ide-cd: prevent null pointer deref via cdrom_newpc_intr
[linux-2.6] / drivers / ide / ide-cd.c
1 /*
2  * ATAPI CD-ROM driver.
3  *
4  * Copyright (C) 1994-1996   Scott Snyder <snyder@fnald0.fnal.gov>
5  * Copyright (C) 1996-1998   Erik Andersen <andersee@debian.org>
6  * Copyright (C) 1998-2000   Jens Axboe <axboe@suse.de>
7  * Copyright (C) 2005, 2007-2009  Bartlomiej Zolnierkiewicz
8  *
9  * May be copied or modified under the terms of the GNU General Public
10  * License.  See linux/COPYING for more information.
11  *
12  * See Documentation/cdrom/ide-cd for usage information.
13  *
14  * Suggestions are welcome. Patches that work are more welcome though. ;-)
15  *
16  * Documentation:
17  *      Mt. Fuji (SFF8090 version 4) and ATAPI (SFF-8020i rev 2.6) standards.
18  *
19  * For historical changelog please see:
20  *      Documentation/ide/ChangeLog.ide-cd.1994-2004
21  */
22
23 #define DRV_NAME "ide-cd"
24 #define PFX DRV_NAME ": "
25
26 #define IDECD_VERSION "5.00"
27
28 #include <linux/module.h>
29 #include <linux/types.h>
30 #include <linux/kernel.h>
31 #include <linux/delay.h>
32 #include <linux/timer.h>
33 #include <linux/slab.h>
34 #include <linux/interrupt.h>
35 #include <linux/errno.h>
36 #include <linux/cdrom.h>
37 #include <linux/ide.h>
38 #include <linux/completion.h>
39 #include <linux/mutex.h>
40 #include <linux/bcd.h>
41
42 /* For SCSI -> ATAPI command conversion */
43 #include <scsi/scsi.h>
44
45 #include <linux/irq.h>
46 #include <linux/io.h>
47 #include <asm/byteorder.h>
48 #include <linux/uaccess.h>
49 #include <asm/unaligned.h>
50
51 #include "ide-cd.h"
52
53 static DEFINE_MUTEX(idecd_ref_mutex);
54
55 static void ide_cd_release(struct device *);
56
57 static struct cdrom_info *ide_cd_get(struct gendisk *disk)
58 {
59         struct cdrom_info *cd = NULL;
60
61         mutex_lock(&idecd_ref_mutex);
62         cd = ide_drv_g(disk, cdrom_info);
63         if (cd) {
64                 if (ide_device_get(cd->drive))
65                         cd = NULL;
66                 else
67                         get_device(&cd->dev);
68
69         }
70         mutex_unlock(&idecd_ref_mutex);
71         return cd;
72 }
73
74 static void ide_cd_put(struct cdrom_info *cd)
75 {
76         ide_drive_t *drive = cd->drive;
77
78         mutex_lock(&idecd_ref_mutex);
79         put_device(&cd->dev);
80         ide_device_put(drive);
81         mutex_unlock(&idecd_ref_mutex);
82 }
83
84 /*
85  * Generic packet command support and error handling routines.
86  */
87
88 /* Mark that we've seen a media change and invalidate our internal buffers. */
89 static void cdrom_saw_media_change(ide_drive_t *drive)
90 {
91         drive->dev_flags |= IDE_DFLAG_MEDIA_CHANGED;
92         drive->atapi_flags &= ~IDE_AFLAG_TOC_VALID;
93 }
94
95 static int cdrom_log_sense(ide_drive_t *drive, struct request *rq)
96 {
97         struct request_sense *sense = &drive->sense_data;
98         int log = 0;
99
100         if (!sense || !rq || (rq->cmd_flags & REQ_QUIET))
101                 return 0;
102
103         ide_debug_log(IDE_DBG_SENSE, "sense_key: 0x%x", sense->sense_key);
104
105         switch (sense->sense_key) {
106         case NO_SENSE:
107         case RECOVERED_ERROR:
108                 break;
109         case NOT_READY:
110                 /*
111                  * don't care about tray state messages for e.g. capacity
112                  * commands or in-progress or becoming ready
113                  */
114                 if (sense->asc == 0x3a || sense->asc == 0x04)
115                         break;
116                 log = 1;
117                 break;
118         case ILLEGAL_REQUEST:
119                 /*
120                  * don't log START_STOP unit with LoEj set, since we cannot
121                  * reliably check if drive can auto-close
122                  */
123                 if (rq->cmd[0] == GPCMD_START_STOP_UNIT && sense->asc == 0x24)
124                         break;
125                 log = 1;
126                 break;
127         case UNIT_ATTENTION:
128                 /*
129                  * Make good and sure we've seen this potential media change.
130                  * Some drives (i.e. Creative) fail to present the correct sense
131                  * key in the error register.
132                  */
133                 cdrom_saw_media_change(drive);
134                 break;
135         default:
136                 log = 1;
137                 break;
138         }
139         return log;
140 }
141
142 static void cdrom_analyze_sense_data(ide_drive_t *drive,
143                                      struct request *failed_command)
144 {
145         struct request_sense *sense = &drive->sense_data;
146         struct cdrom_info *info = drive->driver_data;
147         unsigned long sector;
148         unsigned long bio_sectors;
149
150         ide_debug_log(IDE_DBG_SENSE, "error_code: 0x%x, sense_key: 0x%x",
151                                      sense->error_code, sense->sense_key);
152
153         if (failed_command)
154                 ide_debug_log(IDE_DBG_SENSE, "failed cmd: 0x%x",
155                                              failed_command->cmd[0]);
156
157         if (!cdrom_log_sense(drive, failed_command))
158                 return;
159
160         /*
161          * If a read toc is executed for a CD-R or CD-RW medium where the first
162          * toc has not been recorded yet, it will fail with 05/24/00 (which is a
163          * confusing error)
164          */
165         if (failed_command && failed_command->cmd[0] == GPCMD_READ_TOC_PMA_ATIP)
166                 if (sense->sense_key == 0x05 && sense->asc == 0x24)
167                         return;
168
169         /* current error */
170         if (sense->error_code == 0x70) {
171                 switch (sense->sense_key) {
172                 case MEDIUM_ERROR:
173                 case VOLUME_OVERFLOW:
174                 case ILLEGAL_REQUEST:
175                         if (!sense->valid)
176                                 break;
177                         if (failed_command == NULL ||
178                                         !blk_fs_request(failed_command))
179                                 break;
180                         sector = (sense->information[0] << 24) |
181                                  (sense->information[1] << 16) |
182                                  (sense->information[2] <<  8) |
183                                  (sense->information[3]);
184
185                         if (queue_logical_block_size(drive->queue) == 2048)
186                                 /* device sector size is 2K */
187                                 sector <<= 2;
188
189                         bio_sectors = max(bio_sectors(failed_command->bio), 4U);
190                         sector &= ~(bio_sectors - 1);
191
192                         /*
193                          * The SCSI specification allows for the value
194                          * returned by READ CAPACITY to be up to 75 2K
195                          * sectors past the last readable block.
196                          * Therefore, if we hit a medium error within the
197                          * last 75 2K sectors, we decrease the saved size
198                          * value.
199                          */
200                         if (sector < get_capacity(info->disk) &&
201                             drive->probed_capacity - sector < 4 * 75)
202                                 set_capacity(info->disk, sector);
203                 }
204         }
205
206         ide_cd_log_error(drive->name, failed_command, sense);
207 }
208
209 static void ide_cd_complete_failed_rq(ide_drive_t *drive, struct request *rq)
210 {
211         /*
212          * For REQ_TYPE_SENSE, "rq->special" points to the original
213          * failed request.  Also, the sense data should be read
214          * directly from rq which might be different from the original
215          * sense buffer if it got copied during mapping.
216          */
217         struct request *failed = (struct request *)rq->special;
218         void *sense = bio_data(rq->bio);
219
220         if (failed) {
221                 if (failed->sense) {
222                         /*
223                          * Sense is always read into drive->sense_data.
224                          * Copy back if the failed request has its
225                          * sense pointer set.
226                          */
227                         memcpy(failed->sense, sense, 18);
228                         failed->sense_len = rq->sense_len;
229                 }
230                 cdrom_analyze_sense_data(drive, failed);
231
232                 if (ide_end_rq(drive, failed, -EIO, blk_rq_bytes(failed)))
233                         BUG();
234         } else
235                 cdrom_analyze_sense_data(drive, NULL);
236 }
237
238
239 /*
240  * Allow the drive 5 seconds to recover; some devices will return NOT_READY
241  * while flushing data from cache.
242  *
243  * returns: 0 failed (write timeout expired)
244  *          1 success
245  */
246 static int ide_cd_breathe(ide_drive_t *drive, struct request *rq)
247 {
248
249         struct cdrom_info *info = drive->driver_data;
250
251         if (!rq->errors)
252                 info->write_timeout = jiffies + ATAPI_WAIT_WRITE_BUSY;
253
254         rq->errors = 1;
255
256         if (time_after(jiffies, info->write_timeout))
257                 return 0;
258         else {
259                 struct request_queue *q = drive->queue;
260                 unsigned long flags;
261
262                 /*
263                  * take a breather relying on the unplug timer to kick us again
264                  */
265
266                 spin_lock_irqsave(q->queue_lock, flags);
267                 blk_plug_device(q);
268                 spin_unlock_irqrestore(q->queue_lock, flags);
269
270                 return 1;
271         }
272 }
273
274 /**
275  * Returns:
276  * 0: if the request should be continued.
277  * 1: if the request will be going through error recovery.
278  * 2: if the request should be ended.
279  */
280 static int cdrom_decode_status(ide_drive_t *drive, u8 stat)
281 {
282         ide_hwif_t *hwif = drive->hwif;
283         struct request *rq = hwif->rq;
284         int err, sense_key, do_end_request = 0;
285
286         /* get the IDE error register */
287         err = ide_read_error(drive);
288         sense_key = err >> 4;
289
290         ide_debug_log(IDE_DBG_RQ, "cmd: 0x%x, rq->cmd_type: 0x%x, err: 0x%x, "
291                                   "stat 0x%x",
292                                   rq->cmd[0], rq->cmd_type, err, stat);
293
294         if (blk_sense_request(rq)) {
295                 /*
296                  * We got an error trying to get sense info from the drive
297                  * (probably while trying to recover from a former error).
298                  * Just give up.
299                  */
300                 rq->cmd_flags |= REQ_FAILED;
301                 return 2;
302         }
303
304         /* if we have an error, pass CHECK_CONDITION as the SCSI status byte */
305         if (blk_pc_request(rq) && !rq->errors)
306                 rq->errors = SAM_STAT_CHECK_CONDITION;
307
308         if (blk_noretry_request(rq))
309                 do_end_request = 1;
310
311         switch (sense_key) {
312         case NOT_READY:
313                 if (blk_fs_request(rq) && rq_data_dir(rq) == WRITE) {
314                         if (ide_cd_breathe(drive, rq))
315                                 return 1;
316                 } else {
317                         cdrom_saw_media_change(drive);
318
319                         if (blk_fs_request(rq) && !blk_rq_quiet(rq))
320                                 printk(KERN_ERR PFX "%s: tray open\n",
321                                         drive->name);
322                 }
323                 do_end_request = 1;
324                 break;
325         case UNIT_ATTENTION:
326                 cdrom_saw_media_change(drive);
327
328                 if (blk_fs_request(rq) == 0)
329                         return 0;
330
331                 /*
332                  * Arrange to retry the request but be sure to give up if we've
333                  * retried too many times.
334                  */
335                 if (++rq->errors > ERROR_MAX)
336                         do_end_request = 1;
337                 break;
338         case ILLEGAL_REQUEST:
339                 /*
340                  * Don't print error message for this condition -- SFF8090i
341                  * indicates that 5/24/00 is the correct response to a request
342                  * to close the tray if the drive doesn't have that capability.
343                  *
344                  * cdrom_log_sense() knows this!
345                  */
346                 if (rq->cmd[0] == GPCMD_START_STOP_UNIT)
347                         break;
348                 /* fall-through */
349         case DATA_PROTECT:
350                 /*
351                  * No point in retrying after an illegal request or data
352                  * protect error.
353                  */
354                 if (!blk_rq_quiet(rq))
355                         ide_dump_status(drive, "command error", stat);
356                 do_end_request = 1;
357                 break;
358         case MEDIUM_ERROR:
359                 /*
360                  * No point in re-trying a zillion times on a bad sector.
361                  * If we got here the error is not correctable.
362                  */
363                 if (!blk_rq_quiet(rq))
364                         ide_dump_status(drive, "media error "
365                                         "(bad sector)", stat);
366                 do_end_request = 1;
367                 break;
368         case BLANK_CHECK:
369                 /* disk appears blank? */
370                 if (!blk_rq_quiet(rq))
371                         ide_dump_status(drive, "media error (blank)",
372                                         stat);
373                 do_end_request = 1;
374                 break;
375         default:
376                 if (blk_fs_request(rq) == 0)
377                         break;
378                 if (err & ~ATA_ABORTED) {
379                         /* go to the default handler for other errors */
380                         ide_error(drive, "cdrom_decode_status", stat);
381                         return 1;
382                 } else if (++rq->errors > ERROR_MAX)
383                         /* we've racked up too many retries, abort */
384                         do_end_request = 1;
385         }
386
387         if (blk_fs_request(rq) == 0) {
388                 rq->cmd_flags |= REQ_FAILED;
389                 do_end_request = 1;
390         }
391
392         /*
393          * End a request through request sense analysis when we have sense data.
394          * We need this in order to perform end of media processing.
395          */
396         if (do_end_request)
397                 goto end_request;
398
399         /* if we got a CHECK_CONDITION status, queue a request sense command */
400         if (stat & ATA_ERR)
401                 return ide_queue_sense_rq(drive, NULL) ? 2 : 1;
402         return 1;
403
404 end_request:
405         if (stat & ATA_ERR) {
406                 hwif->rq = NULL;
407                 return ide_queue_sense_rq(drive, rq) ? 2 : 1;
408         } else
409                 return 2;
410 }
411
412 static void ide_cd_request_sense_fixup(ide_drive_t *drive, struct ide_cmd *cmd)
413 {
414         struct request *rq = cmd->rq;
415
416         ide_debug_log(IDE_DBG_FUNC, "rq->cmd[0]: 0x%x", rq->cmd[0]);
417
418         /*
419          * Some of the trailing request sense fields are optional,
420          * and some drives don't send them.  Sigh.
421          */
422         if (rq->cmd[0] == GPCMD_REQUEST_SENSE &&
423             cmd->nleft > 0 && cmd->nleft <= 5)
424                 cmd->nleft = 0;
425 }
426
427 int ide_cd_queue_pc(ide_drive_t *drive, const unsigned char *cmd,
428                     int write, void *buffer, unsigned *bufflen,
429                     struct request_sense *sense, int timeout,
430                     unsigned int cmd_flags)
431 {
432         struct cdrom_info *info = drive->driver_data;
433         struct request_sense local_sense;
434         int retries = 10;
435         unsigned int flags = 0;
436
437         if (!sense)
438                 sense = &local_sense;
439
440         ide_debug_log(IDE_DBG_PC, "cmd[0]: 0x%x, write: 0x%x, timeout: %d, "
441                                   "cmd_flags: 0x%x",
442                                   cmd[0], write, timeout, cmd_flags);
443
444         /* start of retry loop */
445         do {
446                 struct request *rq;
447                 int error;
448
449                 rq = blk_get_request(drive->queue, write, __GFP_WAIT);
450
451                 memcpy(rq->cmd, cmd, BLK_MAX_CDB);
452                 rq->cmd_type = REQ_TYPE_ATA_PC;
453                 rq->sense = sense;
454                 rq->cmd_flags |= cmd_flags;
455                 rq->timeout = timeout;
456                 if (buffer) {
457                         error = blk_rq_map_kern(drive->queue, rq, buffer,
458                                                 *bufflen, GFP_NOIO);
459                         if (error) {
460                                 blk_put_request(rq);
461                                 return error;
462                         }
463                 }
464
465                 error = blk_execute_rq(drive->queue, info->disk, rq, 0);
466
467                 if (buffer)
468                         *bufflen = rq->resid_len;
469
470                 flags = rq->cmd_flags;
471                 blk_put_request(rq);
472
473                 /*
474                  * FIXME: we should probably abort/retry or something in case of
475                  * failure.
476                  */
477                 if (flags & REQ_FAILED) {
478                         /*
479                          * The request failed.  Retry if it was due to a unit
480                          * attention status (usually means media was changed).
481                          */
482                         struct request_sense *reqbuf = sense;
483
484                         if (reqbuf->sense_key == UNIT_ATTENTION)
485                                 cdrom_saw_media_change(drive);
486                         else if (reqbuf->sense_key == NOT_READY &&
487                                  reqbuf->asc == 4 && reqbuf->ascq != 4) {
488                                 /*
489                                  * The drive is in the process of loading
490                                  * a disk.  Retry, but wait a little to give
491                                  * the drive time to complete the load.
492                                  */
493                                 ssleep(2);
494                         } else {
495                                 /* otherwise, don't retry */
496                                 retries = 0;
497                         }
498                         --retries;
499                 }
500
501                 /* end of retry loop */
502         } while ((flags & REQ_FAILED) && retries >= 0);
503
504         /* return an error if the command failed */
505         return (flags & REQ_FAILED) ? -EIO : 0;
506 }
507
508 static void ide_cd_error_cmd(ide_drive_t *drive, struct ide_cmd *cmd)
509 {
510         unsigned int nr_bytes = cmd->nbytes - cmd->nleft;
511
512         if (cmd->tf_flags & IDE_TFLAG_WRITE)
513                 nr_bytes -= cmd->last_xfer_len;
514
515         if (nr_bytes > 0)
516                 ide_complete_rq(drive, 0, nr_bytes);
517 }
518
519 static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
520 {
521         ide_hwif_t *hwif = drive->hwif;
522         struct ide_cmd *cmd = &hwif->cmd;
523         struct request *rq = hwif->rq;
524         ide_expiry_t *expiry = NULL;
525         int dma_error = 0, dma, thislen, uptodate = 0;
526         int write = (rq_data_dir(rq) == WRITE) ? 1 : 0, rc = 0;
527         int sense = blk_sense_request(rq);
528         unsigned int timeout;
529         u16 len;
530         u8 ireason, stat;
531
532         ide_debug_log(IDE_DBG_PC, "cmd: 0x%x, write: 0x%x", rq->cmd[0], write);
533
534         /* check for errors */
535         dma = drive->dma;
536         if (dma) {
537                 drive->dma = 0;
538                 drive->waiting_for_dma = 0;
539                 dma_error = hwif->dma_ops->dma_end(drive);
540                 ide_dma_unmap_sg(drive, cmd);
541                 if (dma_error) {
542                         printk(KERN_ERR PFX "%s: DMA %s error\n", drive->name,
543                                         write ? "write" : "read");
544                         ide_dma_off(drive);
545                 }
546         }
547
548         /* check status */
549         stat = hwif->tp_ops->read_status(hwif);
550
551         if (!OK_STAT(stat, 0, BAD_R_STAT)) {
552                 rc = cdrom_decode_status(drive, stat);
553                 if (rc) {
554                         if (rc == 2)
555                                 goto out_end;
556                         return ide_stopped;
557                 }
558         }
559
560         /* using dma, transfer is complete now */
561         if (dma) {
562                 if (dma_error)
563                         return ide_error(drive, "dma error", stat);
564                 uptodate = 1;
565                 goto out_end;
566         }
567
568         ide_read_bcount_and_ireason(drive, &len, &ireason);
569
570         thislen = blk_fs_request(rq) ? len : cmd->nleft;
571         if (thislen > len)
572                 thislen = len;
573
574         ide_debug_log(IDE_DBG_PC, "DRQ: stat: 0x%x, thislen: %d",
575                                   stat, thislen);
576
577         /* If DRQ is clear, the command has completed. */
578         if ((stat & ATA_DRQ) == 0) {
579                 if (blk_fs_request(rq)) {
580                         /*
581                          * If we're not done reading/writing, complain.
582                          * Otherwise, complete the command normally.
583                          */
584                         uptodate = 1;
585                         if (cmd->nleft > 0) {
586                                 printk(KERN_ERR PFX "%s: %s: data underrun "
587                                         "(%u bytes)\n", drive->name, __func__,
588                                         cmd->nleft);
589                                 if (!write)
590                                         rq->cmd_flags |= REQ_FAILED;
591                                 uptodate = 0;
592                         }
593                 } else if (!blk_pc_request(rq)) {
594                         ide_cd_request_sense_fixup(drive, cmd);
595                         /* complain if we still have data left to transfer */
596                         uptodate = cmd->nleft ? 0 : 1;
597                         if (uptodate == 0)
598                                 rq->cmd_flags |= REQ_FAILED;
599                 }
600                 goto out_end;
601         }
602
603         rc = ide_check_ireason(drive, rq, len, ireason, write);
604         if (rc)
605                 goto out_end;
606
607         cmd->last_xfer_len = 0;
608
609         ide_debug_log(IDE_DBG_PC, "data transfer, rq->cmd_type: 0x%x, "
610                                   "ireason: 0x%x",
611                                   rq->cmd_type, ireason);
612
613         /* transfer data */
614         while (thislen > 0) {
615                 int blen = min_t(int, thislen, cmd->nleft);
616
617                 if (cmd->nleft == 0)
618                         break;
619
620                 ide_pio_bytes(drive, cmd, write, blen);
621                 cmd->last_xfer_len += blen;
622
623                 thislen -= blen;
624                 len -= blen;
625
626                 if (sense && write == 0)
627                         rq->sense_len += blen;
628         }
629
630         /* pad, if necessary */
631         if (len > 0) {
632                 if (blk_fs_request(rq) == 0 || write == 0)
633                         ide_pad_transfer(drive, write, len);
634                 else {
635                         printk(KERN_ERR PFX "%s: confused, missing data\n",
636                                 drive->name);
637                         blk_dump_rq_flags(rq, "cdrom_newpc_intr");
638                 }
639         }
640
641         if (blk_pc_request(rq)) {
642                 timeout = rq->timeout;
643         } else {
644                 timeout = ATAPI_WAIT_PC;
645                 if (!blk_fs_request(rq))
646                         expiry = ide_cd_expiry;
647         }
648
649         hwif->expiry = expiry;
650         ide_set_handler(drive, cdrom_newpc_intr, timeout);
651         return ide_started;
652
653 out_end:
654         if (blk_pc_request(rq) && rc == 0) {
655                 rq->resid_len = 0;
656                 blk_end_request_all(rq, 0);
657                 hwif->rq = NULL;
658         } else {
659                 if (sense && uptodate)
660                         ide_cd_complete_failed_rq(drive, rq);
661
662                 if (blk_fs_request(rq)) {
663                         if (cmd->nleft == 0)
664                                 uptodate = 1;
665                 } else {
666                         if (uptodate <= 0 && rq->errors == 0)
667                                 rq->errors = -EIO;
668                 }
669
670                 if (uptodate == 0 && rq->bio)
671                         ide_cd_error_cmd(drive, cmd);
672
673                 /* make sure it's fully ended */
674                 if (blk_fs_request(rq) == 0) {
675                         rq->resid_len -= cmd->nbytes - cmd->nleft;
676                         if (uptodate == 0 && (cmd->tf_flags & IDE_TFLAG_WRITE))
677                                 rq->resid_len += cmd->last_xfer_len;
678                 }
679
680                 ide_complete_rq(drive, uptodate ? 0 : -EIO, blk_rq_bytes(rq));
681
682                 if (sense && rc == 2)
683                         ide_error(drive, "request sense failure", stat);
684         }
685         return ide_stopped;
686 }
687
688 static ide_startstop_t cdrom_start_rw(ide_drive_t *drive, struct request *rq)
689 {
690         struct cdrom_info *cd = drive->driver_data;
691         struct request_queue *q = drive->queue;
692         int write = rq_data_dir(rq) == WRITE;
693         unsigned short sectors_per_frame =
694                 queue_logical_block_size(q) >> SECTOR_BITS;
695
696         ide_debug_log(IDE_DBG_RQ, "rq->cmd[0]: 0x%x, rq->cmd_flags: 0x%x, "
697                                   "secs_per_frame: %u",
698                                   rq->cmd[0], rq->cmd_flags, sectors_per_frame);
699
700         if (write) {
701                 /* disk has become write protected */
702                 if (get_disk_ro(cd->disk))
703                         return ide_stopped;
704         } else {
705                 /*
706                  * We may be retrying this request after an error.  Fix up any
707                  * weirdness which might be present in the request packet.
708                  */
709                 q->prep_rq_fn(q, rq);
710         }
711
712         /* fs requests *must* be hardware frame aligned */
713         if ((blk_rq_sectors(rq) & (sectors_per_frame - 1)) ||
714             (blk_rq_pos(rq) & (sectors_per_frame - 1)))
715                 return ide_stopped;
716
717         /* use DMA, if possible */
718         drive->dma = !!(drive->dev_flags & IDE_DFLAG_USING_DMA);
719
720         if (write)
721                 cd->devinfo.media_written = 1;
722
723         rq->timeout = ATAPI_WAIT_PC;
724
725         return ide_started;
726 }
727
728 static void cdrom_do_block_pc(ide_drive_t *drive, struct request *rq)
729 {
730
731         ide_debug_log(IDE_DBG_PC, "rq->cmd[0]: 0x%x, rq->cmd_type: 0x%x",
732                                   rq->cmd[0], rq->cmd_type);
733
734         if (blk_pc_request(rq))
735                 rq->cmd_flags |= REQ_QUIET;
736         else
737                 rq->cmd_flags &= ~REQ_FAILED;
738
739         drive->dma = 0;
740
741         /* sg request */
742         if (rq->bio) {
743                 struct request_queue *q = drive->queue;
744                 char *buf = bio_data(rq->bio);
745                 unsigned int alignment;
746
747                 drive->dma = !!(drive->dev_flags & IDE_DFLAG_USING_DMA);
748
749                 /*
750                  * check if dma is safe
751                  *
752                  * NOTE! The "len" and "addr" checks should possibly have
753                  * separate masks.
754                  */
755                 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
756                 if ((unsigned long)buf & alignment
757                     || blk_rq_bytes(rq) & q->dma_pad_mask
758                     || object_is_on_stack(buf))
759                         drive->dma = 0;
760         }
761 }
762
763 static ide_startstop_t ide_cd_do_request(ide_drive_t *drive, struct request *rq,
764                                         sector_t block)
765 {
766         struct ide_cmd cmd;
767         int uptodate = 0, nsectors;
768
769         ide_debug_log(IDE_DBG_RQ, "cmd: 0x%x, block: %llu",
770                                   rq->cmd[0], (unsigned long long)block);
771
772         if (drive->debug_mask & IDE_DBG_RQ)
773                 blk_dump_rq_flags(rq, "ide_cd_do_request");
774
775         if (blk_fs_request(rq)) {
776                 if (cdrom_start_rw(drive, rq) == ide_stopped)
777                         goto out_end;
778         } else if (blk_sense_request(rq) || blk_pc_request(rq) ||
779                    rq->cmd_type == REQ_TYPE_ATA_PC) {
780                 if (!rq->timeout)
781                         rq->timeout = ATAPI_WAIT_PC;
782
783                 cdrom_do_block_pc(drive, rq);
784         } else if (blk_special_request(rq)) {
785                 /* right now this can only be a reset... */
786                 uptodate = 1;
787                 goto out_end;
788         } else
789                 BUG();
790
791         /* prepare sense request for this command */
792         ide_prep_sense(drive, rq);
793
794         memset(&cmd, 0, sizeof(cmd));
795
796         if (rq_data_dir(rq))
797                 cmd.tf_flags |= IDE_TFLAG_WRITE;
798
799         cmd.rq = rq;
800
801         if (blk_fs_request(rq) || blk_rq_bytes(rq)) {
802                 ide_init_sg_cmd(&cmd, blk_rq_bytes(rq));
803                 ide_map_sg(drive, &cmd);
804         }
805
806         return ide_issue_pc(drive, &cmd);
807 out_end:
808         nsectors = blk_rq_sectors(rq);
809
810         if (nsectors == 0)
811                 nsectors = 1;
812
813         ide_complete_rq(drive, uptodate ? 0 : -EIO, nsectors << 9);
814
815         return ide_stopped;
816 }
817
818 /*
819  * Ioctl handling.
820  *
821  * Routines which queue packet commands take as a final argument a pointer to a
822  * request_sense struct. If execution of the command results in an error with a
823  * CHECK CONDITION status, this structure will be filled with the results of the
824  * subsequent request sense command. The pointer can also be NULL, in which case
825  * no sense information is returned.
826  */
827 static void msf_from_bcd(struct atapi_msf *msf)
828 {
829         msf->minute = bcd2bin(msf->minute);
830         msf->second = bcd2bin(msf->second);
831         msf->frame  = bcd2bin(msf->frame);
832 }
833
834 int cdrom_check_status(ide_drive_t *drive, struct request_sense *sense)
835 {
836         struct cdrom_info *info = drive->driver_data;
837         struct cdrom_device_info *cdi = &info->devinfo;
838         unsigned char cmd[BLK_MAX_CDB];
839
840         ide_debug_log(IDE_DBG_FUNC, "enter");
841
842         memset(cmd, 0, BLK_MAX_CDB);
843         cmd[0] = GPCMD_TEST_UNIT_READY;
844
845         /*
846          * Sanyo 3 CD changer uses byte 7 of TEST_UNIT_READY to switch CDs
847          * instead of supporting the LOAD_UNLOAD opcode.
848          */
849         cmd[7] = cdi->sanyo_slot % 3;
850
851         return ide_cd_queue_pc(drive, cmd, 0, NULL, NULL, sense, 0, REQ_QUIET);
852 }
853
854 static int cdrom_read_capacity(ide_drive_t *drive, unsigned long *capacity,
855                                unsigned long *sectors_per_frame,
856                                struct request_sense *sense)
857 {
858         struct {
859                 __be32 lba;
860                 __be32 blocklen;
861         } capbuf;
862
863         int stat;
864         unsigned char cmd[BLK_MAX_CDB];
865         unsigned len = sizeof(capbuf);
866         u32 blocklen;
867
868         ide_debug_log(IDE_DBG_FUNC, "enter");
869
870         memset(cmd, 0, BLK_MAX_CDB);
871         cmd[0] = GPCMD_READ_CDVD_CAPACITY;
872
873         stat = ide_cd_queue_pc(drive, cmd, 0, &capbuf, &len, sense, 0,
874                                REQ_QUIET);
875         if (stat)
876                 return stat;
877
878         /*
879          * Sanity check the given block size
880          */
881         blocklen = be32_to_cpu(capbuf.blocklen);
882         switch (blocklen) {
883         case 512:
884         case 1024:
885         case 2048:
886         case 4096:
887                 break;
888         default:
889                 printk(KERN_ERR PFX "%s: weird block size %u\n",
890                                 drive->name, blocklen);
891                 printk(KERN_ERR PFX "%s: default to 2kb block size\n",
892                                 drive->name);
893                 blocklen = 2048;
894                 break;
895         }
896
897         *capacity = 1 + be32_to_cpu(capbuf.lba);
898         *sectors_per_frame = blocklen >> SECTOR_BITS;
899
900         ide_debug_log(IDE_DBG_PROBE, "cap: %lu, sectors_per_frame: %lu",
901                                      *capacity, *sectors_per_frame);
902
903         return 0;
904 }
905
906 static int cdrom_read_tocentry(ide_drive_t *drive, int trackno, int msf_flag,
907                                 int format, char *buf, int buflen,
908                                 struct request_sense *sense)
909 {
910         unsigned char cmd[BLK_MAX_CDB];
911
912         ide_debug_log(IDE_DBG_FUNC, "enter");
913
914         memset(cmd, 0, BLK_MAX_CDB);
915
916         cmd[0] = GPCMD_READ_TOC_PMA_ATIP;
917         cmd[6] = trackno;
918         cmd[7] = (buflen >> 8);
919         cmd[8] = (buflen & 0xff);
920         cmd[9] = (format << 6);
921
922         if (msf_flag)
923                 cmd[1] = 2;
924
925         return ide_cd_queue_pc(drive, cmd, 0, buf, &buflen, sense, 0, REQ_QUIET);
926 }
927
928 /* Try to read the entire TOC for the disk into our internal buffer. */
929 int ide_cd_read_toc(ide_drive_t *drive, struct request_sense *sense)
930 {
931         int stat, ntracks, i;
932         struct cdrom_info *info = drive->driver_data;
933         struct cdrom_device_info *cdi = &info->devinfo;
934         struct atapi_toc *toc = info->toc;
935         struct {
936                 struct atapi_toc_header hdr;
937                 struct atapi_toc_entry  ent;
938         } ms_tmp;
939         long last_written;
940         unsigned long sectors_per_frame = SECTORS_PER_FRAME;
941
942         ide_debug_log(IDE_DBG_FUNC, "enter");
943
944         if (toc == NULL) {
945                 /* try to allocate space */
946                 toc = kmalloc(sizeof(struct atapi_toc), GFP_KERNEL);
947                 if (toc == NULL) {
948                         printk(KERN_ERR PFX "%s: No cdrom TOC buffer!\n",
949                                         drive->name);
950                         return -ENOMEM;
951                 }
952                 info->toc = toc;
953         }
954
955         /*
956          * Check to see if the existing data is still valid. If it is,
957          * just return.
958          */
959         (void) cdrom_check_status(drive, sense);
960
961         if (drive->atapi_flags & IDE_AFLAG_TOC_VALID)
962                 return 0;
963
964         /* try to get the total cdrom capacity and sector size */
965         stat = cdrom_read_capacity(drive, &toc->capacity, &sectors_per_frame,
966                                    sense);
967         if (stat)
968                 toc->capacity = 0x1fffff;
969
970         set_capacity(info->disk, toc->capacity * sectors_per_frame);
971         /* save a private copy of the TOC capacity for error handling */
972         drive->probed_capacity = toc->capacity * sectors_per_frame;
973
974         blk_queue_logical_block_size(drive->queue,
975                                      sectors_per_frame << SECTOR_BITS);
976
977         /* first read just the header, so we know how long the TOC is */
978         stat = cdrom_read_tocentry(drive, 0, 1, 0, (char *) &toc->hdr,
979                                     sizeof(struct atapi_toc_header), sense);
980         if (stat)
981                 return stat;
982
983         if (drive->atapi_flags & IDE_AFLAG_TOCTRACKS_AS_BCD) {
984                 toc->hdr.first_track = bcd2bin(toc->hdr.first_track);
985                 toc->hdr.last_track  = bcd2bin(toc->hdr.last_track);
986         }
987
988         ntracks = toc->hdr.last_track - toc->hdr.first_track + 1;
989         if (ntracks <= 0)
990                 return -EIO;
991         if (ntracks > MAX_TRACKS)
992                 ntracks = MAX_TRACKS;
993
994         /* now read the whole schmeer */
995         stat = cdrom_read_tocentry(drive, toc->hdr.first_track, 1, 0,
996                                   (char *)&toc->hdr,
997                                    sizeof(struct atapi_toc_header) +
998                                    (ntracks + 1) *
999                                    sizeof(struct atapi_toc_entry), sense);
1000
1001         if (stat && toc->hdr.first_track > 1) {
1002                 /*
1003                  * Cds with CDI tracks only don't have any TOC entries, despite
1004                  * of this the returned values are
1005                  * first_track == last_track = number of CDI tracks + 1,
1006                  * so that this case is indistinguishable from the same layout
1007                  * plus an additional audio track. If we get an error for the
1008                  * regular case, we assume a CDI without additional audio
1009                  * tracks. In this case the readable TOC is empty (CDI tracks
1010                  * are not included) and only holds the Leadout entry.
1011                  *
1012                  * Heiko Eißfeldt.
1013                  */
1014                 ntracks = 0;
1015                 stat = cdrom_read_tocentry(drive, CDROM_LEADOUT, 1, 0,
1016                                            (char *)&toc->hdr,
1017                                            sizeof(struct atapi_toc_header) +
1018                                            (ntracks + 1) *
1019                                            sizeof(struct atapi_toc_entry),
1020                                            sense);
1021                 if (stat)
1022                         return stat;
1023
1024                 if (drive->atapi_flags & IDE_AFLAG_TOCTRACKS_AS_BCD) {
1025                         toc->hdr.first_track = (u8)bin2bcd(CDROM_LEADOUT);
1026                         toc->hdr.last_track = (u8)bin2bcd(CDROM_LEADOUT);
1027                 } else {
1028                         toc->hdr.first_track = CDROM_LEADOUT;
1029                         toc->hdr.last_track = CDROM_LEADOUT;
1030                 }
1031         }
1032
1033         if (stat)
1034                 return stat;
1035
1036         toc->hdr.toc_length = be16_to_cpu(toc->hdr.toc_length);
1037
1038         if (drive->atapi_flags & IDE_AFLAG_TOCTRACKS_AS_BCD) {
1039                 toc->hdr.first_track = bcd2bin(toc->hdr.first_track);
1040                 toc->hdr.last_track  = bcd2bin(toc->hdr.last_track);
1041         }
1042
1043         for (i = 0; i <= ntracks; i++) {
1044                 if (drive->atapi_flags & IDE_AFLAG_TOCADDR_AS_BCD) {
1045                         if (drive->atapi_flags & IDE_AFLAG_TOCTRACKS_AS_BCD)
1046                                 toc->ent[i].track = bcd2bin(toc->ent[i].track);
1047                         msf_from_bcd(&toc->ent[i].addr.msf);
1048                 }
1049                 toc->ent[i].addr.lba = msf_to_lba(toc->ent[i].addr.msf.minute,
1050                                                   toc->ent[i].addr.msf.second,
1051                                                   toc->ent[i].addr.msf.frame);
1052         }
1053
1054         if (toc->hdr.first_track != CDROM_LEADOUT) {
1055                 /* read the multisession information */
1056                 stat = cdrom_read_tocentry(drive, 0, 0, 1, (char *)&ms_tmp,
1057                                            sizeof(ms_tmp), sense);
1058                 if (stat)
1059                         return stat;
1060
1061                 toc->last_session_lba = be32_to_cpu(ms_tmp.ent.addr.lba);
1062         } else {
1063                 ms_tmp.hdr.last_track = CDROM_LEADOUT;
1064                 ms_tmp.hdr.first_track = ms_tmp.hdr.last_track;
1065                 toc->last_session_lba = msf_to_lba(0, 2, 0); /* 0m 2s 0f */
1066         }
1067
1068         if (drive->atapi_flags & IDE_AFLAG_TOCADDR_AS_BCD) {
1069                 /* re-read multisession information using MSF format */
1070                 stat = cdrom_read_tocentry(drive, 0, 1, 1, (char *)&ms_tmp,
1071                                            sizeof(ms_tmp), sense);
1072                 if (stat)
1073                         return stat;
1074
1075                 msf_from_bcd(&ms_tmp.ent.addr.msf);
1076                 toc->last_session_lba = msf_to_lba(ms_tmp.ent.addr.msf.minute,
1077                                                    ms_tmp.ent.addr.msf.second,
1078                                                    ms_tmp.ent.addr.msf.frame);
1079         }
1080
1081         toc->xa_flag = (ms_tmp.hdr.first_track != ms_tmp.hdr.last_track);
1082
1083         /* now try to get the total cdrom capacity */
1084         stat = cdrom_get_last_written(cdi, &last_written);
1085         if (!stat && (last_written > toc->capacity)) {
1086                 toc->capacity = last_written;
1087                 set_capacity(info->disk, toc->capacity * sectors_per_frame);
1088                 drive->probed_capacity = toc->capacity * sectors_per_frame;
1089         }
1090
1091         /* Remember that we've read this stuff. */
1092         drive->atapi_flags |= IDE_AFLAG_TOC_VALID;
1093
1094         return 0;
1095 }
1096
1097 int ide_cdrom_get_capabilities(ide_drive_t *drive, u8 *buf)
1098 {
1099         struct cdrom_info *info = drive->driver_data;
1100         struct cdrom_device_info *cdi = &info->devinfo;
1101         struct packet_command cgc;
1102         int stat, attempts = 3, size = ATAPI_CAPABILITIES_PAGE_SIZE;
1103
1104         ide_debug_log(IDE_DBG_FUNC, "enter");
1105
1106         if ((drive->atapi_flags & IDE_AFLAG_FULL_CAPS_PAGE) == 0)
1107                 size -= ATAPI_CAPABILITIES_PAGE_PAD_SIZE;
1108
1109         init_cdrom_command(&cgc, buf, size, CGC_DATA_UNKNOWN);
1110         do {
1111                 /* we seem to get stat=0x01,err=0x00 the first time (??) */
1112                 stat = cdrom_mode_sense(cdi, &cgc, GPMODE_CAPABILITIES_PAGE, 0);
1113                 if (!stat)
1114                         break;
1115         } while (--attempts);
1116         return stat;
1117 }
1118
1119 void ide_cdrom_update_speed(ide_drive_t *drive, u8 *buf)
1120 {
1121         struct cdrom_info *cd = drive->driver_data;
1122         u16 curspeed, maxspeed;
1123
1124         ide_debug_log(IDE_DBG_FUNC, "enter");
1125
1126         if (drive->atapi_flags & IDE_AFLAG_LE_SPEED_FIELDS) {
1127                 curspeed = le16_to_cpup((__le16 *)&buf[8 + 14]);
1128                 maxspeed = le16_to_cpup((__le16 *)&buf[8 + 8]);
1129         } else {
1130                 curspeed = be16_to_cpup((__be16 *)&buf[8 + 14]);
1131                 maxspeed = be16_to_cpup((__be16 *)&buf[8 + 8]);
1132         }
1133
1134         ide_debug_log(IDE_DBG_PROBE, "curspeed: %u, maxspeed: %u",
1135                                      curspeed, maxspeed);
1136
1137         cd->current_speed = (curspeed + (176/2)) / 176;
1138         cd->max_speed = (maxspeed + (176/2)) / 176;
1139 }
1140
1141 #define IDE_CD_CAPABILITIES \
1142         (CDC_CLOSE_TRAY | CDC_OPEN_TRAY | CDC_LOCK | CDC_SELECT_SPEED | \
1143          CDC_SELECT_DISC | CDC_MULTI_SESSION | CDC_MCN | CDC_MEDIA_CHANGED | \
1144          CDC_PLAY_AUDIO | CDC_RESET | CDC_DRIVE_STATUS | CDC_CD_R | \
1145          CDC_CD_RW | CDC_DVD | CDC_DVD_R | CDC_DVD_RAM | CDC_GENERIC_PACKET | \
1146          CDC_MO_DRIVE | CDC_MRW | CDC_MRW_W | CDC_RAM)
1147
1148 static struct cdrom_device_ops ide_cdrom_dops = {
1149         .open                   = ide_cdrom_open_real,
1150         .release                = ide_cdrom_release_real,
1151         .drive_status           = ide_cdrom_drive_status,
1152         .media_changed          = ide_cdrom_check_media_change_real,
1153         .tray_move              = ide_cdrom_tray_move,
1154         .lock_door              = ide_cdrom_lock_door,
1155         .select_speed           = ide_cdrom_select_speed,
1156         .get_last_session       = ide_cdrom_get_last_session,
1157         .get_mcn                = ide_cdrom_get_mcn,
1158         .reset                  = ide_cdrom_reset,
1159         .audio_ioctl            = ide_cdrom_audio_ioctl,
1160         .capability             = IDE_CD_CAPABILITIES,
1161         .generic_packet         = ide_cdrom_packet,
1162 };
1163
1164 static int ide_cdrom_register(ide_drive_t *drive, int nslots)
1165 {
1166         struct cdrom_info *info = drive->driver_data;
1167         struct cdrom_device_info *devinfo = &info->devinfo;
1168
1169         ide_debug_log(IDE_DBG_PROBE, "nslots: %d", nslots);
1170
1171         devinfo->ops = &ide_cdrom_dops;
1172         devinfo->speed = info->current_speed;
1173         devinfo->capacity = nslots;
1174         devinfo->handle = drive;
1175         strcpy(devinfo->name, drive->name);
1176
1177         if (drive->atapi_flags & IDE_AFLAG_NO_SPEED_SELECT)
1178                 devinfo->mask |= CDC_SELECT_SPEED;
1179
1180         devinfo->disk = info->disk;
1181         return register_cdrom(devinfo);
1182 }
1183
1184 static int ide_cdrom_probe_capabilities(ide_drive_t *drive)
1185 {
1186         struct cdrom_info *cd = drive->driver_data;
1187         struct cdrom_device_info *cdi = &cd->devinfo;
1188         u8 buf[ATAPI_CAPABILITIES_PAGE_SIZE];
1189         mechtype_t mechtype;
1190         int nslots = 1;
1191
1192         ide_debug_log(IDE_DBG_PROBE, "media: 0x%x, atapi_flags: 0x%lx",
1193                                      drive->media, drive->atapi_flags);
1194
1195         cdi->mask = (CDC_CD_R | CDC_CD_RW | CDC_DVD | CDC_DVD_R |
1196                      CDC_DVD_RAM | CDC_SELECT_DISC | CDC_PLAY_AUDIO |
1197                      CDC_MO_DRIVE | CDC_RAM);
1198
1199         if (drive->media == ide_optical) {
1200                 cdi->mask &= ~(CDC_MO_DRIVE | CDC_RAM);
1201                 printk(KERN_ERR PFX "%s: ATAPI magneto-optical drive\n",
1202                                 drive->name);
1203                 return nslots;
1204         }
1205
1206         if (drive->atapi_flags & IDE_AFLAG_PRE_ATAPI12) {
1207                 drive->atapi_flags &= ~IDE_AFLAG_NO_EJECT;
1208                 cdi->mask &= ~CDC_PLAY_AUDIO;
1209                 return nslots;
1210         }
1211
1212         /*
1213          * We have to cheat a little here. the packet will eventually be queued
1214          * with ide_cdrom_packet(), which extracts the drive from cdi->handle.
1215          * Since this device hasn't been registered with the Uniform layer yet,
1216          * it can't do this. Same goes for cdi->ops.
1217          */
1218         cdi->handle = drive;
1219         cdi->ops = &ide_cdrom_dops;
1220
1221         if (ide_cdrom_get_capabilities(drive, buf))
1222                 return 0;
1223
1224         if ((buf[8 + 6] & 0x01) == 0)
1225                 drive->dev_flags &= ~IDE_DFLAG_DOORLOCKING;
1226         if (buf[8 + 6] & 0x08)
1227                 drive->atapi_flags &= ~IDE_AFLAG_NO_EJECT;
1228         if (buf[8 + 3] & 0x01)
1229                 cdi->mask &= ~CDC_CD_R;
1230         if (buf[8 + 3] & 0x02)
1231                 cdi->mask &= ~(CDC_CD_RW | CDC_RAM);
1232         if (buf[8 + 2] & 0x38)
1233                 cdi->mask &= ~CDC_DVD;
1234         if (buf[8 + 3] & 0x20)
1235                 cdi->mask &= ~(CDC_DVD_RAM | CDC_RAM);
1236         if (buf[8 + 3] & 0x10)
1237                 cdi->mask &= ~CDC_DVD_R;
1238         if ((buf[8 + 4] & 0x01) || (drive->atapi_flags & IDE_AFLAG_PLAY_AUDIO_OK))
1239                 cdi->mask &= ~CDC_PLAY_AUDIO;
1240
1241         mechtype = buf[8 + 6] >> 5;
1242         if (mechtype == mechtype_caddy ||
1243             mechtype == mechtype_popup ||
1244             (drive->atapi_flags & IDE_AFLAG_NO_AUTOCLOSE))
1245                 cdi->mask |= CDC_CLOSE_TRAY;
1246
1247         if (cdi->sanyo_slot > 0) {
1248                 cdi->mask &= ~CDC_SELECT_DISC;
1249                 nslots = 3;
1250         } else if (mechtype == mechtype_individual_changer ||
1251                    mechtype == mechtype_cartridge_changer) {
1252                 nslots = cdrom_number_of_slots(cdi);
1253                 if (nslots > 1)
1254                         cdi->mask &= ~CDC_SELECT_DISC;
1255         }
1256
1257         ide_cdrom_update_speed(drive, buf);
1258
1259         printk(KERN_INFO PFX "%s: ATAPI", drive->name);
1260
1261         /* don't print speed if the drive reported 0 */
1262         if (cd->max_speed)
1263                 printk(KERN_CONT " %dX", cd->max_speed);
1264
1265         printk(KERN_CONT " %s", (cdi->mask & CDC_DVD) ? "CD-ROM" : "DVD-ROM");
1266
1267         if ((cdi->mask & CDC_DVD_R) == 0 || (cdi->mask & CDC_DVD_RAM) == 0)
1268                 printk(KERN_CONT " DVD%s%s",
1269                                  (cdi->mask & CDC_DVD_R) ? "" : "-R",
1270                                  (cdi->mask & CDC_DVD_RAM) ? "" : "/RAM");
1271
1272         if ((cdi->mask & CDC_CD_R) == 0 || (cdi->mask & CDC_CD_RW) == 0)
1273                 printk(KERN_CONT " CD%s%s",
1274                                  (cdi->mask & CDC_CD_R) ? "" : "-R",
1275                                  (cdi->mask & CDC_CD_RW) ? "" : "/RW");
1276
1277         if ((cdi->mask & CDC_SELECT_DISC) == 0)
1278                 printk(KERN_CONT " changer w/%d slots", nslots);
1279         else
1280                 printk(KERN_CONT " drive");
1281
1282         printk(KERN_CONT ", %dkB Cache\n",
1283                          be16_to_cpup((__be16 *)&buf[8 + 12]));
1284
1285         return nslots;
1286 }
1287
1288 /* standard prep_rq_fn that builds 10 byte cmds */
1289 static int ide_cdrom_prep_fs(struct request_queue *q, struct request *rq)
1290 {
1291         int hard_sect = queue_logical_block_size(q);
1292         long block = (long)blk_rq_pos(rq) / (hard_sect >> 9);
1293         unsigned long blocks = blk_rq_sectors(rq) / (hard_sect >> 9);
1294
1295         memset(rq->cmd, 0, BLK_MAX_CDB);
1296
1297         if (rq_data_dir(rq) == READ)
1298                 rq->cmd[0] = GPCMD_READ_10;
1299         else
1300                 rq->cmd[0] = GPCMD_WRITE_10;
1301
1302         /*
1303          * fill in lba
1304          */
1305         rq->cmd[2] = (block >> 24) & 0xff;
1306         rq->cmd[3] = (block >> 16) & 0xff;
1307         rq->cmd[4] = (block >>  8) & 0xff;
1308         rq->cmd[5] = block & 0xff;
1309
1310         /*
1311          * and transfer length
1312          */
1313         rq->cmd[7] = (blocks >> 8) & 0xff;
1314         rq->cmd[8] = blocks & 0xff;
1315         rq->cmd_len = 10;
1316         return BLKPREP_OK;
1317 }
1318
1319 /*
1320  * Most of the SCSI commands are supported directly by ATAPI devices.
1321  * This transform handles the few exceptions.
1322  */
1323 static int ide_cdrom_prep_pc(struct request *rq)
1324 {
1325         u8 *c = rq->cmd;
1326
1327         /* transform 6-byte read/write commands to the 10-byte version */
1328         if (c[0] == READ_6 || c[0] == WRITE_6) {
1329                 c[8] = c[4];
1330                 c[5] = c[3];
1331                 c[4] = c[2];
1332                 c[3] = c[1] & 0x1f;
1333                 c[2] = 0;
1334                 c[1] &= 0xe0;
1335                 c[0] += (READ_10 - READ_6);
1336                 rq->cmd_len = 10;
1337                 return BLKPREP_OK;
1338         }
1339
1340         /*
1341          * it's silly to pretend we understand 6-byte sense commands, just
1342          * reject with ILLEGAL_REQUEST and the caller should take the
1343          * appropriate action
1344          */
1345         if (c[0] == MODE_SENSE || c[0] == MODE_SELECT) {
1346                 rq->errors = ILLEGAL_REQUEST;
1347                 return BLKPREP_KILL;
1348         }
1349
1350         return BLKPREP_OK;
1351 }
1352
1353 static int ide_cdrom_prep_fn(struct request_queue *q, struct request *rq)
1354 {
1355         if (blk_fs_request(rq))
1356                 return ide_cdrom_prep_fs(q, rq);
1357         else if (blk_pc_request(rq))
1358                 return ide_cdrom_prep_pc(rq);
1359
1360         return 0;
1361 }
1362
1363 struct cd_list_entry {
1364         const char      *id_model;
1365         const char      *id_firmware;
1366         unsigned int    cd_flags;
1367 };
1368
1369 #ifdef CONFIG_IDE_PROC_FS
1370 static sector_t ide_cdrom_capacity(ide_drive_t *drive)
1371 {
1372         unsigned long capacity, sectors_per_frame;
1373
1374         if (cdrom_read_capacity(drive, &capacity, &sectors_per_frame, NULL))
1375                 return 0;
1376
1377         return capacity * sectors_per_frame;
1378 }
1379
1380 static int proc_idecd_read_capacity(char *page, char **start, off_t off,
1381                                         int count, int *eof, void *data)
1382 {
1383         ide_drive_t *drive = data;
1384         int len;
1385
1386         len = sprintf(page, "%llu\n", (long long)ide_cdrom_capacity(drive));
1387         PROC_IDE_READ_RETURN(page, start, off, count, eof, len);
1388 }
1389
1390 static ide_proc_entry_t idecd_proc[] = {
1391         { "capacity", S_IFREG|S_IRUGO, proc_idecd_read_capacity, NULL },
1392         { NULL, 0, NULL, NULL }
1393 };
1394
1395 static ide_proc_entry_t *ide_cd_proc_entries(ide_drive_t *drive)
1396 {
1397         return idecd_proc;
1398 }
1399
1400 static const struct ide_proc_devset *ide_cd_proc_devsets(ide_drive_t *drive)
1401 {
1402         return NULL;
1403 }
1404 #endif
1405
1406 static const struct cd_list_entry ide_cd_quirks_list[] = {
1407         /* SCR-3231 doesn't support the SET_CD_SPEED command. */
1408         { "SAMSUNG CD-ROM SCR-3231", NULL,   IDE_AFLAG_NO_SPEED_SELECT       },
1409         /* Old NEC260 (not R) was released before ATAPI 1.2 spec. */
1410         { "NEC CD-ROM DRIVE:260",    "1.01", IDE_AFLAG_TOCADDR_AS_BCD |
1411                                              IDE_AFLAG_PRE_ATAPI12,          },
1412         /* Vertos 300, some versions of this drive like to talk BCD. */
1413         { "V003S0DS",                NULL,   IDE_AFLAG_VERTOS_300_SSD,       },
1414         /* Vertos 600 ESD. */
1415         { "V006E0DS",                NULL,   IDE_AFLAG_VERTOS_600_ESD,       },
1416         /*
1417          * Sanyo 3 CD changer uses a non-standard command for CD changing
1418          * (by default standard ATAPI support for CD changers is used).
1419          */
1420         { "CD-ROM CDR-C3 G",         NULL,   IDE_AFLAG_SANYO_3CD             },
1421         { "CD-ROM CDR-C3G",          NULL,   IDE_AFLAG_SANYO_3CD             },
1422         { "CD-ROM CDR_C36",          NULL,   IDE_AFLAG_SANYO_3CD             },
1423         /* Stingray 8X CD-ROM. */
1424         { "STINGRAY 8422 IDE 8X CD-ROM 7-27-95", NULL, IDE_AFLAG_PRE_ATAPI12 },
1425         /*
1426          * ACER 50X CD-ROM and WPI 32X CD-ROM require the full spec length
1427          * mode sense page capabilities size, but older drives break.
1428          */
1429         { "ATAPI CD ROM DRIVE 50X MAX", NULL,   IDE_AFLAG_FULL_CAPS_PAGE     },
1430         { "WPI CDS-32X",                NULL,   IDE_AFLAG_FULL_CAPS_PAGE     },
1431         /* ACER/AOpen 24X CD-ROM has the speed fields byte-swapped. */
1432         { "",                        "241N", IDE_AFLAG_LE_SPEED_FIELDS       },
1433         /*
1434          * Some drives used by Apple don't advertise audio play
1435          * but they do support reading TOC & audio datas.
1436          */
1437         { "MATSHITADVD-ROM SR-8187", NULL,   IDE_AFLAG_PLAY_AUDIO_OK         },
1438         { "MATSHITADVD-ROM SR-8186", NULL,   IDE_AFLAG_PLAY_AUDIO_OK         },
1439         { "MATSHITADVD-ROM SR-8176", NULL,   IDE_AFLAG_PLAY_AUDIO_OK         },
1440         { "MATSHITADVD-ROM SR-8174", NULL,   IDE_AFLAG_PLAY_AUDIO_OK         },
1441         { "Optiarc DVD RW AD-5200A", NULL,   IDE_AFLAG_PLAY_AUDIO_OK         },
1442         { "Optiarc DVD RW AD-7200A", NULL,   IDE_AFLAG_PLAY_AUDIO_OK         },
1443         { "Optiarc DVD RW AD-7543A", NULL,   IDE_AFLAG_NO_AUTOCLOSE          },
1444         { "TEAC CD-ROM CD-224E",     NULL,   IDE_AFLAG_NO_AUTOCLOSE          },
1445         { NULL, NULL, 0 }
1446 };
1447
1448 static unsigned int ide_cd_flags(u16 *id)
1449 {
1450         const struct cd_list_entry *cle = ide_cd_quirks_list;
1451
1452         while (cle->id_model) {
1453                 if (strcmp(cle->id_model, (char *)&id[ATA_ID_PROD]) == 0 &&
1454                     (cle->id_firmware == NULL ||
1455                      strstr((char *)&id[ATA_ID_FW_REV], cle->id_firmware)))
1456                         return cle->cd_flags;
1457                 cle++;
1458         }
1459
1460         return 0;
1461 }
1462
1463 static int ide_cdrom_setup(ide_drive_t *drive)
1464 {
1465         struct cdrom_info *cd = drive->driver_data;
1466         struct cdrom_device_info *cdi = &cd->devinfo;
1467         struct request_queue *q = drive->queue;
1468         u16 *id = drive->id;
1469         char *fw_rev = (char *)&id[ATA_ID_FW_REV];
1470         int nslots;
1471
1472         ide_debug_log(IDE_DBG_PROBE, "enter");
1473
1474         blk_queue_prep_rq(q, ide_cdrom_prep_fn);
1475         blk_queue_dma_alignment(q, 31);
1476         blk_queue_update_dma_pad(q, 15);
1477
1478         q->unplug_delay = max((1 * HZ) / 1000, 1);
1479
1480         drive->dev_flags |= IDE_DFLAG_MEDIA_CHANGED;
1481         drive->atapi_flags = IDE_AFLAG_NO_EJECT | ide_cd_flags(id);
1482
1483         if ((drive->atapi_flags & IDE_AFLAG_VERTOS_300_SSD) &&
1484             fw_rev[4] == '1' && fw_rev[6] <= '2')
1485                 drive->atapi_flags |= (IDE_AFLAG_TOCTRACKS_AS_BCD |
1486                                      IDE_AFLAG_TOCADDR_AS_BCD);
1487         else if ((drive->atapi_flags & IDE_AFLAG_VERTOS_600_ESD) &&
1488                  fw_rev[4] == '1' && fw_rev[6] <= '2')
1489                 drive->atapi_flags |= IDE_AFLAG_TOCTRACKS_AS_BCD;
1490         else if (drive->atapi_flags & IDE_AFLAG_SANYO_3CD)
1491                 /* 3 => use CD in slot 0 */
1492                 cdi->sanyo_slot = 3;
1493
1494         nslots = ide_cdrom_probe_capabilities(drive);
1495
1496         blk_queue_logical_block_size(q, CD_FRAMESIZE);
1497
1498         if (ide_cdrom_register(drive, nslots)) {
1499                 printk(KERN_ERR PFX "%s: %s failed to register device with the"
1500                                 " cdrom driver.\n", drive->name, __func__);
1501                 cd->devinfo.handle = NULL;
1502                 return 1;
1503         }
1504
1505         ide_proc_register_driver(drive, cd->driver);
1506         return 0;
1507 }
1508
1509 static void ide_cd_remove(ide_drive_t *drive)
1510 {
1511         struct cdrom_info *info = drive->driver_data;
1512
1513         ide_debug_log(IDE_DBG_FUNC, "enter");
1514
1515         ide_proc_unregister_driver(drive, info->driver);
1516         device_del(&info->dev);
1517         del_gendisk(info->disk);
1518
1519         mutex_lock(&idecd_ref_mutex);
1520         put_device(&info->dev);
1521         mutex_unlock(&idecd_ref_mutex);
1522 }
1523
1524 static void ide_cd_release(struct device *dev)
1525 {
1526         struct cdrom_info *info = to_ide_drv(dev, cdrom_info);
1527         struct cdrom_device_info *devinfo = &info->devinfo;
1528         ide_drive_t *drive = info->drive;
1529         struct gendisk *g = info->disk;
1530
1531         ide_debug_log(IDE_DBG_FUNC, "enter");
1532
1533         kfree(info->toc);
1534         if (devinfo->handle == drive)
1535                 unregister_cdrom(devinfo);
1536         drive->driver_data = NULL;
1537         blk_queue_prep_rq(drive->queue, NULL);
1538         g->private_data = NULL;
1539         put_disk(g);
1540         kfree(info);
1541 }
1542
1543 static int ide_cd_probe(ide_drive_t *);
1544
1545 static struct ide_driver ide_cdrom_driver = {
1546         .gen_driver = {
1547                 .owner          = THIS_MODULE,
1548                 .name           = "ide-cdrom",
1549                 .bus            = &ide_bus_type,
1550         },
1551         .probe                  = ide_cd_probe,
1552         .remove                 = ide_cd_remove,
1553         .version                = IDECD_VERSION,
1554         .do_request             = ide_cd_do_request,
1555 #ifdef CONFIG_IDE_PROC_FS
1556         .proc_entries           = ide_cd_proc_entries,
1557         .proc_devsets           = ide_cd_proc_devsets,
1558 #endif
1559 };
1560
1561 static int idecd_open(struct block_device *bdev, fmode_t mode)
1562 {
1563         struct cdrom_info *info = ide_cd_get(bdev->bd_disk);
1564         int rc = -ENOMEM;
1565
1566         if (!info)
1567                 return -ENXIO;
1568
1569         rc = cdrom_open(&info->devinfo, bdev, mode);
1570
1571         if (rc < 0)
1572                 ide_cd_put(info);
1573
1574         return rc;
1575 }
1576
1577 static int idecd_release(struct gendisk *disk, fmode_t mode)
1578 {
1579         struct cdrom_info *info = ide_drv_g(disk, cdrom_info);
1580
1581         cdrom_release(&info->devinfo, mode);
1582
1583         ide_cd_put(info);
1584
1585         return 0;
1586 }
1587
1588 static int idecd_set_spindown(struct cdrom_device_info *cdi, unsigned long arg)
1589 {
1590         struct packet_command cgc;
1591         char buffer[16];
1592         int stat;
1593         char spindown;
1594
1595         if (copy_from_user(&spindown, (void __user *)arg, sizeof(char)))
1596                 return -EFAULT;
1597
1598         init_cdrom_command(&cgc, buffer, sizeof(buffer), CGC_DATA_UNKNOWN);
1599
1600         stat = cdrom_mode_sense(cdi, &cgc, GPMODE_CDROM_PAGE, 0);
1601         if (stat)
1602                 return stat;
1603
1604         buffer[11] = (buffer[11] & 0xf0) | (spindown & 0x0f);
1605         return cdrom_mode_select(cdi, &cgc);
1606 }
1607
1608 static int idecd_get_spindown(struct cdrom_device_info *cdi, unsigned long arg)
1609 {
1610         struct packet_command cgc;
1611         char buffer[16];
1612         int stat;
1613         char spindown;
1614
1615         init_cdrom_command(&cgc, buffer, sizeof(buffer), CGC_DATA_UNKNOWN);
1616
1617         stat = cdrom_mode_sense(cdi, &cgc, GPMODE_CDROM_PAGE, 0);
1618         if (stat)
1619                 return stat;
1620
1621         spindown = buffer[11] & 0x0f;
1622         if (copy_to_user((void __user *)arg, &spindown, sizeof(char)))
1623                 return -EFAULT;
1624         return 0;
1625 }
1626
1627 static int idecd_ioctl(struct block_device *bdev, fmode_t mode,
1628                         unsigned int cmd, unsigned long arg)
1629 {
1630         struct cdrom_info *info = ide_drv_g(bdev->bd_disk, cdrom_info);
1631         int err;
1632
1633         switch (cmd) {
1634         case CDROMSETSPINDOWN:
1635                 return idecd_set_spindown(&info->devinfo, arg);
1636         case CDROMGETSPINDOWN:
1637                 return idecd_get_spindown(&info->devinfo, arg);
1638         default:
1639                 break;
1640         }
1641
1642         err = generic_ide_ioctl(info->drive, bdev, cmd, arg);
1643         if (err == -EINVAL)
1644                 err = cdrom_ioctl(&info->devinfo, bdev, mode, cmd, arg);
1645
1646         return err;
1647 }
1648
1649 static int idecd_media_changed(struct gendisk *disk)
1650 {
1651         struct cdrom_info *info = ide_drv_g(disk, cdrom_info);
1652         return cdrom_media_changed(&info->devinfo);
1653 }
1654
1655 static int idecd_revalidate_disk(struct gendisk *disk)
1656 {
1657         struct cdrom_info *info = ide_drv_g(disk, cdrom_info);
1658         struct request_sense sense;
1659
1660         ide_cd_read_toc(info->drive, &sense);
1661
1662         return  0;
1663 }
1664
1665 static struct block_device_operations idecd_ops = {
1666         .owner                  = THIS_MODULE,
1667         .open                   = idecd_open,
1668         .release                = idecd_release,
1669         .locked_ioctl           = idecd_ioctl,
1670         .media_changed          = idecd_media_changed,
1671         .revalidate_disk        = idecd_revalidate_disk
1672 };
1673
1674 /* module options */
1675 static unsigned long debug_mask;
1676 module_param(debug_mask, ulong, 0644);
1677
1678 MODULE_DESCRIPTION("ATAPI CD-ROM Driver");
1679
1680 static int ide_cd_probe(ide_drive_t *drive)
1681 {
1682         struct cdrom_info *info;
1683         struct gendisk *g;
1684         struct request_sense sense;
1685
1686         ide_debug_log(IDE_DBG_PROBE, "driver_req: %s, media: 0x%x",
1687                                      drive->driver_req, drive->media);
1688
1689         if (!strstr("ide-cdrom", drive->driver_req))
1690                 goto failed;
1691
1692         if (drive->media != ide_cdrom && drive->media != ide_optical)
1693                 goto failed;
1694
1695         drive->debug_mask = debug_mask;
1696         drive->irq_handler = cdrom_newpc_intr;
1697
1698         info = kzalloc(sizeof(struct cdrom_info), GFP_KERNEL);
1699         if (info == NULL) {
1700                 printk(KERN_ERR PFX "%s: Can't allocate a cdrom structure\n",
1701                                 drive->name);
1702                 goto failed;
1703         }
1704
1705         g = alloc_disk(1 << PARTN_BITS);
1706         if (!g)
1707                 goto out_free_cd;
1708
1709         ide_init_disk(g, drive);
1710
1711         info->dev.parent = &drive->gendev;
1712         info->dev.release = ide_cd_release;
1713         dev_set_name(&info->dev, dev_name(&drive->gendev));
1714
1715         if (device_register(&info->dev))
1716                 goto out_free_disk;
1717
1718         info->drive = drive;
1719         info->driver = &ide_cdrom_driver;
1720         info->disk = g;
1721
1722         g->private_data = &info->driver;
1723
1724         drive->driver_data = info;
1725
1726         g->minors = 1;
1727         g->driverfs_dev = &drive->gendev;
1728         g->flags = GENHD_FL_CD | GENHD_FL_REMOVABLE;
1729         if (ide_cdrom_setup(drive)) {
1730                 put_device(&info->dev);
1731                 goto failed;
1732         }
1733
1734         ide_cd_read_toc(drive, &sense);
1735         g->fops = &idecd_ops;
1736         g->flags |= GENHD_FL_REMOVABLE;
1737         add_disk(g);
1738         return 0;
1739
1740 out_free_disk:
1741         put_disk(g);
1742 out_free_cd:
1743         kfree(info);
1744 failed:
1745         return -ENODEV;
1746 }
1747
1748 static void __exit ide_cdrom_exit(void)
1749 {
1750         driver_unregister(&ide_cdrom_driver.gen_driver);
1751 }
1752
1753 static int __init ide_cdrom_init(void)
1754 {
1755         printk(KERN_INFO DRV_NAME " driver " IDECD_VERSION "\n");
1756         return driver_register(&ide_cdrom_driver.gen_driver);
1757 }
1758
1759 MODULE_ALIAS("ide:*m-cdrom*");
1760 MODULE_ALIAS("ide-cd");
1761 module_init(ide_cdrom_init);
1762 module_exit(ide_cdrom_exit);
1763 MODULE_LICENSE("GPL");