drivers/nvme/host/scsi.c

   1 /*
   2  * NVM Express device driver
   3  * Copyright (c) 2011-2014, Intel Corporation.
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms and conditions of the GNU General Public License,
   7  * version 2, as published by the Free Software Foundation.
   8  *
   9  * This program is distributed in the hope it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  12  * more details.
  13  */
  14
  15 /*
  16  * Refer to the SCSI-NVMe Translation spec for details on how
  17  * each command is translated.
  18  */
  19
  20 #include <linux/bio.h>
  21 #include <linux/bitops.h>
  22 #include <linux/blkdev.h>
  23 #include <linux/compat.h>
  24 #include <linux/delay.h>
  25 #include <linux/errno.h>
  26 #include <linux/fs.h>
  27 #include <linux/genhd.h>
  28 #include <linux/idr.h>
  29 #include <linux/init.h>
  30 #include <linux/interrupt.h>
  31 #include <linux/io.h>
  32 #include <linux/kdev_t.h>
  33 #include <linux/kthread.h>
  34 #include <linux/kernel.h>
  35 #include <linux/mm.h>
  36 #include <linux/module.h>
  37 #include <linux/moduleparam.h>
  38 #include <linux/pci.h>
  39 #include <linux/poison.h>
  40 #include <linux/sched.h>
  41 #include <linux/slab.h>
  42 #include <linux/types.h>
  43 #include <asm/unaligned.h>
  44 #include <scsi/sg.h>
  45 #include <scsi/scsi.h>
  46
  47 #include "nvme.h"
  48
  49 static int sg_version_num = 30534;      /* 2 digits for each component */
  50
  51 /* VPD Page Codes */
  52 #define VPD_SUPPORTED_PAGES                             0x00
  53 #define VPD_SERIAL_NUMBER                               0x80
  54 #define VPD_DEVICE_IDENTIFIERS                          0x83
  55 #define VPD_EXTENDED_INQUIRY                            0x86
  56 #define VPD_BLOCK_LIMITS                                0xB0
  57 #define VPD_BLOCK_DEV_CHARACTERISTICS                   0xB1
  58
  59 /* format unit paramter list offsets */
  60 #define FORMAT_UNIT_SHORT_PARM_LIST_LEN                 4
  61 #define FORMAT_UNIT_LONG_PARM_LIST_LEN                  8
  62 #define FORMAT_UNIT_PROT_INT_OFFSET                     3
  63 #define FORMAT_UNIT_PROT_FIELD_USAGE_OFFSET             0
  64 #define FORMAT_UNIT_PROT_FIELD_USAGE_MASK               0x07
  65
  66 /* Misc. defines */
  67 #define FIXED_SENSE_DATA                                0x70
  68 #define DESC_FORMAT_SENSE_DATA                          0x72
  69 #define FIXED_SENSE_DATA_ADD_LENGTH                     10
  70 #define LUN_ENTRY_SIZE                                  8
  71 #define LUN_DATA_HEADER_SIZE                            8
  72 #define ALL_LUNS_RETURNED                               0x02
  73 #define ALL_WELL_KNOWN_LUNS_RETURNED                    0x01
  74 #define RESTRICTED_LUNS_RETURNED                        0x00
  75 #define DOWNLOAD_SAVE_ACTIVATE                          0x05
  76 #define DOWNLOAD_SAVE_DEFER_ACTIVATE                    0x0E
  77 #define ACTIVATE_DEFERRED_MICROCODE                     0x0F
  78 #define FORMAT_UNIT_IMMED_MASK                          0x2
  79 #define FORMAT_UNIT_IMMED_OFFSET                        1
  80 #define KELVIN_TEMP_FACTOR                              273
  81 #define FIXED_FMT_SENSE_DATA_SIZE                       18
  82 #define DESC_FMT_SENSE_DATA_SIZE                        8
  83
  84 /* SCSI/NVMe defines and bit masks */
  85 #define INQ_STANDARD_INQUIRY_PAGE                       0x00
  86 #define INQ_SUPPORTED_VPD_PAGES_PAGE                    0x00
  87 #define INQ_UNIT_SERIAL_NUMBER_PAGE                     0x80
  88 #define INQ_DEVICE_IDENTIFICATION_PAGE                  0x83
  89 #define INQ_EXTENDED_INQUIRY_DATA_PAGE                  0x86
  90 #define INQ_BDEV_LIMITS_PAGE                            0xB0
  91 #define INQ_BDEV_CHARACTERISTICS_PAGE                   0xB1
  92 #define INQ_SERIAL_NUMBER_LENGTH                        0x14
  93 #define INQ_NUM_SUPPORTED_VPD_PAGES                     6
  94 #define VERSION_SPC_4                                   0x06
  95 #define ACA_UNSUPPORTED                                 0
  96 #define STANDARD_INQUIRY_LENGTH                         36
  97 #define ADDITIONAL_STD_INQ_LENGTH                       31
  98 #define EXTENDED_INQUIRY_DATA_PAGE_LENGTH               0x3C
  99 #define RESERVED_FIELD                                  0
 100
 101 /* Mode Sense/Select defines */
 102 #define MODE_PAGE_INFO_EXCEP                            0x1C
 103 #define MODE_PAGE_CACHING                               0x08
 104 #define MODE_PAGE_CONTROL                               0x0A
 105 #define MODE_PAGE_POWER_CONDITION                       0x1A
 106 #define MODE_PAGE_RETURN_ALL                            0x3F
 107 #define MODE_PAGE_BLK_DES_LEN                           0x08
 108 #define MODE_PAGE_LLBAA_BLK_DES_LEN                     0x10
 109 #define MODE_PAGE_CACHING_LEN                           0x14
 110 #define MODE_PAGE_CONTROL_LEN                           0x0C
 111 #define MODE_PAGE_POW_CND_LEN                           0x28
 112 #define MODE_PAGE_INF_EXC_LEN                           0x0C
 113 #define MODE_PAGE_ALL_LEN                               0x54
 114 #define MODE_SENSE6_MPH_SIZE                            4
 115 #define MODE_SENSE_PAGE_CONTROL_MASK                    0xC0
 116 #define MODE_SENSE_PAGE_CODE_OFFSET                     2
 117 #define MODE_SENSE_PAGE_CODE_MASK                       0x3F
 118 #define MODE_SENSE_LLBAA_MASK                           0x10
 119 #define MODE_SENSE_LLBAA_SHIFT                          4
 120 #define MODE_SENSE_DBD_MASK                             8
 121 #define MODE_SENSE_DBD_SHIFT                            3
 122 #define MODE_SENSE10_MPH_SIZE                           8
 123 #define MODE_SELECT_CDB_PAGE_FORMAT_MASK                0x10
 124 #define MODE_SELECT_CDB_SAVE_PAGES_MASK                 0x1
 125 #define MODE_SELECT_6_BD_OFFSET                         3
 126 #define MODE_SELECT_10_BD_OFFSET                        6
 127 #define MODE_SELECT_10_LLBAA_OFFSET                     4
 128 #define MODE_SELECT_10_LLBAA_MASK                       1
 129 #define MODE_SELECT_6_MPH_SIZE                          4
 130 #define MODE_SELECT_10_MPH_SIZE                         8
 131 #define CACHING_MODE_PAGE_WCE_MASK                      0x04
 132 #define MODE_SENSE_BLK_DESC_ENABLED                     0
 133 #define MODE_SENSE_BLK_DESC_COUNT                       1
 134 #define MODE_SELECT_PAGE_CODE_MASK                      0x3F
 135 #define SHORT_DESC_BLOCK                                8
 136 #define LONG_DESC_BLOCK                                 16
 137 #define MODE_PAGE_POW_CND_LEN_FIELD                     0x26
 138 #define MODE_PAGE_INF_EXC_LEN_FIELD                     0x0A
 139 #define MODE_PAGE_CACHING_LEN_FIELD                     0x12
 140 #define MODE_PAGE_CONTROL_LEN_FIELD                     0x0A
 141 #define MODE_SENSE_PC_CURRENT_VALUES                    0
 142
 143 /* Log Sense defines */
 144 #define LOG_PAGE_SUPPORTED_LOG_PAGES_PAGE               0x00
 145 #define LOG_PAGE_SUPPORTED_LOG_PAGES_LENGTH             0x07
 146 #define LOG_PAGE_INFORMATIONAL_EXCEPTIONS_PAGE          0x2F
 147 #define LOG_PAGE_TEMPERATURE_PAGE                       0x0D
 148 #define LOG_SENSE_CDB_SP_NOT_ENABLED                    0
 149 #define LOG_SENSE_CDB_PC_MASK                           0xC0
 150 #define LOG_SENSE_CDB_PC_SHIFT                          6
 151 #define LOG_SENSE_CDB_PC_CUMULATIVE_VALUES              1
 152 #define LOG_SENSE_CDB_PAGE_CODE_MASK                    0x3F
 153 #define REMAINING_INFO_EXCP_PAGE_LENGTH                 0x8
 154 #define LOG_INFO_EXCP_PAGE_LENGTH                       0xC
 155 #define REMAINING_TEMP_PAGE_LENGTH                      0xC
 156 #define LOG_TEMP_PAGE_LENGTH                            0x10
 157 #define LOG_TEMP_UNKNOWN                                0xFF
 158 #define SUPPORTED_LOG_PAGES_PAGE_LENGTH                 0x3
 159
 160 /* Read Capacity defines */
 161 #define READ_CAP_10_RESP_SIZE                           8
 162 #define READ_CAP_16_RESP_SIZE                           32
 163
 164 /* NVMe Namespace and Command Defines */
 165 #define BYTES_TO_DWORDS                                 4
 166 #define NVME_MAX_FIRMWARE_SLOT                          7
 167
 168 /* Report LUNs defines */
 169 #define REPORT_LUNS_FIRST_LUN_OFFSET                    8
 170
 171 /* SCSI ADDITIONAL SENSE Codes */
 172
 173 #define SCSI_ASC_NO_SENSE                               0x00
 174 #define SCSI_ASC_PERIPHERAL_DEV_WRITE_FAULT             0x03
 175 #define SCSI_ASC_LUN_NOT_READY                          0x04
 176 #define SCSI_ASC_WARNING                                0x0B
 177 #define SCSI_ASC_LOG_BLOCK_GUARD_CHECK_FAILED           0x10
 178 #define SCSI_ASC_LOG_BLOCK_APPTAG_CHECK_FAILED          0x10
 179 #define SCSI_ASC_LOG_BLOCK_REFTAG_CHECK_FAILED          0x10
 180 #define SCSI_ASC_UNRECOVERED_READ_ERROR                 0x11
 181 #define SCSI_ASC_MISCOMPARE_DURING_VERIFY               0x1D
 182 #define SCSI_ASC_ACCESS_DENIED_INVALID_LUN_ID           0x20
 183 #define SCSI_ASC_ILLEGAL_COMMAND                        0x20
 184 #define SCSI_ASC_ILLEGAL_BLOCK                          0x21
 185 #define SCSI_ASC_INVALID_CDB                            0x24
 186 #define SCSI_ASC_INVALID_LUN                            0x25
 187 #define SCSI_ASC_INVALID_PARAMETER                      0x26
 188 #define SCSI_ASC_FORMAT_COMMAND_FAILED                  0x31
 189 #define SCSI_ASC_INTERNAL_TARGET_FAILURE                0x44
 190
 191 /* SCSI ADDITIONAL SENSE Code Qualifiers */
 192
 193 #define SCSI_ASCQ_CAUSE_NOT_REPORTABLE                  0x00
 194 #define SCSI_ASCQ_FORMAT_COMMAND_FAILED                 0x01
 195 #define SCSI_ASCQ_LOG_BLOCK_GUARD_CHECK_FAILED          0x01
 196 #define SCSI_ASCQ_LOG_BLOCK_APPTAG_CHECK_FAILED         0x02
 197 #define SCSI_ASCQ_LOG_BLOCK_REFTAG_CHECK_FAILED         0x03
 198 #define SCSI_ASCQ_FORMAT_IN_PROGRESS                    0x04
 199 #define SCSI_ASCQ_POWER_LOSS_EXPECTED                   0x08
 200 #define SCSI_ASCQ_INVALID_LUN_ID                        0x09
 201
 202 /* copied from drivers/usb/gadget/function/storage_common.h */
 203 static inline u32 get_unaligned_be24(u8 *buf)
 204 {
 205         return 0xffffff & (u32) get_unaligned_be32(buf - 1);
 206 }
 207
 208 /* Struct to gather data that needs to be extracted from a SCSI CDB.
 209    Not conforming to any particular CDB variant, but compatible with all. */
 210
 211 struct nvme_trans_io_cdb {
 212         u8 fua;
 213         u8 prot_info;
 214         u64 lba;
 215         u32 xfer_len;
 216 };
 217
 218
 219 /* Internal Helper Functions */
 220
 221
 222 /* Copy data to userspace memory */
 223
 224 static int nvme_trans_copy_to_user(struct sg_io_hdr *hdr, void *from,
 225                                                                 unsigned long n)
 226 {
 227         int i;
 228         void *index = from;
 229         size_t remaining = n;
 230         size_t xfer_len;
 231
 232         if (hdr->iovec_count > 0) {
 233                 struct sg_iovec sgl;
 234
 235                 for (i = 0; i < hdr->iovec_count; i++) {
 236                         if (copy_from_user(&sgl, hdr->dxferp +
 237                                                 i * sizeof(struct sg_iovec),
 238                                                 sizeof(struct sg_iovec)))
 239                                 return -EFAULT;
 240                         xfer_len = min(remaining, sgl.iov_len);
 241                         if (copy_to_user(sgl.iov_base, index, xfer_len))
 242                                 return -EFAULT;
 243
 244                         index += xfer_len;
 245                         remaining -= xfer_len;
 246                         if (remaining == 0)
 247                                 break;
 248                 }
 249                 return 0;
 250         }
 251
 252         if (copy_to_user(hdr->dxferp, from, n))
 253                 return -EFAULT;
 254         return 0;
 255 }
 256
 257 /* Copy data from userspace memory */
 258
 259 static int nvme_trans_copy_from_user(struct sg_io_hdr *hdr, void *to,
 260                                                                 unsigned long n)
 261 {
 262         int i;
 263         void *index = to;
 264         size_t remaining = n;
 265         size_t xfer_len;
 266
 267         if (hdr->iovec_count > 0) {
 268                 struct sg_iovec sgl;
 269
 270                 for (i = 0; i < hdr->iovec_count; i++) {
 271                         if (copy_from_user(&sgl, hdr->dxferp +
 272                                                 i * sizeof(struct sg_iovec),
 273                                                 sizeof(struct sg_iovec)))
 274                                 return -EFAULT;
 275                         xfer_len = min(remaining, sgl.iov_len);
 276                         if (copy_from_user(index, sgl.iov_base, xfer_len))
 277                                 return -EFAULT;
 278                         index += xfer_len;
 279                         remaining -= xfer_len;
 280                         if (remaining == 0)
 281                                 break;
 282                 }
 283                 return 0;
 284         }
 285
 286         if (copy_from_user(to, hdr->dxferp, n))
 287                 return -EFAULT;
 288         return 0;
 289 }
 290
 291 /* Status/Sense Buffer Writeback */
 292
 293 static int nvme_trans_completion(struct sg_io_hdr *hdr, u8 status, u8 sense_key,
 294                                  u8 asc, u8 ascq)
 295 {
 296         u8 xfer_len;
 297         u8 resp[DESC_FMT_SENSE_DATA_SIZE];
 298
 299         if (scsi_status_is_good(status)) {
 300                 hdr->status = SAM_STAT_GOOD;
 301                 hdr->masked_status = GOOD;
 302                 hdr->host_status = DID_OK;
 303                 hdr->driver_status = DRIVER_OK;
 304                 hdr->sb_len_wr = 0;
 305         } else {
 306                 hdr->status = status;
 307                 hdr->masked_status = status >> 1;
 308                 hdr->host_status = DID_OK;
 309                 hdr->driver_status = DRIVER_OK;
 310
 311                 memset(resp, 0, DESC_FMT_SENSE_DATA_SIZE);
 312                 resp[0] = DESC_FORMAT_SENSE_DATA;
 313                 resp[1] = sense_key;
 314                 resp[2] = asc;
 315                 resp[3] = ascq;
 316
 317                 xfer_len = min_t(u8, hdr->mx_sb_len, DESC_FMT_SENSE_DATA_SIZE);
 318                 hdr->sb_len_wr = xfer_len;
 319                 if (copy_to_user(hdr->sbp, resp, xfer_len) > 0)
 320                         return -EFAULT;
 321         }
 322
 323         return 0;
 324 }
 325
 326 /*
 327  * Take a status code from a lowlevel routine, and if it was a positive NVMe
 328  * error code update the sense data based on it.  In either case the passed
 329  * in value is returned again, unless an -EFAULT from copy_to_user overrides
 330  * it.
 331  */
 332 static int nvme_trans_status_code(struct sg_io_hdr *hdr, int nvme_sc)
 333 {
 334         u8 status, sense_key, asc, ascq;
 335         int res;
 336
 337         /* For non-nvme (Linux) errors, simply return the error code */
 338         if (nvme_sc < 0)
 339                 return nvme_sc;
 340
 341         /* Mask DNR, More, and reserved fields */
 342         switch (nvme_sc & 0x7FF) {
 343         /* Generic Command Status */
 344         case NVME_SC_SUCCESS:
 345                 status = SAM_STAT_GOOD;
 346                 sense_key = NO_SENSE;
 347                 asc = SCSI_ASC_NO_SENSE;
 348                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 349                 break;
 350         case NVME_SC_INVALID_OPCODE:
 351                 status = SAM_STAT_CHECK_CONDITION;
 352                 sense_key = ILLEGAL_REQUEST;
 353                 asc = SCSI_ASC_ILLEGAL_COMMAND;
 354                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 355                 break;
 356         case NVME_SC_INVALID_FIELD:
 357                 status = SAM_STAT_CHECK_CONDITION;
 358                 sense_key = ILLEGAL_REQUEST;
 359                 asc = SCSI_ASC_INVALID_CDB;
 360                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 361                 break;
 362         case NVME_SC_DATA_XFER_ERROR:
 363                 status = SAM_STAT_CHECK_CONDITION;
 364                 sense_key = MEDIUM_ERROR;
 365                 asc = SCSI_ASC_NO_SENSE;
 366                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 367                 break;
 368         case NVME_SC_POWER_LOSS:
 369                 status = SAM_STAT_TASK_ABORTED;
 370                 sense_key = ABORTED_COMMAND;
 371                 asc = SCSI_ASC_WARNING;
 372                 ascq = SCSI_ASCQ_POWER_LOSS_EXPECTED;
 373                 break;
 374         case NVME_SC_INTERNAL:
 375                 status = SAM_STAT_CHECK_CONDITION;
 376                 sense_key = HARDWARE_ERROR;
 377                 asc = SCSI_ASC_INTERNAL_TARGET_FAILURE;
 378                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 379                 break;
 380         case NVME_SC_ABORT_REQ:
 381                 status = SAM_STAT_TASK_ABORTED;
 382                 sense_key = ABORTED_COMMAND;
 383                 asc = SCSI_ASC_NO_SENSE;
 384                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 385                 break;
 386         case NVME_SC_ABORT_QUEUE:
 387                 status = SAM_STAT_TASK_ABORTED;
 388                 sense_key = ABORTED_COMMAND;
 389                 asc = SCSI_ASC_NO_SENSE;
 390                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 391                 break;
 392         case NVME_SC_FUSED_FAIL:
 393                 status = SAM_STAT_TASK_ABORTED;
 394                 sense_key = ABORTED_COMMAND;
 395                 asc = SCSI_ASC_NO_SENSE;
 396                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 397                 break;
 398         case NVME_SC_FUSED_MISSING:
 399                 status = SAM_STAT_TASK_ABORTED;
 400                 sense_key = ABORTED_COMMAND;
 401                 asc = SCSI_ASC_NO_SENSE;
 402                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 403                 break;
 404         case NVME_SC_INVALID_NS:
 405                 status = SAM_STAT_CHECK_CONDITION;
 406                 sense_key = ILLEGAL_REQUEST;
 407                 asc = SCSI_ASC_ACCESS_DENIED_INVALID_LUN_ID;
 408                 ascq = SCSI_ASCQ_INVALID_LUN_ID;
 409                 break;
 410         case NVME_SC_LBA_RANGE:
 411                 status = SAM_STAT_CHECK_CONDITION;
 412                 sense_key = ILLEGAL_REQUEST;
 413                 asc = SCSI_ASC_ILLEGAL_BLOCK;
 414                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 415                 break;
 416         case NVME_SC_CAP_EXCEEDED:
 417                 status = SAM_STAT_CHECK_CONDITION;
 418                 sense_key = MEDIUM_ERROR;
 419                 asc = SCSI_ASC_NO_SENSE;
 420                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 421                 break;
 422         case NVME_SC_NS_NOT_READY:
 423                 status = SAM_STAT_CHECK_CONDITION;
 424                 sense_key = NOT_READY;
 425                 asc = SCSI_ASC_LUN_NOT_READY;
 426                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 427                 break;
 428
 429         /* Command Specific Status */
 430         case NVME_SC_INVALID_FORMAT:
 431                 status = SAM_STAT_CHECK_CONDITION;
 432                 sense_key = ILLEGAL_REQUEST;
 433                 asc = SCSI_ASC_FORMAT_COMMAND_FAILED;
 434                 ascq = SCSI_ASCQ_FORMAT_COMMAND_FAILED;
 435                 break;
 436         case NVME_SC_BAD_ATTRIBUTES:
 437                 status = SAM_STAT_CHECK_CONDITION;
 438                 sense_key = ILLEGAL_REQUEST;
 439                 asc = SCSI_ASC_INVALID_CDB;
 440                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 441                 break;
 442
 443         /* Media Errors */
 444         case NVME_SC_WRITE_FAULT:
 445                 status = SAM_STAT_CHECK_CONDITION;
 446                 sense_key = MEDIUM_ERROR;
 447                 asc = SCSI_ASC_PERIPHERAL_DEV_WRITE_FAULT;
 448                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 449                 break;
 450         case NVME_SC_READ_ERROR:
 451                 status = SAM_STAT_CHECK_CONDITION;
 452                 sense_key = MEDIUM_ERROR;
 453                 asc = SCSI_ASC_UNRECOVERED_READ_ERROR;
 454                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 455                 break;
 456         case NVME_SC_GUARD_CHECK:
 457                 status = SAM_STAT_CHECK_CONDITION;
 458                 sense_key = MEDIUM_ERROR;
 459                 asc = SCSI_ASC_LOG_BLOCK_GUARD_CHECK_FAILED;
 460                 ascq = SCSI_ASCQ_LOG_BLOCK_GUARD_CHECK_FAILED;
 461                 break;
 462         case NVME_SC_APPTAG_CHECK:
 463                 status = SAM_STAT_CHECK_CONDITION;
 464                 sense_key = MEDIUM_ERROR;
 465                 asc = SCSI_ASC_LOG_BLOCK_APPTAG_CHECK_FAILED;
 466                 ascq = SCSI_ASCQ_LOG_BLOCK_APPTAG_CHECK_FAILED;
 467                 break;
 468         case NVME_SC_REFTAG_CHECK:
 469                 status = SAM_STAT_CHECK_CONDITION;
 470                 sense_key = MEDIUM_ERROR;
 471                 asc = SCSI_ASC_LOG_BLOCK_REFTAG_CHECK_FAILED;
 472                 ascq = SCSI_ASCQ_LOG_BLOCK_REFTAG_CHECK_FAILED;
 473                 break;
 474         case NVME_SC_COMPARE_FAILED:
 475                 status = SAM_STAT_CHECK_CONDITION;
 476                 sense_key = MISCOMPARE;
 477                 asc = SCSI_ASC_MISCOMPARE_DURING_VERIFY;
 478                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 479                 break;
 480         case NVME_SC_ACCESS_DENIED:
 481                 status = SAM_STAT_CHECK_CONDITION;
 482                 sense_key = ILLEGAL_REQUEST;
 483                 asc = SCSI_ASC_ACCESS_DENIED_INVALID_LUN_ID;
 484                 ascq = SCSI_ASCQ_INVALID_LUN_ID;
 485                 break;
 486
 487         /* Unspecified/Default */
 488         case NVME_SC_CMDID_CONFLICT:
 489         case NVME_SC_CMD_SEQ_ERROR:
 490         case NVME_SC_CQ_INVALID:
 491         case NVME_SC_QID_INVALID:
 492         case NVME_SC_QUEUE_SIZE:
 493         case NVME_SC_ABORT_LIMIT:
 494         case NVME_SC_ABORT_MISSING:
 495         case NVME_SC_ASYNC_LIMIT:
 496         case NVME_SC_FIRMWARE_SLOT:
 497         case NVME_SC_FIRMWARE_IMAGE:
 498         case NVME_SC_INVALID_VECTOR:
 499         case NVME_SC_INVALID_LOG_PAGE:
 500         default:
 501                 status = SAM_STAT_CHECK_CONDITION;
 502                 sense_key = ILLEGAL_REQUEST;
 503                 asc = SCSI_ASC_NO_SENSE;
 504                 ascq = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
 505                 break;
 506         }
 507
 508         res = nvme_trans_completion(hdr, status, sense_key, asc, ascq);
 509         return res ? res : nvme_sc;
 510 }
 511
 512 /* INQUIRY Helper Functions */
 513
 514 static int nvme_trans_standard_inquiry_page(struct nvme_ns *ns,
 515                                         struct sg_io_hdr *hdr, u8 *inq_response,
 516                                         int alloc_len)
 517 {
 518         struct nvme_ctrl *ctrl = ns->ctrl;
 519         struct nvme_id_ns *id_ns;
 520         int res;
 521         int nvme_sc;
 522         int xfer_len;
 523         u8 resp_data_format = 0x02;
 524         u8 protect;
 525         u8 cmdque = 0x01 << 1;
 526         u8 fw_offset = sizeof(ctrl->firmware_rev);
 527
 528         /* nvme ns identify - use DPS value for PROTECT field */
 529         nvme_sc = nvme_identify_ns(ctrl, ns->ns_id, &id_ns);
 530         res = nvme_trans_status_code(hdr, nvme_sc);
 531         if (res)
 532                 return res;
 533
 534         if (id_ns->dps)
 535                 protect = 0x01;
 536         else
 537                 protect = 0;
 538         kfree(id_ns);
 539
 540         memset(inq_response, 0, STANDARD_INQUIRY_LENGTH);
 541         inq_response[2] = VERSION_SPC_4;
 542         inq_response[3] = resp_data_format;     /*normaca=0 | hisup=0 */
 543         inq_response[4] = ADDITIONAL_STD_INQ_LENGTH;
 544         inq_response[5] = protect;      /* sccs=0 | acc=0 | tpgs=0 | pc3=0 */
 545         inq_response[7] = cmdque;       /* wbus16=0 | sync=0 | vs=0 */
 546         strncpy(&inq_response[8], "NVMe    ", 8);
 547         strncpy(&inq_response[16], ctrl->model, 16);
 548
 549         while (ctrl->firmware_rev[fw_offset - 1] == ' ' && fw_offset > 4)
 550                 fw_offset--;
 551         fw_offset -= 4;
 552         strncpy(&inq_response[32], ctrl->firmware_rev + fw_offset, 4);
 553
 554         xfer_len = min(alloc_len, STANDARD_INQUIRY_LENGTH);
 555         return nvme_trans_copy_to_user(hdr, inq_response, xfer_len);
 556 }
 557
 558 static int nvme_trans_supported_vpd_pages(struct nvme_ns *ns,
 559                                         struct sg_io_hdr *hdr, u8 *inq_response,
 560                                         int alloc_len)
 561 {
 562         int xfer_len;
 563
 564         memset(inq_response, 0, STANDARD_INQUIRY_LENGTH);
 565         inq_response[1] = INQ_SUPPORTED_VPD_PAGES_PAGE;   /* Page Code */
 566         inq_response[3] = INQ_NUM_SUPPORTED_VPD_PAGES;    /* Page Length */
 567         inq_response[4] = INQ_SUPPORTED_VPD_PAGES_PAGE;
 568         inq_response[5] = INQ_UNIT_SERIAL_NUMBER_PAGE;
 569         inq_response[6] = INQ_DEVICE_IDENTIFICATION_PAGE;
 570         inq_response[7] = INQ_EXTENDED_INQUIRY_DATA_PAGE;
 571         inq_response[8] = INQ_BDEV_CHARACTERISTICS_PAGE;
 572         inq_response[9] = INQ_BDEV_LIMITS_PAGE;
 573
 574         xfer_len = min(alloc_len, STANDARD_INQUIRY_LENGTH);
 575         return nvme_trans_copy_to_user(hdr, inq_response, xfer_len);
 576 }
 577
 578 static int nvme_trans_unit_serial_page(struct nvme_ns *ns,
 579                                         struct sg_io_hdr *hdr, u8 *inq_response,
 580                                         int alloc_len)
 581 {
 582         int xfer_len;
 583
 584         memset(inq_response, 0, STANDARD_INQUIRY_LENGTH);
 585         inq_response[1] = INQ_UNIT_SERIAL_NUMBER_PAGE; /* Page Code */
 586         inq_response[3] = INQ_SERIAL_NUMBER_LENGTH;    /* Page Length */
 587         strncpy(&inq_response[4], ns->ctrl->serial, INQ_SERIAL_NUMBER_LENGTH);
 588
 589         xfer_len = min(alloc_len, STANDARD_INQUIRY_LENGTH);
 590         return nvme_trans_copy_to_user(hdr, inq_response, xfer_len);
 591 }
 592
 593 static int nvme_fill_device_id_eui64(struct nvme_ns *ns, struct sg_io_hdr *hdr,
 594                 u8 *inq_response, int alloc_len)
 595 {
 596         struct nvme_id_ns *id_ns;
 597         int nvme_sc, res;
 598         size_t len;
 599         void *eui;
 600
 601         nvme_sc = nvme_identify_ns(ns->ctrl, ns->ns_id, &id_ns);
 602         res = nvme_trans_status_code(hdr, nvme_sc);
 603         if (res)
 604                 return res;
 605
 606         eui = id_ns->eui64;
 607         len = sizeof(id_ns->eui64);
 608
 609         if (ns->ctrl->vs >= NVME_VS(1, 2, 0)) {
 610                 if (bitmap_empty(eui, len * 8)) {
 611                         eui = id_ns->nguid;
 612                         len = sizeof(id_ns->nguid);
 613                 }
 614         }
 615
 616         if (bitmap_empty(eui, len * 8)) {
 617                 res = -EOPNOTSUPP;
 618                 goto out_free_id;
 619         }
 620
 621         memset(inq_response, 0, alloc_len);
 622         inq_response[1] = INQ_DEVICE_IDENTIFICATION_PAGE;
 623         inq_response[3] = 4 + len; /* Page Length */
 624
 625         /* Designation Descriptor start */
 626         inq_response[4] = 0x01; /* Proto ID=0h | Code set=1h */
 627         inq_response[5] = 0x02; /* PIV=0b | Asso=00b | Designator Type=2h */
 628         inq_response[6] = 0x00; /* Rsvd */
 629         inq_response[7] = len;  /* Designator Length */
 630         memcpy(&inq_response[8], eui, len);
 631
 632         res = nvme_trans_copy_to_user(hdr, inq_response, alloc_len);
 633 out_free_id:
 634         kfree(id_ns);
 635         return res;
 636 }
 637
 638 static int nvme_fill_device_id_scsi_string(struct nvme_ns *ns,
 639                 struct sg_io_hdr *hdr, u8 *inq_response, int alloc_len)
 640 {
 641         struct nvme_ctrl *ctrl = ns->ctrl;
 642         struct nvme_id_ctrl *id_ctrl;
 643         int nvme_sc, res;
 644
 645         if (alloc_len < 72) {
 646                 return nvme_trans_completion(hdr,
 647                                 SAM_STAT_CHECK_CONDITION,
 648                                 ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
 649                                 SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
 650         }
 651
 652         nvme_sc = nvme_identify_ctrl(ctrl, &id_ctrl);
 653         res = nvme_trans_status_code(hdr, nvme_sc);
 654         if (res)
 655                 return res;
 656
 657         memset(inq_response, 0, alloc_len);
 658         inq_response[1] = INQ_DEVICE_IDENTIFICATION_PAGE;
 659         inq_response[3] = 0x48; /* Page Length */
 660
 661         /* Designation Descriptor start */
 662         inq_response[4] = 0x03; /* Proto ID=0h | Code set=3h */
 663         inq_response[5] = 0x08; /* PIV=0b | Asso=00b | Designator Type=8h */
 664         inq_response[6] = 0x00; /* Rsvd */
 665         inq_response[7] = 0x44; /* Designator Length */
 666
 667         sprintf(&inq_response[8], "%04x", le16_to_cpu(id_ctrl->vid));
 668         memcpy(&inq_response[12], ctrl->model, sizeof(ctrl->model));
 669         sprintf(&inq_response[52], "%04x", cpu_to_be32(ns->ns_id));
 670         memcpy(&inq_response[56], ctrl->serial, sizeof(ctrl->serial));
 671
 672         res = nvme_trans_copy_to_user(hdr, inq_response, alloc_len);
 673         kfree(id_ctrl);
 674         return res;
 675 }
 676
 677 static int nvme_trans_device_id_page(struct nvme_ns *ns, struct sg_io_hdr *hdr,
 678                                         u8 *resp, int alloc_len)
 679 {
 680         int res;
 681
 682         if (ns->ctrl->vs >= NVME_VS(1, 1, 0)) {
 683                 res = nvme_fill_device_id_eui64(ns, hdr, resp, alloc_len);
 684                 if (res != -EOPNOTSUPP)
 685                         return res;
 686         }
 687
 688         return nvme_fill_device_id_scsi_string(ns, hdr, resp, alloc_len);
 689 }
 690
 691 static int nvme_trans_ext_inq_page(struct nvme_ns *ns, struct sg_io_hdr *hdr,
 692                                         int alloc_len)
 693 {
 694         u8 *inq_response;
 695         int res;
 696         int nvme_sc;
 697         struct nvme_ctrl *ctrl = ns->ctrl;
 698         struct nvme_id_ctrl *id_ctrl;
 699         struct nvme_id_ns *id_ns;
 700         int xfer_len;
 701         u8 microcode = 0x80;
 702         u8 spt;
 703         u8 spt_lut[8] = {0, 0, 2, 1, 4, 6, 5, 7};
 704         u8 grd_chk, app_chk, ref_chk, protect;
 705         u8 uask_sup = 0x20;
 706         u8 v_sup;
 707         u8 luiclr = 0x01;
 708
 709         inq_response = kmalloc(EXTENDED_INQUIRY_DATA_PAGE_LENGTH, GFP_KERNEL);
 710         if (inq_response == NULL)
 711                 return -ENOMEM;
 712
 713         nvme_sc = nvme_identify_ns(ctrl, ns->ns_id, &id_ns);
 714         res = nvme_trans_status_code(hdr, nvme_sc);
 715         if (res)
 716                 goto out_free_inq;
 717
 718         spt = spt_lut[id_ns->dpc & 0x07] << 3;
 719         if (id_ns->dps)
 720                 protect = 0x01;
 721         else
 722                 protect = 0;
 723         kfree(id_ns);
 724
 725         grd_chk = protect << 2;
 726         app_chk = protect << 1;
 727         ref_chk = protect;
 728
 729         nvme_sc = nvme_identify_ctrl(ctrl, &id_ctrl);
 730         res = nvme_trans_status_code(hdr, nvme_sc);
 731         if (res)
 732                 goto out_free_inq;
 733
 734         v_sup = id_ctrl->vwc;
 735         kfree(id_ctrl);
 736
 737         memset(inq_response, 0, EXTENDED_INQUIRY_DATA_PAGE_LENGTH);
 738         inq_response[1] = INQ_EXTENDED_INQUIRY_DATA_PAGE;    /* Page Code */
 739         inq_response[2] = 0x00;    /* Page Length MSB */
 740         inq_response[3] = 0x3C;    /* Page Length LSB */
 741         inq_response[4] = microcode | spt | grd_chk | app_chk | ref_chk;
 742         inq_response[5] = uask_sup;
 743         inq_response[6] = v_sup;
 744         inq_response[7] = luiclr;
 745         inq_response[8] = 0;
 746         inq_response[9] = 0;
 747
 748         xfer_len = min(alloc_len, EXTENDED_INQUIRY_DATA_PAGE_LENGTH);
 749         res = nvme_trans_copy_to_user(hdr, inq_response, xfer_len);
 750
 751  out_free_inq:
 752         kfree(inq_response);
 753         return res;
 754 }
 755
 756 static int nvme_trans_bdev_limits_page(struct nvme_ns *ns, struct sg_io_hdr *hdr,
 757                                         u8 *inq_response, int alloc_len)
 758 {
 759         __be32 max_sectors = cpu_to_be32(
 760                 nvme_block_nr(ns, queue_max_hw_sectors(ns->queue)));
 761         __be32 max_discard = cpu_to_be32(ns->queue->limits.max_discard_sectors);
 762         __be32 discard_desc_count = cpu_to_be32(0x100);
 763
 764         memset(inq_response, 0, STANDARD_INQUIRY_LENGTH);
 765         inq_response[1] = VPD_BLOCK_LIMITS;
 766         inq_response[3] = 0x3c; /* Page Length */
 767         memcpy(&inq_response[8], &max_sectors, sizeof(u32));
 768         memcpy(&inq_response[20], &max_discard, sizeof(u32));
 769
 770         if (max_discard)
 771                 memcpy(&inq_response[24], &discard_desc_count, sizeof(u32));
 772
 773         return nvme_trans_copy_to_user(hdr, inq_response, 0x3c);
 774 }
 775
 776 static int nvme_trans_bdev_char_page(struct nvme_ns *ns, struct sg_io_hdr *hdr,
 777                                         int alloc_len)
 778 {
 779         u8 *inq_response;
 780         int res;
 781         int xfer_len;
 782
 783         inq_response = kzalloc(EXTENDED_INQUIRY_DATA_PAGE_LENGTH, GFP_KERNEL);
 784         if (inq_response == NULL) {
 785                 res = -ENOMEM;
 786                 goto out_mem;
 787         }
 788
 789         inq_response[1] = INQ_BDEV_CHARACTERISTICS_PAGE;    /* Page Code */
 790         inq_response[2] = 0x00;    /* Page Length MSB */
 791         inq_response[3] = 0x3C;    /* Page Length LSB */
 792         inq_response[4] = 0x00;    /* Medium Rotation Rate MSB */
 793         inq_response[5] = 0x01;    /* Medium Rotation Rate LSB */
 794         inq_response[6] = 0x00;    /* Form Factor */
 795
 796         xfer_len = min(alloc_len, EXTENDED_INQUIRY_DATA_PAGE_LENGTH);
 797         res = nvme_trans_copy_to_user(hdr, inq_response, xfer_len);
 798
 799         kfree(inq_response);
 800  out_mem:
 801         return res;
 802 }
 803
 804 /* LOG SENSE Helper Functions */
 805
 806 static int nvme_trans_log_supp_pages(struct nvme_ns *ns, struct sg_io_hdr *hdr,
 807                                         int alloc_len)
 808 {
 809         int res;
 810         int xfer_len;
 811         u8 *log_response;
 812
 813         log_response = kzalloc(LOG_PAGE_SUPPORTED_LOG_PAGES_LENGTH, GFP_KERNEL);
 814         if (log_response == NULL) {
 815                 res = -ENOMEM;
 816                 goto out_mem;
 817         }
 818
 819         log_response[0] = LOG_PAGE_SUPPORTED_LOG_PAGES_PAGE;
 820         /* Subpage=0x00, Page Length MSB=0 */
 821         log_response[3] = SUPPORTED_LOG_PAGES_PAGE_LENGTH;
 822         log_response[4] = LOG_PAGE_SUPPORTED_LOG_PAGES_PAGE;
 823         log_response[5] = LOG_PAGE_INFORMATIONAL_EXCEPTIONS_PAGE;
 824         log_response[6] = LOG_PAGE_TEMPERATURE_PAGE;
 825
 826         xfer_len = min(alloc_len, LOG_PAGE_SUPPORTED_LOG_PAGES_LENGTH);
 827         res = nvme_trans_copy_to_user(hdr, log_response, xfer_len);
 828
 829         kfree(log_response);
 830  out_mem:
 831         return res;
 832 }
 833
 834 static int nvme_trans_log_info_exceptions(struct nvme_ns *ns,
 835                                         struct sg_io_hdr *hdr, int alloc_len)
 836 {
 837         int res;
 838         int xfer_len;
 839         u8 *log_response;
 840         struct nvme_smart_log *smart_log;
 841         u8 temp_c;
 842         u16 temp_k;
 843
 844         log_response = kzalloc(LOG_INFO_EXCP_PAGE_LENGTH, GFP_KERNEL);
 845         if (log_response == NULL)
 846                 return -ENOMEM;
 847
 848         res = nvme_get_log_page(ns->ctrl, &smart_log);
 849         if (res < 0)
 850                 goto out_free_response;
 851
 852         if (res != NVME_SC_SUCCESS) {
 853                 temp_c = LOG_TEMP_UNKNOWN;
 854         } else {
 855                 temp_k = (smart_log->temperature[1] << 8) +
 856                                 (smart_log->temperature[0]);
 857                 temp_c = temp_k - KELVIN_TEMP_FACTOR;
 858         }
 859         kfree(smart_log);
 860
 861         log_response[0] = LOG_PAGE_INFORMATIONAL_EXCEPTIONS_PAGE;
 862         /* Subpage=0x00, Page Length MSB=0 */
 863         log_response[3] = REMAINING_INFO_EXCP_PAGE_LENGTH;
 864         /* Informational Exceptions Log Parameter 1 Start */
 865         /* Parameter Code=0x0000 bytes 4,5 */
 866         log_response[6] = 0x23; /* DU=0, TSD=1, ETC=0, TMC=0, FMT_AND_LNK=11b */
 867         log_response[7] = 0x04; /* PARAMETER LENGTH */
 868         /* Add sense Code and qualifier = 0x00 each */
 869         /* Use Temperature from NVMe Get Log Page, convert to C from K */
 870         log_response[10] = temp_c;
 871
 872         xfer_len = min(alloc_len, LOG_INFO_EXCP_PAGE_LENGTH);
 873         res = nvme_trans_copy_to_user(hdr, log_response, xfer_len);
 874
 875  out_free_response:
 876         kfree(log_response);
 877         return res;
 878 }
 879
 880 static int nvme_trans_log_temperature(struct nvme_ns *ns, struct sg_io_hdr *hdr,
 881                                         int alloc_len)
 882 {
 883         int res;
 884         int xfer_len;
 885         u8 *log_response;
 886         struct nvme_smart_log *smart_log;
 887         u32 feature_resp;
 888         u8 temp_c_cur, temp_c_thresh;
 889         u16 temp_k;
 890
 891         log_response = kzalloc(LOG_TEMP_PAGE_LENGTH, GFP_KERNEL);
 892         if (log_response == NULL)
 893                 return -ENOMEM;
 894
 895         res = nvme_get_log_page(ns->ctrl, &smart_log);
 896         if (res < 0)
 897                 goto out_free_response;
 898
 899         if (res != NVME_SC_SUCCESS) {
 900                 temp_c_cur = LOG_TEMP_UNKNOWN;
 901         } else {
 902                 temp_k = (smart_log->temperature[1] << 8) +
 903                                 (smart_log->temperature[0]);
 904                 temp_c_cur = temp_k - KELVIN_TEMP_FACTOR;
 905         }
 906         kfree(smart_log);
 907
 908         /* Get Features for Temp Threshold */
 909         res = nvme_get_features(ns->ctrl, NVME_FEAT_TEMP_THRESH, 0, NULL, 0,
 910                                                                 &feature_resp);
 911         if (res != NVME_SC_SUCCESS)
 912                 temp_c_thresh = LOG_TEMP_UNKNOWN;
 913         else
 914                 temp_c_thresh = (feature_resp & 0xFFFF) - KELVIN_TEMP_FACTOR;
 915
 916         log_response[0] = LOG_PAGE_TEMPERATURE_PAGE;
 917         /* Subpage=0x00, Page Length MSB=0 */
 918         log_response[3] = REMAINING_TEMP_PAGE_LENGTH;
 919         /* Temperature Log Parameter 1 (Temperature) Start */
 920         /* Parameter Code = 0x0000 */
 921         log_response[6] = 0x01;         /* Format and Linking = 01b */
 922         log_response[7] = 0x02;         /* Parameter Length */
 923         /* Use Temperature from NVMe Get Log Page, convert to C from K */
 924         log_response[9] = temp_c_cur;
 925         /* Temperature Log Parameter 2 (Reference Temperature) Start */
 926         log_response[11] = 0x01;        /* Parameter Code = 0x0001 */
 927         log_response[12] = 0x01;        /* Format and Linking = 01b */
 928         log_response[13] = 0x02;        /* Parameter Length */
 929         /* Use Temperature Thresh from NVMe Get Log Page, convert to C from K */
 930         log_response[15] = temp_c_thresh;
 931
 932         xfer_len = min(alloc_len, LOG_TEMP_PAGE_LENGTH);
 933         res = nvme_trans_copy_to_user(hdr, log_response, xfer_len);
 934
 935  out_free_response:
 936         kfree(log_response);
 937         return res;
 938 }
 939
 940 /* MODE SENSE Helper Functions */
 941
 942 static int nvme_trans_fill_mode_parm_hdr(u8 *resp, int len, u8 cdb10, u8 llbaa,
 943                                         u16 mode_data_length, u16 blk_desc_len)
 944 {
 945         /* Quick check to make sure I don't stomp on my own memory... */
 946         if ((cdb10 && len < 8) || (!cdb10 && len < 4))
 947                 return -EINVAL;
 948
 949         if (cdb10) {
 950                 resp[0] = (mode_data_length & 0xFF00) >> 8;
 951                 resp[1] = (mode_data_length & 0x00FF);
 952                 resp[3] = 0x10 /* DPOFUA */;
 953                 resp[4] = llbaa;
 954                 resp[5] = RESERVED_FIELD;
 955                 resp[6] = (blk_desc_len & 0xFF00) >> 8;
 956                 resp[7] = (blk_desc_len & 0x00FF);
 957         } else {
 958                 resp[0] = (mode_data_length & 0x00FF);
 959                 resp[2] = 0x10 /* DPOFUA */;
 960                 resp[3] = (blk_desc_len & 0x00FF);
 961         }
 962
 963         return 0;
 964 }
 965
 966 static int nvme_trans_fill_blk_desc(struct nvme_ns *ns, struct sg_io_hdr *hdr,
 967                                     u8 *resp, int len, u8 llbaa)
 968 {
 969         int res;
 970         int nvme_sc;
 971         struct nvme_id_ns *id_ns;
 972         u8 flbas;
 973         u32 lba_length;
 974
 975         if (llbaa == 0 && len < MODE_PAGE_BLK_DES_LEN)
 976                 return -EINVAL;
 977         else if (llbaa > 0 && len < MODE_PAGE_LLBAA_BLK_DES_LEN)
 978                 return -EINVAL;
 979
 980         nvme_sc = nvme_identify_ns(ns->ctrl, ns->ns_id, &id_ns);
 981         res = nvme_trans_status_code(hdr, nvme_sc);
 982         if (res)
 983                 return res;
 984
 985         flbas = (id_ns->flbas) & 0x0F;
 986         lba_length = (1 << (id_ns->lbaf[flbas].ds));
 987
 988         if (llbaa == 0) {
 989                 __be32 tmp_cap = cpu_to_be32(le64_to_cpu(id_ns->ncap));
 990                 /* Byte 4 is reserved */
 991                 __be32 tmp_len = cpu_to_be32(lba_length & 0x00FFFFFF);
 992
 993                 memcpy(resp, &tmp_cap, sizeof(u32));
 994                 memcpy(&resp[4], &tmp_len, sizeof(u32));
 995         } else {
 996                 __be64 tmp_cap = cpu_to_be64(le64_to_cpu(id_ns->ncap));
 997                 __be32 tmp_len = cpu_to_be32(lba_length);
 998
 999                 memcpy(resp, &tmp_cap, sizeof(u64));
1000                 /* Bytes 8, 9, 10, 11 are reserved */
1001                 memcpy(&resp[12], &tmp_len, sizeof(u32));
1002         }
1003
1004         kfree(id_ns);
1005         return res;
1006 }
1007
1008 static int nvme_trans_fill_control_page(struct nvme_ns *ns,
1009                                         struct sg_io_hdr *hdr, u8 *resp,
1010                                         int len)
1011 {
1012         if (len < MODE_PAGE_CONTROL_LEN)
1013                 return -EINVAL;
1014
1015         resp[0] = MODE_PAGE_CONTROL;
1016         resp[1] = MODE_PAGE_CONTROL_LEN_FIELD;
1017         resp[2] = 0x0E;         /* TST=000b, TMF_ONLY=0, DPICZ=1,
1018                                  * D_SENSE=1, GLTSD=1, RLEC=0 */
1019         resp[3] = 0x12;         /* Q_ALGO_MODIFIER=1h, NUAR=0, QERR=01b */
1020         /* Byte 4:  VS=0, RAC=0, UA_INT=0, SWP=0 */
1021         resp[5] = 0x40;         /* ATO=0, TAS=1, ATMPE=0, RWWP=0, AUTOLOAD=0 */
1022         /* resp[6] and [7] are obsolete, thus zero */
1023         resp[8] = 0xFF;         /* Busy timeout period = 0xffff */
1024         resp[9] = 0xFF;
1025         /* Bytes 10,11: Extended selftest completion time = 0x0000 */
1026
1027         return 0;
1028 }
1029
1030 static int nvme_trans_fill_caching_page(struct nvme_ns *ns,
1031                                         struct sg_io_hdr *hdr,
1032                                         u8 *resp, int len)
1033 {
1034         int res = 0;
1035         int nvme_sc;
1036         u32 feature_resp;
1037         u8 vwc;
1038
1039         if (len < MODE_PAGE_CACHING_LEN)
1040                 return -EINVAL;
1041
1042         nvme_sc = nvme_get_features(ns->ctrl, NVME_FEAT_VOLATILE_WC, 0, NULL, 0,
1043                                                                 &feature_resp);
1044         res = nvme_trans_status_code(hdr, nvme_sc);
1045         if (res)
1046                 return res;
1047
1048         vwc = feature_resp & 0x00000001;
1049
1050         resp[0] = MODE_PAGE_CACHING;
1051         resp[1] = MODE_PAGE_CACHING_LEN_FIELD;
1052         resp[2] = vwc << 2;
1053         return 0;
1054 }
1055
1056 static int nvme_trans_fill_pow_cnd_page(struct nvme_ns *ns,
1057                                         struct sg_io_hdr *hdr, u8 *resp,
1058                                         int len)
1059 {
1060         if (len < MODE_PAGE_POW_CND_LEN)
1061                 return -EINVAL;
1062
1063         resp[0] = MODE_PAGE_POWER_CONDITION;
1064         resp[1] = MODE_PAGE_POW_CND_LEN_FIELD;
1065         /* All other bytes are zero */
1066
1067         return 0;
1068 }
1069
1070 static int nvme_trans_fill_inf_exc_page(struct nvme_ns *ns,
1071                                         struct sg_io_hdr *hdr, u8 *resp,
1072                                         int len)
1073 {
1074         if (len < MODE_PAGE_INF_EXC_LEN)
1075                 return -EINVAL;
1076
1077         resp[0] = MODE_PAGE_INFO_EXCEP;
1078         resp[1] = MODE_PAGE_INF_EXC_LEN_FIELD;
1079         resp[2] = 0x88;
1080         /* All other bytes are zero */
1081
1082         return 0;
1083 }
1084
1085 static int nvme_trans_fill_all_pages(struct nvme_ns *ns, struct sg_io_hdr *hdr,
1086                                      u8 *resp, int len)
1087 {
1088         int res;
1089         u16 mode_pages_offset_1 = 0;
1090         u16 mode_pages_offset_2, mode_pages_offset_3, mode_pages_offset_4;
1091
1092         mode_pages_offset_2 = mode_pages_offset_1 + MODE_PAGE_CACHING_LEN;
1093         mode_pages_offset_3 = mode_pages_offset_2 + MODE_PAGE_CONTROL_LEN;
1094         mode_pages_offset_4 = mode_pages_offset_3 + MODE_PAGE_POW_CND_LEN;
1095
1096         res = nvme_trans_fill_caching_page(ns, hdr, &resp[mode_pages_offset_1],
1097                                         MODE_PAGE_CACHING_LEN);
1098         if (res)
1099                 return res;
1100         res = nvme_trans_fill_control_page(ns, hdr, &resp[mode_pages_offset_2],
1101                                         MODE_PAGE_CONTROL_LEN);
1102         if (res)
1103                 return res;
1104         res = nvme_trans_fill_pow_cnd_page(ns, hdr, &resp[mode_pages_offset_3],
1105                                         MODE_PAGE_POW_CND_LEN);
1106         if (res)
1107                 return res;
1108         return nvme_trans_fill_inf_exc_page(ns, hdr, &resp[mode_pages_offset_4],
1109                                         MODE_PAGE_INF_EXC_LEN);
1110 }
1111
1112 static inline int nvme_trans_get_blk_desc_len(u8 dbd, u8 llbaa)
1113 {
1114         if (dbd == MODE_SENSE_BLK_DESC_ENABLED) {
1115                 /* SPC-4: len = 8 x Num_of_descriptors if llbaa = 0, 16x if 1 */
1116                 return 8 * (llbaa + 1) * MODE_SENSE_BLK_DESC_COUNT;
1117         } else {
1118                 return 0;
1119         }
1120 }
1121
1122 static int nvme_trans_mode_page_create(struct nvme_ns *ns,
1123                                         struct sg_io_hdr *hdr, u8 *cmd,
1124                                         u16 alloc_len, u8 cdb10,
1125                                         int (*mode_page_fill_func)
1126                                         (struct nvme_ns *,
1127                                         struct sg_io_hdr *hdr, u8 *, int),
1128                                         u16 mode_pages_tot_len)
1129 {
1130         int res;
1131         int xfer_len;
1132         u8 *response;
1133         u8 dbd, llbaa;
1134         u16 resp_size;
1135         int mph_size;
1136         u16 mode_pages_offset_1;
1137         u16 blk_desc_len, blk_desc_offset, mode_data_length;
1138
1139         dbd = (cmd[1] & MODE_SENSE_DBD_MASK) >> MODE_SENSE_DBD_SHIFT;
1140         llbaa = (cmd[1] & MODE_SENSE_LLBAA_MASK) >> MODE_SENSE_LLBAA_SHIFT;
1141         mph_size = cdb10 ? MODE_SENSE10_MPH_SIZE : MODE_SENSE6_MPH_SIZE;
1142
1143         blk_desc_len = nvme_trans_get_blk_desc_len(dbd, llbaa);
1144
1145         resp_size = mph_size + blk_desc_len + mode_pages_tot_len;
1146         /* Refer spc4r34 Table 440 for calculation of Mode data Length field */
1147         mode_data_length = 3 + (3 * cdb10) + blk_desc_len + mode_pages_tot_len;
1148
1149         blk_desc_offset = mph_size;
1150         mode_pages_offset_1 = blk_desc_offset + blk_desc_len;
1151
1152         response = kzalloc(resp_size, GFP_KERNEL);
1153         if (response == NULL) {
1154                 res = -ENOMEM;
1155                 goto out_mem;
1156         }
1157
1158         res = nvme_trans_fill_mode_parm_hdr(&response[0], mph_size, cdb10,
1159                                         llbaa, mode_data_length, blk_desc_len);
1160         if (res)
1161                 goto out_free;
1162         if (blk_desc_len > 0) {
1163                 res = nvme_trans_fill_blk_desc(ns, hdr,
1164                                                &response[blk_desc_offset],
1165                                                blk_desc_len, llbaa);
1166                 if (res)
1167                         goto out_free;
1168         }
1169         res = mode_page_fill_func(ns, hdr, &response[mode_pages_offset_1],
1170                                         mode_pages_tot_len);
1171         if (res)
1172                 goto out_free;
1173
1174         xfer_len = min(alloc_len, resp_size);
1175         res = nvme_trans_copy_to_user(hdr, response, xfer_len);
1176
1177  out_free:
1178         kfree(response);
1179  out_mem:
1180         return res;
1181 }
1182
1183 /* Read Capacity Helper Functions */
1184
1185 static void nvme_trans_fill_read_cap(u8 *response, struct nvme_id_ns *id_ns,
1186                                                                 u8 cdb16)
1187 {
1188         u8 flbas;
1189         u32 lba_length;
1190         u64 rlba;
1191         u8 prot_en;
1192         u8 p_type_lut[4] = {0, 0, 1, 2};
1193         __be64 tmp_rlba;
1194         __be32 tmp_rlba_32;
1195         __be32 tmp_len;
1196
1197         flbas = (id_ns->flbas) & 0x0F;
1198         lba_length = (1 << (id_ns->lbaf[flbas].ds));
1199         rlba = le64_to_cpup(&id_ns->nsze) - 1;
1200         (id_ns->dps) ? (prot_en = 0x01) : (prot_en = 0);
1201
1202         if (!cdb16) {
1203                 if (rlba > 0xFFFFFFFF)
1204                         rlba = 0xFFFFFFFF;
1205                 tmp_rlba_32 = cpu_to_be32(rlba);
1206                 tmp_len = cpu_to_be32(lba_length);
1207                 memcpy(response, &tmp_rlba_32, sizeof(u32));
1208                 memcpy(&response[4], &tmp_len, sizeof(u32));
1209         } else {
1210                 tmp_rlba = cpu_to_be64(rlba);
1211                 tmp_len = cpu_to_be32(lba_length);
1212                 memcpy(response, &tmp_rlba, sizeof(u64));
1213                 memcpy(&response[8], &tmp_len, sizeof(u32));
1214                 response[12] = (p_type_lut[id_ns->dps & 0x3] << 1) | prot_en;
1215                 /* P_I_Exponent = 0x0 | LBPPBE = 0x0 */
1216                 /* LBPME = 0 | LBPRZ = 0 | LALBA = 0x00 */
1217                 /* Bytes 16-31 - Reserved */
1218         }
1219 }
1220
1221 /* Start Stop Unit Helper Functions */
1222
1223 static int nvme_trans_send_activate_fw_cmd(struct nvme_ns *ns, struct sg_io_hdr *hdr,
1224                                         u8 buffer_id)
1225 {
1226         struct nvme_command c;
1227         int nvme_sc;
1228
1229         memset(&c, 0, sizeof(c));
1230         c.common.opcode = nvme_admin_activate_fw;
1231         c.common.cdw10[0] = cpu_to_le32(buffer_id | NVME_FWACT_REPL_ACTV);
1232
1233         nvme_sc = nvme_submit_sync_cmd(ns->queue, &c, NULL, 0);
1234         return nvme_trans_status_code(hdr, nvme_sc);
1235 }
1236
1237 static int nvme_trans_send_download_fw_cmd(struct nvme_ns *ns, struct sg_io_hdr *hdr,
1238                                         u8 opcode, u32 tot_len, u32 offset,
1239                                         u8 buffer_id)
1240 {
1241         int nvme_sc;
1242         struct nvme_command c;
1243
1244         if (hdr->iovec_count > 0) {
1245                 /* Assuming SGL is not allowed for this command */
1246                 return nvme_trans_completion(hdr,
1247                                         SAM_STAT_CHECK_CONDITION,
1248                                         ILLEGAL_REQUEST,
1249                                         SCSI_ASC_INVALID_CDB,
1250                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1251         }
1252
1253         memset(&c, 0, sizeof(c));
1254         c.common.opcode = nvme_admin_download_fw;
1255         c.dlfw.numd = cpu_to_le32((tot_len/BYTES_TO_DWORDS) - 1);
1256         c.dlfw.offset = cpu_to_le32(offset/BYTES_TO_DWORDS);
1257
1258         nvme_sc = nvme_submit_user_cmd(ns->ctrl->admin_q, &c,
1259                         hdr->dxferp, tot_len, NULL, 0);
1260         return nvme_trans_status_code(hdr, nvme_sc);
1261 }
1262
1263 /* Mode Select Helper Functions */
1264
1265 static inline void nvme_trans_modesel_get_bd_len(u8 *parm_list, u8 cdb10,
1266                                                 u16 *bd_len, u8 *llbaa)
1267 {
1268         if (cdb10) {
1269                 /* 10 Byte CDB */
1270                 *bd_len = (parm_list[MODE_SELECT_10_BD_OFFSET] << 8) +
1271                         parm_list[MODE_SELECT_10_BD_OFFSET + 1];
1272                 *llbaa = parm_list[MODE_SELECT_10_LLBAA_OFFSET] &
1273                                 MODE_SELECT_10_LLBAA_MASK;
1274         } else {
1275                 /* 6 Byte CDB */
1276                 *bd_len = parm_list[MODE_SELECT_6_BD_OFFSET];
1277         }
1278 }
1279
1280 static void nvme_trans_modesel_save_bd(struct nvme_ns *ns, u8 *parm_list,
1281                                         u16 idx, u16 bd_len, u8 llbaa)
1282 {
1283         u16 bd_num;
1284
1285         bd_num = bd_len / ((llbaa == 0) ?
1286                         SHORT_DESC_BLOCK : LONG_DESC_BLOCK);
1287         /* Store block descriptor info if a FORMAT UNIT comes later */
1288         /* TODO Saving 1st BD info; what to do if multiple BD received? */
1289         if (llbaa == 0) {
1290                 /* Standard Block Descriptor - spc4r34 7.5.5.1 */
1291                 ns->mode_select_num_blocks =
1292                                 (parm_list[idx + 1] << 16) +
1293                                 (parm_list[idx + 2] << 8) +
1294                                 (parm_list[idx + 3]);
1295
1296                 ns->mode_select_block_len =
1297                                 (parm_list[idx + 5] << 16) +
1298                                 (parm_list[idx + 6] << 8) +
1299                                 (parm_list[idx + 7]);
1300         } else {
1301                 /* Long LBA Block Descriptor - sbc3r27 6.4.2.3 */
1302                 ns->mode_select_num_blocks =
1303                                 (((u64)parm_list[idx + 0]) << 56) +
1304                                 (((u64)parm_list[idx + 1]) << 48) +
1305                                 (((u64)parm_list[idx + 2]) << 40) +
1306                                 (((u64)parm_list[idx + 3]) << 32) +
1307                                 (((u64)parm_list[idx + 4]) << 24) +
1308                                 (((u64)parm_list[idx + 5]) << 16) +
1309                                 (((u64)parm_list[idx + 6]) << 8) +
1310                                 ((u64)parm_list[idx + 7]);
1311
1312                 ns->mode_select_block_len =
1313                                 (parm_list[idx + 12] << 24) +
1314                                 (parm_list[idx + 13] << 16) +
1315                                 (parm_list[idx + 14] << 8) +
1316                                 (parm_list[idx + 15]);
1317         }
1318 }
1319
1320 static int nvme_trans_modesel_get_mp(struct nvme_ns *ns, struct sg_io_hdr *hdr,
1321                                         u8 *mode_page, u8 page_code)
1322 {
1323         int res = 0;
1324         int nvme_sc;
1325         unsigned dword11;
1326
1327         switch (page_code) {
1328         case MODE_PAGE_CACHING:
1329                 dword11 = ((mode_page[2] & CACHING_MODE_PAGE_WCE_MASK) ? 1 : 0);
1330                 nvme_sc = nvme_set_features(ns->ctrl, NVME_FEAT_VOLATILE_WC,
1331                                             dword11, NULL, 0, NULL);
1332                 res = nvme_trans_status_code(hdr, nvme_sc);
1333                 break;
1334         case MODE_PAGE_CONTROL:
1335                 break;
1336         case MODE_PAGE_POWER_CONDITION:
1337                 /* Verify the OS is not trying to set timers */
1338                 if ((mode_page[2] & 0x01) != 0 || (mode_page[3] & 0x0F) != 0) {
1339                         res = nvme_trans_completion(hdr,
1340                                                 SAM_STAT_CHECK_CONDITION,
1341                                                 ILLEGAL_REQUEST,
1342                                                 SCSI_ASC_INVALID_PARAMETER,
1343                                                 SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1344                         break;
1345                 }
1346                 break;
1347         default:
1348                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
1349                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
1350                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1351                 break;
1352         }
1353
1354         return res;
1355 }
1356
1357 static int nvme_trans_modesel_data(struct nvme_ns *ns, struct sg_io_hdr *hdr,
1358                                         u8 *cmd, u16 parm_list_len, u8 pf,
1359                                         u8 sp, u8 cdb10)
1360 {
1361         int res;
1362         u8 *parm_list;
1363         u16 bd_len;
1364         u8 llbaa = 0;
1365         u16 index, saved_index;
1366         u8 page_code;
1367         u16 mp_size;
1368
1369         /* Get parm list from data-in/out buffer */
1370         parm_list = kmalloc(parm_list_len, GFP_KERNEL);
1371         if (parm_list == NULL) {
1372                 res = -ENOMEM;
1373                 goto out;
1374         }
1375
1376         res = nvme_trans_copy_from_user(hdr, parm_list, parm_list_len);
1377         if (res)
1378                 goto out_mem;
1379
1380         nvme_trans_modesel_get_bd_len(parm_list, cdb10, &bd_len, &llbaa);
1381         index = (cdb10) ? (MODE_SELECT_10_MPH_SIZE) : (MODE_SELECT_6_MPH_SIZE);
1382
1383         if (bd_len != 0) {
1384                 /* Block Descriptors present, parse */
1385                 nvme_trans_modesel_save_bd(ns, parm_list, index, bd_len, llbaa);
1386                 index += bd_len;
1387         }
1388         saved_index = index;
1389
1390         /* Multiple mode pages may be present; iterate through all */
1391         /* In 1st Iteration, don't do NVME Command, only check for CDB errors */
1392         do {
1393                 page_code = parm_list[index] & MODE_SELECT_PAGE_CODE_MASK;
1394                 mp_size = parm_list[index + 1] + 2;
1395                 if ((page_code != MODE_PAGE_CACHING) &&
1396                     (page_code != MODE_PAGE_CONTROL) &&
1397                     (page_code != MODE_PAGE_POWER_CONDITION)) {
1398                         res = nvme_trans_completion(hdr,
1399                                                 SAM_STAT_CHECK_CONDITION,
1400                                                 ILLEGAL_REQUEST,
1401                                                 SCSI_ASC_INVALID_CDB,
1402                                                 SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1403                         goto out_mem;
1404                 }
1405                 index += mp_size;
1406         } while (index < parm_list_len);
1407
1408         /* In 2nd Iteration, do the NVME Commands */
1409         index = saved_index;
1410         do {
1411                 page_code = parm_list[index] & MODE_SELECT_PAGE_CODE_MASK;
1412                 mp_size = parm_list[index + 1] + 2;
1413                 res = nvme_trans_modesel_get_mp(ns, hdr, &parm_list[index],
1414                                                                 page_code);
1415                 if (res)
1416                         break;
1417                 index += mp_size;
1418         } while (index < parm_list_len);
1419
1420  out_mem:
1421         kfree(parm_list);
1422  out:
1423         return res;
1424 }
1425
1426 /* Format Unit Helper Functions */
1427
1428 static int nvme_trans_fmt_set_blk_size_count(struct nvme_ns *ns,
1429                                              struct sg_io_hdr *hdr)
1430 {
1431         int res = 0;
1432         int nvme_sc;
1433         u8 flbas;
1434
1435         /*
1436          * SCSI Expects a MODE SELECT would have been issued prior to
1437          * a FORMAT UNIT, and the block size and number would be used
1438          * from the block descriptor in it. If a MODE SELECT had not
1439          * been issued, FORMAT shall use the current values for both.
1440          */
1441
1442         if (ns->mode_select_num_blocks == 0 || ns->mode_select_block_len == 0) {
1443                 struct nvme_id_ns *id_ns;
1444
1445                 nvme_sc = nvme_identify_ns(ns->ctrl, ns->ns_id, &id_ns);
1446                 res = nvme_trans_status_code(hdr, nvme_sc);
1447                 if (res)
1448                         return res;
1449
1450                 if (ns->mode_select_num_blocks == 0)
1451                         ns->mode_select_num_blocks = le64_to_cpu(id_ns->ncap);
1452                 if (ns->mode_select_block_len == 0) {
1453                         flbas = (id_ns->flbas) & 0x0F;
1454                         ns->mode_select_block_len =
1455                                                 (1 << (id_ns->lbaf[flbas].ds));
1456                 }
1457
1458                 kfree(id_ns);
1459         }
1460
1461         return 0;
1462 }
1463
1464 static int nvme_trans_fmt_get_parm_header(struct sg_io_hdr *hdr, u8 len,
1465                                         u8 format_prot_info, u8 *nvme_pf_code)
1466 {
1467         int res;
1468         u8 *parm_list;
1469         u8 pf_usage, pf_code;
1470
1471         parm_list = kmalloc(len, GFP_KERNEL);
1472         if (parm_list == NULL) {
1473                 res = -ENOMEM;
1474                 goto out;
1475         }
1476         res = nvme_trans_copy_from_user(hdr, parm_list, len);
1477         if (res)
1478                 goto out_mem;
1479
1480         if ((parm_list[FORMAT_UNIT_IMMED_OFFSET] &
1481                                 FORMAT_UNIT_IMMED_MASK) != 0) {
1482                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
1483                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
1484                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1485                 goto out_mem;
1486         }
1487
1488         if (len == FORMAT_UNIT_LONG_PARM_LIST_LEN &&
1489             (parm_list[FORMAT_UNIT_PROT_INT_OFFSET] & 0x0F) != 0) {
1490                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
1491                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
1492                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1493                 goto out_mem;
1494         }
1495         pf_usage = parm_list[FORMAT_UNIT_PROT_FIELD_USAGE_OFFSET] &
1496                         FORMAT_UNIT_PROT_FIELD_USAGE_MASK;
1497         pf_code = (pf_usage << 2) | format_prot_info;
1498         switch (pf_code) {
1499         case 0:
1500                 *nvme_pf_code = 0;
1501                 break;
1502         case 2:
1503                 *nvme_pf_code = 1;
1504                 break;
1505         case 3:
1506                 *nvme_pf_code = 2;
1507                 break;
1508         case 7:
1509                 *nvme_pf_code = 3;
1510                 break;
1511         default:
1512                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
1513                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
1514                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1515                 break;
1516         }
1517
1518  out_mem:
1519         kfree(parm_list);
1520  out:
1521         return res;
1522 }
1523
1524 static int nvme_trans_fmt_send_cmd(struct nvme_ns *ns, struct sg_io_hdr *hdr,
1525                                    u8 prot_info)
1526 {
1527         int res;
1528         int nvme_sc;
1529         struct nvme_id_ns *id_ns;
1530         u8 i;
1531         u8 flbas, nlbaf;
1532         u8 selected_lbaf = 0xFF;
1533         u32 cdw10 = 0;
1534         struct nvme_command c;
1535
1536         /* Loop thru LBAF's in id_ns to match reqd lbaf, put in cdw10 */
1537         nvme_sc = nvme_identify_ns(ns->ctrl, ns->ns_id, &id_ns);
1538         res = nvme_trans_status_code(hdr, nvme_sc);
1539         if (res)
1540                 return res;
1541
1542         flbas = (id_ns->flbas) & 0x0F;
1543         nlbaf = id_ns->nlbaf;
1544
1545         for (i = 0; i < nlbaf; i++) {
1546                 if (ns->mode_select_block_len == (1 << (id_ns->lbaf[i].ds))) {
1547                         selected_lbaf = i;
1548                         break;
1549                 }
1550         }
1551         if (selected_lbaf > 0x0F) {
1552                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
1553                                 ILLEGAL_REQUEST, SCSI_ASC_INVALID_PARAMETER,
1554                                 SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1555         }
1556         if (ns->mode_select_num_blocks != le64_to_cpu(id_ns->ncap)) {
1557                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
1558                                 ILLEGAL_REQUEST, SCSI_ASC_INVALID_PARAMETER,
1559                                 SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1560         }
1561
1562         cdw10 |= prot_info << 5;
1563         cdw10 |= selected_lbaf & 0x0F;
1564         memset(&c, 0, sizeof(c));
1565         c.format.opcode = nvme_admin_format_nvm;
1566         c.format.nsid = cpu_to_le32(ns->ns_id);
1567         c.format.cdw10 = cpu_to_le32(cdw10);
1568
1569         nvme_sc = nvme_submit_sync_cmd(ns->ctrl->admin_q, &c, NULL, 0);
1570         res = nvme_trans_status_code(hdr, nvme_sc);
1571
1572         kfree(id_ns);
1573         return res;
1574 }
1575
1576 static inline u32 nvme_trans_io_get_num_cmds(struct sg_io_hdr *hdr,
1577                                         struct nvme_trans_io_cdb *cdb_info,
1578                                         u32 max_blocks)
1579 {
1580         /* If using iovecs, send one nvme command per vector */
1581         if (hdr->iovec_count > 0)
1582                 return hdr->iovec_count;
1583         else if (cdb_info->xfer_len > max_blocks)
1584                 return ((cdb_info->xfer_len - 1) / max_blocks) + 1;
1585         else
1586                 return 1;
1587 }
1588
1589 static u16 nvme_trans_io_get_control(struct nvme_ns *ns,
1590                                         struct nvme_trans_io_cdb *cdb_info)
1591 {
1592         u16 control = 0;
1593
1594         /* When Protection information support is added, implement here */
1595
1596         if (cdb_info->fua > 0)
1597                 control |= NVME_RW_FUA;
1598
1599         return control;
1600 }
1601
1602 static int nvme_trans_do_nvme_io(struct nvme_ns *ns, struct sg_io_hdr *hdr,
1603                                 struct nvme_trans_io_cdb *cdb_info, u8 is_write)
1604 {
1605         int nvme_sc = NVME_SC_SUCCESS;
1606         u32 num_cmds;
1607         u64 unit_len;
1608         u64 unit_num_blocks;    /* Number of blocks to xfer in each nvme cmd */
1609         u32 retcode;
1610         u32 i = 0;
1611         u64 nvme_offset = 0;
1612         void __user *next_mapping_addr;
1613         struct nvme_command c;
1614         u8 opcode = (is_write ? nvme_cmd_write : nvme_cmd_read);
1615         u16 control;
1616         u32 max_blocks = queue_max_hw_sectors(ns->queue);
1617
1618         num_cmds = nvme_trans_io_get_num_cmds(hdr, cdb_info, max_blocks);
1619
1620         /*
1621          * This loop handles two cases.
1622          * First, when an SGL is used in the form of an iovec list:
1623          *   - Use iov_base as the next mapping address for the nvme command_id
1624          *   - Use iov_len as the data transfer length for the command.
1625          * Second, when we have a single buffer
1626          *   - If larger than max_blocks, split into chunks, offset
1627          *        each nvme command accordingly.
1628          */
1629         for (i = 0; i < num_cmds; i++) {
1630                 memset(&c, 0, sizeof(c));
1631                 if (hdr->iovec_count > 0) {
1632                         struct sg_iovec sgl;
1633
1634                         retcode = copy_from_user(&sgl, hdr->dxferp +
1635                                         i * sizeof(struct sg_iovec),
1636                                         sizeof(struct sg_iovec));
1637                         if (retcode)
1638                                 return -EFAULT;
1639                         unit_len = sgl.iov_len;
1640                         unit_num_blocks = unit_len >> ns->lba_shift;
1641                         next_mapping_addr = sgl.iov_base;
1642                 } else {
1643                         unit_num_blocks = min((u64)max_blocks,
1644                                         (cdb_info->xfer_len - nvme_offset));
1645                         unit_len = unit_num_blocks << ns->lba_shift;
1646                         next_mapping_addr = hdr->dxferp +
1647                                         ((1 << ns->lba_shift) * nvme_offset);
1648                 }
1649
1650                 c.rw.opcode = opcode;
1651                 c.rw.nsid = cpu_to_le32(ns->ns_id);
1652                 c.rw.slba = cpu_to_le64(cdb_info->lba + nvme_offset);
1653                 c.rw.length = cpu_to_le16(unit_num_blocks - 1);
1654                 control = nvme_trans_io_get_control(ns, cdb_info);
1655                 c.rw.control = cpu_to_le16(control);
1656
1657                 if (get_capacity(ns->disk) - unit_num_blocks <
1658                                 cdb_info->lba + nvme_offset) {
1659                         nvme_sc = NVME_SC_LBA_RANGE;
1660                         break;
1661                 }
1662                 nvme_sc = nvme_submit_user_cmd(ns->queue, &c,
1663                                 next_mapping_addr, unit_len, NULL, 0);
1664                 if (nvme_sc)
1665                         break;
1666
1667                 nvme_offset += unit_num_blocks;
1668         }
1669
1670         return nvme_trans_status_code(hdr, nvme_sc);
1671 }
1672
1673
1674 /* SCSI Command Translation Functions */
1675
1676 static int nvme_trans_io(struct nvme_ns *ns, struct sg_io_hdr *hdr, u8 is_write,
1677                                                         u8 *cmd)
1678 {
1679         int res = 0;
1680         struct nvme_trans_io_cdb cdb_info = { 0, };
1681         u8 opcode = cmd[0];
1682         u64 xfer_bytes;
1683         u64 sum_iov_len = 0;
1684         struct sg_iovec sgl;
1685         int i;
1686         size_t not_copied;
1687
1688         /*
1689          * The FUA and WPROTECT fields are not supported in 6-byte CDBs,
1690          * but always in the same place for all others.
1691          */
1692         switch (opcode) {
1693         case WRITE_6:
1694         case READ_6:
1695                 break;
1696         default:
1697                 cdb_info.fua = cmd[1] & 0x8;
1698                 cdb_info.prot_info = (cmd[1] & 0xe0) >> 5;
1699                 if (cdb_info.prot_info && !ns->pi_type) {
1700                         return nvme_trans_completion(hdr,
1701                                         SAM_STAT_CHECK_CONDITION,
1702                                         ILLEGAL_REQUEST,
1703                                         SCSI_ASC_INVALID_CDB,
1704                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1705                 }
1706         }
1707
1708         switch (opcode) {
1709         case WRITE_6:
1710         case READ_6:
1711                 cdb_info.lba = get_unaligned_be24(&cmd[1]);
1712                 cdb_info.xfer_len = cmd[4];
1713                 if (cdb_info.xfer_len == 0)
1714                         cdb_info.xfer_len = 256;
1715                 break;
1716         case WRITE_10:
1717         case READ_10:
1718                 cdb_info.lba = get_unaligned_be32(&cmd[2]);
1719                 cdb_info.xfer_len = get_unaligned_be16(&cmd[7]);
1720                 break;
1721         case WRITE_12:
1722         case READ_12:
1723                 cdb_info.lba = get_unaligned_be32(&cmd[2]);
1724                 cdb_info.xfer_len = get_unaligned_be32(&cmd[6]);
1725                 break;
1726         case WRITE_16:
1727         case READ_16:
1728                 cdb_info.lba = get_unaligned_be64(&cmd[2]);
1729                 cdb_info.xfer_len = get_unaligned_be32(&cmd[10]);
1730                 break;
1731         default:
1732                 /* Will never really reach here */
1733                 res = -EIO;
1734                 goto out;
1735         }
1736
1737         /* Calculate total length of transfer (in bytes) */
1738         if (hdr->iovec_count > 0) {
1739                 for (i = 0; i < hdr->iovec_count; i++) {
1740                         not_copied = copy_from_user(&sgl, hdr->dxferp +
1741                                                 i * sizeof(struct sg_iovec),
1742                                                 sizeof(struct sg_iovec));
1743                         if (not_copied)
1744                                 return -EFAULT;
1745                         sum_iov_len += sgl.iov_len;
1746                         /* IO vector sizes should be multiples of block size */
1747                         if (sgl.iov_len % (1 << ns->lba_shift) != 0) {
1748                                 res = nvme_trans_completion(hdr,
1749                                                 SAM_STAT_CHECK_CONDITION,
1750                                                 ILLEGAL_REQUEST,
1751                                                 SCSI_ASC_INVALID_PARAMETER,
1752                                                 SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1753                                 goto out;
1754                         }
1755                 }
1756         } else {
1757                 sum_iov_len = hdr->dxfer_len;
1758         }
1759
1760         /* As Per sg ioctl howto, if the lengths differ, use the lower one */
1761         xfer_bytes = min(((u64)hdr->dxfer_len), sum_iov_len);
1762
1763         /* If block count and actual data buffer size dont match, error out */
1764         if (xfer_bytes != (cdb_info.xfer_len << ns->lba_shift)) {
1765                 res = -EINVAL;
1766                 goto out;
1767         }
1768
1769         /* Check for 0 length transfer - it is not illegal */
1770         if (cdb_info.xfer_len == 0)
1771                 goto out;
1772
1773         /* Send NVMe IO Command(s) */
1774         res = nvme_trans_do_nvme_io(ns, hdr, &cdb_info, is_write);
1775         if (res)
1776                 goto out;
1777
1778  out:
1779         return res;
1780 }
1781
1782 static int nvme_trans_inquiry(struct nvme_ns *ns, struct sg_io_hdr *hdr,
1783                                                         u8 *cmd)
1784 {
1785         int res = 0;
1786         u8 evpd;
1787         u8 page_code;
1788         int alloc_len;
1789         u8 *inq_response;
1790
1791         evpd = cmd[1] & 0x01;
1792         page_code = cmd[2];
1793         alloc_len = get_unaligned_be16(&cmd[3]);
1794
1795         inq_response = kmalloc(max(alloc_len, STANDARD_INQUIRY_LENGTH),
1796                                 GFP_KERNEL);
1797         if (inq_response == NULL) {
1798                 res = -ENOMEM;
1799                 goto out_mem;
1800         }
1801
1802         if (evpd == 0) {
1803                 if (page_code == INQ_STANDARD_INQUIRY_PAGE) {
1804                         res = nvme_trans_standard_inquiry_page(ns, hdr,
1805                                                 inq_response, alloc_len);
1806                 } else {
1807                         res = nvme_trans_completion(hdr,
1808                                                 SAM_STAT_CHECK_CONDITION,
1809                                                 ILLEGAL_REQUEST,
1810                                                 SCSI_ASC_INVALID_CDB,
1811                                                 SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1812                 }
1813         } else {
1814                 switch (page_code) {
1815                 case VPD_SUPPORTED_PAGES:
1816                         res = nvme_trans_supported_vpd_pages(ns, hdr,
1817                                                 inq_response, alloc_len);
1818                         break;
1819                 case VPD_SERIAL_NUMBER:
1820                         res = nvme_trans_unit_serial_page(ns, hdr, inq_response,
1821                                                                 alloc_len);
1822                         break;
1823                 case VPD_DEVICE_IDENTIFIERS:
1824                         res = nvme_trans_device_id_page(ns, hdr, inq_response,
1825                                                                 alloc_len);
1826                         break;
1827                 case VPD_EXTENDED_INQUIRY:
1828                         res = nvme_trans_ext_inq_page(ns, hdr, alloc_len);
1829                         break;
1830                 case VPD_BLOCK_LIMITS:
1831                         res = nvme_trans_bdev_limits_page(ns, hdr, inq_response,
1832                                                                 alloc_len);
1833                         break;
1834                 case VPD_BLOCK_DEV_CHARACTERISTICS:
1835                         res = nvme_trans_bdev_char_page(ns, hdr, alloc_len);
1836                         break;
1837                 default:
1838                         res = nvme_trans_completion(hdr,
1839                                                 SAM_STAT_CHECK_CONDITION,
1840                                                 ILLEGAL_REQUEST,
1841                                                 SCSI_ASC_INVALID_CDB,
1842                                                 SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1843                         break;
1844                 }
1845         }
1846         kfree(inq_response);
1847  out_mem:
1848         return res;
1849 }
1850
1851 static int nvme_trans_log_sense(struct nvme_ns *ns, struct sg_io_hdr *hdr,
1852                                                         u8 *cmd)
1853 {
1854         int res;
1855         u16 alloc_len;
1856         u8 pc;
1857         u8 page_code;
1858
1859         if (cmd[1] != LOG_SENSE_CDB_SP_NOT_ENABLED) {
1860                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
1861                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
1862                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1863                 goto out;
1864         }
1865
1866         page_code = cmd[2] & LOG_SENSE_CDB_PAGE_CODE_MASK;
1867         pc = (cmd[2] & LOG_SENSE_CDB_PC_MASK) >> LOG_SENSE_CDB_PC_SHIFT;
1868         if (pc != LOG_SENSE_CDB_PC_CUMULATIVE_VALUES) {
1869                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
1870                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
1871                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1872                 goto out;
1873         }
1874         alloc_len = get_unaligned_be16(&cmd[7]);
1875         switch (page_code) {
1876         case LOG_PAGE_SUPPORTED_LOG_PAGES_PAGE:
1877                 res = nvme_trans_log_supp_pages(ns, hdr, alloc_len);
1878                 break;
1879         case LOG_PAGE_INFORMATIONAL_EXCEPTIONS_PAGE:
1880                 res = nvme_trans_log_info_exceptions(ns, hdr, alloc_len);
1881                 break;
1882         case LOG_PAGE_TEMPERATURE_PAGE:
1883                 res = nvme_trans_log_temperature(ns, hdr, alloc_len);
1884                 break;
1885         default:
1886                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
1887                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
1888                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1889                 break;
1890         }
1891
1892  out:
1893         return res;
1894 }
1895
1896 static int nvme_trans_mode_select(struct nvme_ns *ns, struct sg_io_hdr *hdr,
1897                                                         u8 *cmd)
1898 {
1899         u8 cdb10 = 0;
1900         u16 parm_list_len;
1901         u8 page_format;
1902         u8 save_pages;
1903
1904         page_format = cmd[1] & MODE_SELECT_CDB_PAGE_FORMAT_MASK;
1905         save_pages = cmd[1] & MODE_SELECT_CDB_SAVE_PAGES_MASK;
1906
1907         if (cmd[0] == MODE_SELECT) {
1908                 parm_list_len = cmd[4];
1909         } else {
1910                 parm_list_len = cmd[7];
1911                 cdb10 = 1;
1912         }
1913
1914         if (parm_list_len != 0) {
1915                 /*
1916                  * According to SPC-4 r24, a paramter list length field of 0
1917                  * shall not be considered an error
1918                  */
1919                 return nvme_trans_modesel_data(ns, hdr, cmd, parm_list_len,
1920                                                 page_format, save_pages, cdb10);
1921         }
1922
1923         return 0;
1924 }
1925
1926 static int nvme_trans_mode_sense(struct nvme_ns *ns, struct sg_io_hdr *hdr,
1927                                                         u8 *cmd)
1928 {
1929         int res = 0;
1930         u16 alloc_len;
1931         u8 cdb10 = 0;
1932
1933         if (cmd[0] == MODE_SENSE) {
1934                 alloc_len = cmd[4];
1935         } else {
1936                 alloc_len = get_unaligned_be16(&cmd[7]);
1937                 cdb10 = 1;
1938         }
1939
1940         if ((cmd[2] & MODE_SENSE_PAGE_CONTROL_MASK) !=
1941                         MODE_SENSE_PC_CURRENT_VALUES) {
1942                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
1943                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
1944                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1945                 goto out;
1946         }
1947
1948         switch (cmd[2] & MODE_SENSE_PAGE_CODE_MASK) {
1949         case MODE_PAGE_CACHING:
1950                 res = nvme_trans_mode_page_create(ns, hdr, cmd, alloc_len,
1951                                                 cdb10,
1952                                                 &nvme_trans_fill_caching_page,
1953                                                 MODE_PAGE_CACHING_LEN);
1954                 break;
1955         case MODE_PAGE_CONTROL:
1956                 res = nvme_trans_mode_page_create(ns, hdr, cmd, alloc_len,
1957                                                 cdb10,
1958                                                 &nvme_trans_fill_control_page,
1959                                                 MODE_PAGE_CONTROL_LEN);
1960                 break;
1961         case MODE_PAGE_POWER_CONDITION:
1962                 res = nvme_trans_mode_page_create(ns, hdr, cmd, alloc_len,
1963                                                 cdb10,
1964                                                 &nvme_trans_fill_pow_cnd_page,
1965                                                 MODE_PAGE_POW_CND_LEN);
1966                 break;
1967         case MODE_PAGE_INFO_EXCEP:
1968                 res = nvme_trans_mode_page_create(ns, hdr, cmd, alloc_len,
1969                                                 cdb10,
1970                                                 &nvme_trans_fill_inf_exc_page,
1971                                                 MODE_PAGE_INF_EXC_LEN);
1972                 break;
1973         case MODE_PAGE_RETURN_ALL:
1974                 res = nvme_trans_mode_page_create(ns, hdr, cmd, alloc_len,
1975                                                 cdb10,
1976                                                 &nvme_trans_fill_all_pages,
1977                                                 MODE_PAGE_ALL_LEN);
1978                 break;
1979         default:
1980                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
1981                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
1982                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
1983                 break;
1984         }
1985
1986  out:
1987         return res;
1988 }
1989
1990 static int nvme_trans_read_capacity(struct nvme_ns *ns, struct sg_io_hdr *hdr,
1991                                                         u8 *cmd, u8 cdb16)
1992 {
1993         int res;
1994         int nvme_sc;
1995         u32 alloc_len;
1996         u32 resp_size;
1997         u32 xfer_len;
1998         struct nvme_id_ns *id_ns;
1999         u8 *response;
2000
2001         if (cdb16) {
2002                 alloc_len = get_unaligned_be32(&cmd[10]);
2003                 resp_size = READ_CAP_16_RESP_SIZE;
2004         } else {
2005                 alloc_len = READ_CAP_10_RESP_SIZE;
2006                 resp_size = READ_CAP_10_RESP_SIZE;
2007         }
2008
2009         nvme_sc = nvme_identify_ns(ns->ctrl, ns->ns_id, &id_ns);
2010         res = nvme_trans_status_code(hdr, nvme_sc);
2011         if (res)
2012                 return res;
2013
2014         response = kzalloc(resp_size, GFP_KERNEL);
2015         if (response == NULL) {
2016                 res = -ENOMEM;
2017                 goto out_free_id;
2018         }
2019         nvme_trans_fill_read_cap(response, id_ns, cdb16);
2020
2021         xfer_len = min(alloc_len, resp_size);
2022         res = nvme_trans_copy_to_user(hdr, response, xfer_len);
2023
2024         kfree(response);
2025  out_free_id:
2026         kfree(id_ns);
2027         return res;
2028 }
2029
2030 static int nvme_trans_report_luns(struct nvme_ns *ns, struct sg_io_hdr *hdr,
2031                                                         u8 *cmd)
2032 {
2033         int res;
2034         int nvme_sc;
2035         u32 alloc_len, xfer_len, resp_size;
2036         u8 *response;
2037         struct nvme_id_ctrl *id_ctrl;
2038         u32 ll_length, lun_id;
2039         u8 lun_id_offset = REPORT_LUNS_FIRST_LUN_OFFSET;
2040         __be32 tmp_len;
2041
2042         switch (cmd[2]) {
2043         default:
2044                 return nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
2045                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
2046                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
2047         case ALL_LUNS_RETURNED:
2048         case ALL_WELL_KNOWN_LUNS_RETURNED:
2049         case RESTRICTED_LUNS_RETURNED:
2050                 nvme_sc = nvme_identify_ctrl(ns->ctrl, &id_ctrl);
2051                 res = nvme_trans_status_code(hdr, nvme_sc);
2052                 if (res)
2053                         return res;
2054
2055                 ll_length = le32_to_cpu(id_ctrl->nn) * LUN_ENTRY_SIZE;
2056                 resp_size = ll_length + LUN_DATA_HEADER_SIZE;
2057
2058                 alloc_len = get_unaligned_be32(&cmd[6]);
2059                 if (alloc_len < resp_size) {
2060                         res = nvme_trans_completion(hdr,
2061                                         SAM_STAT_CHECK_CONDITION,
2062                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
2063                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
2064                         goto out_free_id;
2065                 }
2066
2067                 response = kzalloc(resp_size, GFP_KERNEL);
2068                 if (response == NULL) {
2069                         res = -ENOMEM;
2070                         goto out_free_id;
2071                 }
2072
2073                 /* The first LUN ID will always be 0 per the SAM spec */
2074                 for (lun_id = 0; lun_id < le32_to_cpu(id_ctrl->nn); lun_id++) {
2075                         /*
2076                          * Set the LUN Id and then increment to the next LUN
2077                          * location in the parameter data.
2078                          */
2079                         __be64 tmp_id = cpu_to_be64(lun_id);
2080                         memcpy(&response[lun_id_offset], &tmp_id, sizeof(u64));
2081                         lun_id_offset += LUN_ENTRY_SIZE;
2082                 }
2083                 tmp_len = cpu_to_be32(ll_length);
2084                 memcpy(response, &tmp_len, sizeof(u32));
2085         }
2086
2087         xfer_len = min(alloc_len, resp_size);
2088         res = nvme_trans_copy_to_user(hdr, response, xfer_len);
2089
2090         kfree(response);
2091  out_free_id:
2092         kfree(id_ctrl);
2093         return res;
2094 }
2095
2096 static int nvme_trans_request_sense(struct nvme_ns *ns, struct sg_io_hdr *hdr,
2097                                                         u8 *cmd)
2098 {
2099         int res;
2100         u8 alloc_len, xfer_len, resp_size;
2101         u8 desc_format;
2102         u8 *response;
2103
2104         desc_format = cmd[1] & 0x01;
2105         alloc_len = cmd[4];
2106
2107         resp_size = ((desc_format) ? (DESC_FMT_SENSE_DATA_SIZE) :
2108                                         (FIXED_FMT_SENSE_DATA_SIZE));
2109         response = kzalloc(resp_size, GFP_KERNEL);
2110         if (response == NULL) {
2111                 res = -ENOMEM;
2112                 goto out;
2113         }
2114
2115         if (desc_format) {
2116                 /* Descriptor Format Sense Data */
2117                 response[0] = DESC_FORMAT_SENSE_DATA;
2118                 response[1] = NO_SENSE;
2119                 /* TODO How is LOW POWER CONDITION ON handled? (byte 2) */
2120                 response[2] = SCSI_ASC_NO_SENSE;
2121                 response[3] = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
2122                 /* SDAT_OVFL = 0 | Additional Sense Length = 0 */
2123         } else {
2124                 /* Fixed Format Sense Data */
2125                 response[0] = FIXED_SENSE_DATA;
2126                 /* Byte 1 = Obsolete */
2127                 response[2] = NO_SENSE; /* FM, EOM, ILI, SDAT_OVFL = 0 */
2128                 /* Bytes 3-6 - Information - set to zero */
2129                 response[7] = FIXED_SENSE_DATA_ADD_LENGTH;
2130                 /* Bytes 8-11 - Cmd Specific Information - set to zero */
2131                 response[12] = SCSI_ASC_NO_SENSE;
2132                 response[13] = SCSI_ASCQ_CAUSE_NOT_REPORTABLE;
2133                 /* Byte 14 = Field Replaceable Unit Code = 0 */
2134                 /* Bytes 15-17 - SKSV=0; Sense Key Specific = 0 */
2135         }
2136
2137         xfer_len = min(alloc_len, resp_size);
2138         res = nvme_trans_copy_to_user(hdr, response, xfer_len);
2139
2140         kfree(response);
2141  out:
2142         return res;
2143 }
2144
2145 static int nvme_trans_security_protocol(struct nvme_ns *ns,
2146                                         struct sg_io_hdr *hdr,
2147                                         u8 *cmd)
2148 {
2149         return nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
2150                                 ILLEGAL_REQUEST, SCSI_ASC_ILLEGAL_COMMAND,
2151                                 SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
2152 }
2153
2154 static int nvme_trans_synchronize_cache(struct nvme_ns *ns,
2155                                         struct sg_io_hdr *hdr)
2156 {
2157         int nvme_sc;
2158         struct nvme_command c;
2159
2160         memset(&c, 0, sizeof(c));
2161         c.common.opcode = nvme_cmd_flush;
2162         c.common.nsid = cpu_to_le32(ns->ns_id);
2163
2164         nvme_sc = nvme_submit_sync_cmd(ns->queue, &c, NULL, 0);
2165         return nvme_trans_status_code(hdr, nvme_sc);
2166 }
2167
2168 static int nvme_trans_start_stop(struct nvme_ns *ns, struct sg_io_hdr *hdr,
2169                                                         u8 *cmd)
2170 {
2171         u8 immed, pcmod, no_flush, start;
2172
2173         immed = cmd[1] & 0x01;
2174         pcmod = cmd[3] & 0x0f;
2175         no_flush = cmd[4] & 0x04;
2176         start = cmd[4] & 0x01;
2177
2178         if (immed != 0) {
2179                 return nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
2180                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
2181                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
2182         } else {
2183                 if (no_flush == 0) {
2184                         /* Issue NVME FLUSH command prior to START STOP UNIT */
2185                         int res = nvme_trans_synchronize_cache(ns, hdr);
2186                         if (res)
2187                                 return res;
2188                 }
2189
2190                 return 0;
2191         }
2192 }
2193
2194 static int nvme_trans_format_unit(struct nvme_ns *ns, struct sg_io_hdr *hdr,
2195                                                         u8 *cmd)
2196 {
2197         int res;
2198         u8 parm_hdr_len = 0;
2199         u8 nvme_pf_code = 0;
2200         u8 format_prot_info, long_list, format_data;
2201
2202         format_prot_info = (cmd[1] & 0xc0) >> 6;
2203         long_list = cmd[1] & 0x20;
2204         format_data = cmd[1] & 0x10;
2205
2206         if (format_data != 0) {
2207                 if (format_prot_info != 0) {
2208                         if (long_list == 0)
2209                                 parm_hdr_len = FORMAT_UNIT_SHORT_PARM_LIST_LEN;
2210                         else
2211                                 parm_hdr_len = FORMAT_UNIT_LONG_PARM_LIST_LEN;
2212                 }
2213         } else if (format_data == 0 && format_prot_info != 0) {
2214                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
2215                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
2216                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
2217                 goto out;
2218         }
2219
2220         /* Get parm header from data-in/out buffer */
2221         /*
2222          * According to the translation spec, the only fields in the parameter
2223          * list we are concerned with are in the header. So allocate only that.
2224          */
2225         if (parm_hdr_len > 0) {
2226                 res = nvme_trans_fmt_get_parm_header(hdr, parm_hdr_len,
2227                                         format_prot_info, &nvme_pf_code);
2228                 if (res)
2229                         goto out;
2230         }
2231
2232         /* Attempt to activate any previously downloaded firmware image */
2233         res = nvme_trans_send_activate_fw_cmd(ns, hdr, 0);
2234
2235         /* Determine Block size and count and send format command */
2236         res = nvme_trans_fmt_set_blk_size_count(ns, hdr);
2237         if (res)
2238                 goto out;
2239
2240         res = nvme_trans_fmt_send_cmd(ns, hdr, nvme_pf_code);
2241
2242  out:
2243         return res;
2244 }
2245
2246 static int nvme_trans_test_unit_ready(struct nvme_ns *ns,
2247                                         struct sg_io_hdr *hdr,
2248                                         u8 *cmd)
2249 {
2250         if (nvme_ctrl_ready(ns->ctrl))
2251                 return nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
2252                                             NOT_READY, SCSI_ASC_LUN_NOT_READY,
2253                                             SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
2254         else
2255                 return nvme_trans_completion(hdr, SAM_STAT_GOOD, NO_SENSE, 0, 0);
2256 }
2257
2258 static int nvme_trans_write_buffer(struct nvme_ns *ns, struct sg_io_hdr *hdr,
2259                                                         u8 *cmd)
2260 {
2261         int res = 0;
2262         u32 buffer_offset, parm_list_length;
2263         u8 buffer_id, mode;
2264
2265         parm_list_length = get_unaligned_be24(&cmd[6]);
2266         if (parm_list_length % BYTES_TO_DWORDS != 0) {
2267                 /* NVMe expects Firmware file to be a whole number of DWORDS */
2268                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
2269                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
2270                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
2271                 goto out;
2272         }
2273         buffer_id = cmd[2];
2274         if (buffer_id > NVME_MAX_FIRMWARE_SLOT) {
2275                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
2276                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
2277                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
2278                 goto out;
2279         }
2280         mode = cmd[1] & 0x1f;
2281         buffer_offset = get_unaligned_be24(&cmd[3]);
2282
2283         switch (mode) {
2284         case DOWNLOAD_SAVE_ACTIVATE:
2285                 res = nvme_trans_send_download_fw_cmd(ns, hdr, nvme_admin_download_fw,
2286                                                 parm_list_length, buffer_offset,
2287                                                 buffer_id);
2288                 if (res)
2289                         goto out;
2290                 res = nvme_trans_send_activate_fw_cmd(ns, hdr, buffer_id);
2291                 break;
2292         case DOWNLOAD_SAVE_DEFER_ACTIVATE:
2293                 res = nvme_trans_send_download_fw_cmd(ns, hdr, nvme_admin_download_fw,
2294                                                 parm_list_length, buffer_offset,
2295                                                 buffer_id);
2296                 break;
2297         case ACTIVATE_DEFERRED_MICROCODE:
2298                 res = nvme_trans_send_activate_fw_cmd(ns, hdr, buffer_id);
2299                 break;
2300         default:
2301                 res = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
2302                                         ILLEGAL_REQUEST, SCSI_ASC_INVALID_CDB,
2303                                         SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
2304                 break;
2305         }
2306
2307  out:
2308         return res;
2309 }
2310
2311 struct scsi_unmap_blk_desc {
2312         __be64  slba;
2313         __be32  nlb;
2314         u32     resv;
2315 };
2316
2317 struct scsi_unmap_parm_list {
2318         __be16  unmap_data_len;
2319         __be16  unmap_blk_desc_data_len;
2320         u32     resv;
2321         struct scsi_unmap_blk_desc desc[0];
2322 };
2323
2324 static int nvme_trans_unmap(struct nvme_ns *ns, struct sg_io_hdr *hdr,
2325                                                         u8 *cmd)
2326 {
2327         struct scsi_unmap_parm_list *plist;
2328         struct nvme_dsm_range *range;
2329         struct nvme_command c;
2330         int i, nvme_sc, res;
2331         u16 ndesc, list_len;
2332
2333         list_len = get_unaligned_be16(&cmd[7]);
2334         if (!list_len)
2335                 return -EINVAL;
2336
2337         plist = kmalloc(list_len, GFP_KERNEL);
2338         if (!plist)
2339                 return -ENOMEM;
2340
2341         res = nvme_trans_copy_from_user(hdr, plist, list_len);
2342         if (res)
2343                 goto out;
2344
2345         ndesc = be16_to_cpu(plist->unmap_blk_desc_data_len) >> 4;
2346         if (!ndesc || ndesc > 256) {
2347                 res = -EINVAL;
2348                 goto out;
2349         }
2350
2351         range = kcalloc(ndesc, sizeof(*range), GFP_KERNEL);
2352         if (!range) {
2353                 res = -ENOMEM;
2354                 goto out;
2355         }
2356
2357         for (i = 0; i < ndesc; i++) {
2358                 range[i].nlb = cpu_to_le32(be32_to_cpu(plist->desc[i].nlb));
2359                 range[i].slba = cpu_to_le64(be64_to_cpu(plist->desc[i].slba));
2360                 range[i].cattr = 0;
2361         }
2362
2363         memset(&c, 0, sizeof(c));
2364         c.dsm.opcode = nvme_cmd_dsm;
2365         c.dsm.nsid = cpu_to_le32(ns->ns_id);
2366         c.dsm.nr = cpu_to_le32(ndesc - 1);
2367         c.dsm.attributes = cpu_to_le32(NVME_DSMGMT_AD);
2368
2369         nvme_sc = nvme_submit_sync_cmd(ns->queue, &c, range,
2370                         ndesc * sizeof(*range));
2371         res = nvme_trans_status_code(hdr, nvme_sc);
2372
2373         kfree(range);
2374  out:
2375         kfree(plist);
2376         return res;
2377 }
2378
2379 static int nvme_scsi_translate(struct nvme_ns *ns, struct sg_io_hdr *hdr)
2380 {
2381         u8 cmd[BLK_MAX_CDB];
2382         int retcode;
2383         unsigned int opcode;
2384
2385         if (hdr->cmdp == NULL)
2386                 return -EMSGSIZE;
2387         if (copy_from_user(cmd, hdr->cmdp, hdr->cmd_len))
2388                 return -EFAULT;
2389
2390         /*
2391          * Prime the hdr with good status for scsi commands that don't require
2392          * an nvme command for translation.
2393          */
2394         retcode = nvme_trans_status_code(hdr, NVME_SC_SUCCESS);
2395         if (retcode)
2396                 return retcode;
2397
2398         opcode = cmd[0];
2399
2400         switch (opcode) {
2401         case READ_6:
2402         case READ_10:
2403         case READ_12:
2404         case READ_16:
2405                 retcode = nvme_trans_io(ns, hdr, 0, cmd);
2406                 break;
2407         case WRITE_6:
2408         case WRITE_10:
2409         case WRITE_12:
2410         case WRITE_16:
2411                 retcode = nvme_trans_io(ns, hdr, 1, cmd);
2412                 break;
2413         case INQUIRY:
2414                 retcode = nvme_trans_inquiry(ns, hdr, cmd);
2415                 break;
2416         case LOG_SENSE:
2417                 retcode = nvme_trans_log_sense(ns, hdr, cmd);
2418                 break;
2419         case MODE_SELECT:
2420         case MODE_SELECT_10:
2421                 retcode = nvme_trans_mode_select(ns, hdr, cmd);
2422                 break;
2423         case MODE_SENSE:
2424         case MODE_SENSE_10:
2425                 retcode = nvme_trans_mode_sense(ns, hdr, cmd);
2426                 break;
2427         case READ_CAPACITY:
2428                 retcode = nvme_trans_read_capacity(ns, hdr, cmd, 0);
2429                 break;
2430         case SERVICE_ACTION_IN_16:
2431                 switch (cmd[1]) {
2432                 case SAI_READ_CAPACITY_16:
2433                         retcode = nvme_trans_read_capacity(ns, hdr, cmd, 1);
2434                         break;
2435                 default:
2436                         goto out;
2437                 }
2438                 break;
2439         case REPORT_LUNS:
2440                 retcode = nvme_trans_report_luns(ns, hdr, cmd);
2441                 break;
2442         case REQUEST_SENSE:
2443                 retcode = nvme_trans_request_sense(ns, hdr, cmd);
2444                 break;
2445         case SECURITY_PROTOCOL_IN:
2446         case SECURITY_PROTOCOL_OUT:
2447                 retcode = nvme_trans_security_protocol(ns, hdr, cmd);
2448                 break;
2449         case START_STOP:
2450                 retcode = nvme_trans_start_stop(ns, hdr, cmd);
2451                 break;
2452         case SYNCHRONIZE_CACHE:
2453                 retcode = nvme_trans_synchronize_cache(ns, hdr);
2454                 break;
2455         case FORMAT_UNIT:
2456                 retcode = nvme_trans_format_unit(ns, hdr, cmd);
2457                 break;
2458         case TEST_UNIT_READY:
2459                 retcode = nvme_trans_test_unit_ready(ns, hdr, cmd);
2460                 break;
2461         case WRITE_BUFFER:
2462                 retcode = nvme_trans_write_buffer(ns, hdr, cmd);
2463                 break;
2464         case UNMAP:
2465                 retcode = nvme_trans_unmap(ns, hdr, cmd);
2466                 break;
2467         default:
2468  out:
2469                 retcode = nvme_trans_completion(hdr, SAM_STAT_CHECK_CONDITION,
2470                                 ILLEGAL_REQUEST, SCSI_ASC_ILLEGAL_COMMAND,
2471                                 SCSI_ASCQ_CAUSE_NOT_REPORTABLE);
2472                 break;
2473         }
2474         return retcode;
2475 }
2476
2477 int nvme_sg_io(struct nvme_ns *ns, struct sg_io_hdr __user *u_hdr)
2478 {
2479         struct sg_io_hdr hdr;
2480         int retcode;
2481
2482         if (!capable(CAP_SYS_ADMIN))
2483                 return -EACCES;
2484         if (copy_from_user(&hdr, u_hdr, sizeof(hdr)))
2485                 return -EFAULT;
2486         if (hdr.interface_id != 'S')
2487                 return -EINVAL;
2488         if (hdr.cmd_len > BLK_MAX_CDB)
2489                 return -EINVAL;
2490
2491         /*
2492          * A positive return code means a NVMe status, which has been
2493          * translated to sense data.
2494          */
2495         retcode = nvme_scsi_translate(ns, &hdr);
2496         if (retcode < 0)
2497                 return retcode;
2498         if (copy_to_user(u_hdr, &hdr, sizeof(sg_io_hdr_t)) > 0)
2499                 return -EFAULT;
2500         return 0;
2501 }
2502
2503 int nvme_sg_get_version_num(int __user *ip)
2504 {
2505         return put_user(sg_version_num, ip);
2506 }