),
5316 };
5317
5318 static int sdebug_driver_probe(struct device * dev)
5319 {
5320         int error = 0;
5321         int opts;
5322         struct sdebug_host_info *sdbg_host;
5323         struct Scsi_Host *hpnt;
5324         int host_prot;
5325
5326         sdbg_host = to_sdebug_host(dev);
5327
5328         sdebug_driver_template.can_queue = scsi_debug_max_queue;
5329         if (scsi_debug_clustering)
5330                 sdebug_driver_template.use_clustering = ENABLE_CLUSTERING;
5331         hpnt = scsi_host_alloc(&sdebug_driver_template, sizeof(sdbg_host));
5332         if (NULL == hpnt) {
5333                 pr_err("scsi_host_alloc failed\n");
5334                 error = -ENODEV;
5335                 return error;
5336         }
5337
5338         sdbg_host->shost = hpnt;
5339         *((struct sdebug_host_info **)hpnt->hostdata) = sdbg_host;
5340         if ((hpnt->this_id >= 0) && (scsi_debug_num_tgts > hpnt->this_id))
5341                 hpnt->max_id = scsi_debug_num_tgts + 1;
5342         else
5343                 hpnt->max_id = scsi_debug_num_tgts;
5344         /* = scsi_debug_max_luns; */
5345         hpnt->max_lun = SCSI_W_LUN_REPORT_LUNS + 1;
5346
5347         host_prot = 0;
5348
5349         switch (scsi_debug_dif) {
5350
5351         case SD_DIF_TYPE1_PROTECTION:
5352                 host_prot = SHOST_DIF_TYPE1_PROTECTION;
5353                 if (scsi_debug_dix)
5354                         host_prot |= SHOST_DIX_TYPE1_PROTECTION;
5355                 break;
5356
5357         case SD_DIF_TYPE2_PROTECTION:
5358                 host_prot = SHOST_DIF_TYPE2_PROTECTION;
5359                 if (scsi_debug_dix)
5360                         host_prot |= SHOST_DIX_TYPE2_PROTECTION;
5361                 break;
5362
5363         case SD_DIF_TYPE3_PROTECTION:
5364                 host_prot = SHOST_DIF_TYPE3_PROTECTION;
5365                 if (scsi_debug_dix)
5366                         host_prot |= SHOST_DIX_TYPE3_PROTECTION;
5367                 break;
5368
5369         default:
5370                 if (scsi_debug_dix)
5371                         host_prot |= SHOST_DIX_TYPE0_PROTECTION;
5372                 break;
5373         }
5374
5375         scsi_host_set_prot(hpnt, host_prot);
5376
5377         pr_info("host protection%s%s%s%s%s%s%s\n",
5378                (host_prot & SHOST_DIF_TYPE1_PROTECTION) ? " DIF1" : "",
5379                (host_prot & SHOST_DIF_TYPE2_PROTECTION) ? " DIF2" : "",
5380                (host_prot & SHOST_DIF_TYPE3_PROTECTION) ? " DIF3" : "",
5381                (host_prot & SHOST_DIX_TYPE0_PROTECTION) ? " DIX0" : "",
5382                (host_prot & SHOST_DIX_TYPE1_PROTECTION) ? " DIX1" : "",
5383                (host_prot & SHOST_DIX_TYPE2_PROTECTION) ? " DIX2" : "",
5384                (host_prot & SHOST_DIX_TYPE3_PROTECTION) ? " DIX3" : "");
5385
5386         if (scsi_debug_guard == 1)
5387                 scsi_host_set_guard(hpnt, SHOST_DIX_GUARD_IP);
5388         else
5389                 scsi_host_set_guard(hpnt, SHOST_DIX_GUARD_CRC);
5390
5391         opts = scsi_debug_opts;
5392         if (SCSI_DEBUG_OPT_RECOVERED_ERR & opts)
5393                 sdebug_any_injecting_opt = true;
5394         else if (SCSI_DEBUG_OPT_TRANSPORT_ERR & opts)
5395                 sdebug_any_injecting_opt = true;
5396         else if (SCSI_DEBUG_OPT_DIF_ERR & opts)
5397                 sdebug_any_injecting_opt = true;
5398         else if (SCSI_DEBUG_OPT_DIX_ERR & opts)
5399                 sdebug_any_injecting_opt = true;
5400         else if (SCSI_DEBUG_OPT_SHORT_TRANSFER & opts)
5401                 sdebug_any_injecting_opt = true;
5402
5403         error = scsi_add_host(hpnt, &sdbg_host->dev);
5404         if (error) {
5405                 pr_err("scsi_add_host failed\n");
5406                 error = -ENODEV;
5407                 scsi_host_put(hpnt);
5408         } else
5409                 scsi_scan_host(hpnt);
5410
5411         return error;
5412 }
5413
5414 static int sdebug_driver_remove(struct device * dev)
5415 {
5416         struct sdebug_host_info *sdbg_host;
5417         struct sdebug_dev_info *sdbg_devinfo, *tmp;
5418
5419         sdbg_host = to_sdebug_host(dev);
5420
5421         if (!sdbg_host) {
5422                 pr_err("Unable to locate host info\n");
5423                 return -ENODEV;
5424         }
5425
5426         scsi_remove_host(sdbg_host->shost);
5427
5428         list_for_each_entry_safe(sdbg_devinfo, tmp, &sdbg_host->dev_info_list,
5429                                  dev_list) {
5430                 list_del(&sdbg_devinfo->dev_list);
5431                 kfree(sdbg_devinfo);
5432         }
5433
5434         scsi_host_put(sdbg_host->shost);
5435         return 0;
5436 }
5437
5438 static int pseudo_lld_bus_match(struct device *dev,
5439                                 struct device_driver *dev_driver)
5440 {
5441         return 1;
5442 }
5443
5444 static struct bus_type pseudo_lld_bus = {
5445         .name = "pseudo",
5446         .match = pseudo_lld_bus_match,
5447         .probe = sdebug_driver_probe,
5448         .remove = sdebug_driver_remove,
5449         .drv_groups = sdebug_drv_groups,
5450 };