sreq->sr_data_direction = DMA_FROM_DEVICE; 
data_dir = DMA_FROM_DEVICE; 
int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg){	int rc = 0;	u8 scsi_cmd[MAX_COMMAND_SIZE];	u8 args[4], *argbuf = NULL;	int argsize = 0;	struct scsi_request *sreq;	if (NULL == (void *)arg)		return -EINVAL;	if (copy_from_user(args, arg, sizeof(args)))		return -EFAULT;	sreq = scsi_allocate_request(scsidev, GFP_KERNEL);	if (!sreq)		return -EINTR;	memset(scsi_cmd, 0, sizeof(scsi_cmd));	if (args[3]) {		argsize = SECTOR_SIZE * args[3];		argbuf = kmalloc(argsize, GFP_KERNEL);		if (argbuf == NULL) {			rc = -ENOMEM;			goto error;		}		scsi_cmd[1]  = (4 << 1); /* PIO Data-in */		scsi_cmd[2]  = 0x0e;     /* no off.line or cc, read from dev,		                            block count in sector count field */		sreq->sr_data_direction = DMA_FROM_DEVICE;	} else {		scsi_cmd[1]  = (3 << 1); /* Non-data */		/* scsi_cmd[2] is already 0 -- no off.line, cc, or data xfer */		sreq->sr_data_direction = DMA_NONE;	}	scsi_cmd[0] = ATA_16;	scsi_cmd[4] = args[2];	if (args[0] == WIN_SMART) { /* hack -- ide driver does this too... */		scsi_cmd[6]  = args[3];		scsi_cmd[8]  = args[1];		scsi_cmd[10] = 0x4f;		scsi_cmd[12] = 0xc2;	} else {		scsi_cmd[6]  = args[1];	}	scsi_cmd[14] = args[0];	/* Good values for timeout and retries?  Values below	   from scsi_ioctl_send_command() for default case... */	scsi_wait_req(sreq, scsi_cmd, argbuf, argsize, (10*HZ), 5);	if (sreq->sr_result) {		rc = -EIO;		goto error;	}	/* Need code to retrieve data from check condition? */	if ((argbuf)	 && copy_to_user((void *)(arg + sizeof(args)), argbuf, argsize))		rc = -EFAULT;error:	scsi_release_request(sreq);	if (argbuf)		kfree(argbuf);	return rc;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/85837ebdd7bb3e96a60e9b4c6af6c60d1273bc67/libata-scsi.c/buggy/drivers/scsi/libata-scsi.c