Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: (21 commits)
  libata: bump transfer chunk size if it's odd
  libata: Return proper ATA INT status in pata_bf54x driver
  pata_ali: trim trailing whitespace (fix checkpatch complaints)
  pata_isapnp: Polled devices
  pata_hpt37x: Fix cable detect bug spotted by Sergei
  pata_ali: Lots of problems still showing up with small ATAPI DMA
  pata_ali: Add Mitac 8317 and derivatives
  libata-core: List more documentation sources for reference
  ata_piix: Invalid use of writel/readl with iomap
  sata_sil24: fix sg table sizing
  pata_jmicron: fix disabled port handling in jmicron_pre_reset()
  pata_sil680: kill bogus reset code (take 2)
  ata_piix: port enable for the first SATA controller of ICH8 is 0xf not 0x3
  ata_piix: only enable the first port on apple macbook pro
  ata_piix: reorganize controller IDs
  pata_sis.c: Add Packard Bell EasyNote K5305 to laptops
  libata-scsi: be tolerant of 12-byte ATAPI commands in 16-byte CDBs
  libata: use ATA_HORKAGE_STUCK_ERR for ATAPI tape drives
  libata: workaround DRQ=1 ERR=1 for ATAPI tape drives
  libata: remove unused functions
  ...

1 files changed, 34 insertions, 4 deletions

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 94144ed50a6b..a883bb03d4c7 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2485,11 +2485,40 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc)
         if (!using_pio && ata_check_atapi_dma(qc))
                 using_pio = 1;
 
-        /* Some controller variants snoop this value for Packet transfers
-           to do state machine and FIFO management. Thus we want to set it
-           properly, and for DMA where it is effectively meaningless */
+        /* Some controller variants snoop this value for Packet
+         * transfers to do state machine and FIFO management.  Thus we
+         * want to set it properly, and for DMA where it is
+         * effectively meaningless.
+         */
         nbytes = min(qc->nbytes, (unsigned int)63 * 1024);
 
+        /* Most ATAPI devices which honor transfer chunk size don't
+         * behave according to the spec when odd chunk size which
+         * matches the transfer length is specified.  If the number of
+         * bytes to transfer is 2n+1.  According to the spec, what
+         * should happen is to indicate that 2n+1 is going to be
+         * transferred and transfer 2n+2 bytes where the last byte is
+         * padding.
+         *
+         * In practice, this doesn't happen.  ATAPI devices first
+         * indicate and transfer 2n bytes and then indicate and
+         * transfer 2 bytes where the last byte is padding.
+         *
+         * This inconsistency confuses several controllers which
+         * perform PIO using DMA such as Intel AHCIs and sil3124/32.
+         * These controllers use actual number of transferred bytes to
+         * update DMA poitner and transfer of 4n+2 bytes make those
+         * controller push DMA pointer by 4n+4 bytes because SATA data
+         * FISes are aligned to 4 bytes.  This causes data corruption
+         * and buffer overrun.
+         *
+         * Always setting nbytes to even number solves this problem
+         * because then ATAPI devices don't have to split data at 2n
+         * boundaries.
+         */
+        if (nbytes & 0x1)
+                nbytes++;
+
         qc->tf.lbam = (nbytes & 0xFF);
         qc->tf.lbah = (nbytes >> 8);
 
@@ -2869,7 +2898,8 @@ static inline int __ata_scsi_queuecmd(struct scsi_cmnd *scmd,
                 xlat_func = NULL;
                 if (likely((scsi_op != ATA_16) || !atapi_passthru16)) {
                         /* relay SCSI command to ATAPI device */
-                        if (unlikely(scmd->cmd_len > dev->cdb_len))
+                        int len = COMMAND_SIZE(scsi_op);
+                        if (unlikely(len > scmd->cmd_len || len > dev->cdb_len))
                                 goto bad_cdb_len;
 
                         xlat_func = atapi_xlat;