xref: /freebsd/sys/dev/usb/storage/umass.c (revision 48c5129f93c5eb5419c87b08e4677d51513f1dc0)
1 #include <sys/cdefs.h>
2 __FBSDID("$FreeBSD$");
3 
4 /*-
5  * Copyright (c) 1999 MAEKAWA Masahide <bishop@rr.iij4u.or.jp>,
6  *		      Nick Hibma <n_hibma@FreeBSD.org>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  *	$FreeBSD$
31  *	$NetBSD: umass.c,v 1.28 2000/04/02 23:46:53 augustss Exp $
32  */
33 
34 /* Also already merged from NetBSD:
35  *	$NetBSD: umass.c,v 1.67 2001/11/25 19:05:22 augustss Exp $
36  *	$NetBSD: umass.c,v 1.90 2002/11/04 19:17:33 pooka Exp $
37  *	$NetBSD: umass.c,v 1.108 2003/11/07 17:03:25 wiz Exp $
38  *	$NetBSD: umass.c,v 1.109 2003/12/04 13:57:31 keihan Exp $
39  */
40 
41 /*
42  * Universal Serial Bus Mass Storage Class specs:
43  * http://www.usb.org/developers/devclass_docs/usb_msc_overview_1.2.pdf
44  * http://www.usb.org/developers/devclass_docs/usbmassbulk_10.pdf
45  * http://www.usb.org/developers/devclass_docs/usb_msc_cbi_1.1.pdf
46  * http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf
47  */
48 
49 /*
50  * Ported to NetBSD by Lennart Augustsson <augustss@NetBSD.org>.
51  * Parts of the code written by Jason R. Thorpe <thorpej@shagadelic.org>.
52  */
53 
54 /*
55  * The driver handles 3 Wire Protocols
56  * - Command/Bulk/Interrupt (CBI)
57  * - Command/Bulk/Interrupt with Command Completion Interrupt (CBI with CCI)
58  * - Mass Storage Bulk-Only (BBB)
59  *   (BBB refers Bulk/Bulk/Bulk for Command/Data/Status phases)
60  *
61  * Over these wire protocols it handles the following command protocols
62  * - SCSI
63  * - UFI (floppy command set)
64  * - 8070i (ATAPI)
65  *
66  * UFI and 8070i (ATAPI) are transformed versions of the SCSI command set. The
67  * sc->sc_transform method is used to convert the commands into the appropriate
68  * format (if at all necessary). For example, UFI requires all commands to be
69  * 12 bytes in length amongst other things.
70  *
71  * The source code below is marked and can be split into a number of pieces
72  * (in this order):
73  *
74  * - probe/attach/detach
75  * - generic transfer routines
76  * - BBB
77  * - CBI
78  * - CBI_I (in addition to functions from CBI)
79  * - CAM (Common Access Method)
80  * - SCSI
81  * - UFI
82  * - 8070i (ATAPI)
83  *
84  * The protocols are implemented using a state machine, for the transfers as
85  * well as for the resets. The state machine is contained in umass_t_*_callback.
86  * The state machine is started through either umass_command_start() or
87  * umass_reset().
88  *
89  * The reason for doing this is a) CAM performs a lot better this way and b) it
90  * avoids using tsleep from interrupt context (for example after a failed
91  * transfer).
92  */
93 
94 /*
95  * The SCSI related part of this driver has been derived from the
96  * dev/ppbus/vpo.c driver, by Nicolas Souchu (nsouch@FreeBSD.org).
97  *
98  * The CAM layer uses so called actions which are messages sent to the host
99  * adapter for completion. The actions come in through umass_cam_action. The
100  * appropriate block of routines is called depending on the transport protocol
101  * in use. When the transfer has finished, these routines call
102  * umass_cam_cb again to complete the CAM command.
103  */
104 
105 #include <sys/stdint.h>
106 #include <sys/stddef.h>
107 #include <sys/param.h>
108 #include <sys/queue.h>
109 #include <sys/types.h>
110 #include <sys/systm.h>
111 #include <sys/kernel.h>
112 #include <sys/bus.h>
113 #include <sys/module.h>
114 #include <sys/lock.h>
115 #include <sys/mutex.h>
116 #include <sys/condvar.h>
117 #include <sys/sysctl.h>
118 #include <sys/sx.h>
119 #include <sys/unistd.h>
120 #include <sys/callout.h>
121 #include <sys/malloc.h>
122 #include <sys/priv.h>
123 
124 #include <dev/usb/usb.h>
125 #include <dev/usb/usbdi.h>
126 #include <dev/usb/usbdi_util.h>
127 #include "usbdevs.h"
128 
129 #include <dev/usb/quirk/usb_quirk.h>
130 
131 #include <cam/cam.h>
132 #include <cam/cam_ccb.h>
133 #include <cam/cam_sim.h>
134 #include <cam/cam_xpt_sim.h>
135 #include <cam/scsi/scsi_all.h>
136 #include <cam/scsi/scsi_da.h>
137 
138 #include <cam/cam_periph.h>
139 
140 #ifdef USB_DEBUG
141 #define	DIF(m, x)				\
142   do {						\
143     if (umass_debug & (m)) { x ; }		\
144   } while (0)
145 
146 #define	DPRINTF(sc, m, fmt, ...)			\
147   do {							\
148     if (umass_debug & (m)) {				\
149         printf("%s:%s: " fmt,				\
150 	       (sc) ? (const char *)(sc)->sc_name :	\
151 	       (const char *)"umassX",			\
152 		__FUNCTION__ ,## __VA_ARGS__);		\
153     }							\
154   } while (0)
155 
156 #define	UDMASS_GEN	0x00010000	/* general */
157 #define	UDMASS_SCSI	0x00020000	/* scsi */
158 #define	UDMASS_UFI	0x00040000	/* ufi command set */
159 #define	UDMASS_ATAPI	0x00080000	/* 8070i command set */
160 #define	UDMASS_CMD	(UDMASS_SCSI|UDMASS_UFI|UDMASS_ATAPI)
161 #define	UDMASS_USB	0x00100000	/* USB general */
162 #define	UDMASS_BBB	0x00200000	/* Bulk-Only transfers */
163 #define	UDMASS_CBI	0x00400000	/* CBI transfers */
164 #define	UDMASS_WIRE	(UDMASS_BBB|UDMASS_CBI)
165 #define	UDMASS_ALL	0xffff0000	/* all of the above */
166 static int umass_debug = 0;
167 
168 static SYSCTL_NODE(_hw_usb, OID_AUTO, umass, CTLFLAG_RW, 0, "USB umass");
169 SYSCTL_INT(_hw_usb_umass, OID_AUTO, debug, CTLFLAG_RW | CTLFLAG_TUN,
170     &umass_debug, 0, "umass debug level");
171 TUNABLE_INT("hw.usb.umass.debug", &umass_debug);
172 #else
173 #define	DIF(...) do { } while (0)
174 #define	DPRINTF(...) do { } while (0)
175 #endif
176 
177 #define	UMASS_BULK_SIZE (1 << 17)
178 #define	UMASS_CBI_DIAGNOSTIC_CMDLEN 12	/* bytes */
179 #define	UMASS_MAX_CMDLEN MAX(12, CAM_MAX_CDBLEN)	/* bytes */
180 
181 /* USB transfer definitions */
182 
183 #define	UMASS_T_BBB_RESET1      0	/* Bulk-Only */
184 #define	UMASS_T_BBB_RESET2      1
185 #define	UMASS_T_BBB_RESET3      2
186 #define	UMASS_T_BBB_COMMAND     3
187 #define	UMASS_T_BBB_DATA_READ   4
188 #define	UMASS_T_BBB_DATA_RD_CS  5
189 #define	UMASS_T_BBB_DATA_WRITE  6
190 #define	UMASS_T_BBB_DATA_WR_CS  7
191 #define	UMASS_T_BBB_STATUS      8
192 #define	UMASS_T_BBB_MAX         9
193 
194 #define	UMASS_T_CBI_RESET1      0	/* CBI */
195 #define	UMASS_T_CBI_RESET2      1
196 #define	UMASS_T_CBI_RESET3      2
197 #define	UMASS_T_CBI_COMMAND     3
198 #define	UMASS_T_CBI_DATA_READ   4
199 #define	UMASS_T_CBI_DATA_RD_CS  5
200 #define	UMASS_T_CBI_DATA_WRITE  6
201 #define	UMASS_T_CBI_DATA_WR_CS  7
202 #define	UMASS_T_CBI_STATUS      8
203 #define	UMASS_T_CBI_RESET4      9
204 #define	UMASS_T_CBI_MAX        10
205 
206 #define	UMASS_T_MAX MAX(UMASS_T_CBI_MAX, UMASS_T_BBB_MAX)
207 
208 /* Generic definitions */
209 
210 /* Direction for transfer */
211 #define	DIR_NONE	0
212 #define	DIR_IN		1
213 #define	DIR_OUT		2
214 
215 /* device name */
216 #define	DEVNAME		"umass"
217 #define	DEVNAME_SIM	"umass-sim"
218 
219 /* Approximate maximum transfer speeds (assumes 33% overhead). */
220 #define	UMASS_FULL_TRANSFER_SPEED	1000
221 #define	UMASS_HIGH_TRANSFER_SPEED	40000
222 #define	UMASS_SUPER_TRANSFER_SPEED	400000
223 #define	UMASS_FLOPPY_TRANSFER_SPEED	20
224 
225 #define	UMASS_TIMEOUT			5000	/* ms */
226 
227 /* CAM specific definitions */
228 
229 #define	UMASS_SCSIID_MAX	1	/* maximum number of drives expected */
230 #define	UMASS_SCSIID_HOST	UMASS_SCSIID_MAX
231 
232 /* Bulk-Only features */
233 
234 #define	UR_BBB_RESET		0xff	/* Bulk-Only reset */
235 #define	UR_BBB_GET_MAX_LUN	0xfe	/* Get maximum lun */
236 
237 /* Command Block Wrapper */
238 typedef struct {
239 	uDWord	dCBWSignature;
240 #define	CBWSIGNATURE	0x43425355
241 	uDWord	dCBWTag;
242 	uDWord	dCBWDataTransferLength;
243 	uByte	bCBWFlags;
244 #define	CBWFLAGS_OUT	0x00
245 #define	CBWFLAGS_IN	0x80
246 	uByte	bCBWLUN;
247 	uByte	bCDBLength;
248 #define	CBWCDBLENGTH	16
249 	uByte	CBWCDB[CBWCDBLENGTH];
250 } __packed umass_bbb_cbw_t;
251 
252 #define	UMASS_BBB_CBW_SIZE	31
253 
254 /* Command Status Wrapper */
255 typedef struct {
256 	uDWord	dCSWSignature;
257 #define	CSWSIGNATURE	0x53425355
258 #define	CSWSIGNATURE_IMAGINATION_DBX1	0x43425355
259 #define	CSWSIGNATURE_OLYMPUS_C1	0x55425355
260 	uDWord	dCSWTag;
261 	uDWord	dCSWDataResidue;
262 	uByte	bCSWStatus;
263 #define	CSWSTATUS_GOOD	0x0
264 #define	CSWSTATUS_FAILED	0x1
265 #define	CSWSTATUS_PHASE	0x2
266 } __packed umass_bbb_csw_t;
267 
268 #define	UMASS_BBB_CSW_SIZE	13
269 
270 /* CBI features */
271 
272 #define	UR_CBI_ADSC	0x00
273 
274 typedef union {
275 	struct {
276 		uint8_t	type;
277 #define	IDB_TYPE_CCI		0x00
278 		uint8_t	value;
279 #define	IDB_VALUE_PASS		0x00
280 #define	IDB_VALUE_FAIL		0x01
281 #define	IDB_VALUE_PHASE		0x02
282 #define	IDB_VALUE_PERSISTENT	0x03
283 #define	IDB_VALUE_STATUS_MASK	0x03
284 	} __packed common;
285 
286 	struct {
287 		uint8_t	asc;
288 		uint8_t	ascq;
289 	} __packed ufi;
290 } __packed umass_cbi_sbl_t;
291 
292 struct umass_softc;			/* see below */
293 
294 typedef void (umass_callback_t)(struct umass_softc *sc, union ccb *ccb,
295     	uint32_t residue, uint8_t status);
296 
297 #define	STATUS_CMD_OK		0	/* everything ok */
298 #define	STATUS_CMD_UNKNOWN	1	/* will have to fetch sense */
299 #define	STATUS_CMD_FAILED	2	/* transfer was ok, command failed */
300 #define	STATUS_WIRE_FAILED	3	/* couldn't even get command across */
301 
302 typedef uint8_t (umass_transform_t)(struct umass_softc *sc, uint8_t *cmd_ptr,
303     	uint8_t cmd_len);
304 
305 /* Wire and command protocol */
306 #define	UMASS_PROTO_BBB		0x0001	/* USB wire protocol */
307 #define	UMASS_PROTO_CBI		0x0002
308 #define	UMASS_PROTO_CBI_I	0x0004
309 #define	UMASS_PROTO_WIRE	0x00ff	/* USB wire protocol mask */
310 #define	UMASS_PROTO_SCSI	0x0100	/* command protocol */
311 #define	UMASS_PROTO_ATAPI	0x0200
312 #define	UMASS_PROTO_UFI		0x0400
313 #define	UMASS_PROTO_RBC		0x0800
314 #define	UMASS_PROTO_COMMAND	0xff00	/* command protocol mask */
315 
316 /* Device specific quirks */
317 #define	NO_QUIRKS		0x0000
318 	/*
319 	 * The drive does not support Test Unit Ready. Convert to Start Unit
320 	 */
321 #define	NO_TEST_UNIT_READY	0x0001
322 	/*
323 	 * The drive does not reset the Unit Attention state after REQUEST
324 	 * SENSE has been sent. The INQUIRY command does not reset the UA
325 	 * either, and so CAM runs in circles trying to retrieve the initial
326 	 * INQUIRY data.
327 	 */
328 #define	RS_NO_CLEAR_UA		0x0002
329 	/* The drive does not support START STOP.  */
330 #define	NO_START_STOP		0x0004
331 	/* Don't ask for full inquiry data (255b).  */
332 #define	FORCE_SHORT_INQUIRY	0x0008
333 	/* Needs to be initialised the Shuttle way */
334 #define	SHUTTLE_INIT		0x0010
335 	/* Drive needs to be switched to alternate iface 1 */
336 #define	ALT_IFACE_1		0x0020
337 	/* Drive does not do 1Mb/s, but just floppy speeds (20kb/s) */
338 #define	FLOPPY_SPEED		0x0040
339 	/* The device can't count and gets the residue of transfers wrong */
340 #define	IGNORE_RESIDUE		0x0080
341 	/* No GetMaxLun call */
342 #define	NO_GETMAXLUN		0x0100
343 	/* The device uses a weird CSWSIGNATURE. */
344 #define	WRONG_CSWSIG		0x0200
345 	/* Device cannot handle INQUIRY so fake a generic response */
346 #define	NO_INQUIRY		0x0400
347 	/* Device cannot handle INQUIRY EVPD, return CHECK CONDITION */
348 #define	NO_INQUIRY_EVPD		0x0800
349 	/* Pad all RBC requests to 12 bytes. */
350 #define	RBC_PAD_TO_12		0x1000
351 	/*
352 	 * Device reports number of sectors from READ_CAPACITY, not max
353 	 * sector number.
354 	 */
355 #define	READ_CAPACITY_OFFBY1	0x2000
356 	/*
357 	 * Device cannot handle a SCSI synchronize cache command.  Normally
358 	 * this quirk would be handled in the cam layer, but for IDE bridges
359 	 * we need to associate the quirk with the bridge and not the
360 	 * underlying disk device.  This is handled by faking a success
361 	 * result.
362 	 */
363 #define	NO_SYNCHRONIZE_CACHE	0x4000
364 	/* Device does not support 'PREVENT/ALLOW MEDIUM REMOVAL'. */
365 #define	NO_PREVENT_ALLOW	0x8000
366 
367 struct umass_softc {
368 
369 	struct scsi_sense cam_scsi_sense;
370 	struct scsi_test_unit_ready cam_scsi_test_unit_ready;
371 	struct mtx sc_mtx;
372 	struct {
373 		uint8_t *data_ptr;
374 		union ccb *ccb;
375 		umass_callback_t *callback;
376 
377 		uint32_t data_len;	/* bytes */
378 		uint32_t data_rem;	/* bytes */
379 		uint32_t data_timeout;	/* ms */
380 		uint32_t actlen;	/* bytes */
381 
382 		uint8_t	cmd_data[UMASS_MAX_CMDLEN];
383 		uint8_t	cmd_len;	/* bytes */
384 		uint8_t	dir;
385 		uint8_t	lun;
386 	}	sc_transfer;
387 
388 	/* Bulk specific variables for transfers in progress */
389 	umass_bbb_cbw_t cbw;		/* command block wrapper */
390 	umass_bbb_csw_t csw;		/* command status wrapper */
391 
392 	/* CBI specific variables for transfers in progress */
393 	umass_cbi_sbl_t sbl;		/* status block */
394 
395 	device_t sc_dev;
396 	struct usb_device *sc_udev;
397 	struct cam_sim *sc_sim;		/* SCSI Interface Module */
398 	struct usb_xfer *sc_xfer[UMASS_T_MAX];
399 
400 	/*
401 	 * The command transform function is used to convert the SCSI
402 	 * commands into their derivatives, like UFI, ATAPI, and friends.
403 	 */
404 	umass_transform_t *sc_transform;
405 
406 	uint32_t sc_unit;
407 	uint32_t sc_quirks;		/* they got it almost right */
408 	uint32_t sc_proto;		/* wire and cmd protocol */
409 
410 	uint8_t	sc_name[16];
411 	uint8_t	sc_iface_no;		/* interface number */
412 	uint8_t	sc_maxlun;		/* maximum LUN number, inclusive */
413 	uint8_t	sc_last_xfer_index;
414 	uint8_t	sc_status_try;
415 };
416 
417 struct umass_probe_proto {
418 	uint32_t quirks;
419 	uint32_t proto;
420 
421 	int	error;
422 };
423 
424 /* prototypes */
425 
426 static device_probe_t umass_probe;
427 static device_attach_t umass_attach;
428 static device_detach_t umass_detach;
429 
430 static usb_callback_t umass_tr_error;
431 static usb_callback_t umass_t_bbb_reset1_callback;
432 static usb_callback_t umass_t_bbb_reset2_callback;
433 static usb_callback_t umass_t_bbb_reset3_callback;
434 static usb_callback_t umass_t_bbb_command_callback;
435 static usb_callback_t umass_t_bbb_data_read_callback;
436 static usb_callback_t umass_t_bbb_data_rd_cs_callback;
437 static usb_callback_t umass_t_bbb_data_write_callback;
438 static usb_callback_t umass_t_bbb_data_wr_cs_callback;
439 static usb_callback_t umass_t_bbb_status_callback;
440 static usb_callback_t umass_t_cbi_reset1_callback;
441 static usb_callback_t umass_t_cbi_reset2_callback;
442 static usb_callback_t umass_t_cbi_reset3_callback;
443 static usb_callback_t umass_t_cbi_reset4_callback;
444 static usb_callback_t umass_t_cbi_command_callback;
445 static usb_callback_t umass_t_cbi_data_read_callback;
446 static usb_callback_t umass_t_cbi_data_rd_cs_callback;
447 static usb_callback_t umass_t_cbi_data_write_callback;
448 static usb_callback_t umass_t_cbi_data_wr_cs_callback;
449 static usb_callback_t umass_t_cbi_status_callback;
450 
451 static void	umass_cancel_ccb(struct umass_softc *);
452 static void	umass_init_shuttle(struct umass_softc *);
453 static void	umass_reset(struct umass_softc *);
454 static void	umass_t_bbb_data_clear_stall_callback(struct usb_xfer *,
455 		    uint8_t, uint8_t, usb_error_t);
456 static void	umass_command_start(struct umass_softc *, uint8_t, void *,
457 		    uint32_t, uint32_t, umass_callback_t *, union ccb *);
458 static uint8_t	umass_bbb_get_max_lun(struct umass_softc *);
459 static void	umass_cbi_start_status(struct umass_softc *);
460 static void	umass_t_cbi_data_clear_stall_callback(struct usb_xfer *,
461 		    uint8_t, uint8_t, usb_error_t);
462 static int	umass_cam_attach_sim(struct umass_softc *);
463 static void	umass_cam_attach(struct umass_softc *);
464 static void	umass_cam_detach_sim(struct umass_softc *);
465 static void	umass_cam_action(struct cam_sim *, union ccb *);
466 static void	umass_cam_poll(struct cam_sim *);
467 static void	umass_cam_cb(struct umass_softc *, union ccb *, uint32_t,
468 		    uint8_t);
469 static void	umass_cam_sense_cb(struct umass_softc *, union ccb *, uint32_t,
470 		    uint8_t);
471 static void	umass_cam_quirk_cb(struct umass_softc *, union ccb *, uint32_t,
472 		    uint8_t);
473 static uint8_t	umass_scsi_transform(struct umass_softc *, uint8_t *, uint8_t);
474 static uint8_t	umass_rbc_transform(struct umass_softc *, uint8_t *, uint8_t);
475 static uint8_t	umass_ufi_transform(struct umass_softc *, uint8_t *, uint8_t);
476 static uint8_t	umass_atapi_transform(struct umass_softc *, uint8_t *,
477 		    uint8_t);
478 static uint8_t	umass_no_transform(struct umass_softc *, uint8_t *, uint8_t);
479 static uint8_t	umass_std_transform(struct umass_softc *, union ccb *, uint8_t
480 		    *, uint8_t);
481 
482 #ifdef USB_DEBUG
483 static void	umass_bbb_dump_cbw(struct umass_softc *, umass_bbb_cbw_t *);
484 static void	umass_bbb_dump_csw(struct umass_softc *, umass_bbb_csw_t *);
485 static void	umass_cbi_dump_cmd(struct umass_softc *, void *, uint8_t);
486 static void	umass_dump_buffer(struct umass_softc *, uint8_t *, uint32_t,
487 		    uint32_t);
488 #endif
489 
490 static struct usb_config umass_bbb_config[UMASS_T_BBB_MAX] = {
491 
492 	[UMASS_T_BBB_RESET1] = {
493 		.type = UE_CONTROL,
494 		.endpoint = 0x00,	/* Control pipe */
495 		.direction = UE_DIR_ANY,
496 		.bufsize = sizeof(struct usb_device_request),
497 		.callback = &umass_t_bbb_reset1_callback,
498 		.timeout = 5000,	/* 5 seconds */
499 		.interval = 500,	/* 500 milliseconds */
500 	},
501 
502 	[UMASS_T_BBB_RESET2] = {
503 		.type = UE_CONTROL,
504 		.endpoint = 0x00,	/* Control pipe */
505 		.direction = UE_DIR_ANY,
506 		.bufsize = sizeof(struct usb_device_request),
507 		.callback = &umass_t_bbb_reset2_callback,
508 		.timeout = 5000,	/* 5 seconds */
509 		.interval = 50,	/* 50 milliseconds */
510 	},
511 
512 	[UMASS_T_BBB_RESET3] = {
513 		.type = UE_CONTROL,
514 		.endpoint = 0x00,	/* Control pipe */
515 		.direction = UE_DIR_ANY,
516 		.bufsize = sizeof(struct usb_device_request),
517 		.callback = &umass_t_bbb_reset3_callback,
518 		.timeout = 5000,	/* 5 seconds */
519 		.interval = 50,	/* 50 milliseconds */
520 	},
521 
522 	[UMASS_T_BBB_COMMAND] = {
523 		.type = UE_BULK,
524 		.endpoint = UE_ADDR_ANY,
525 		.direction = UE_DIR_OUT,
526 		.bufsize = sizeof(umass_bbb_cbw_t),
527 		.callback = &umass_t_bbb_command_callback,
528 		.timeout = 5000,	/* 5 seconds */
529 	},
530 
531 	[UMASS_T_BBB_DATA_READ] = {
532 		.type = UE_BULK,
533 		.endpoint = UE_ADDR_ANY,
534 		.direction = UE_DIR_IN,
535 		.bufsize = UMASS_BULK_SIZE,
536 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
537 		.callback = &umass_t_bbb_data_read_callback,
538 		.timeout = 0,	/* overwritten later */
539 	},
540 
541 	[UMASS_T_BBB_DATA_RD_CS] = {
542 		.type = UE_CONTROL,
543 		.endpoint = 0x00,	/* Control pipe */
544 		.direction = UE_DIR_ANY,
545 		.bufsize = sizeof(struct usb_device_request),
546 		.callback = &umass_t_bbb_data_rd_cs_callback,
547 		.timeout = 5000,	/* 5 seconds */
548 	},
549 
550 	[UMASS_T_BBB_DATA_WRITE] = {
551 		.type = UE_BULK,
552 		.endpoint = UE_ADDR_ANY,
553 		.direction = UE_DIR_OUT,
554 		.bufsize = UMASS_BULK_SIZE,
555 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
556 		.callback = &umass_t_bbb_data_write_callback,
557 		.timeout = 0,	/* overwritten later */
558 	},
559 
560 	[UMASS_T_BBB_DATA_WR_CS] = {
561 		.type = UE_CONTROL,
562 		.endpoint = 0x00,	/* Control pipe */
563 		.direction = UE_DIR_ANY,
564 		.bufsize = sizeof(struct usb_device_request),
565 		.callback = &umass_t_bbb_data_wr_cs_callback,
566 		.timeout = 5000,	/* 5 seconds */
567 	},
568 
569 	[UMASS_T_BBB_STATUS] = {
570 		.type = UE_BULK,
571 		.endpoint = UE_ADDR_ANY,
572 		.direction = UE_DIR_IN,
573 		.bufsize = sizeof(umass_bbb_csw_t),
574 		.flags = {.short_xfer_ok = 1,},
575 		.callback = &umass_t_bbb_status_callback,
576 		.timeout = 5000,	/* ms */
577 	},
578 };
579 
580 static struct usb_config umass_cbi_config[UMASS_T_CBI_MAX] = {
581 
582 	[UMASS_T_CBI_RESET1] = {
583 		.type = UE_CONTROL,
584 		.endpoint = 0x00,	/* Control pipe */
585 		.direction = UE_DIR_ANY,
586 		.bufsize = (sizeof(struct usb_device_request) +
587 		    UMASS_CBI_DIAGNOSTIC_CMDLEN),
588 		.callback = &umass_t_cbi_reset1_callback,
589 		.timeout = 5000,	/* 5 seconds */
590 		.interval = 500,	/* 500 milliseconds */
591 	},
592 
593 	[UMASS_T_CBI_RESET2] = {
594 		.type = UE_CONTROL,
595 		.endpoint = 0x00,	/* Control pipe */
596 		.direction = UE_DIR_ANY,
597 		.bufsize = sizeof(struct usb_device_request),
598 		.callback = &umass_t_cbi_reset2_callback,
599 		.timeout = 5000,	/* 5 seconds */
600 		.interval = 50,	/* 50 milliseconds */
601 	},
602 
603 	[UMASS_T_CBI_RESET3] = {
604 		.type = UE_CONTROL,
605 		.endpoint = 0x00,	/* Control pipe */
606 		.direction = UE_DIR_ANY,
607 		.bufsize = sizeof(struct usb_device_request),
608 		.callback = &umass_t_cbi_reset3_callback,
609 		.timeout = 5000,	/* 5 seconds */
610 		.interval = 50,	/* 50 milliseconds */
611 	},
612 
613 	[UMASS_T_CBI_COMMAND] = {
614 		.type = UE_CONTROL,
615 		.endpoint = 0x00,	/* Control pipe */
616 		.direction = UE_DIR_ANY,
617 		.bufsize = (sizeof(struct usb_device_request) +
618 		    UMASS_MAX_CMDLEN),
619 		.callback = &umass_t_cbi_command_callback,
620 		.timeout = 5000,	/* 5 seconds */
621 	},
622 
623 	[UMASS_T_CBI_DATA_READ] = {
624 		.type = UE_BULK,
625 		.endpoint = UE_ADDR_ANY,
626 		.direction = UE_DIR_IN,
627 		.bufsize = UMASS_BULK_SIZE,
628 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
629 		.callback = &umass_t_cbi_data_read_callback,
630 		.timeout = 0,	/* overwritten later */
631 	},
632 
633 	[UMASS_T_CBI_DATA_RD_CS] = {
634 		.type = UE_CONTROL,
635 		.endpoint = 0x00,	/* Control pipe */
636 		.direction = UE_DIR_ANY,
637 		.bufsize = sizeof(struct usb_device_request),
638 		.callback = &umass_t_cbi_data_rd_cs_callback,
639 		.timeout = 5000,	/* 5 seconds */
640 	},
641 
642 	[UMASS_T_CBI_DATA_WRITE] = {
643 		.type = UE_BULK,
644 		.endpoint = UE_ADDR_ANY,
645 		.direction = UE_DIR_OUT,
646 		.bufsize = UMASS_BULK_SIZE,
647 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
648 		.callback = &umass_t_cbi_data_write_callback,
649 		.timeout = 0,	/* overwritten later */
650 	},
651 
652 	[UMASS_T_CBI_DATA_WR_CS] = {
653 		.type = UE_CONTROL,
654 		.endpoint = 0x00,	/* Control pipe */
655 		.direction = UE_DIR_ANY,
656 		.bufsize = sizeof(struct usb_device_request),
657 		.callback = &umass_t_cbi_data_wr_cs_callback,
658 		.timeout = 5000,	/* 5 seconds */
659 	},
660 
661 	[UMASS_T_CBI_STATUS] = {
662 		.type = UE_INTERRUPT,
663 		.endpoint = UE_ADDR_ANY,
664 		.direction = UE_DIR_IN,
665 		.flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
666 		.bufsize = sizeof(umass_cbi_sbl_t),
667 		.callback = &umass_t_cbi_status_callback,
668 		.timeout = 5000,	/* ms */
669 	},
670 
671 	[UMASS_T_CBI_RESET4] = {
672 		.type = UE_CONTROL,
673 		.endpoint = 0x00,	/* Control pipe */
674 		.direction = UE_DIR_ANY,
675 		.bufsize = sizeof(struct usb_device_request),
676 		.callback = &umass_t_cbi_reset4_callback,
677 		.timeout = 5000,	/* ms */
678 	},
679 };
680 
681 /* If device cannot return valid inquiry data, fake it */
682 static const uint8_t fake_inq_data[SHORT_INQUIRY_LENGTH] = {
683 	0, /* removable */ 0x80, SCSI_REV_2, SCSI_REV_2,
684 	 /* additional_length */ 31, 0, 0, 0
685 };
686 
687 #define	UFI_COMMAND_LENGTH	12	/* UFI commands are always 12 bytes */
688 #define	ATAPI_COMMAND_LENGTH	12	/* ATAPI commands are always 12 bytes */
689 
690 static devclass_t umass_devclass;
691 
692 static device_method_t umass_methods[] = {
693 	/* Device interface */
694 	DEVMETHOD(device_probe, umass_probe),
695 	DEVMETHOD(device_attach, umass_attach),
696 	DEVMETHOD(device_detach, umass_detach),
697 	{0, 0}
698 };
699 
700 static driver_t umass_driver = {
701 	.name = "umass",
702 	.methods = umass_methods,
703 	.size = sizeof(struct umass_softc),
704 };
705 
706 DRIVER_MODULE(umass, uhub, umass_driver, umass_devclass, NULL, 0);
707 MODULE_DEPEND(umass, usb, 1, 1, 1);
708 MODULE_DEPEND(umass, cam, 1, 1, 1);
709 MODULE_VERSION(umass, 1);
710 
711 /*
712  * USB device probe/attach/detach
713  */
714 
715 static const STRUCT_USB_HOST_ID __used umass_devs[] = {
716 	/* generic mass storage class */
717 	{USB_IFACE_CLASS(UICLASS_MASS),},
718 };
719 
720 static uint16_t
721 umass_get_proto(struct usb_interface *iface)
722 {
723 	struct usb_interface_descriptor *id;
724 	uint16_t retval;
725 
726 	retval = 0;
727 
728 	/* Check for a standards compliant device */
729 	id = usbd_get_interface_descriptor(iface);
730 	if ((id == NULL) ||
731 	    (id->bInterfaceClass != UICLASS_MASS)) {
732 		goto done;
733 	}
734 	switch (id->bInterfaceSubClass) {
735 	case UISUBCLASS_SCSI:
736 		retval |= UMASS_PROTO_SCSI;
737 		break;
738 	case UISUBCLASS_UFI:
739 		retval |= UMASS_PROTO_UFI;
740 		break;
741 	case UISUBCLASS_RBC:
742 		retval |= UMASS_PROTO_RBC;
743 		break;
744 	case UISUBCLASS_SFF8020I:
745 	case UISUBCLASS_SFF8070I:
746 		retval |= UMASS_PROTO_ATAPI;
747 		break;
748 	default:
749 		goto done;
750 	}
751 
752 	switch (id->bInterfaceProtocol) {
753 	case UIPROTO_MASS_CBI:
754 		retval |= UMASS_PROTO_CBI;
755 		break;
756 	case UIPROTO_MASS_CBI_I:
757 		retval |= UMASS_PROTO_CBI_I;
758 		break;
759 	case UIPROTO_MASS_BBB_OLD:
760 	case UIPROTO_MASS_BBB:
761 		retval |= UMASS_PROTO_BBB;
762 		break;
763 	default:
764 		goto done;
765 	}
766 done:
767 	return (retval);
768 }
769 
770 /*
771  * Match the device we are seeing with the devices supported.
772  */
773 static struct umass_probe_proto
774 umass_probe_proto(device_t dev, struct usb_attach_arg *uaa)
775 {
776 	struct umass_probe_proto ret;
777 	uint32_t quirks = NO_QUIRKS;
778 	uint32_t proto = umass_get_proto(uaa->iface);
779 
780 	memset(&ret, 0, sizeof(ret));
781 	ret.error = BUS_PROBE_GENERIC;
782 
783 	/* Search for protocol enforcement */
784 
785 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_BBB)) {
786 		proto &= ~UMASS_PROTO_WIRE;
787 		proto |= UMASS_PROTO_BBB;
788 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI)) {
789 		proto &= ~UMASS_PROTO_WIRE;
790 		proto |= UMASS_PROTO_CBI;
791 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI_I)) {
792 		proto &= ~UMASS_PROTO_WIRE;
793 		proto |= UMASS_PROTO_CBI_I;
794 	}
795 
796 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_SCSI)) {
797 		proto &= ~UMASS_PROTO_COMMAND;
798 		proto |= UMASS_PROTO_SCSI;
799 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_ATAPI)) {
800 		proto &= ~UMASS_PROTO_COMMAND;
801 		proto |= UMASS_PROTO_ATAPI;
802 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_UFI)) {
803 		proto &= ~UMASS_PROTO_COMMAND;
804 		proto |= UMASS_PROTO_UFI;
805 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_RBC)) {
806 		proto &= ~UMASS_PROTO_COMMAND;
807 		proto |= UMASS_PROTO_RBC;
808 	}
809 
810 	/* Check if the protocol is invalid */
811 
812 	if ((proto & UMASS_PROTO_COMMAND) == 0) {
813 		ret.error = ENXIO;
814 		goto done;
815 	}
816 
817 	if ((proto & UMASS_PROTO_WIRE) == 0) {
818 		ret.error = ENXIO;
819 		goto done;
820 	}
821 
822 	/* Search for quirks */
823 
824 	if (usb_test_quirk(uaa, UQ_MSC_NO_TEST_UNIT_READY))
825 		quirks |= NO_TEST_UNIT_READY;
826 	if (usb_test_quirk(uaa, UQ_MSC_NO_RS_CLEAR_UA))
827 		quirks |= RS_NO_CLEAR_UA;
828 	if (usb_test_quirk(uaa, UQ_MSC_NO_START_STOP))
829 		quirks |= NO_START_STOP;
830 	if (usb_test_quirk(uaa, UQ_MSC_NO_GETMAXLUN))
831 		quirks |= NO_GETMAXLUN;
832 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY))
833 		quirks |= NO_INQUIRY;
834 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY_EVPD))
835 		quirks |= NO_INQUIRY_EVPD;
836 	if (usb_test_quirk(uaa, UQ_MSC_NO_PREVENT_ALLOW))
837 		quirks |= NO_PREVENT_ALLOW;
838 	if (usb_test_quirk(uaa, UQ_MSC_NO_SYNC_CACHE))
839 		quirks |= NO_SYNCHRONIZE_CACHE;
840 	if (usb_test_quirk(uaa, UQ_MSC_SHUTTLE_INIT))
841 		quirks |= SHUTTLE_INIT;
842 	if (usb_test_quirk(uaa, UQ_MSC_ALT_IFACE_1))
843 		quirks |= ALT_IFACE_1;
844 	if (usb_test_quirk(uaa, UQ_MSC_FLOPPY_SPEED))
845 		quirks |= FLOPPY_SPEED;
846 	if (usb_test_quirk(uaa, UQ_MSC_IGNORE_RESIDUE))
847 		quirks |= IGNORE_RESIDUE;
848 	if (usb_test_quirk(uaa, UQ_MSC_WRONG_CSWSIG))
849 		quirks |= WRONG_CSWSIG;
850 	if (usb_test_quirk(uaa, UQ_MSC_RBC_PAD_TO_12))
851 		quirks |= RBC_PAD_TO_12;
852 	if (usb_test_quirk(uaa, UQ_MSC_READ_CAP_OFFBY1))
853 		quirks |= READ_CAPACITY_OFFBY1;
854 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_SHORT_INQ))
855 		quirks |= FORCE_SHORT_INQUIRY;
856 
857 done:
858 	ret.quirks = quirks;
859 	ret.proto = proto;
860 	return (ret);
861 }
862 
863 static int
864 umass_probe(device_t dev)
865 {
866 	struct usb_attach_arg *uaa = device_get_ivars(dev);
867 	struct umass_probe_proto temp;
868 
869 	if (uaa->usb_mode != USB_MODE_HOST) {
870 		return (ENXIO);
871 	}
872 	temp = umass_probe_proto(dev, uaa);
873 
874 	return (temp.error);
875 }
876 
877 static int
878 umass_attach(device_t dev)
879 {
880 	struct umass_softc *sc = device_get_softc(dev);
881 	struct usb_attach_arg *uaa = device_get_ivars(dev);
882 	struct umass_probe_proto temp = umass_probe_proto(dev, uaa);
883 	struct usb_interface_descriptor *id;
884 	int32_t err;
885 
886 	/*
887 	 * NOTE: the softc struct is cleared in device_set_driver.
888 	 * We can safely call umass_detach without specifically
889 	 * initializing the struct.
890 	 */
891 
892 	sc->sc_dev = dev;
893 	sc->sc_udev = uaa->device;
894 	sc->sc_proto = temp.proto;
895 	sc->sc_quirks = temp.quirks;
896 	sc->sc_unit = device_get_unit(dev);
897 
898 	snprintf(sc->sc_name, sizeof(sc->sc_name),
899 	    "%s", device_get_nameunit(dev));
900 
901 	device_set_usb_desc(dev);
902 
903         mtx_init(&sc->sc_mtx, device_get_nameunit(dev),
904 	    NULL, MTX_DEF | MTX_RECURSE);
905 
906 	/* get interface index */
907 
908 	id = usbd_get_interface_descriptor(uaa->iface);
909 	if (id == NULL) {
910 		device_printf(dev, "failed to get "
911 		    "interface number\n");
912 		goto detach;
913 	}
914 	sc->sc_iface_no = id->bInterfaceNumber;
915 
916 #ifdef USB_DEBUG
917 	device_printf(dev, " ");
918 
919 	switch (sc->sc_proto & UMASS_PROTO_COMMAND) {
920 	case UMASS_PROTO_SCSI:
921 		printf("SCSI");
922 		break;
923 	case UMASS_PROTO_ATAPI:
924 		printf("8070i (ATAPI)");
925 		break;
926 	case UMASS_PROTO_UFI:
927 		printf("UFI");
928 		break;
929 	case UMASS_PROTO_RBC:
930 		printf("RBC");
931 		break;
932 	default:
933 		printf("(unknown 0x%02x)",
934 		    sc->sc_proto & UMASS_PROTO_COMMAND);
935 		break;
936 	}
937 
938 	printf(" over ");
939 
940 	switch (sc->sc_proto & UMASS_PROTO_WIRE) {
941 	case UMASS_PROTO_BBB:
942 		printf("Bulk-Only");
943 		break;
944 	case UMASS_PROTO_CBI:		/* uses Comand/Bulk pipes */
945 		printf("CBI");
946 		break;
947 	case UMASS_PROTO_CBI_I:	/* uses Comand/Bulk/Interrupt pipes */
948 		printf("CBI with CCI");
949 		break;
950 	default:
951 		printf("(unknown 0x%02x)",
952 		    sc->sc_proto & UMASS_PROTO_WIRE);
953 	}
954 
955 	printf("; quirks = 0x%04x\n", sc->sc_quirks);
956 #endif
957 
958 	if (sc->sc_quirks & ALT_IFACE_1) {
959 		err = usbd_set_alt_interface_index
960 		    (uaa->device, uaa->info.bIfaceIndex, 1);
961 
962 		if (err) {
963 			DPRINTF(sc, UDMASS_USB, "could not switch to "
964 			    "Alt Interface 1\n");
965 			goto detach;
966 		}
967 	}
968 	/* allocate all required USB transfers */
969 
970 	if (sc->sc_proto & UMASS_PROTO_BBB) {
971 
972 		err = usbd_transfer_setup(uaa->device,
973 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_bbb_config,
974 		    UMASS_T_BBB_MAX, sc, &sc->sc_mtx);
975 
976 		/* skip reset first time */
977 		sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
978 
979 	} else if (sc->sc_proto & (UMASS_PROTO_CBI | UMASS_PROTO_CBI_I)) {
980 
981 		err = usbd_transfer_setup(uaa->device,
982 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_cbi_config,
983 		    UMASS_T_CBI_MAX, sc, &sc->sc_mtx);
984 
985 		/* skip reset first time */
986 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
987 
988 	} else {
989 		err = USB_ERR_INVAL;
990 	}
991 
992 	if (err) {
993 		device_printf(dev, "could not setup required "
994 		    "transfers, %s\n", usbd_errstr(err));
995 		goto detach;
996 	}
997 	sc->sc_transform =
998 	    (sc->sc_proto & UMASS_PROTO_SCSI) ? &umass_scsi_transform :
999 	    (sc->sc_proto & UMASS_PROTO_UFI) ? &umass_ufi_transform :
1000 	    (sc->sc_proto & UMASS_PROTO_ATAPI) ? &umass_atapi_transform :
1001 	    (sc->sc_proto & UMASS_PROTO_RBC) ? &umass_rbc_transform :
1002 	    &umass_no_transform;
1003 
1004 	/* from here onwards the device can be used. */
1005 
1006 	if (sc->sc_quirks & SHUTTLE_INIT) {
1007 		umass_init_shuttle(sc);
1008 	}
1009 	/* get the maximum LUN supported by the device */
1010 
1011 	if (((sc->sc_proto & UMASS_PROTO_WIRE) == UMASS_PROTO_BBB) &&
1012 	    !(sc->sc_quirks & NO_GETMAXLUN))
1013 		sc->sc_maxlun = umass_bbb_get_max_lun(sc);
1014 	else
1015 		sc->sc_maxlun = 0;
1016 
1017 	/* Prepare the SCSI command block */
1018 	sc->cam_scsi_sense.opcode = REQUEST_SENSE;
1019 	sc->cam_scsi_test_unit_ready.opcode = TEST_UNIT_READY;
1020 
1021 	/* register the SIM */
1022 	err = umass_cam_attach_sim(sc);
1023 	if (err) {
1024 		goto detach;
1025 	}
1026 	/* scan the SIM */
1027 	umass_cam_attach(sc);
1028 
1029 	DPRINTF(sc, UDMASS_GEN, "Attach finished\n");
1030 
1031 	return (0);			/* success */
1032 
1033 detach:
1034 	umass_detach(dev);
1035 	return (ENXIO);			/* failure */
1036 }
1037 
1038 static int
1039 umass_detach(device_t dev)
1040 {
1041 	struct umass_softc *sc = device_get_softc(dev);
1042 
1043 	DPRINTF(sc, UDMASS_USB, "\n");
1044 
1045 	/* teardown our statemachine */
1046 
1047 	usbd_transfer_unsetup(sc->sc_xfer, UMASS_T_MAX);
1048 
1049 	mtx_lock(&sc->sc_mtx);
1050 
1051 	/* cancel any leftover CCB's */
1052 
1053 	umass_cancel_ccb(sc);
1054 
1055 	umass_cam_detach_sim(sc);
1056 
1057 	mtx_unlock(&sc->sc_mtx);
1058 
1059 	mtx_destroy(&sc->sc_mtx);
1060 
1061 	return (0);			/* success */
1062 }
1063 
1064 static void
1065 umass_init_shuttle(struct umass_softc *sc)
1066 {
1067 	struct usb_device_request req;
1068 	usb_error_t err;
1069 	uint8_t status[2] = {0, 0};
1070 
1071 	/*
1072 	 * The Linux driver does this, but no one can tell us what the
1073 	 * command does.
1074 	 */
1075 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1076 	req.bRequest = 1;		/* XXX unknown command */
1077 	USETW(req.wValue, 0);
1078 	req.wIndex[0] = sc->sc_iface_no;
1079 	req.wIndex[1] = 0;
1080 	USETW(req.wLength, sizeof(status));
1081 	err = usbd_do_request(sc->sc_udev, NULL, &req, &status);
1082 
1083 	DPRINTF(sc, UDMASS_GEN, "Shuttle init returned 0x%02x%02x\n",
1084 	    status[0], status[1]);
1085 }
1086 
1087 /*
1088  * Generic functions to handle transfers
1089  */
1090 
1091 static void
1092 umass_transfer_start(struct umass_softc *sc, uint8_t xfer_index)
1093 {
1094 	DPRINTF(sc, UDMASS_GEN, "transfer index = "
1095 	    "%d\n", xfer_index);
1096 
1097 	if (sc->sc_xfer[xfer_index]) {
1098 		sc->sc_last_xfer_index = xfer_index;
1099 		usbd_transfer_start(sc->sc_xfer[xfer_index]);
1100 	} else {
1101 		umass_cancel_ccb(sc);
1102 	}
1103 }
1104 
1105 static void
1106 umass_reset(struct umass_softc *sc)
1107 {
1108 	DPRINTF(sc, UDMASS_GEN, "resetting device\n");
1109 
1110 	/*
1111 	 * stop the last transfer, if not already stopped:
1112 	 */
1113 	usbd_transfer_stop(sc->sc_xfer[sc->sc_last_xfer_index]);
1114 	umass_transfer_start(sc, 0);
1115 }
1116 
1117 static void
1118 umass_cancel_ccb(struct umass_softc *sc)
1119 {
1120 	union ccb *ccb;
1121 
1122 	mtx_assert(&sc->sc_mtx, MA_OWNED);
1123 
1124 	ccb = sc->sc_transfer.ccb;
1125 	sc->sc_transfer.ccb = NULL;
1126 	sc->sc_last_xfer_index = 0;
1127 
1128 	if (ccb) {
1129 		(sc->sc_transfer.callback)
1130 		    (sc, ccb, (sc->sc_transfer.data_len -
1131 		    sc->sc_transfer.actlen), STATUS_WIRE_FAILED);
1132 	}
1133 }
1134 
1135 static void
1136 umass_tr_error(struct usb_xfer *xfer, usb_error_t error)
1137 {
1138 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1139 
1140 	if (error != USB_ERR_CANCELLED) {
1141 
1142 		DPRINTF(sc, UDMASS_GEN, "transfer error, %s -> "
1143 		    "reset\n", usbd_errstr(error));
1144 	}
1145 	umass_cancel_ccb(sc);
1146 }
1147 
1148 /*
1149  * BBB protocol specific functions
1150  */
1151 
1152 static void
1153 umass_t_bbb_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1154 {
1155 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1156 	struct usb_device_request req;
1157 	struct usb_page_cache *pc;
1158 
1159 	switch (USB_GET_STATE(xfer)) {
1160 	case USB_ST_TRANSFERRED:
1161 		umass_transfer_start(sc, UMASS_T_BBB_RESET2);
1162 		return;
1163 
1164 	case USB_ST_SETUP:
1165 		/*
1166 		 * Reset recovery (5.3.4 in Universal Serial Bus Mass Storage Class)
1167 		 *
1168 		 * For Reset Recovery the host shall issue in the following order:
1169 		 * a) a Bulk-Only Mass Storage Reset
1170 		 * b) a Clear Feature HALT to the Bulk-In endpoint
1171 		 * c) a Clear Feature HALT to the Bulk-Out endpoint
1172 		 *
1173 		 * This is done in 3 steps, using 3 transfers:
1174 		 * UMASS_T_BBB_RESET1
1175 		 * UMASS_T_BBB_RESET2
1176 		 * UMASS_T_BBB_RESET3
1177 		 */
1178 
1179 		DPRINTF(sc, UDMASS_BBB, "BBB reset!\n");
1180 
1181 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1182 		req.bRequest = UR_BBB_RESET;	/* bulk only reset */
1183 		USETW(req.wValue, 0);
1184 		req.wIndex[0] = sc->sc_iface_no;
1185 		req.wIndex[1] = 0;
1186 		USETW(req.wLength, 0);
1187 
1188 		pc = usbd_xfer_get_frame(xfer, 0);
1189 		usbd_copy_in(pc, 0, &req, sizeof(req));
1190 
1191 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1192 		usbd_xfer_set_frames(xfer, 1);
1193 		usbd_transfer_submit(xfer);
1194 		return;
1195 
1196 	default:			/* Error */
1197 		umass_tr_error(xfer, error);
1198 		return;
1199 	}
1200 }
1201 
1202 static void
1203 umass_t_bbb_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1204 {
1205 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_RESET3,
1206 	    UMASS_T_BBB_DATA_READ, error);
1207 }
1208 
1209 static void
1210 umass_t_bbb_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1211 {
1212 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_COMMAND,
1213 	    UMASS_T_BBB_DATA_WRITE, error);
1214 }
1215 
1216 static void
1217 umass_t_bbb_data_clear_stall_callback(struct usb_xfer *xfer,
1218     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1219 {
1220 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1221 
1222 	switch (USB_GET_STATE(xfer)) {
1223 	case USB_ST_TRANSFERRED:
1224 tr_transferred:
1225 		umass_transfer_start(sc, next_xfer);
1226 		return;
1227 
1228 	case USB_ST_SETUP:
1229 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1230 			goto tr_transferred;
1231 		}
1232 		return;
1233 
1234 	default:			/* Error */
1235 		umass_tr_error(xfer, error);
1236 		return;
1237 	}
1238 }
1239 
1240 static void
1241 umass_t_bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
1242 {
1243 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1244 	union ccb *ccb = sc->sc_transfer.ccb;
1245 	struct usb_page_cache *pc;
1246 	uint32_t tag;
1247 
1248 	switch (USB_GET_STATE(xfer)) {
1249 	case USB_ST_TRANSFERRED:
1250 		umass_transfer_start
1251 		    (sc, ((sc->sc_transfer.dir == DIR_IN) ? UMASS_T_BBB_DATA_READ :
1252 		    (sc->sc_transfer.dir == DIR_OUT) ? UMASS_T_BBB_DATA_WRITE :
1253 		    UMASS_T_BBB_STATUS));
1254 		return;
1255 
1256 	case USB_ST_SETUP:
1257 
1258 		sc->sc_status_try = 0;
1259 
1260 		if (ccb) {
1261 
1262 			/*
1263 		         * the initial value is not important,
1264 		         * as long as the values are unique:
1265 		         */
1266 			tag = UGETDW(sc->cbw.dCBWTag) + 1;
1267 
1268 			USETDW(sc->cbw.dCBWSignature, CBWSIGNATURE);
1269 			USETDW(sc->cbw.dCBWTag, tag);
1270 
1271 			/*
1272 		         * dCBWDataTransferLength:
1273 		         *   This field indicates the number of bytes of data that the host
1274 		         *   intends to transfer on the IN or OUT Bulk endpoint(as indicated by
1275 		         *   the Direction bit) during the execution of this command. If this
1276 		         *   field is set to 0, the device will expect that no data will be
1277 		         *   transferred IN or OUT during this command, regardless of the value
1278 		         *   of the Direction bit defined in dCBWFlags.
1279 		         */
1280 			USETDW(sc->cbw.dCBWDataTransferLength, sc->sc_transfer.data_len);
1281 
1282 			/*
1283 		         * dCBWFlags:
1284 		         *   The bits of the Flags field are defined as follows:
1285 		         *     Bits 0-6  reserved
1286 		         *     Bit  7    Direction - this bit shall be ignored if the
1287 		         *                           dCBWDataTransferLength field is zero.
1288 		         *               0 = data Out from host to device
1289 		         *               1 = data In from device to host
1290 		         */
1291 			sc->cbw.bCBWFlags = ((sc->sc_transfer.dir == DIR_IN) ?
1292 			    CBWFLAGS_IN : CBWFLAGS_OUT);
1293 			sc->cbw.bCBWLUN = sc->sc_transfer.lun;
1294 
1295 			if (sc->sc_transfer.cmd_len > sizeof(sc->cbw.CBWCDB)) {
1296 				sc->sc_transfer.cmd_len = sizeof(sc->cbw.CBWCDB);
1297 				DPRINTF(sc, UDMASS_BBB, "Truncating long command!\n");
1298 			}
1299 			sc->cbw.bCDBLength = sc->sc_transfer.cmd_len;
1300 
1301 			memcpy(sc->cbw.CBWCDB, sc->sc_transfer.cmd_data,
1302 			    sc->sc_transfer.cmd_len);
1303 
1304 			memset(sc->sc_transfer.cmd_data +
1305 			    sc->sc_transfer.cmd_len, 0,
1306 			    sizeof(sc->cbw.CBWCDB) -
1307 			    sc->sc_transfer.cmd_len);
1308 
1309 			DIF(UDMASS_BBB, umass_bbb_dump_cbw(sc, &sc->cbw));
1310 
1311 			pc = usbd_xfer_get_frame(xfer, 0);
1312 			usbd_copy_in(pc, 0, &sc->cbw, sizeof(sc->cbw));
1313 			usbd_xfer_set_frame_len(xfer, 0, sizeof(sc->cbw));
1314 
1315 			usbd_transfer_submit(xfer);
1316 		}
1317 		return;
1318 
1319 	default:			/* Error */
1320 		umass_tr_error(xfer, error);
1321 		return;
1322 	}
1323 }
1324 
1325 static void
1326 umass_t_bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1327 {
1328 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1329 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1330 	int actlen, sumlen;
1331 
1332 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1333 
1334 	switch (USB_GET_STATE(xfer)) {
1335 	case USB_ST_TRANSFERRED:
1336 		sc->sc_transfer.data_rem -= actlen;
1337 		sc->sc_transfer.data_ptr += actlen;
1338 		sc->sc_transfer.actlen += actlen;
1339 
1340 		if (actlen < sumlen) {
1341 			/* short transfer */
1342 			sc->sc_transfer.data_rem = 0;
1343 		}
1344 	case USB_ST_SETUP:
1345 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1346 		    max_bulk, sc->sc_transfer.data_rem);
1347 
1348 		if (sc->sc_transfer.data_rem == 0) {
1349 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1350 			return;
1351 		}
1352 		if (max_bulk > sc->sc_transfer.data_rem) {
1353 			max_bulk = sc->sc_transfer.data_rem;
1354 		}
1355 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1356 
1357 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1358 		    max_bulk);
1359 
1360 		usbd_transfer_submit(xfer);
1361 		return;
1362 
1363 	default:			/* Error */
1364 		if (error == USB_ERR_CANCELLED) {
1365 			umass_tr_error(xfer, error);
1366 		} else {
1367 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1368 		}
1369 		return;
1370 	}
1371 }
1372 
1373 static void
1374 umass_t_bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1375 {
1376 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1377 	    UMASS_T_BBB_DATA_READ, error);
1378 }
1379 
1380 static void
1381 umass_t_bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1382 {
1383 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1384 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1385 	int actlen, sumlen;
1386 
1387 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1388 
1389 	switch (USB_GET_STATE(xfer)) {
1390 	case USB_ST_TRANSFERRED:
1391 		sc->sc_transfer.data_rem -= actlen;
1392 		sc->sc_transfer.data_ptr += actlen;
1393 		sc->sc_transfer.actlen += actlen;
1394 
1395 		if (actlen < sumlen) {
1396 			/* short transfer */
1397 			sc->sc_transfer.data_rem = 0;
1398 		}
1399 	case USB_ST_SETUP:
1400 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1401 		    max_bulk, sc->sc_transfer.data_rem);
1402 
1403 		if (sc->sc_transfer.data_rem == 0) {
1404 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1405 			return;
1406 		}
1407 		if (max_bulk > sc->sc_transfer.data_rem) {
1408 			max_bulk = sc->sc_transfer.data_rem;
1409 		}
1410 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1411 
1412 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1413 		    max_bulk);
1414 
1415 		usbd_transfer_submit(xfer);
1416 		return;
1417 
1418 	default:			/* Error */
1419 		if (error == USB_ERR_CANCELLED) {
1420 			umass_tr_error(xfer, error);
1421 		} else {
1422 			umass_transfer_start(sc, UMASS_T_BBB_DATA_WR_CS);
1423 		}
1424 		return;
1425 	}
1426 }
1427 
1428 static void
1429 umass_t_bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1430 {
1431 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1432 	    UMASS_T_BBB_DATA_WRITE, error);
1433 }
1434 
1435 static void
1436 umass_t_bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
1437 {
1438 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1439 	union ccb *ccb = sc->sc_transfer.ccb;
1440 	struct usb_page_cache *pc;
1441 	uint32_t residue;
1442 	int actlen;
1443 
1444 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1445 
1446 	switch (USB_GET_STATE(xfer)) {
1447 	case USB_ST_TRANSFERRED:
1448 
1449 		/*
1450 		 * Do a full reset if there is something wrong with the CSW:
1451 		 */
1452 		sc->sc_status_try = 1;
1453 
1454 		/* Zero missing parts of the CSW: */
1455 
1456 		if (actlen < (int)sizeof(sc->csw))
1457 			memset(&sc->csw, 0, sizeof(sc->csw));
1458 
1459 		pc = usbd_xfer_get_frame(xfer, 0);
1460 		usbd_copy_out(pc, 0, &sc->csw, actlen);
1461 
1462 		DIF(UDMASS_BBB, umass_bbb_dump_csw(sc, &sc->csw));
1463 
1464 		residue = UGETDW(sc->csw.dCSWDataResidue);
1465 
1466 		if ((!residue) || (sc->sc_quirks & IGNORE_RESIDUE)) {
1467 			residue = (sc->sc_transfer.data_len -
1468 			    sc->sc_transfer.actlen);
1469 		}
1470 		if (residue > sc->sc_transfer.data_len) {
1471 			DPRINTF(sc, UDMASS_BBB, "truncating residue from %d "
1472 			    "to %d bytes\n", residue, sc->sc_transfer.data_len);
1473 			residue = sc->sc_transfer.data_len;
1474 		}
1475 		/* translate weird command-status signatures: */
1476 		if (sc->sc_quirks & WRONG_CSWSIG) {
1477 
1478 			uint32_t temp = UGETDW(sc->csw.dCSWSignature);
1479 
1480 			if ((temp == CSWSIGNATURE_OLYMPUS_C1) ||
1481 			    (temp == CSWSIGNATURE_IMAGINATION_DBX1)) {
1482 				USETDW(sc->csw.dCSWSignature, CSWSIGNATURE);
1483 			}
1484 		}
1485 		/* check CSW and handle eventual error */
1486 		if (UGETDW(sc->csw.dCSWSignature) != CSWSIGNATURE) {
1487 			DPRINTF(sc, UDMASS_BBB, "bad CSW signature 0x%08x != 0x%08x\n",
1488 			    UGETDW(sc->csw.dCSWSignature), CSWSIGNATURE);
1489 			/*
1490 			 * Invalid CSW: Wrong signature or wrong tag might
1491 			 * indicate that we lost synchronization. Reset the
1492 			 * device.
1493 			 */
1494 			goto tr_error;
1495 		} else if (UGETDW(sc->csw.dCSWTag) != UGETDW(sc->cbw.dCBWTag)) {
1496 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: tag 0x%08x should be "
1497 			    "0x%08x\n", UGETDW(sc->csw.dCSWTag),
1498 			    UGETDW(sc->cbw.dCBWTag));
1499 			goto tr_error;
1500 		} else if (sc->csw.bCSWStatus > CSWSTATUS_PHASE) {
1501 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: status %d > %d\n",
1502 			    sc->csw.bCSWStatus, CSWSTATUS_PHASE);
1503 			goto tr_error;
1504 		} else if (sc->csw.bCSWStatus == CSWSTATUS_PHASE) {
1505 			DPRINTF(sc, UDMASS_BBB, "Phase error, residue = "
1506 			    "%d\n", residue);
1507 			goto tr_error;
1508 		} else if (sc->sc_transfer.actlen > sc->sc_transfer.data_len) {
1509 			DPRINTF(sc, UDMASS_BBB, "Buffer overrun %d > %d\n",
1510 			    sc->sc_transfer.actlen, sc->sc_transfer.data_len);
1511 			goto tr_error;
1512 		} else if (sc->csw.bCSWStatus == CSWSTATUS_FAILED) {
1513 			DPRINTF(sc, UDMASS_BBB, "Command failed, residue = "
1514 			    "%d\n", residue);
1515 
1516 			sc->sc_transfer.ccb = NULL;
1517 
1518 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1519 
1520 			(sc->sc_transfer.callback)
1521 			    (sc, ccb, residue, STATUS_CMD_FAILED);
1522 		} else {
1523 			sc->sc_transfer.ccb = NULL;
1524 
1525 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1526 
1527 			(sc->sc_transfer.callback)
1528 			    (sc, ccb, residue, STATUS_CMD_OK);
1529 		}
1530 		return;
1531 
1532 	case USB_ST_SETUP:
1533 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1534 		usbd_transfer_submit(xfer);
1535 		return;
1536 
1537 	default:
1538 tr_error:
1539 		DPRINTF(sc, UDMASS_BBB, "Failed to read CSW: %s, try %d\n",
1540 		    usbd_errstr(error), sc->sc_status_try);
1541 
1542 		if ((error == USB_ERR_CANCELLED) ||
1543 		    (sc->sc_status_try)) {
1544 			umass_tr_error(xfer, error);
1545 		} else {
1546 			sc->sc_status_try = 1;
1547 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1548 		}
1549 		return;
1550 	}
1551 }
1552 
1553 static void
1554 umass_command_start(struct umass_softc *sc, uint8_t dir,
1555     void *data_ptr, uint32_t data_len,
1556     uint32_t data_timeout, umass_callback_t *callback,
1557     union ccb *ccb)
1558 {
1559 	sc->sc_transfer.lun = ccb->ccb_h.target_lun;
1560 
1561 	/*
1562 	 * NOTE: assumes that "sc->sc_transfer.cmd_data" and
1563 	 * "sc->sc_transfer.cmd_len" has been properly
1564 	 * initialized.
1565 	 */
1566 
1567 	sc->sc_transfer.dir = data_len ? dir : DIR_NONE;
1568 	sc->sc_transfer.data_ptr = data_ptr;
1569 	sc->sc_transfer.data_len = data_len;
1570 	sc->sc_transfer.data_rem = data_len;
1571 	sc->sc_transfer.data_timeout = (data_timeout + UMASS_TIMEOUT);
1572 
1573 	sc->sc_transfer.actlen = 0;
1574 	sc->sc_transfer.callback = callback;
1575 	sc->sc_transfer.ccb = ccb;
1576 
1577 	if (sc->sc_xfer[sc->sc_last_xfer_index]) {
1578 		usbd_transfer_start(sc->sc_xfer[sc->sc_last_xfer_index]);
1579 	} else {
1580 		umass_cancel_ccb(sc);
1581 	}
1582 }
1583 
1584 static uint8_t
1585 umass_bbb_get_max_lun(struct umass_softc *sc)
1586 {
1587 	struct usb_device_request req;
1588 	usb_error_t err;
1589 	uint8_t buf = 0;
1590 
1591 	/* The Get Max Lun command is a class-specific request. */
1592 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
1593 	req.bRequest = UR_BBB_GET_MAX_LUN;
1594 	USETW(req.wValue, 0);
1595 	req.wIndex[0] = sc->sc_iface_no;
1596 	req.wIndex[1] = 0;
1597 	USETW(req.wLength, 1);
1598 
1599 	err = usbd_do_request(sc->sc_udev, NULL, &req, &buf);
1600 	if (err) {
1601 		buf = 0;
1602 
1603 		/* Device doesn't support Get Max Lun request. */
1604 		printf("%s: Get Max Lun not supported (%s)\n",
1605 		    sc->sc_name, usbd_errstr(err));
1606 	}
1607 	return (buf);
1608 }
1609 
1610 /*
1611  * Command/Bulk/Interrupt (CBI) specific functions
1612  */
1613 
1614 static void
1615 umass_cbi_start_status(struct umass_softc *sc)
1616 {
1617 	if (sc->sc_xfer[UMASS_T_CBI_STATUS]) {
1618 		umass_transfer_start(sc, UMASS_T_CBI_STATUS);
1619 	} else {
1620 		union ccb *ccb = sc->sc_transfer.ccb;
1621 
1622 		sc->sc_transfer.ccb = NULL;
1623 
1624 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1625 
1626 		(sc->sc_transfer.callback)
1627 		    (sc, ccb, (sc->sc_transfer.data_len -
1628 		    sc->sc_transfer.actlen), STATUS_CMD_UNKNOWN);
1629 	}
1630 }
1631 
1632 static void
1633 umass_t_cbi_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1634 {
1635 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1636 	struct usb_device_request req;
1637 	struct usb_page_cache *pc;
1638 	uint8_t buf[UMASS_CBI_DIAGNOSTIC_CMDLEN];
1639 
1640 	uint8_t i;
1641 
1642 	switch (USB_GET_STATE(xfer)) {
1643 	case USB_ST_TRANSFERRED:
1644 		umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1645 		break;
1646 
1647 	case USB_ST_SETUP:
1648 		/*
1649 		 * Command Block Reset Protocol
1650 		 *
1651 		 * First send a reset request to the device. Then clear
1652 		 * any possibly stalled bulk endpoints.
1653 		 *
1654 		 * This is done in 3 steps, using 3 transfers:
1655 		 * UMASS_T_CBI_RESET1
1656 		 * UMASS_T_CBI_RESET2
1657 		 * UMASS_T_CBI_RESET3
1658 		 * UMASS_T_CBI_RESET4 (only if there is an interrupt endpoint)
1659 		 */
1660 
1661 		DPRINTF(sc, UDMASS_CBI, "CBI reset!\n");
1662 
1663 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1664 		req.bRequest = UR_CBI_ADSC;
1665 		USETW(req.wValue, 0);
1666 		req.wIndex[0] = sc->sc_iface_no;
1667 		req.wIndex[1] = 0;
1668 		USETW(req.wLength, UMASS_CBI_DIAGNOSTIC_CMDLEN);
1669 
1670 		/*
1671 		 * The 0x1d code is the SEND DIAGNOSTIC command. To
1672 		 * distinguish between the two, the last 10 bytes of the CBL
1673 		 * is filled with 0xff (section 2.2 of the CBI
1674 		 * specification)
1675 		 */
1676 		buf[0] = 0x1d;		/* Command Block Reset */
1677 		buf[1] = 0x04;
1678 
1679 		for (i = 2; i < UMASS_CBI_DIAGNOSTIC_CMDLEN; i++) {
1680 			buf[i] = 0xff;
1681 		}
1682 
1683 		pc = usbd_xfer_get_frame(xfer, 0);
1684 		usbd_copy_in(pc, 0, &req, sizeof(req));
1685 		pc = usbd_xfer_get_frame(xfer, 1);
1686 		usbd_copy_in(pc, 0, buf, sizeof(buf));
1687 
1688 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1689 		usbd_xfer_set_frame_len(xfer, 1, sizeof(buf));
1690 		usbd_xfer_set_frames(xfer, 2);
1691 		usbd_transfer_submit(xfer);
1692 		break;
1693 
1694 	default:			/* Error */
1695 		if (error == USB_ERR_CANCELLED)
1696 			umass_tr_error(xfer, error);
1697 		else
1698 			umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1699 		break;
1700 	}
1701 }
1702 
1703 static void
1704 umass_t_cbi_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1705 {
1706 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_RESET3,
1707 	    UMASS_T_CBI_DATA_READ, error);
1708 }
1709 
1710 static void
1711 umass_t_cbi_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1712 {
1713 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1714 
1715 	umass_t_cbi_data_clear_stall_callback
1716 	    (xfer, (sc->sc_xfer[UMASS_T_CBI_RESET4] &&
1717 	    sc->sc_xfer[UMASS_T_CBI_STATUS]) ?
1718 	    UMASS_T_CBI_RESET4 : UMASS_T_CBI_COMMAND,
1719 	    UMASS_T_CBI_DATA_WRITE, error);
1720 }
1721 
1722 static void
1723 umass_t_cbi_reset4_callback(struct usb_xfer *xfer, usb_error_t error)
1724 {
1725 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_COMMAND,
1726 	    UMASS_T_CBI_STATUS, error);
1727 }
1728 
1729 static void
1730 umass_t_cbi_data_clear_stall_callback(struct usb_xfer *xfer,
1731     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1732 {
1733 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1734 
1735 	switch (USB_GET_STATE(xfer)) {
1736 	case USB_ST_TRANSFERRED:
1737 tr_transferred:
1738 		if (next_xfer == UMASS_T_CBI_STATUS) {
1739 			umass_cbi_start_status(sc);
1740 		} else {
1741 			umass_transfer_start(sc, next_xfer);
1742 		}
1743 		break;
1744 
1745 	case USB_ST_SETUP:
1746 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1747 			goto tr_transferred;	/* should not happen */
1748 		}
1749 		break;
1750 
1751 	default:			/* Error */
1752 		umass_tr_error(xfer, error);
1753 		break;
1754 	}
1755 }
1756 
1757 static void
1758 umass_t_cbi_command_callback(struct usb_xfer *xfer, usb_error_t error)
1759 {
1760 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1761 	union ccb *ccb = sc->sc_transfer.ccb;
1762 	struct usb_device_request req;
1763 	struct usb_page_cache *pc;
1764 
1765 	switch (USB_GET_STATE(xfer)) {
1766 	case USB_ST_TRANSFERRED:
1767 
1768 		if (sc->sc_transfer.dir == DIR_NONE) {
1769 			umass_cbi_start_status(sc);
1770 		} else {
1771 			umass_transfer_start
1772 			    (sc, (sc->sc_transfer.dir == DIR_IN) ?
1773 			    UMASS_T_CBI_DATA_READ : UMASS_T_CBI_DATA_WRITE);
1774 		}
1775 		break;
1776 
1777 	case USB_ST_SETUP:
1778 
1779 		if (ccb) {
1780 
1781 			/*
1782 		         * do a CBI transfer with cmd_len bytes from
1783 		         * cmd_data, possibly a data phase of data_len
1784 		         * bytes from/to the device and finally a status
1785 		         * read phase.
1786 		         */
1787 
1788 			req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1789 			req.bRequest = UR_CBI_ADSC;
1790 			USETW(req.wValue, 0);
1791 			req.wIndex[0] = sc->sc_iface_no;
1792 			req.wIndex[1] = 0;
1793 			req.wLength[0] = sc->sc_transfer.cmd_len;
1794 			req.wLength[1] = 0;
1795 
1796 			pc = usbd_xfer_get_frame(xfer, 0);
1797 			usbd_copy_in(pc, 0, &req, sizeof(req));
1798 			pc = usbd_xfer_get_frame(xfer, 1);
1799 			usbd_copy_in(pc, 0, sc->sc_transfer.cmd_data,
1800 			    sc->sc_transfer.cmd_len);
1801 
1802 			usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1803 			usbd_xfer_set_frame_len(xfer, 1, sc->sc_transfer.cmd_len);
1804 			usbd_xfer_set_frames(xfer,
1805 			    sc->sc_transfer.cmd_len ? 2 : 1);
1806 
1807 			DIF(UDMASS_CBI,
1808 			    umass_cbi_dump_cmd(sc,
1809 			    sc->sc_transfer.cmd_data,
1810 			    sc->sc_transfer.cmd_len));
1811 
1812 			usbd_transfer_submit(xfer);
1813 		}
1814 		break;
1815 
1816 	default:			/* Error */
1817 		/*
1818 		 * STALL on the control pipe can be result of the command error.
1819 		 * Attempt to clear this STALL same as for bulk pipe also
1820 		 * results in command completion interrupt, but ASC/ASCQ there
1821 		 * look like not always valid, so don't bother about it.
1822 		 */
1823 		if ((error == USB_ERR_STALLED) ||
1824 		    (sc->sc_transfer.callback == &umass_cam_cb)) {
1825 			sc->sc_transfer.ccb = NULL;
1826 			(sc->sc_transfer.callback)
1827 			    (sc, ccb, sc->sc_transfer.data_len,
1828 			    STATUS_CMD_UNKNOWN);
1829 		} else {
1830 			umass_tr_error(xfer, error);
1831 			/* skip reset */
1832 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1833 		}
1834 		break;
1835 	}
1836 }
1837 
1838 static void
1839 umass_t_cbi_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1840 {
1841 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1842 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1843 	int actlen, sumlen;
1844 
1845 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1846 
1847 	switch (USB_GET_STATE(xfer)) {
1848 	case USB_ST_TRANSFERRED:
1849 		sc->sc_transfer.data_rem -= actlen;
1850 		sc->sc_transfer.data_ptr += actlen;
1851 		sc->sc_transfer.actlen += actlen;
1852 
1853 		if (actlen < sumlen) {
1854 			/* short transfer */
1855 			sc->sc_transfer.data_rem = 0;
1856 		}
1857 	case USB_ST_SETUP:
1858 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1859 		    max_bulk, sc->sc_transfer.data_rem);
1860 
1861 		if (sc->sc_transfer.data_rem == 0) {
1862 			umass_cbi_start_status(sc);
1863 			break;
1864 		}
1865 		if (max_bulk > sc->sc_transfer.data_rem) {
1866 			max_bulk = sc->sc_transfer.data_rem;
1867 		}
1868 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1869 
1870 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1871 		    max_bulk);
1872 
1873 		usbd_transfer_submit(xfer);
1874 		break;
1875 
1876 	default:			/* Error */
1877 		if ((error == USB_ERR_CANCELLED) ||
1878 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1879 			umass_tr_error(xfer, error);
1880 		} else {
1881 			umass_transfer_start(sc, UMASS_T_CBI_DATA_RD_CS);
1882 		}
1883 		break;
1884 	}
1885 }
1886 
1887 static void
1888 umass_t_cbi_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1889 {
1890 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1891 	    UMASS_T_CBI_DATA_READ, error);
1892 }
1893 
1894 static void
1895 umass_t_cbi_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1896 {
1897 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1898 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1899 	int actlen, sumlen;
1900 
1901 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1902 
1903 	switch (USB_GET_STATE(xfer)) {
1904 	case USB_ST_TRANSFERRED:
1905 		sc->sc_transfer.data_rem -= actlen;
1906 		sc->sc_transfer.data_ptr += actlen;
1907 		sc->sc_transfer.actlen += actlen;
1908 
1909 		if (actlen < sumlen) {
1910 			/* short transfer */
1911 			sc->sc_transfer.data_rem = 0;
1912 		}
1913 	case USB_ST_SETUP:
1914 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1915 		    max_bulk, sc->sc_transfer.data_rem);
1916 
1917 		if (sc->sc_transfer.data_rem == 0) {
1918 			umass_cbi_start_status(sc);
1919 			break;
1920 		}
1921 		if (max_bulk > sc->sc_transfer.data_rem) {
1922 			max_bulk = sc->sc_transfer.data_rem;
1923 		}
1924 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1925 
1926 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1927 		    max_bulk);
1928 
1929 		usbd_transfer_submit(xfer);
1930 		break;
1931 
1932 	default:			/* Error */
1933 		if ((error == USB_ERR_CANCELLED) ||
1934 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1935 			umass_tr_error(xfer, error);
1936 		} else {
1937 			umass_transfer_start(sc, UMASS_T_CBI_DATA_WR_CS);
1938 		}
1939 		break;
1940 	}
1941 }
1942 
1943 static void
1944 umass_t_cbi_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1945 {
1946 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1947 	    UMASS_T_CBI_DATA_WRITE, error);
1948 }
1949 
1950 static void
1951 umass_t_cbi_status_callback(struct usb_xfer *xfer, usb_error_t error)
1952 {
1953 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1954 	union ccb *ccb = sc->sc_transfer.ccb;
1955 	struct usb_page_cache *pc;
1956 	uint32_t residue;
1957 	uint8_t status;
1958 	int actlen;
1959 
1960 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1961 
1962 	switch (USB_GET_STATE(xfer)) {
1963 	case USB_ST_TRANSFERRED:
1964 
1965 		if (actlen < (int)sizeof(sc->sbl)) {
1966 			goto tr_setup;
1967 		}
1968 		pc = usbd_xfer_get_frame(xfer, 0);
1969 		usbd_copy_out(pc, 0, &sc->sbl, sizeof(sc->sbl));
1970 
1971 		residue = (sc->sc_transfer.data_len -
1972 		    sc->sc_transfer.actlen);
1973 
1974 		/* dissect the information in the buffer */
1975 
1976 		if (sc->sc_proto & UMASS_PROTO_UFI) {
1977 
1978 			/*
1979 			 * Section 3.4.3.1.3 specifies that the UFI command
1980 			 * protocol returns an ASC and ASCQ in the interrupt
1981 			 * data block.
1982 			 */
1983 
1984 			DPRINTF(sc, UDMASS_CBI, "UFI CCI, ASC = 0x%02x, "
1985 			    "ASCQ = 0x%02x\n", sc->sbl.ufi.asc,
1986 			    sc->sbl.ufi.ascq);
1987 
1988 			status = (((sc->sbl.ufi.asc == 0) &&
1989 			    (sc->sbl.ufi.ascq == 0)) ?
1990 			    STATUS_CMD_OK : STATUS_CMD_FAILED);
1991 
1992 			sc->sc_transfer.ccb = NULL;
1993 
1994 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1995 
1996 			(sc->sc_transfer.callback)
1997 			    (sc, ccb, residue, status);
1998 
1999 			break;
2000 
2001 		} else {
2002 
2003 			/* Command Interrupt Data Block */
2004 
2005 			DPRINTF(sc, UDMASS_CBI, "type=0x%02x, value=0x%02x\n",
2006 			    sc->sbl.common.type, sc->sbl.common.value);
2007 
2008 			if (sc->sbl.common.type == IDB_TYPE_CCI) {
2009 
2010 				status = (sc->sbl.common.value & IDB_VALUE_STATUS_MASK);
2011 
2012 				status = ((status == IDB_VALUE_PASS) ? STATUS_CMD_OK :
2013 				    (status == IDB_VALUE_FAIL) ? STATUS_CMD_FAILED :
2014 				    (status == IDB_VALUE_PERSISTENT) ? STATUS_CMD_FAILED :
2015 				    STATUS_WIRE_FAILED);
2016 
2017 				sc->sc_transfer.ccb = NULL;
2018 
2019 				sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2020 
2021 				(sc->sc_transfer.callback)
2022 				    (sc, ccb, residue, status);
2023 
2024 				break;
2025 			}
2026 		}
2027 
2028 		/* fallthrough */
2029 
2030 	case USB_ST_SETUP:
2031 tr_setup:
2032 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2033 		usbd_transfer_submit(xfer);
2034 		break;
2035 
2036 	default:			/* Error */
2037 		DPRINTF(sc, UDMASS_CBI, "Failed to read CSW: %s\n",
2038 		    usbd_errstr(error));
2039 		umass_tr_error(xfer, error);
2040 		break;
2041 	}
2042 }
2043 
2044 /*
2045  * CAM specific functions (used by SCSI, UFI, 8070i (ATAPI))
2046  */
2047 
2048 static int
2049 umass_cam_attach_sim(struct umass_softc *sc)
2050 {
2051 	struct cam_devq *devq;		/* Per device Queue */
2052 
2053 	/*
2054 	 * A HBA is attached to the CAM layer.
2055 	 *
2056 	 * The CAM layer will then after a while start probing for devices on
2057 	 * the bus. The number of SIMs is limited to one.
2058 	 */
2059 
2060 	devq = cam_simq_alloc(1 /* maximum openings */ );
2061 	if (devq == NULL) {
2062 		return (ENOMEM);
2063 	}
2064 	sc->sc_sim = cam_sim_alloc
2065 	    (&umass_cam_action, &umass_cam_poll,
2066 	    DEVNAME_SIM,
2067 	    sc /* priv */ ,
2068 	    sc->sc_unit /* unit number */ ,
2069 	    &sc->sc_mtx /* mutex */ ,
2070 	    1 /* maximum device openings */ ,
2071 	    0 /* maximum tagged device openings */ ,
2072 	    devq);
2073 
2074 	if (sc->sc_sim == NULL) {
2075 		cam_simq_free(devq);
2076 		return (ENOMEM);
2077 	}
2078 
2079 	mtx_lock(&sc->sc_mtx);
2080 
2081 	if (xpt_bus_register(sc->sc_sim, sc->sc_dev,
2082 	    sc->sc_unit) != CAM_SUCCESS) {
2083 		mtx_unlock(&sc->sc_mtx);
2084 		return (ENOMEM);
2085 	}
2086 	mtx_unlock(&sc->sc_mtx);
2087 
2088 	return (0);
2089 }
2090 
2091 static void
2092 umass_cam_attach(struct umass_softc *sc)
2093 {
2094 #ifndef USB_DEBUG
2095 	if (bootverbose)
2096 #endif
2097 		printf("%s:%d:%d:%d: Attached to scbus%d\n",
2098 		    sc->sc_name, cam_sim_path(sc->sc_sim),
2099 		    sc->sc_unit, CAM_LUN_WILDCARD,
2100 		    cam_sim_path(sc->sc_sim));
2101 }
2102 
2103 /* umass_cam_detach
2104  *	detach from the CAM layer
2105  */
2106 
2107 static void
2108 umass_cam_detach_sim(struct umass_softc *sc)
2109 {
2110 	if (sc->sc_sim != NULL) {
2111 		if (xpt_bus_deregister(cam_sim_path(sc->sc_sim))) {
2112 			/* accessing the softc is not possible after this */
2113 			sc->sc_sim->softc = NULL;
2114 			cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2115 		} else {
2116 			panic("%s: CAM layer is busy\n",
2117 			    sc->sc_name);
2118 		}
2119 		sc->sc_sim = NULL;
2120 	}
2121 }
2122 
2123 /* umass_cam_action
2124  * 	CAM requests for action come through here
2125  */
2126 
2127 static void
2128 umass_cam_action(struct cam_sim *sim, union ccb *ccb)
2129 {
2130 	struct umass_softc *sc = (struct umass_softc *)sim->softc;
2131 
2132 	if (sc == NULL) {
2133 		ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2134 		xpt_done(ccb);
2135 		return;
2136 	}
2137 
2138 	/* Perform the requested action */
2139 	switch (ccb->ccb_h.func_code) {
2140 	case XPT_SCSI_IO:
2141 		{
2142 			uint8_t *cmd;
2143 			uint8_t dir;
2144 
2145 			if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2146 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2147 			} else {
2148 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2149 			}
2150 
2151 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2152 			    "cmd: 0x%02x, flags: 0x%02x, "
2153 			    "%db cmd/%db data/%db sense\n",
2154 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2155 			    ccb->ccb_h.target_lun, cmd[0],
2156 			    ccb->ccb_h.flags & CAM_DIR_MASK, ccb->csio.cdb_len,
2157 			    ccb->csio.dxfer_len, ccb->csio.sense_len);
2158 
2159 			if (sc->sc_transfer.ccb) {
2160 				DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2161 				    "I/O in progress, deferring\n",
2162 				    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2163 				    ccb->ccb_h.target_lun);
2164 				ccb->ccb_h.status = CAM_SCSI_BUSY;
2165 				xpt_done(ccb);
2166 				goto done;
2167 			}
2168 			switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
2169 			case CAM_DIR_IN:
2170 				dir = DIR_IN;
2171 				break;
2172 			case CAM_DIR_OUT:
2173 				dir = DIR_OUT;
2174 				DIF(UDMASS_SCSI,
2175 				    umass_dump_buffer(sc, ccb->csio.data_ptr,
2176 				    ccb->csio.dxfer_len, 48));
2177 				break;
2178 			default:
2179 				dir = DIR_NONE;
2180 			}
2181 
2182 			ccb->ccb_h.status = CAM_REQ_INPROG | CAM_SIM_QUEUED;
2183 
2184 			/*
2185 			 * sc->sc_transform will convert the command to the
2186 			 * command format needed by the specific command set
2187 			 * and return the converted command in
2188 			 * "sc->sc_transfer.cmd_data"
2189 			 */
2190 			if (umass_std_transform(sc, ccb, cmd, ccb->csio.cdb_len)) {
2191 
2192 				if (sc->sc_transfer.cmd_data[0] == INQUIRY) {
2193 					const char *pserial;
2194 
2195 					pserial = usb_get_serial(sc->sc_udev);
2196 
2197 					/*
2198 					 * Umass devices don't generally report their serial numbers
2199 					 * in the usual SCSI way.  Emulate it here.
2200 					 */
2201 					if ((sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2202 					    (sc->sc_transfer.cmd_data[2] == SVPD_UNIT_SERIAL_NUMBER) &&
2203 					    (pserial[0] != '\0')) {
2204 						struct scsi_vpd_unit_serial_number *vpd_serial;
2205 
2206 						vpd_serial = (struct scsi_vpd_unit_serial_number *)ccb->csio.data_ptr;
2207 						vpd_serial->length = strlen(pserial);
2208 						if (vpd_serial->length > sizeof(vpd_serial->serial_num))
2209 							vpd_serial->length = sizeof(vpd_serial->serial_num);
2210 						memcpy(vpd_serial->serial_num, pserial, vpd_serial->length);
2211 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2212 						ccb->ccb_h.status = CAM_REQ_CMP;
2213 						xpt_done(ccb);
2214 						goto done;
2215 					}
2216 
2217 					/*
2218 					 * Handle EVPD inquiry for broken devices first
2219 					 * NO_INQUIRY also implies NO_INQUIRY_EVPD
2220 					 */
2221 					if ((sc->sc_quirks & (NO_INQUIRY_EVPD | NO_INQUIRY)) &&
2222 					    (sc->sc_transfer.cmd_data[1] & SI_EVPD)) {
2223 
2224 						scsi_set_sense_data(&ccb->csio.sense_data,
2225 							/*sense_format*/ SSD_TYPE_NONE,
2226 							/*current_error*/ 1,
2227 							/*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2228 							/*asc*/ 0x24,
2229 							/*ascq*/ 0x00,
2230 							/*extra args*/ SSD_ELEM_NONE);
2231 						ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2232 						ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR |
2233 						    CAM_AUTOSNS_VALID;
2234 						xpt_done(ccb);
2235 						goto done;
2236 					}
2237 					/*
2238 					 * Return fake inquiry data for
2239 					 * broken devices
2240 					 */
2241 					if (sc->sc_quirks & NO_INQUIRY) {
2242 						memcpy(ccb->csio.data_ptr, &fake_inq_data,
2243 						    sizeof(fake_inq_data));
2244 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2245 						ccb->ccb_h.status = CAM_REQ_CMP;
2246 						xpt_done(ccb);
2247 						goto done;
2248 					}
2249 					if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2250 						ccb->csio.dxfer_len = SHORT_INQUIRY_LENGTH;
2251 					}
2252 				} else if (sc->sc_transfer.cmd_data[0] == PREVENT_ALLOW) {
2253 					if (sc->sc_quirks & NO_PREVENT_ALLOW) {
2254 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2255 						ccb->ccb_h.status = CAM_REQ_CMP;
2256 						xpt_done(ccb);
2257 						goto done;
2258 					}
2259 				} else if (sc->sc_transfer.cmd_data[0] == SYNCHRONIZE_CACHE) {
2260 					if (sc->sc_quirks & NO_SYNCHRONIZE_CACHE) {
2261 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2262 						ccb->ccb_h.status = CAM_REQ_CMP;
2263 						xpt_done(ccb);
2264 						goto done;
2265 					}
2266 				}
2267 				umass_command_start(sc, dir, ccb->csio.data_ptr,
2268 				    ccb->csio.dxfer_len,
2269 				    ccb->ccb_h.timeout,
2270 				    &umass_cam_cb, ccb);
2271 			}
2272 			break;
2273 		}
2274 	case XPT_PATH_INQ:
2275 		{
2276 			struct ccb_pathinq *cpi = &ccb->cpi;
2277 
2278 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_PATH_INQ:.\n",
2279 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2280 			    ccb->ccb_h.target_lun);
2281 
2282 			/* host specific information */
2283 			cpi->version_num = 1;
2284 			cpi->hba_inquiry = 0;
2285 			cpi->target_sprt = 0;
2286 			cpi->hba_misc = PIM_NO_6_BYTE;
2287 			cpi->hba_eng_cnt = 0;
2288 			cpi->max_target = UMASS_SCSIID_MAX;	/* one target */
2289 			cpi->initiator_id = UMASS_SCSIID_HOST;
2290 			strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2291 			strlcpy(cpi->hba_vid, "USB SCSI", HBA_IDLEN);
2292 			strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2293 			cpi->unit_number = cam_sim_unit(sim);
2294 			cpi->bus_id = sc->sc_unit;
2295 			cpi->protocol = PROTO_SCSI;
2296 			cpi->protocol_version = SCSI_REV_2;
2297 			cpi->transport = XPORT_USB;
2298 			cpi->transport_version = 0;
2299 
2300 			if (sc == NULL) {
2301 				cpi->base_transfer_speed = 0;
2302 				cpi->max_lun = 0;
2303 			} else {
2304 				if (sc->sc_quirks & FLOPPY_SPEED) {
2305 					cpi->base_transfer_speed =
2306 					    UMASS_FLOPPY_TRANSFER_SPEED;
2307 				} else {
2308 					switch (usbd_get_speed(sc->sc_udev)) {
2309 					case USB_SPEED_SUPER:
2310 						cpi->base_transfer_speed =
2311 						    UMASS_SUPER_TRANSFER_SPEED;
2312 						cpi->maxio = MAXPHYS;
2313 						break;
2314 					case USB_SPEED_HIGH:
2315 						cpi->base_transfer_speed =
2316 						    UMASS_HIGH_TRANSFER_SPEED;
2317 						break;
2318 					default:
2319 						cpi->base_transfer_speed =
2320 						    UMASS_FULL_TRANSFER_SPEED;
2321 						break;
2322 					}
2323 				}
2324 				cpi->max_lun = sc->sc_maxlun;
2325 			}
2326 
2327 			cpi->ccb_h.status = CAM_REQ_CMP;
2328 			xpt_done(ccb);
2329 			break;
2330 		}
2331 	case XPT_RESET_DEV:
2332 		{
2333 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_RESET_DEV:.\n",
2334 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2335 			    ccb->ccb_h.target_lun);
2336 
2337 			umass_reset(sc);
2338 
2339 			ccb->ccb_h.status = CAM_REQ_CMP;
2340 			xpt_done(ccb);
2341 			break;
2342 		}
2343 	case XPT_GET_TRAN_SETTINGS:
2344 		{
2345 			struct ccb_trans_settings *cts = &ccb->cts;
2346 
2347 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_GET_TRAN_SETTINGS:.\n",
2348 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2349 			    ccb->ccb_h.target_lun);
2350 
2351 			cts->protocol = PROTO_SCSI;
2352 			cts->protocol_version = SCSI_REV_2;
2353 			cts->transport = XPORT_USB;
2354 			cts->transport_version = 0;
2355 			cts->xport_specific.valid = 0;
2356 
2357 			ccb->ccb_h.status = CAM_REQ_CMP;
2358 			xpt_done(ccb);
2359 			break;
2360 		}
2361 	case XPT_SET_TRAN_SETTINGS:
2362 		{
2363 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SET_TRAN_SETTINGS:.\n",
2364 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2365 			    ccb->ccb_h.target_lun);
2366 
2367 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2368 			xpt_done(ccb);
2369 			break;
2370 		}
2371 	case XPT_CALC_GEOMETRY:
2372 		{
2373 			cam_calc_geometry(&ccb->ccg, /* extended */ 1);
2374 			xpt_done(ccb);
2375 			break;
2376 		}
2377 	case XPT_NOOP:
2378 		{
2379 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_NOOP:.\n",
2380 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2381 			    ccb->ccb_h.target_lun);
2382 
2383 			ccb->ccb_h.status = CAM_REQ_CMP;
2384 			xpt_done(ccb);
2385 			break;
2386 		}
2387 	default:
2388 		DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:func_code 0x%04x: "
2389 		    "Not implemented\n",
2390 		    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2391 		    ccb->ccb_h.target_lun, ccb->ccb_h.func_code);
2392 
2393 		ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2394 		xpt_done(ccb);
2395 		break;
2396 	}
2397 
2398 done:
2399 	return;
2400 }
2401 
2402 static void
2403 umass_cam_poll(struct cam_sim *sim)
2404 {
2405 	struct umass_softc *sc = (struct umass_softc *)sim->softc;
2406 
2407 	if (sc == NULL)
2408 		return;
2409 
2410 	DPRINTF(sc, UDMASS_SCSI, "CAM poll\n");
2411 
2412 	usbd_transfer_poll(sc->sc_xfer, UMASS_T_MAX);
2413 }
2414 
2415 
2416 /* umass_cam_cb
2417  *	finalise a completed CAM command
2418  */
2419 
2420 static void
2421 umass_cam_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2422     uint8_t status)
2423 {
2424 	ccb->csio.resid = residue;
2425 
2426 	switch (status) {
2427 	case STATUS_CMD_OK:
2428 		ccb->ccb_h.status = CAM_REQ_CMP;
2429 		if ((sc->sc_quirks & READ_CAPACITY_OFFBY1) &&
2430 		    (ccb->ccb_h.func_code == XPT_SCSI_IO) &&
2431 		    (ccb->csio.cdb_io.cdb_bytes[0] == READ_CAPACITY)) {
2432 			struct scsi_read_capacity_data *rcap;
2433 			uint32_t maxsector;
2434 
2435 			rcap = (void *)(ccb->csio.data_ptr);
2436 			maxsector = scsi_4btoul(rcap->addr) - 1;
2437 			scsi_ulto4b(maxsector, rcap->addr);
2438 		}
2439 		/*
2440 		 * We have to add SVPD_UNIT_SERIAL_NUMBER to the list
2441 		 * of pages supported by the device - otherwise, CAM
2442 		 * will never ask us for the serial number if the
2443 		 * device cannot handle that by itself.
2444 		 */
2445 		if (ccb->ccb_h.func_code == XPT_SCSI_IO &&
2446 		    sc->sc_transfer.cmd_data[0] == INQUIRY &&
2447 		    (sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2448 		    sc->sc_transfer.cmd_data[2] == SVPD_SUPPORTED_PAGE_LIST &&
2449 		    (usb_get_serial(sc->sc_udev)[0] != '\0')) {
2450 			struct ccb_scsiio *csio;
2451 			struct scsi_vpd_supported_page_list *page_list;
2452 
2453 			csio = &ccb->csio;
2454 			page_list = (struct scsi_vpd_supported_page_list *)csio->data_ptr;
2455 			if (page_list->length + 1 < SVPD_SUPPORTED_PAGES_SIZE) {
2456 				page_list->list[page_list->length] = SVPD_UNIT_SERIAL_NUMBER;
2457 				page_list->length++;
2458 			}
2459 		}
2460 		xpt_done(ccb);
2461 		break;
2462 
2463 	case STATUS_CMD_UNKNOWN:
2464 	case STATUS_CMD_FAILED:
2465 
2466 		/* fetch sense data */
2467 
2468 		/* the rest of the command was filled in at attach */
2469 		sc->cam_scsi_sense.length = ccb->csio.sense_len;
2470 
2471 		DPRINTF(sc, UDMASS_SCSI, "Fetching %d bytes of "
2472 		    "sense data\n", ccb->csio.sense_len);
2473 
2474 		if (umass_std_transform(sc, ccb, &sc->cam_scsi_sense.opcode,
2475 		    sizeof(sc->cam_scsi_sense))) {
2476 
2477 			if ((sc->sc_quirks & FORCE_SHORT_INQUIRY) &&
2478 			    (sc->sc_transfer.cmd_data[0] == INQUIRY)) {
2479 				ccb->csio.sense_len = SHORT_INQUIRY_LENGTH;
2480 			}
2481 			umass_command_start(sc, DIR_IN, &ccb->csio.sense_data.error_code,
2482 			    ccb->csio.sense_len, ccb->ccb_h.timeout,
2483 			    &umass_cam_sense_cb, ccb);
2484 		}
2485 		break;
2486 
2487 	default:
2488 		/*
2489 		 * The wire protocol failed and will hopefully have
2490 		 * recovered. We return an error to CAM and let CAM
2491 		 * retry the command if necessary.
2492 		 */
2493 		ccb->ccb_h.status = CAM_REQ_CMP_ERR;
2494 		xpt_done(ccb);
2495 		break;
2496 	}
2497 }
2498 
2499 /*
2500  * Finalise a completed autosense operation
2501  */
2502 static void
2503 umass_cam_sense_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2504     uint8_t status)
2505 {
2506 	uint8_t *cmd;
2507 
2508 	switch (status) {
2509 	case STATUS_CMD_OK:
2510 	case STATUS_CMD_UNKNOWN:
2511 	case STATUS_CMD_FAILED: {
2512 		int key, sense_len;
2513 
2514 		ccb->csio.sense_resid = residue;
2515 		sense_len = ccb->csio.sense_len - ccb->csio.sense_resid;
2516 		key = scsi_get_sense_key(&ccb->csio.sense_data, sense_len,
2517 					 /*show_errors*/ 1);
2518 
2519 		if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2520 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2521 		} else {
2522 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2523 		}
2524 
2525 		/*
2526 		 * Getting sense data always succeeds (apart from wire
2527 		 * failures):
2528 		 */
2529 		if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2530 		    (cmd[0] == INQUIRY) &&
2531 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2532 			/*
2533 			 * Ignore unit attention errors in the case where
2534 			 * the Unit Attention state is not cleared on
2535 			 * REQUEST SENSE. They will appear again at the next
2536 			 * command.
2537 			 */
2538 			ccb->ccb_h.status = CAM_REQ_CMP;
2539 		} else if (key == SSD_KEY_NO_SENSE) {
2540 			/*
2541 			 * No problem after all (in the case of CBI without
2542 			 * CCI)
2543 			 */
2544 			ccb->ccb_h.status = CAM_REQ_CMP;
2545 		} else if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2546 			    (cmd[0] == READ_CAPACITY) &&
2547 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2548 			/*
2549 			 * Some devices do not clear the unit attention error
2550 			 * on request sense. We insert a test unit ready
2551 			 * command to make sure we clear the unit attention
2552 			 * condition, then allow the retry to proceed as
2553 			 * usual.
2554 			 */
2555 
2556 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2557 			    | CAM_AUTOSNS_VALID;
2558 			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2559 
2560 #if 0
2561 			DELAY(300000);
2562 #endif
2563 			DPRINTF(sc, UDMASS_SCSI, "Doing a sneaky"
2564 			    "TEST_UNIT_READY\n");
2565 
2566 			/* the rest of the command was filled in at attach */
2567 
2568 			if (umass_std_transform(sc, ccb,
2569 			    &sc->cam_scsi_test_unit_ready.opcode,
2570 			    sizeof(sc->cam_scsi_test_unit_ready))) {
2571 				umass_command_start(sc, DIR_NONE, NULL, 0,
2572 				    ccb->ccb_h.timeout,
2573 				    &umass_cam_quirk_cb, ccb);
2574 			}
2575 			break;
2576 		} else {
2577 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2578 			    | CAM_AUTOSNS_VALID;
2579 			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2580 		}
2581 		xpt_done(ccb);
2582 		break;
2583 	}
2584 	default:
2585 		DPRINTF(sc, UDMASS_SCSI, "Autosense failed, "
2586 		    "status %d\n", status);
2587 		ccb->ccb_h.status = CAM_AUTOSENSE_FAIL;
2588 		xpt_done(ccb);
2589 	}
2590 }
2591 
2592 /*
2593  * This completion code just handles the fact that we sent a test-unit-ready
2594  * after having previously failed a READ CAPACITY with CHECK_COND.  Even
2595  * though this command succeeded, we have to tell CAM to retry.
2596  */
2597 static void
2598 umass_cam_quirk_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2599     uint8_t status)
2600 {
2601 	DPRINTF(sc, UDMASS_SCSI, "Test unit ready "
2602 	    "returned status %d\n", status);
2603 
2604 	ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2605 	    | CAM_AUTOSNS_VALID;
2606 	ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2607 	xpt_done(ccb);
2608 }
2609 
2610 /*
2611  * SCSI specific functions
2612  */
2613 
2614 static uint8_t
2615 umass_scsi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2616     uint8_t cmd_len)
2617 {
2618 	if ((cmd_len == 0) ||
2619 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2620 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2621 		    "length: %d bytes\n", cmd_len);
2622 		return (0);		/* failure */
2623 	}
2624 	sc->sc_transfer.cmd_len = cmd_len;
2625 
2626 	switch (cmd_ptr[0]) {
2627 	case TEST_UNIT_READY:
2628 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2629 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2630 			    "to START_UNIT\n");
2631 			memset(sc->sc_transfer.cmd_data, 0, cmd_len);
2632 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2633 			sc->sc_transfer.cmd_data[4] = SSS_START;
2634 			return (1);
2635 		}
2636 		break;
2637 
2638 	case INQUIRY:
2639 		/*
2640 		 * some drives wedge when asked for full inquiry
2641 		 * information.
2642 		 */
2643 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2644 			memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2645 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2646 			return (1);
2647 		}
2648 		break;
2649 	}
2650 
2651 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2652 	return (1);
2653 }
2654 
2655 static uint8_t
2656 umass_rbc_transform(struct umass_softc *sc, uint8_t *cmd_ptr, uint8_t cmd_len)
2657 {
2658 	if ((cmd_len == 0) ||
2659 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2660 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2661 		    "length: %d bytes\n", cmd_len);
2662 		return (0);		/* failure */
2663 	}
2664 	switch (cmd_ptr[0]) {
2665 		/* these commands are defined in RBC: */
2666 	case READ_10:
2667 	case READ_CAPACITY:
2668 	case START_STOP_UNIT:
2669 	case SYNCHRONIZE_CACHE:
2670 	case WRITE_10:
2671 	case 0x2f:			/* VERIFY_10 is absent from
2672 					 * scsi_all.h??? */
2673 	case INQUIRY:
2674 	case MODE_SELECT_10:
2675 	case MODE_SENSE_10:
2676 	case TEST_UNIT_READY:
2677 	case WRITE_BUFFER:
2678 		/*
2679 		 * The following commands are not listed in my copy of the
2680 		 * RBC specs. CAM however seems to want those, and at least
2681 		 * the Sony DSC device appears to support those as well
2682 		 */
2683 	case REQUEST_SENSE:
2684 	case PREVENT_ALLOW:
2685 
2686 		memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2687 
2688 		if ((sc->sc_quirks & RBC_PAD_TO_12) && (cmd_len < 12)) {
2689 			memset(sc->sc_transfer.cmd_data + cmd_len,
2690 			    0, 12 - cmd_len);
2691 			cmd_len = 12;
2692 		}
2693 		sc->sc_transfer.cmd_len = cmd_len;
2694 		return (1);		/* sucess */
2695 
2696 		/* All other commands are not legal in RBC */
2697 	default:
2698 		DPRINTF(sc, UDMASS_SCSI, "Unsupported RBC "
2699 		    "command 0x%02x\n", cmd_ptr[0]);
2700 		return (0);		/* failure */
2701 	}
2702 }
2703 
2704 static uint8_t
2705 umass_ufi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2706     uint8_t cmd_len)
2707 {
2708 	if ((cmd_len == 0) ||
2709 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2710 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2711 		    "length: %d bytes\n", cmd_len);
2712 		return (0);		/* failure */
2713 	}
2714 	/* An UFI command is always 12 bytes in length */
2715 	sc->sc_transfer.cmd_len = UFI_COMMAND_LENGTH;
2716 
2717 	/* Zero the command data */
2718 	memset(sc->sc_transfer.cmd_data, 0, UFI_COMMAND_LENGTH);
2719 
2720 	switch (cmd_ptr[0]) {
2721 		/*
2722 		 * Commands of which the format has been verified. They
2723 		 * should work. Copy the command into the (zeroed out)
2724 		 * destination buffer.
2725 		 */
2726 	case TEST_UNIT_READY:
2727 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2728 			/*
2729 			 * Some devices do not support this command. Start
2730 			 * Stop Unit should give the same results
2731 			 */
2732 			DPRINTF(sc, UDMASS_UFI, "Converted TEST_UNIT_READY "
2733 			    "to START_UNIT\n");
2734 
2735 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2736 			sc->sc_transfer.cmd_data[4] = SSS_START;
2737 			return (1);
2738 		}
2739 		break;
2740 
2741 	case REZERO_UNIT:
2742 	case REQUEST_SENSE:
2743 	case FORMAT_UNIT:
2744 	case INQUIRY:
2745 	case START_STOP_UNIT:
2746 	case SEND_DIAGNOSTIC:
2747 	case PREVENT_ALLOW:
2748 	case READ_CAPACITY:
2749 	case READ_10:
2750 	case WRITE_10:
2751 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2752 	case WRITE_AND_VERIFY:
2753 	case VERIFY:
2754 	case MODE_SELECT_10:
2755 	case MODE_SENSE_10:
2756 	case READ_12:
2757 	case WRITE_12:
2758 	case READ_FORMAT_CAPACITIES:
2759 		break;
2760 
2761 		/*
2762 		 * SYNCHRONIZE_CACHE isn't supported by UFI, nor should it be
2763 		 * required for UFI devices, so it is appropriate to fake
2764 		 * success.
2765 		 */
2766 	case SYNCHRONIZE_CACHE:
2767 		return (2);
2768 
2769 	default:
2770 		DPRINTF(sc, UDMASS_SCSI, "Unsupported UFI "
2771 		    "command 0x%02x\n", cmd_ptr[0]);
2772 		return (0);		/* failure */
2773 	}
2774 
2775 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2776 	return (1);			/* success */
2777 }
2778 
2779 /*
2780  * 8070i (ATAPI) specific functions
2781  */
2782 static uint8_t
2783 umass_atapi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2784     uint8_t cmd_len)
2785 {
2786 	if ((cmd_len == 0) ||
2787 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2788 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2789 		    "length: %d bytes\n", cmd_len);
2790 		return (0);		/* failure */
2791 	}
2792 	/* An ATAPI command is always 12 bytes in length. */
2793 	sc->sc_transfer.cmd_len = ATAPI_COMMAND_LENGTH;
2794 
2795 	/* Zero the command data */
2796 	memset(sc->sc_transfer.cmd_data, 0, ATAPI_COMMAND_LENGTH);
2797 
2798 	switch (cmd_ptr[0]) {
2799 		/*
2800 		 * Commands of which the format has been verified. They
2801 		 * should work. Copy the command into the destination
2802 		 * buffer.
2803 		 */
2804 	case INQUIRY:
2805 		/*
2806 		 * some drives wedge when asked for full inquiry
2807 		 * information.
2808 		 */
2809 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2810 			memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2811 
2812 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2813 			return (1);
2814 		}
2815 		break;
2816 
2817 	case TEST_UNIT_READY:
2818 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2819 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2820 			    "to START_UNIT\n");
2821 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2822 			sc->sc_transfer.cmd_data[4] = SSS_START;
2823 			return (1);
2824 		}
2825 		break;
2826 
2827 	case REZERO_UNIT:
2828 	case REQUEST_SENSE:
2829 	case START_STOP_UNIT:
2830 	case SEND_DIAGNOSTIC:
2831 	case PREVENT_ALLOW:
2832 	case READ_CAPACITY:
2833 	case READ_10:
2834 	case WRITE_10:
2835 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2836 	case SYNCHRONIZE_CACHE:
2837 	case MODE_SELECT_10:
2838 	case MODE_SENSE_10:
2839 	case READ_BUFFER:
2840 	case 0x42:			/* READ_SUBCHANNEL */
2841 	case 0x43:			/* READ_TOC */
2842 	case 0x44:			/* READ_HEADER */
2843 	case 0x47:			/* PLAY_MSF (Play Minute/Second/Frame) */
2844 	case 0x48:			/* PLAY_TRACK */
2845 	case 0x49:			/* PLAY_TRACK_REL */
2846 	case 0x4b:			/* PAUSE */
2847 	case 0x51:			/* READ_DISK_INFO */
2848 	case 0x52:			/* READ_TRACK_INFO */
2849 	case 0x54:			/* SEND_OPC */
2850 	case 0x59:			/* READ_MASTER_CUE */
2851 	case 0x5b:			/* CLOSE_TR_SESSION */
2852 	case 0x5c:			/* READ_BUFFER_CAP */
2853 	case 0x5d:			/* SEND_CUE_SHEET */
2854 	case 0xa1:			/* BLANK */
2855 	case 0xa5:			/* PLAY_12 */
2856 	case 0xa6:			/* EXCHANGE_MEDIUM */
2857 	case 0xad:			/* READ_DVD_STRUCTURE */
2858 	case 0xbb:			/* SET_CD_SPEED */
2859 	case 0xe5:			/* READ_TRACK_INFO_PHILIPS */
2860 		break;
2861 
2862 	case READ_12:
2863 	case WRITE_12:
2864 	default:
2865 		DPRINTF(sc, UDMASS_SCSI, "Unsupported ATAPI "
2866 		    "command 0x%02x - trying anyway\n",
2867 		    cmd_ptr[0]);
2868 		break;
2869 	}
2870 
2871 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2872 	return (1);			/* success */
2873 }
2874 
2875 static uint8_t
2876 umass_no_transform(struct umass_softc *sc, uint8_t *cmd,
2877     uint8_t cmdlen)
2878 {
2879 	return (0);			/* failure */
2880 }
2881 
2882 static uint8_t
2883 umass_std_transform(struct umass_softc *sc, union ccb *ccb,
2884     uint8_t *cmd, uint8_t cmdlen)
2885 {
2886 	uint8_t retval;
2887 
2888 	retval = (sc->sc_transform) (sc, cmd, cmdlen);
2889 
2890 	if (retval == 2) {
2891 		ccb->ccb_h.status = CAM_REQ_CMP;
2892 		xpt_done(ccb);
2893 		return (0);
2894 	} else if (retval == 0) {
2895 		ccb->ccb_h.status = CAM_REQ_INVALID;
2896 		xpt_done(ccb);
2897 		return (0);
2898 	}
2899 	/* Command should be executed */
2900 	return (1);
2901 }
2902 
2903 #ifdef USB_DEBUG
2904 static void
2905 umass_bbb_dump_cbw(struct umass_softc *sc, umass_bbb_cbw_t *cbw)
2906 {
2907 	uint8_t *c = cbw->CBWCDB;
2908 
2909 	uint32_t dlen = UGETDW(cbw->dCBWDataTransferLength);
2910 	uint32_t tag = UGETDW(cbw->dCBWTag);
2911 
2912 	uint8_t clen = cbw->bCDBLength;
2913 	uint8_t flags = cbw->bCBWFlags;
2914 	uint8_t lun = cbw->bCBWLUN;
2915 
2916 	DPRINTF(sc, UDMASS_BBB, "CBW %d: cmd = %db "
2917 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
2918 	    "data = %db, lun = %d, dir = %s\n",
2919 	    tag, clen,
2920 	    c[0], c[1], c[2], c[3], c[4], c[5], (clen > 6 ? "..." : ""),
2921 	    dlen, lun, (flags == CBWFLAGS_IN ? "in" :
2922 	    (flags == CBWFLAGS_OUT ? "out" : "<invalid>")));
2923 }
2924 
2925 static void
2926 umass_bbb_dump_csw(struct umass_softc *sc, umass_bbb_csw_t *csw)
2927 {
2928 	uint32_t sig = UGETDW(csw->dCSWSignature);
2929 	uint32_t tag = UGETDW(csw->dCSWTag);
2930 	uint32_t res = UGETDW(csw->dCSWDataResidue);
2931 	uint8_t status = csw->bCSWStatus;
2932 
2933 	DPRINTF(sc, UDMASS_BBB, "CSW %d: sig = 0x%08x (%s), tag = 0x%08x, "
2934 	    "res = %d, status = 0x%02x (%s)\n",
2935 	    tag, sig, (sig == CSWSIGNATURE ? "valid" : "invalid"),
2936 	    tag, res,
2937 	    status, (status == CSWSTATUS_GOOD ? "good" :
2938 	    (status == CSWSTATUS_FAILED ? "failed" :
2939 	    (status == CSWSTATUS_PHASE ? "phase" : "<invalid>"))));
2940 }
2941 
2942 static void
2943 umass_cbi_dump_cmd(struct umass_softc *sc, void *cmd, uint8_t cmdlen)
2944 {
2945 	uint8_t *c = cmd;
2946 	uint8_t dir = sc->sc_transfer.dir;
2947 
2948 	DPRINTF(sc, UDMASS_BBB, "cmd = %db "
2949 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
2950 	    "data = %db, dir = %s\n",
2951 	    cmdlen,
2952 	    c[0], c[1], c[2], c[3], c[4], c[5], (cmdlen > 6 ? "..." : ""),
2953 	    sc->sc_transfer.data_len,
2954 	    (dir == DIR_IN ? "in" :
2955 	    (dir == DIR_OUT ? "out" :
2956 	    (dir == DIR_NONE ? "no data phase" : "<invalid>"))));
2957 }
2958 
2959 static void
2960 umass_dump_buffer(struct umass_softc *sc, uint8_t *buffer, uint32_t buflen,
2961     uint32_t printlen)
2962 {
2963 	uint32_t i, j;
2964 	char s1[40];
2965 	char s2[40];
2966 	char s3[5];
2967 
2968 	s1[0] = '\0';
2969 	s3[0] = '\0';
2970 
2971 	sprintf(s2, " buffer=%p, buflen=%d", buffer, buflen);
2972 	for (i = 0; (i < buflen) && (i < printlen); i++) {
2973 		j = i % 16;
2974 		if (j == 0 && i != 0) {
2975 			DPRINTF(sc, UDMASS_GEN, "0x %s%s\n",
2976 			    s1, s2);
2977 			s2[0] = '\0';
2978 		}
2979 		sprintf(&s1[j * 2], "%02x", buffer[i] & 0xff);
2980 	}
2981 	if (buflen > printlen)
2982 		sprintf(s3, " ...");
2983 	DPRINTF(sc, UDMASS_GEN, "0x %s%s%s\n",
2984 	    s1, s2, s3);
2985 }
2986 
2987 #endif
2988