Merge branch 'for-4.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata

Pull libata fixes from Tejun Heo:
 "I sat on them too long and it's quite a few this late, but nothing has
  a wide blast area. The changes are...

   - Fix corner cases in SG command handling.

   - Recent introduction of default powersaving mode config option
     exposed several devices with broken powersaving behaviors. A number
     of patches to update the blacklist accordingly.

   - Fix a kernel panic on SAS hotplug.

   - Other misc and device specific updates"

* 'for-4.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
  libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version
  libata: Make Crucial BX100 500GB LPM quirk apply to all firmware versions
  libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs
  libata: Enable queued TRIM for Samsung SSD 860
  PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L
  ahci: Add PCI-id for the Highpoint Rocketraid 644L card
  ata: do not schedule hot plug if it is a sas host
  libata: disable LPM for Crucial BX100 SSD 500GB drive
  libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs
  libata: update documentation for sysfs interfaces
  ata: sata_rcar: Remove unused variable in sata_rcar_init_controller()
  libata: transport: cleanup documentation of sysfs interface
  sata_rcar: Reset SATA PHY when Salvator-X board resumes
  libata: don't try to pass through NCQ commands to non-NCQ devices
  libata: remove WARN() for DMA or PIO command without data
  libata: fix length validation of ATAPI-relayed SCSI commands
  ata: libahci: fix comment indentation
  ahci: Add check for device presence (PCIe hot unplug) in ahci_stop_engine()
  libata: Fix compile warning with ATA_DEBUG enabled

11 files changed, 337 insertions, 102 deletions

diff --git a/Documentation/ABI/testing/sysfs-ata b/Documentation/ABI/testing/sysfs-ata
index aa4296498859..9ab0ef1dd1c7 100644
--- a/Documentation/ABI/testing/sysfs-ata
+++ b/Documentation/ABI/testing/sysfs-ata
@@ -1,110 +1,139 @@
 What:           /sys/class/ata_...
-Date:           August 2008
-Contact:        Gwendal Grignou<gwendal@google.com>
 Description:
-
-Provide a place in sysfs for storing the ATA topology of the system.  This allows
-retrieving various information about ATA objects.
+                Provide a place in sysfs for storing the ATA topology of the
+                system. This allows retrieving various information about ATA
+                objects.
 
 Files under /sys/class/ata_port
 -------------------------------
 
-        For each port, a directory ataX is created where X is the ata_port_id of
-        the port. The device parent is the ata host device.
+For each port, a directory ataX is created where X is the ata_port_id of the
+port. The device parent is the ata host device.
 
-idle_irq (read)
 
-        Number of IRQ received by the port while idle [some ata HBA only].
+What:           /sys/class/ata_port/ataX/nr_pmp_links
+What:           /sys/class/ata_port/ataX/idle_irq
+Date:           May, 2010
+KernelVersion:  v2.6.37
+Contact:        Gwendal Grignou <gwendal@chromium.org>
+Description:
+                nr_pmp_links:   (RO) If a SATA Port Multiplier (PM) is
+                                connected, the number of links behind it.
 
-nr_pmp_links (read)
+                idle_irq:       (RO) Number of IRQ received by the port while
+                                idle [some ata HBA only].
 
-        If a SATA Port Multiplier (PM) is connected, number of link behind it.
+
+What:           /sys/class/ata_port/ataX/port_no
+Date:           May, 2013
+KernelVersion:  v3.11
+Contact:        Gwendal Grignou <gwendal@chromium.org>
+Description:
+                (RO) Host local port number. While registering host controller,
+                port numbers are tracked based upon number of ports available on
+                the controller. This attribute is needed by udev for composing
+                persistent links in /dev/disk/by-path.
 
 Files under /sys/class/ata_link
 -------------------------------
 
-        Behind each port, there is a ata_link. If there is a SATA PM in the
-        topology, 15 ata_link objects are created.
-
-        If a link is behind a port, the directory name is linkX, where X is
-        ata_port_id of the port.
-        If a link is behind a PM, its name is linkX.Y where X is ata_port_id
-        of the parent port and Y the PM port.
+Behind each port, there is a ata_link. If there is a SATA PM in the topology, 15
+ata_link objects are created.
 
-hw_sata_spd_limit
+If a link is behind a port, the directory name is linkX, where X is ata_port_id
+of the port. If a link is behind a PM, its name is linkX.Y where X is
+ata_port_id of the parent port and Y the PM port.
 
-        Maximum speed supported by the connected SATA device.
 
-sata_spd_limit
+What:           /sys/class/ata_link/linkX[.Y]/hw_sata_spd_limit
+What:           /sys/class/ata_link/linkX[.Y]/sata_spd_limit
+What:           /sys/class/ata_link/linkX[.Y]/sata_spd
+Date:           May, 2010
+KernelVersion:  v2.6.37
+Contact:        Gwendal Grignou <gwendal@chromium.org>
+Description:
+                hw_sata_spd_limit:      (RO) Maximum speed supported by the
+                                        connected SATA device.
 
-        Maximum speed imposed by libata.
+                sata_spd_limit:         (RO) Maximum speed imposed by libata.
 
-sata_spd
+                sata_spd:               (RO) Current speed of the link
+                                        eg. 1.5, 3 Gbps etc.
 
-        Current speed of the link [1.5, 3Gps,...].
 
 Files under /sys/class/ata_device
 ---------------------------------
 
-        Behind each link, up to two ata device are created.
-        The name of the directory is devX[.Y].Z where:
-        - X is ata_port_id of the port where the device is connected,
-        - Y the port of the PM if any, and
-        - Z the device id: for PATA, there is usually 2 devices [0,1],
-        only 1 for SATA.
-
-class
-        Device class. Can be "ata" for disk, "atapi" for packet device,
-        "pmp" for PM, or "none" if no device was found behind the link.
-
-dma_mode
+Behind each link, up to two ata devices are created.
+The name of the directory is devX[.Y].Z where:
+- X is ata_port_id of the port where the device is connected,
+- Y the port of the PM if any, and
+- Z the device id: for PATA, there is usually 2 devices [0,1], only 1 for SATA.
+
+
+What:           /sys/class/ata_device/devX[.Y].Z/spdn_cnt
+What:           /sys/class/ata_device/devX[.Y].Z/gscr
+What:           /sys/class/ata_device/devX[.Y].Z/ering
+What:           /sys/class/ata_device/devX[.Y].Z/id
+What:           /sys/class/ata_device/devX[.Y].Z/pio_mode
+What:           /sys/class/ata_device/devX[.Y].Z/xfer_mode
+What:           /sys/class/ata_device/devX[.Y].Z/dma_mode
+What:           /sys/class/ata_device/devX[.Y].Z/class
+Date:           May, 2010
+KernelVersion:  v2.6.37
+Contact:        Gwendal Grignou <gwendal@chromium.org>
+Description:
+                spdn_cnt:       (RO) Number of times libata decided to lower the
+                                speed of link due to errors.
 
-        Transfer modes supported by the device when in DMA mode.
-        Mostly used by PATA device.
+                gscr:           (RO) Cached result of the dump of PM GSCR
+                                register. Valid registers are:
 
-pio_mode
+                                0:      SATA_PMP_GSCR_PROD_ID,
+                                1:      SATA_PMP_GSCR_REV,
+                                2:      SATA_PMP_GSCR_PORT_INFO,
+                                32:     SATA_PMP_GSCR_ERROR,
+                                33:     SATA_PMP_GSCR_ERROR_EN,
+                                64:     SATA_PMP_GSCR_FEAT,
+                                96:     SATA_PMP_GSCR_FEAT_EN,
+                                130:    SATA_PMP_GSCR_SII_GPIO
 
-        Transfer modes supported by the device when in PIO mode.
-        Mostly used by PATA device.
+                                Only valid if the device is a PM.
 
-xfer_mode
+                ering:          (RO) Formatted output of the error ring of the
+                                device.
 
-        Current transfer mode.
+                id:             (RO) Cached result of IDENTIFY command, as
+                                described in ATA8 7.16 and 7.17. Only valid if
+                                the device is not a PM.
 
-id
+                pio_mode:       (RO) Transfer modes supported by the device when
+                                in PIO mode. Mostly used by PATA device.
 
-        Cached result of IDENTIFY command, as described in ATA8 7.16 and 7.17.
-        Only valid if the device is not a PM.
+                xfer_mode:      (RO) Current transfer mode
 
-gscr
+                dma_mode:       (RO) Transfer modes supported by the device when
+                                in DMA mode. Mostly used by PATA device.
 
-        Cached result of the dump of PM GSCR register.
-        Valid registers are:
-        0:      SATA_PMP_GSCR_PROD_ID,
-        1:      SATA_PMP_GSCR_REV,
-        2:      SATA_PMP_GSCR_PORT_INFO,
-        32:     SATA_PMP_GSCR_ERROR,
-        33:     SATA_PMP_GSCR_ERROR_EN,
-        64:     SATA_PMP_GSCR_FEAT,
-        96:     SATA_PMP_GSCR_FEAT_EN,
-        130:    SATA_PMP_GSCR_SII_GPIO
-        Only valid if the device is a PM.
+                class:          (RO) Device class. Can be "ata" for disk,
+                                "atapi" for packet device, "pmp" for PM, or
+                                "none" if no device was found behind the link.
 
-trim
 
-        Shows the DSM TRIM mode currently used by the device. Valid
-        values are:
-        unsupported:            Drive does not support DSM TRIM
-        unqueued:               Drive supports unqueued DSM TRIM only
-        queued:                 Drive supports queued DSM TRIM
-        forced_unqueued:        Drive's queued DSM support is known to be
-                                buggy and only unqueued TRIM commands
-                                are sent
+What:           /sys/class/ata_device/devX[.Y].Z/trim
+Date:           May, 2015
+KernelVersion:  v4.10
+Contact:        Gwendal Grignou <gwendal@chromium.org>
+Description:
+                (RO) Shows the DSM TRIM mode currently used by the device. Valid
+                values are:
 
-spdn_cnt
+                unsupported:            Drive does not support DSM TRIM
 
-        Number of time libata decided to lower the speed of link due to errors.
+                unqueued:               Drive supports unqueued DSM TRIM only
 
-ering
+                queued:                 Drive supports queued DSM TRIM
 
-        Formatted output of the error ring of the device.
+                forced_unqueued:        Drive's queued DSM support is known to
+                                        be buggy and only unqueued TRIM commands
+                                        are sent
diff --git a/Documentation/ABI/testing/sysfs-block-device b/Documentation/ABI/testing/sysfs-block-device
new file mode 100644
index 000000000000..82ef6eab042d
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-block-device
@@ -0,0 +1,58 @@
+What:           /sys/block/*/device/sw_activity
+Date:           Jun, 2008
+KernelVersion:  v2.6.27
+Contact:        linux-ide@vger.kernel.org
+Description:
+                (RW) Used by drivers which support software controlled activity
+                LEDs.
+
+                It has the following valid values:
+
+                0       OFF - the LED is not activated on activity
+                1       BLINK_ON - the LED blinks on every 10ms when activity is
+                        detected.
+                2       BLINK_OFF - the LED is on when idle, and blinks off
+                        every 10ms when activity is detected.
+
+                Note that the user must turn sw_activity OFF it they wish to
+                control the activity LED via the em_message file.
+
+
+What:           /sys/block/*/device/unload_heads
+Date:           Sep, 2008
+KernelVersion:  v2.6.28
+Contact:        linux-ide@vger.kernel.org
+Description:
+                (RW) Hard disk shock protection
+
+                Writing an integer value to this file will take the heads of the
+                respective drive off the platter and block all I/O operations
+                for the specified number of milliseconds.
+
+                - If the device does not support the unload heads feature,
+                  access is denied with -EOPNOTSUPP.
+                - The maximal value accepted for a timeout is 30000
+                  milliseconds.
+                - A previously set timeout can be cancelled and disk can resume
+                  normal operation immediately by specifying a timeout of 0.
+                - Some hard drives only comply with an earlier version of the
+                  ATA standard, but support the unload feature nonetheless.
+                  There is no safe way Linux can detect these devices, so this
+                  is not enabled by default. If it is known that your device
+                  does support the unload feature, then you can tell the kernel
+                  to enable it by writing -1. It can be disabled again by
+                  writing -2.
+                - Values below -2 are rejected with -EINVAL
+
+                For more information, see
+                Documentation/laptops/disk-shock-protection.txt
+
+
+What:           /sys/block/*/device/ncq_prio_enable
+Date:           Oct, 2016
+KernelVersion:  v4.10
+Contact:        linux-ide@vger.kernel.org
+Description:
+                (RW) Write to the file to turn on or off the SATA ncq (native
+                command queueing) support. By default this feature is turned
+                off.
diff --git a/Documentation/ABI/testing/sysfs-class-scsi_host b/Documentation/ABI/testing/sysfs-class-scsi_host
index 0eb255e7db12..bafc59fd7b69 100644
--- a/Documentation/ABI/testing/sysfs-class-scsi_host
+++ b/Documentation/ABI/testing/sysfs-class-scsi_host
@@ -27,3 +27,92 @@ Description:	This file contains the current status of the "SSD Smart Path"
                 the direct i/o path to physical devices.  This setting is
                 controller wide, affecting all configured logical drives on the
                 controller.  This file is readable and writable.
+
+What:           /sys/class/scsi_host/hostX/link_power_management_policy
+Date:           Oct, 2007
+KernelVersion:  v2.6.24
+Contact:        linux-ide@vger.kernel.org
+Description:
+                (RW) This parameter allows the user to read and set the link
+                (interface) power management.
+
+                There are four possible options:
+
+                min_power: Tell the controller to try to make the link use the
+                least possible power when possible. This may sacrifice some
+                performance due to increased latency when coming out of lower
+                power states.
+
+                max_performance: Generally, this means no power management.
+                Tell the controller to have performance be a priority over power
+                management.
+
+                medium_power: Tell the controller to enter a lower power state
+                when possible, but do not enter the lowest power state, thus
+                improving latency over min_power setting.
+
+                med_power_with_dipm: Identical to the existing medium_power
+                setting except that it enables dipm (device initiated power
+                management) on top, which makes it match the Windows IRST (Intel
+                Rapid Storage Technology) driver settings. This setting is also
+                close to min_power, except that:
+                a) It does not use host-initiated slumber mode, but it does
+                allow device-initiated slumber
+                b) It does not enable low power device sleep mode (DevSlp).
+
+What:           /sys/class/scsi_host/hostX/em_message
+What:           /sys/class/scsi_host/hostX/em_message_type
+Date:           Jun, 2008
+KernelVersion:  v2.6.27
+Contact:        linux-ide@vger.kernel.org
+Description:
+                em_message: (RW) Enclosure management support. For the LED
+                protocol, writes and reads correspond to the LED message format
+                as defined in the AHCI spec.
+
+                The user must turn sw_activity (under /sys/block/*/device/) OFF
+                it they wish to control the activity LED via the em_message
+                file.
+
+                em_message_type: (RO) Displays the current enclosure management
+                protocol that is being used by the driver (for eg. LED, SAF-TE,
+                SES-2, SGPIO etc).
+
+What:           /sys/class/scsi_host/hostX/ahci_port_cmd
+What:           /sys/class/scsi_host/hostX/ahci_host_caps
+What:           /sys/class/scsi_host/hostX/ahci_host_cap2
+Date:           Mar, 2010
+KernelVersion:  v2.6.35
+Contact:        linux-ide@vger.kernel.org
+Description:
+                [to be documented]
+
+What:           /sys/class/scsi_host/hostX/ahci_host_version
+Date:           Mar, 2010
+KernelVersion:  v2.6.35
+Contact:        linux-ide@vger.kernel.org
+Description:
+                (RO) Display the version of the AHCI spec implemented by the
+                host.
+
+What:           /sys/class/scsi_host/hostX/em_buffer
+Date:           Apr, 2010
+KernelVersion:  v2.6.35
+Contact:        linux-ide@vger.kernel.org
+Description:
+                (RW) Allows access to AHCI EM (enclosure management) buffer
+                directly if the host supports EM.
+
+                For eg. the AHCI driver supports SGPIO EM messages but the
+                SATA/AHCI specs do not define the SGPIO message format of the EM
+                buffer. Different hardware(HW) vendors may have different
+                definitions. With the em_buffer attribute, this issue can be
+                solved by allowing HW vendors to provide userland drivers and
+                tools for their SGPIO initiators.
+
+What:           /sys/class/scsi_host/hostX/em_message_supported
+Date:           Oct, 2009
+KernelVersion:  v2.6.39
+Contact:        linux-ide@vger.kernel.org
+Description:
+                (RO) Displays supported enclosure management message types.
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 355a95a83a34..1ff17799769d 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -550,7 +550,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
           .driver_data = board_ahci_yes_fbs },
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230),
           .driver_data = board_ahci_yes_fbs },
-        { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642),
+        { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642), /* highpoint rocketraid 642L */
+          .driver_data = board_ahci_yes_fbs },
+        { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0645), /* highpoint rocketraid 644L */
           .driver_data = board_ahci_yes_fbs },
 
         /* Promise */
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index a0de7a38430c..7adcf3caabd0 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -665,6 +665,16 @@ int ahci_stop_engine(struct ata_port *ap)
         if ((tmp & (PORT_CMD_START | PORT_CMD_LIST_ON)) == 0)
                 return 0;
 
+        /*
+         * Don't try to issue commands but return with ENODEV if the
+         * AHCI controller not available anymore (e.g. due to PCIe hot
+         * unplugging). Otherwise a 500ms delay for each port is added.
+         */
+        if (tmp == 0xffffffff) {
+                dev_err(ap->host->dev, "AHCI controller unavailable!\n");
+                return -ENODEV;
+        }
+
         /* setting HBA to idle */
         tmp &= ~PORT_CMD_START;
         writel(tmp, port_mmio + PORT_CMD);
diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index 341d0ef82cbd..30cc8f1a31e1 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -340,7 +340,7 @@ static int ahci_platform_get_regulator(struct ahci_host_priv *hpriv, u32 port,
  * 2) regulator for controlling the targets power (optional)
  * 3) 0 - AHCI_MAX_CLKS clocks, as specified in the devs devicetree node,
  *    or for non devicetree enabled platforms a single clock
- *      4) phys (optional)
+ * 4) phys (optional)
  *
  * RETURNS:
  * The allocated ahci_host_priv on success, otherwise an ERR_PTR value
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 3c09122bf038..7431ccd03316 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4530,6 +4530,25 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "PIONEER DVD-RW  DVR-212D",   NULL,   ATA_HORKAGE_NOSETXFER },
         { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
 
+        /* Crucial BX100 SSD 500GB has broken LPM support */
+        { "CT500BX100SSD1",             NULL,   ATA_HORKAGE_NOLPM },
+
+        /* 512GB MX100 with MU01 firmware has both queued TRIM and LPM issues */
+        { "Crucial_CT512MX100*",        "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM |
+                                                ATA_HORKAGE_NOLPM, },
+        /* 512GB MX100 with newer firmware has only LPM issues */
+        { "Crucial_CT512MX100*",        NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM |
+                                                ATA_HORKAGE_NOLPM, },
+
+        /* 480GB+ M500 SSDs have both queued TRIM and LPM issues */
+        { "Crucial_CT480M500*",         NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM |
+                                                ATA_HORKAGE_NOLPM, },
+        { "Crucial_CT960M500*",         NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM |
+                                                ATA_HORKAGE_NOLPM, },
+
         /* devices that don't properly handle queued TRIM commands */
         { "Micron_M500_*",              NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
@@ -4541,7 +4560,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "Crucial_CT*MX100*",          "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
-        { "Samsung SSD 8*",             NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+        { "Samsung SSD 840*",           NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
+                                                ATA_HORKAGE_ZERO_AFTER_TRIM, },
+        { "Samsung SSD 850*",           NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
         { "FCCT*M500*",                 NULL,   ATA_HORKAGE_NO_NCQ_TRIM |
                                                 ATA_HORKAGE_ZERO_AFTER_TRIM, },
@@ -5401,8 +5422,7 @@ void ata_qc_issue(struct ata_queued_cmd *qc)
          * We guarantee to LLDs that they will have at least one
          * non-zero sg if the command is a data command.
          */
-        if (WARN_ON_ONCE(ata_is_data(prot) &&
-                         (!qc->sg || !qc->n_elem || !qc->nbytes)))
+        if (ata_is_data(prot) && (!qc->sg || !qc->n_elem || !qc->nbytes))
                 goto sys_err;
 
         if (ata_is_dma(prot) || (ata_is_pio(prot) &&
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 11c3137d7b0a..c016829a38fd 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -815,7 +815,8 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap)
 
         if (ap->pflags & ATA_PFLAG_LOADING)
                 ap->pflags &= ~ATA_PFLAG_LOADING;
-        else if (ap->pflags & ATA_PFLAG_SCSI_HOTPLUG)
+        else if ((ap->pflags & ATA_PFLAG_SCSI_HOTPLUG) &&
+                !(ap->flags & ATA_FLAG_SAS_HOST))
                 schedule_delayed_work(&ap->hotplug_task, 0);
 
         if (ap->pflags & ATA_PFLAG_RECOVERED)
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 66be961c93a4..89a9d4a2efc8 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3316,6 +3316,12 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
                 goto invalid_fld;
         }
 
+        /* We may not issue NCQ commands to devices not supporting NCQ */
+        if (ata_is_ncq(tf->protocol) && !ata_ncq_enabled(dev)) {
+                fp = 1;
+                goto invalid_fld;
+        }
+
         /* sanity check for pio multi commands */
         if ((cdb[1] & 0xe0) && !is_multi_taskfile(tf)) {
                 fp = 1;
@@ -4282,7 +4288,7 @@ static inline void ata_scsi_dump_cdb(struct ata_port *ap,
 #ifdef ATA_DEBUG
         struct scsi_device *scsidev = cmd->device;
 
-        DPRINTK("CDB (%u:%d,%d,%d) %9ph\n",
+        DPRINTK("CDB (%u:%d,%d,%lld) %9ph\n",
                 ap->print_id,
                 scsidev->channel, scsidev->id, scsidev->lun,
                 cmd->cmnd);
@@ -4309,7 +4315,9 @@ static inline int __ata_scsi_queuecmd(struct scsi_cmnd *scmd,
                 if (likely((scsi_op != ATA_16) || !atapi_passthru16)) {
                         /* relay SCSI command to ATAPI device */
                         int len = COMMAND_SIZE(scsi_op);
-                        if (unlikely(len > scmd->cmd_len || len > dev->cdb_len))
+                        if (unlikely(len > scmd->cmd_len ||
+                                     len > dev->cdb_len ||
+                                     scmd->cmd_len > ATAPI_CDB_LEN))
                                 goto bad_cdb_len;
 
                         xlat_func = atapi_xlat;
diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index 80ee2f2a50d0..6456e07db72a 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -146,6 +146,7 @@
 enum sata_rcar_type {
         RCAR_GEN1_SATA,
         RCAR_GEN2_SATA,
+        RCAR_GEN3_SATA,
         RCAR_R8A7790_ES1_SATA,
 };
 
@@ -784,26 +785,11 @@ static void sata_rcar_setup_port(struct ata_host *host)
         ioaddr->command_addr    = ioaddr->cmd_addr + (ATA_REG_CMD << 2);
 }
 
-static void sata_rcar_init_controller(struct ata_host *host)
+static void sata_rcar_init_module(struct sata_rcar_priv *priv)
 {
-        struct sata_rcar_priv *priv = host->private_data;
         void __iomem *base = priv->base;
         u32 val;
 
-        /* reset and setup phy */
-        switch (priv->type) {
-        case RCAR_GEN1_SATA:
-                sata_rcar_gen1_phy_init(priv);
-                break;
-        case RCAR_GEN2_SATA:
-        case RCAR_R8A7790_ES1_SATA:
-                sata_rcar_gen2_phy_init(priv);
-                break;
-        default:
-                dev_warn(host->dev, "SATA phy is not initialized\n");
-                break;
-        }
-
         /* SATA-IP reset state */
         val = ioread32(base + ATAPI_CONTROL1_REG);
         val |= ATAPI_CONTROL1_RESET;
@@ -824,10 +810,33 @@ static void sata_rcar_init_controller(struct ata_host *host)
         /* ack and mask */
         iowrite32(0, base + SATAINTSTAT_REG);
         iowrite32(0x7ff, base + SATAINTMASK_REG);
+
         /* enable interrupts */
         iowrite32(ATAPI_INT_ENABLE_SATAINT, base + ATAPI_INT_ENABLE_REG);
 }
 
+static void sata_rcar_init_controller(struct ata_host *host)
+{
+        struct sata_rcar_priv *priv = host->private_data;
+
+        /* reset and setup phy */
+        switch (priv->type) {
+        case RCAR_GEN1_SATA:
+                sata_rcar_gen1_phy_init(priv);
+                break;
+        case RCAR_GEN2_SATA:
+        case RCAR_GEN3_SATA:
+        case RCAR_R8A7790_ES1_SATA:
+                sata_rcar_gen2_phy_init(priv);
+                break;
+        default:
+                dev_warn(host->dev, "SATA phy is not initialized\n");
+                break;
+        }
+
+        sata_rcar_init_module(priv);
+}
+
 static const struct of_device_id sata_rcar_match[] = {
         {
                 /* Deprecated by "renesas,sata-r8a7779" */
@@ -856,7 +865,7 @@ static const struct of_device_id sata_rcar_match[] = {
         },
         {
                 .compatible = "renesas,sata-r8a7795",
-                .data = (void *)RCAR_GEN2_SATA
+                .data = (void *)RCAR_GEN3_SATA
         },
         {
                 .compatible = "renesas,rcar-gen2-sata",
@@ -864,7 +873,7 @@ static const struct of_device_id sata_rcar_match[] = {
         },
         {
                 .compatible = "renesas,rcar-gen3-sata",
-                .data = (void *)RCAR_GEN2_SATA
+                .data = (void *)RCAR_GEN3_SATA
         },
         { },
 };
@@ -982,11 +991,18 @@ static int sata_rcar_resume(struct device *dev)
         if (ret)
                 return ret;
 
-        /* ack and mask */
-        iowrite32(0, base + SATAINTSTAT_REG);
-        iowrite32(0x7ff, base + SATAINTMASK_REG);
-        /* enable interrupts */
-        iowrite32(ATAPI_INT_ENABLE_SATAINT, base + ATAPI_INT_ENABLE_REG);
+        if (priv->type == RCAR_GEN3_SATA) {
+                sata_rcar_gen2_phy_init(priv);
+                sata_rcar_init_module(priv);
+        } else {
+                /* ack and mask */
+                iowrite32(0, base + SATAINTSTAT_REG);
+                iowrite32(0x7ff, base + SATAINTMASK_REG);
+
+                /* enable interrupts */
+                iowrite32(ATAPI_INT_ENABLE_SATAINT,
+                          base + ATAPI_INT_ENABLE_REG);
+        }
 
         ata_host_resume(host);
 
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 8b14bd326d4a..46d47bd6ca1f 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3908,6 +3908,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9230,
                          quirk_dma_func1_alias);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0642,
                          quirk_dma_func1_alias);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0645,
+                         quirk_dma_func1_alias);
 /* https://bugs.gentoo.org/show_bug.cgi?id=497630 */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_JMICRON,
                          PCI_DEVICE_ID_JMICRON_JMB388_ESD,