xref: /freebsd/sys/dev/usb/storage/umass.c (revision 7cd2dcf07629713e5a3d60472cfe4701b705a167)
1 #include <sys/cdefs.h>
2 __FBSDID("$FreeBSD$");
3 
4 /*-
5  * Copyright (c) 1999 MAEKAWA Masahide <bishop@rr.iij4u.or.jp>,
6  *		      Nick Hibma <n_hibma@FreeBSD.org>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  *	$FreeBSD$
31  *	$NetBSD: umass.c,v 1.28 2000/04/02 23:46:53 augustss Exp $
32  */
33 
34 /* Also already merged from NetBSD:
35  *	$NetBSD: umass.c,v 1.67 2001/11/25 19:05:22 augustss Exp $
36  *	$NetBSD: umass.c,v 1.90 2002/11/04 19:17:33 pooka Exp $
37  *	$NetBSD: umass.c,v 1.108 2003/11/07 17:03:25 wiz Exp $
38  *	$NetBSD: umass.c,v 1.109 2003/12/04 13:57:31 keihan Exp $
39  */
40 
41 /*
42  * Universal Serial Bus Mass Storage Class specs:
43  * http://www.usb.org/developers/devclass_docs/usb_msc_overview_1.2.pdf
44  * http://www.usb.org/developers/devclass_docs/usbmassbulk_10.pdf
45  * http://www.usb.org/developers/devclass_docs/usb_msc_cbi_1.1.pdf
46  * http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf
47  */
48 
49 /*
50  * Ported to NetBSD by Lennart Augustsson <augustss@NetBSD.org>.
51  * Parts of the code written by Jason R. Thorpe <thorpej@shagadelic.org>.
52  */
53 
54 /*
55  * The driver handles 3 Wire Protocols
56  * - Command/Bulk/Interrupt (CBI)
57  * - Command/Bulk/Interrupt with Command Completion Interrupt (CBI with CCI)
58  * - Mass Storage Bulk-Only (BBB)
59  *   (BBB refers Bulk/Bulk/Bulk for Command/Data/Status phases)
60  *
61  * Over these wire protocols it handles the following command protocols
62  * - SCSI
63  * - UFI (floppy command set)
64  * - 8070i (ATAPI)
65  *
66  * UFI and 8070i (ATAPI) are transformed versions of the SCSI command set. The
67  * sc->sc_transform method is used to convert the commands into the appropriate
68  * format (if at all necessary). For example, UFI requires all commands to be
69  * 12 bytes in length amongst other things.
70  *
71  * The source code below is marked and can be split into a number of pieces
72  * (in this order):
73  *
74  * - probe/attach/detach
75  * - generic transfer routines
76  * - BBB
77  * - CBI
78  * - CBI_I (in addition to functions from CBI)
79  * - CAM (Common Access Method)
80  * - SCSI
81  * - UFI
82  * - 8070i (ATAPI)
83  *
84  * The protocols are implemented using a state machine, for the transfers as
85  * well as for the resets. The state machine is contained in umass_t_*_callback.
86  * The state machine is started through either umass_command_start() or
87  * umass_reset().
88  *
89  * The reason for doing this is a) CAM performs a lot better this way and b) it
90  * avoids using tsleep from interrupt context (for example after a failed
91  * transfer).
92  */
93 
94 /*
95  * The SCSI related part of this driver has been derived from the
96  * dev/ppbus/vpo.c driver, by Nicolas Souchu (nsouch@FreeBSD.org).
97  *
98  * The CAM layer uses so called actions which are messages sent to the host
99  * adapter for completion. The actions come in through umass_cam_action. The
100  * appropriate block of routines is called depending on the transport protocol
101  * in use. When the transfer has finished, these routines call
102  * umass_cam_cb again to complete the CAM command.
103  */
104 
105 #include <sys/stdint.h>
106 #include <sys/stddef.h>
107 #include <sys/param.h>
108 #include <sys/queue.h>
109 #include <sys/types.h>
110 #include <sys/systm.h>
111 #include <sys/kernel.h>
112 #include <sys/bus.h>
113 #include <sys/module.h>
114 #include <sys/lock.h>
115 #include <sys/mutex.h>
116 #include <sys/condvar.h>
117 #include <sys/sysctl.h>
118 #include <sys/sx.h>
119 #include <sys/unistd.h>
120 #include <sys/callout.h>
121 #include <sys/malloc.h>
122 #include <sys/priv.h>
123 
124 #include <dev/usb/usb.h>
125 #include <dev/usb/usbdi.h>
126 #include <dev/usb/usbdi_util.h>
127 #include "usbdevs.h"
128 
129 #include <dev/usb/quirk/usb_quirk.h>
130 
131 #include <cam/cam.h>
132 #include <cam/cam_ccb.h>
133 #include <cam/cam_sim.h>
134 #include <cam/cam_xpt_sim.h>
135 #include <cam/scsi/scsi_all.h>
136 #include <cam/scsi/scsi_da.h>
137 
138 #include <cam/cam_periph.h>
139 
140 #ifdef USB_DEBUG
141 #define	DIF(m, x)				\
142   do {						\
143     if (umass_debug & (m)) { x ; }		\
144   } while (0)
145 
146 #define	DPRINTF(sc, m, fmt, ...)			\
147   do {							\
148     if (umass_debug & (m)) {				\
149         printf("%s:%s: " fmt,				\
150 	       (sc) ? (const char *)(sc)->sc_name :	\
151 	       (const char *)"umassX",			\
152 		__FUNCTION__ ,## __VA_ARGS__);		\
153     }							\
154   } while (0)
155 
156 #define	UDMASS_GEN	0x00010000	/* general */
157 #define	UDMASS_SCSI	0x00020000	/* scsi */
158 #define	UDMASS_UFI	0x00040000	/* ufi command set */
159 #define	UDMASS_ATAPI	0x00080000	/* 8070i command set */
160 #define	UDMASS_CMD	(UDMASS_SCSI|UDMASS_UFI|UDMASS_ATAPI)
161 #define	UDMASS_USB	0x00100000	/* USB general */
162 #define	UDMASS_BBB	0x00200000	/* Bulk-Only transfers */
163 #define	UDMASS_CBI	0x00400000	/* CBI transfers */
164 #define	UDMASS_WIRE	(UDMASS_BBB|UDMASS_CBI)
165 #define	UDMASS_ALL	0xffff0000	/* all of the above */
166 static int umass_debug = 0;
167 
168 static SYSCTL_NODE(_hw_usb, OID_AUTO, umass, CTLFLAG_RW, 0, "USB umass");
169 SYSCTL_INT(_hw_usb_umass, OID_AUTO, debug, CTLFLAG_RW | CTLFLAG_TUN,
170     &umass_debug, 0, "umass debug level");
171 TUNABLE_INT("hw.usb.umass.debug", &umass_debug);
172 #else
173 #define	DIF(...) do { } while (0)
174 #define	DPRINTF(...) do { } while (0)
175 #endif
176 
177 #define	UMASS_BULK_SIZE (1 << 17)
178 #define	UMASS_CBI_DIAGNOSTIC_CMDLEN 12	/* bytes */
179 #define	UMASS_MAX_CMDLEN MAX(12, CAM_MAX_CDBLEN)	/* bytes */
180 
181 /* USB transfer definitions */
182 
183 #define	UMASS_T_BBB_RESET1      0	/* Bulk-Only */
184 #define	UMASS_T_BBB_RESET2      1
185 #define	UMASS_T_BBB_RESET3      2
186 #define	UMASS_T_BBB_COMMAND     3
187 #define	UMASS_T_BBB_DATA_READ   4
188 #define	UMASS_T_BBB_DATA_RD_CS  5
189 #define	UMASS_T_BBB_DATA_WRITE  6
190 #define	UMASS_T_BBB_DATA_WR_CS  7
191 #define	UMASS_T_BBB_STATUS      8
192 #define	UMASS_T_BBB_MAX         9
193 
194 #define	UMASS_T_CBI_RESET1      0	/* CBI */
195 #define	UMASS_T_CBI_RESET2      1
196 #define	UMASS_T_CBI_RESET3      2
197 #define	UMASS_T_CBI_COMMAND     3
198 #define	UMASS_T_CBI_DATA_READ   4
199 #define	UMASS_T_CBI_DATA_RD_CS  5
200 #define	UMASS_T_CBI_DATA_WRITE  6
201 #define	UMASS_T_CBI_DATA_WR_CS  7
202 #define	UMASS_T_CBI_STATUS      8
203 #define	UMASS_T_CBI_RESET4      9
204 #define	UMASS_T_CBI_MAX        10
205 
206 #define	UMASS_T_MAX MAX(UMASS_T_CBI_MAX, UMASS_T_BBB_MAX)
207 
208 /* Generic definitions */
209 
210 /* Direction for transfer */
211 #define	DIR_NONE	0
212 #define	DIR_IN		1
213 #define	DIR_OUT		2
214 
215 /* device name */
216 #define	DEVNAME		"umass"
217 #define	DEVNAME_SIM	"umass-sim"
218 
219 /* Approximate maximum transfer speeds (assumes 33% overhead). */
220 #define	UMASS_FULL_TRANSFER_SPEED	1000
221 #define	UMASS_HIGH_TRANSFER_SPEED	40000
222 #define	UMASS_SUPER_TRANSFER_SPEED	400000
223 #define	UMASS_FLOPPY_TRANSFER_SPEED	20
224 
225 #define	UMASS_TIMEOUT			5000	/* ms */
226 
227 /* CAM specific definitions */
228 
229 #define	UMASS_SCSIID_MAX	1	/* maximum number of drives expected */
230 #define	UMASS_SCSIID_HOST	UMASS_SCSIID_MAX
231 
232 /* Bulk-Only features */
233 
234 #define	UR_BBB_RESET		0xff	/* Bulk-Only reset */
235 #define	UR_BBB_GET_MAX_LUN	0xfe	/* Get maximum lun */
236 
237 /* Command Block Wrapper */
238 typedef struct {
239 	uDWord	dCBWSignature;
240 #define	CBWSIGNATURE	0x43425355
241 	uDWord	dCBWTag;
242 	uDWord	dCBWDataTransferLength;
243 	uByte	bCBWFlags;
244 #define	CBWFLAGS_OUT	0x00
245 #define	CBWFLAGS_IN	0x80
246 	uByte	bCBWLUN;
247 	uByte	bCDBLength;
248 #define	CBWCDBLENGTH	16
249 	uByte	CBWCDB[CBWCDBLENGTH];
250 } __packed umass_bbb_cbw_t;
251 
252 #define	UMASS_BBB_CBW_SIZE	31
253 
254 /* Command Status Wrapper */
255 typedef struct {
256 	uDWord	dCSWSignature;
257 #define	CSWSIGNATURE	0x53425355
258 #define	CSWSIGNATURE_IMAGINATION_DBX1	0x43425355
259 #define	CSWSIGNATURE_OLYMPUS_C1	0x55425355
260 	uDWord	dCSWTag;
261 	uDWord	dCSWDataResidue;
262 	uByte	bCSWStatus;
263 #define	CSWSTATUS_GOOD	0x0
264 #define	CSWSTATUS_FAILED	0x1
265 #define	CSWSTATUS_PHASE	0x2
266 } __packed umass_bbb_csw_t;
267 
268 #define	UMASS_BBB_CSW_SIZE	13
269 
270 /* CBI features */
271 
272 #define	UR_CBI_ADSC	0x00
273 
274 typedef union {
275 	struct {
276 		uint8_t	type;
277 #define	IDB_TYPE_CCI		0x00
278 		uint8_t	value;
279 #define	IDB_VALUE_PASS		0x00
280 #define	IDB_VALUE_FAIL		0x01
281 #define	IDB_VALUE_PHASE		0x02
282 #define	IDB_VALUE_PERSISTENT	0x03
283 #define	IDB_VALUE_STATUS_MASK	0x03
284 	} __packed common;
285 
286 	struct {
287 		uint8_t	asc;
288 		uint8_t	ascq;
289 	} __packed ufi;
290 } __packed umass_cbi_sbl_t;
291 
292 struct umass_softc;			/* see below */
293 
294 typedef void (umass_callback_t)(struct umass_softc *sc, union ccb *ccb,
295     	uint32_t residue, uint8_t status);
296 
297 #define	STATUS_CMD_OK		0	/* everything ok */
298 #define	STATUS_CMD_UNKNOWN	1	/* will have to fetch sense */
299 #define	STATUS_CMD_FAILED	2	/* transfer was ok, command failed */
300 #define	STATUS_WIRE_FAILED	3	/* couldn't even get command across */
301 
302 typedef uint8_t (umass_transform_t)(struct umass_softc *sc, uint8_t *cmd_ptr,
303     	uint8_t cmd_len);
304 
305 /* Wire and command protocol */
306 #define	UMASS_PROTO_BBB		0x0001	/* USB wire protocol */
307 #define	UMASS_PROTO_CBI		0x0002
308 #define	UMASS_PROTO_CBI_I	0x0004
309 #define	UMASS_PROTO_WIRE	0x00ff	/* USB wire protocol mask */
310 #define	UMASS_PROTO_SCSI	0x0100	/* command protocol */
311 #define	UMASS_PROTO_ATAPI	0x0200
312 #define	UMASS_PROTO_UFI		0x0400
313 #define	UMASS_PROTO_RBC		0x0800
314 #define	UMASS_PROTO_COMMAND	0xff00	/* command protocol mask */
315 
316 /* Device specific quirks */
317 #define	NO_QUIRKS		0x0000
318 	/*
319 	 * The drive does not support Test Unit Ready. Convert to Start Unit
320 	 */
321 #define	NO_TEST_UNIT_READY	0x0001
322 	/*
323 	 * The drive does not reset the Unit Attention state after REQUEST
324 	 * SENSE has been sent. The INQUIRY command does not reset the UA
325 	 * either, and so CAM runs in circles trying to retrieve the initial
326 	 * INQUIRY data.
327 	 */
328 #define	RS_NO_CLEAR_UA		0x0002
329 	/* The drive does not support START STOP.  */
330 #define	NO_START_STOP		0x0004
331 	/* Don't ask for full inquiry data (255b).  */
332 #define	FORCE_SHORT_INQUIRY	0x0008
333 	/* Needs to be initialised the Shuttle way */
334 #define	SHUTTLE_INIT		0x0010
335 	/* Drive needs to be switched to alternate iface 1 */
336 #define	ALT_IFACE_1		0x0020
337 	/* Drive does not do 1Mb/s, but just floppy speeds (20kb/s) */
338 #define	FLOPPY_SPEED		0x0040
339 	/* The device can't count and gets the residue of transfers wrong */
340 #define	IGNORE_RESIDUE		0x0080
341 	/* No GetMaxLun call */
342 #define	NO_GETMAXLUN		0x0100
343 	/* The device uses a weird CSWSIGNATURE. */
344 #define	WRONG_CSWSIG		0x0200
345 	/* Device cannot handle INQUIRY so fake a generic response */
346 #define	NO_INQUIRY		0x0400
347 	/* Device cannot handle INQUIRY EVPD, return CHECK CONDITION */
348 #define	NO_INQUIRY_EVPD		0x0800
349 	/* Pad all RBC requests to 12 bytes. */
350 #define	RBC_PAD_TO_12		0x1000
351 	/*
352 	 * Device reports number of sectors from READ_CAPACITY, not max
353 	 * sector number.
354 	 */
355 #define	READ_CAPACITY_OFFBY1	0x2000
356 	/*
357 	 * Device cannot handle a SCSI synchronize cache command.  Normally
358 	 * this quirk would be handled in the cam layer, but for IDE bridges
359 	 * we need to associate the quirk with the bridge and not the
360 	 * underlying disk device.  This is handled by faking a success
361 	 * result.
362 	 */
363 #define	NO_SYNCHRONIZE_CACHE	0x4000
364 
365 struct umass_softc {
366 
367 	struct scsi_sense cam_scsi_sense;
368 	struct scsi_test_unit_ready cam_scsi_test_unit_ready;
369 	struct mtx sc_mtx;
370 	struct {
371 		uint8_t *data_ptr;
372 		union ccb *ccb;
373 		umass_callback_t *callback;
374 
375 		uint32_t data_len;	/* bytes */
376 		uint32_t data_rem;	/* bytes */
377 		uint32_t data_timeout;	/* ms */
378 		uint32_t actlen;	/* bytes */
379 
380 		uint8_t	cmd_data[UMASS_MAX_CMDLEN];
381 		uint8_t	cmd_len;	/* bytes */
382 		uint8_t	dir;
383 		uint8_t	lun;
384 	}	sc_transfer;
385 
386 	/* Bulk specific variables for transfers in progress */
387 	umass_bbb_cbw_t cbw;		/* command block wrapper */
388 	umass_bbb_csw_t csw;		/* command status wrapper */
389 
390 	/* CBI specific variables for transfers in progress */
391 	umass_cbi_sbl_t sbl;		/* status block */
392 
393 	device_t sc_dev;
394 	struct usb_device *sc_udev;
395 	struct cam_sim *sc_sim;		/* SCSI Interface Module */
396 	struct usb_xfer *sc_xfer[UMASS_T_MAX];
397 
398 	/*
399 	 * The command transform function is used to convert the SCSI
400 	 * commands into their derivatives, like UFI, ATAPI, and friends.
401 	 */
402 	umass_transform_t *sc_transform;
403 
404 	uint32_t sc_unit;
405 	uint32_t sc_quirks;		/* they got it almost right */
406 	uint32_t sc_proto;		/* wire and cmd protocol */
407 
408 	uint8_t	sc_name[16];
409 	uint8_t	sc_iface_no;		/* interface number */
410 	uint8_t	sc_maxlun;		/* maximum LUN number, inclusive */
411 	uint8_t	sc_last_xfer_index;
412 	uint8_t	sc_status_try;
413 };
414 
415 struct umass_probe_proto {
416 	uint32_t quirks;
417 	uint32_t proto;
418 
419 	int	error;
420 };
421 
422 /* prototypes */
423 
424 static device_probe_t umass_probe;
425 static device_attach_t umass_attach;
426 static device_detach_t umass_detach;
427 
428 static usb_callback_t umass_tr_error;
429 static usb_callback_t umass_t_bbb_reset1_callback;
430 static usb_callback_t umass_t_bbb_reset2_callback;
431 static usb_callback_t umass_t_bbb_reset3_callback;
432 static usb_callback_t umass_t_bbb_command_callback;
433 static usb_callback_t umass_t_bbb_data_read_callback;
434 static usb_callback_t umass_t_bbb_data_rd_cs_callback;
435 static usb_callback_t umass_t_bbb_data_write_callback;
436 static usb_callback_t umass_t_bbb_data_wr_cs_callback;
437 static usb_callback_t umass_t_bbb_status_callback;
438 static usb_callback_t umass_t_cbi_reset1_callback;
439 static usb_callback_t umass_t_cbi_reset2_callback;
440 static usb_callback_t umass_t_cbi_reset3_callback;
441 static usb_callback_t umass_t_cbi_reset4_callback;
442 static usb_callback_t umass_t_cbi_command_callback;
443 static usb_callback_t umass_t_cbi_data_read_callback;
444 static usb_callback_t umass_t_cbi_data_rd_cs_callback;
445 static usb_callback_t umass_t_cbi_data_write_callback;
446 static usb_callback_t umass_t_cbi_data_wr_cs_callback;
447 static usb_callback_t umass_t_cbi_status_callback;
448 
449 static void	umass_cancel_ccb(struct umass_softc *);
450 static void	umass_init_shuttle(struct umass_softc *);
451 static void	umass_reset(struct umass_softc *);
452 static void	umass_t_bbb_data_clear_stall_callback(struct usb_xfer *,
453 		    uint8_t, uint8_t, usb_error_t);
454 static void	umass_command_start(struct umass_softc *, uint8_t, void *,
455 		    uint32_t, uint32_t, umass_callback_t *, union ccb *);
456 static uint8_t	umass_bbb_get_max_lun(struct umass_softc *);
457 static void	umass_cbi_start_status(struct umass_softc *);
458 static void	umass_t_cbi_data_clear_stall_callback(struct usb_xfer *,
459 		    uint8_t, uint8_t, usb_error_t);
460 static int	umass_cam_attach_sim(struct umass_softc *);
461 static void	umass_cam_attach(struct umass_softc *);
462 static void	umass_cam_detach_sim(struct umass_softc *);
463 static void	umass_cam_action(struct cam_sim *, union ccb *);
464 static void	umass_cam_poll(struct cam_sim *);
465 static void	umass_cam_cb(struct umass_softc *, union ccb *, uint32_t,
466 		    uint8_t);
467 static void	umass_cam_sense_cb(struct umass_softc *, union ccb *, uint32_t,
468 		    uint8_t);
469 static void	umass_cam_quirk_cb(struct umass_softc *, union ccb *, uint32_t,
470 		    uint8_t);
471 static uint8_t	umass_scsi_transform(struct umass_softc *, uint8_t *, uint8_t);
472 static uint8_t	umass_rbc_transform(struct umass_softc *, uint8_t *, uint8_t);
473 static uint8_t	umass_ufi_transform(struct umass_softc *, uint8_t *, uint8_t);
474 static uint8_t	umass_atapi_transform(struct umass_softc *, uint8_t *,
475 		    uint8_t);
476 static uint8_t	umass_no_transform(struct umass_softc *, uint8_t *, uint8_t);
477 static uint8_t	umass_std_transform(struct umass_softc *, union ccb *, uint8_t
478 		    *, uint8_t);
479 
480 #ifdef USB_DEBUG
481 static void	umass_bbb_dump_cbw(struct umass_softc *, umass_bbb_cbw_t *);
482 static void	umass_bbb_dump_csw(struct umass_softc *, umass_bbb_csw_t *);
483 static void	umass_cbi_dump_cmd(struct umass_softc *, void *, uint8_t);
484 static void	umass_dump_buffer(struct umass_softc *, uint8_t *, uint32_t,
485 		    uint32_t);
486 #endif
487 
488 static struct usb_config umass_bbb_config[UMASS_T_BBB_MAX] = {
489 
490 	[UMASS_T_BBB_RESET1] = {
491 		.type = UE_CONTROL,
492 		.endpoint = 0x00,	/* Control pipe */
493 		.direction = UE_DIR_ANY,
494 		.bufsize = sizeof(struct usb_device_request),
495 		.callback = &umass_t_bbb_reset1_callback,
496 		.timeout = 5000,	/* 5 seconds */
497 		.interval = 500,	/* 500 milliseconds */
498 	},
499 
500 	[UMASS_T_BBB_RESET2] = {
501 		.type = UE_CONTROL,
502 		.endpoint = 0x00,	/* Control pipe */
503 		.direction = UE_DIR_ANY,
504 		.bufsize = sizeof(struct usb_device_request),
505 		.callback = &umass_t_bbb_reset2_callback,
506 		.timeout = 5000,	/* 5 seconds */
507 		.interval = 50,	/* 50 milliseconds */
508 	},
509 
510 	[UMASS_T_BBB_RESET3] = {
511 		.type = UE_CONTROL,
512 		.endpoint = 0x00,	/* Control pipe */
513 		.direction = UE_DIR_ANY,
514 		.bufsize = sizeof(struct usb_device_request),
515 		.callback = &umass_t_bbb_reset3_callback,
516 		.timeout = 5000,	/* 5 seconds */
517 		.interval = 50,	/* 50 milliseconds */
518 	},
519 
520 	[UMASS_T_BBB_COMMAND] = {
521 		.type = UE_BULK,
522 		.endpoint = UE_ADDR_ANY,
523 		.direction = UE_DIR_OUT,
524 		.bufsize = sizeof(umass_bbb_cbw_t),
525 		.callback = &umass_t_bbb_command_callback,
526 		.timeout = 5000,	/* 5 seconds */
527 	},
528 
529 	[UMASS_T_BBB_DATA_READ] = {
530 		.type = UE_BULK,
531 		.endpoint = UE_ADDR_ANY,
532 		.direction = UE_DIR_IN,
533 		.bufsize = UMASS_BULK_SIZE,
534 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
535 		.callback = &umass_t_bbb_data_read_callback,
536 		.timeout = 0,	/* overwritten later */
537 	},
538 
539 	[UMASS_T_BBB_DATA_RD_CS] = {
540 		.type = UE_CONTROL,
541 		.endpoint = 0x00,	/* Control pipe */
542 		.direction = UE_DIR_ANY,
543 		.bufsize = sizeof(struct usb_device_request),
544 		.callback = &umass_t_bbb_data_rd_cs_callback,
545 		.timeout = 5000,	/* 5 seconds */
546 	},
547 
548 	[UMASS_T_BBB_DATA_WRITE] = {
549 		.type = UE_BULK,
550 		.endpoint = UE_ADDR_ANY,
551 		.direction = UE_DIR_OUT,
552 		.bufsize = UMASS_BULK_SIZE,
553 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
554 		.callback = &umass_t_bbb_data_write_callback,
555 		.timeout = 0,	/* overwritten later */
556 	},
557 
558 	[UMASS_T_BBB_DATA_WR_CS] = {
559 		.type = UE_CONTROL,
560 		.endpoint = 0x00,	/* Control pipe */
561 		.direction = UE_DIR_ANY,
562 		.bufsize = sizeof(struct usb_device_request),
563 		.callback = &umass_t_bbb_data_wr_cs_callback,
564 		.timeout = 5000,	/* 5 seconds */
565 	},
566 
567 	[UMASS_T_BBB_STATUS] = {
568 		.type = UE_BULK,
569 		.endpoint = UE_ADDR_ANY,
570 		.direction = UE_DIR_IN,
571 		.bufsize = sizeof(umass_bbb_csw_t),
572 		.flags = {.short_xfer_ok = 1,},
573 		.callback = &umass_t_bbb_status_callback,
574 		.timeout = 5000,	/* ms */
575 	},
576 };
577 
578 static struct usb_config umass_cbi_config[UMASS_T_CBI_MAX] = {
579 
580 	[UMASS_T_CBI_RESET1] = {
581 		.type = UE_CONTROL,
582 		.endpoint = 0x00,	/* Control pipe */
583 		.direction = UE_DIR_ANY,
584 		.bufsize = (sizeof(struct usb_device_request) +
585 		    UMASS_CBI_DIAGNOSTIC_CMDLEN),
586 		.callback = &umass_t_cbi_reset1_callback,
587 		.timeout = 5000,	/* 5 seconds */
588 		.interval = 500,	/* 500 milliseconds */
589 	},
590 
591 	[UMASS_T_CBI_RESET2] = {
592 		.type = UE_CONTROL,
593 		.endpoint = 0x00,	/* Control pipe */
594 		.direction = UE_DIR_ANY,
595 		.bufsize = sizeof(struct usb_device_request),
596 		.callback = &umass_t_cbi_reset2_callback,
597 		.timeout = 5000,	/* 5 seconds */
598 		.interval = 50,	/* 50 milliseconds */
599 	},
600 
601 	[UMASS_T_CBI_RESET3] = {
602 		.type = UE_CONTROL,
603 		.endpoint = 0x00,	/* Control pipe */
604 		.direction = UE_DIR_ANY,
605 		.bufsize = sizeof(struct usb_device_request),
606 		.callback = &umass_t_cbi_reset3_callback,
607 		.timeout = 5000,	/* 5 seconds */
608 		.interval = 50,	/* 50 milliseconds */
609 	},
610 
611 	[UMASS_T_CBI_COMMAND] = {
612 		.type = UE_CONTROL,
613 		.endpoint = 0x00,	/* Control pipe */
614 		.direction = UE_DIR_ANY,
615 		.bufsize = (sizeof(struct usb_device_request) +
616 		    UMASS_MAX_CMDLEN),
617 		.callback = &umass_t_cbi_command_callback,
618 		.timeout = 5000,	/* 5 seconds */
619 	},
620 
621 	[UMASS_T_CBI_DATA_READ] = {
622 		.type = UE_BULK,
623 		.endpoint = UE_ADDR_ANY,
624 		.direction = UE_DIR_IN,
625 		.bufsize = UMASS_BULK_SIZE,
626 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
627 		.callback = &umass_t_cbi_data_read_callback,
628 		.timeout = 0,	/* overwritten later */
629 	},
630 
631 	[UMASS_T_CBI_DATA_RD_CS] = {
632 		.type = UE_CONTROL,
633 		.endpoint = 0x00,	/* Control pipe */
634 		.direction = UE_DIR_ANY,
635 		.bufsize = sizeof(struct usb_device_request),
636 		.callback = &umass_t_cbi_data_rd_cs_callback,
637 		.timeout = 5000,	/* 5 seconds */
638 	},
639 
640 	[UMASS_T_CBI_DATA_WRITE] = {
641 		.type = UE_BULK,
642 		.endpoint = UE_ADDR_ANY,
643 		.direction = UE_DIR_OUT,
644 		.bufsize = UMASS_BULK_SIZE,
645 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
646 		.callback = &umass_t_cbi_data_write_callback,
647 		.timeout = 0,	/* overwritten later */
648 	},
649 
650 	[UMASS_T_CBI_DATA_WR_CS] = {
651 		.type = UE_CONTROL,
652 		.endpoint = 0x00,	/* Control pipe */
653 		.direction = UE_DIR_ANY,
654 		.bufsize = sizeof(struct usb_device_request),
655 		.callback = &umass_t_cbi_data_wr_cs_callback,
656 		.timeout = 5000,	/* 5 seconds */
657 	},
658 
659 	[UMASS_T_CBI_STATUS] = {
660 		.type = UE_INTERRUPT,
661 		.endpoint = UE_ADDR_ANY,
662 		.direction = UE_DIR_IN,
663 		.flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
664 		.bufsize = sizeof(umass_cbi_sbl_t),
665 		.callback = &umass_t_cbi_status_callback,
666 		.timeout = 5000,	/* ms */
667 	},
668 
669 	[UMASS_T_CBI_RESET4] = {
670 		.type = UE_CONTROL,
671 		.endpoint = 0x00,	/* Control pipe */
672 		.direction = UE_DIR_ANY,
673 		.bufsize = sizeof(struct usb_device_request),
674 		.callback = &umass_t_cbi_reset4_callback,
675 		.timeout = 5000,	/* ms */
676 	},
677 };
678 
679 /* If device cannot return valid inquiry data, fake it */
680 static const uint8_t fake_inq_data[SHORT_INQUIRY_LENGTH] = {
681 	0, /* removable */ 0x80, SCSI_REV_2, SCSI_REV_2,
682 	 /* additional_length */ 31, 0, 0, 0
683 };
684 
685 #define	UFI_COMMAND_LENGTH	12	/* UFI commands are always 12 bytes */
686 #define	ATAPI_COMMAND_LENGTH	12	/* ATAPI commands are always 12 bytes */
687 
688 static devclass_t umass_devclass;
689 
690 static device_method_t umass_methods[] = {
691 	/* Device interface */
692 	DEVMETHOD(device_probe, umass_probe),
693 	DEVMETHOD(device_attach, umass_attach),
694 	DEVMETHOD(device_detach, umass_detach),
695 	{0, 0}
696 };
697 
698 static driver_t umass_driver = {
699 	.name = "umass",
700 	.methods = umass_methods,
701 	.size = sizeof(struct umass_softc),
702 };
703 
704 DRIVER_MODULE(umass, uhub, umass_driver, umass_devclass, NULL, 0);
705 MODULE_DEPEND(umass, usb, 1, 1, 1);
706 MODULE_DEPEND(umass, cam, 1, 1, 1);
707 MODULE_VERSION(umass, 1);
708 
709 /*
710  * USB device probe/attach/detach
711  */
712 
713 static const STRUCT_USB_HOST_ID __used umass_devs[] = {
714 	/* generic mass storage class */
715 	{USB_IFACE_CLASS(UICLASS_MASS),},
716 };
717 
718 static uint16_t
719 umass_get_proto(struct usb_interface *iface)
720 {
721 	struct usb_interface_descriptor *id;
722 	uint16_t retval;
723 
724 	retval = 0;
725 
726 	/* Check for a standards compliant device */
727 	id = usbd_get_interface_descriptor(iface);
728 	if ((id == NULL) ||
729 	    (id->bInterfaceClass != UICLASS_MASS)) {
730 		goto done;
731 	}
732 	switch (id->bInterfaceSubClass) {
733 	case UISUBCLASS_SCSI:
734 		retval |= UMASS_PROTO_SCSI;
735 		break;
736 	case UISUBCLASS_UFI:
737 		retval |= UMASS_PROTO_UFI;
738 		break;
739 	case UISUBCLASS_RBC:
740 		retval |= UMASS_PROTO_RBC;
741 		break;
742 	case UISUBCLASS_SFF8020I:
743 	case UISUBCLASS_SFF8070I:
744 		retval |= UMASS_PROTO_ATAPI;
745 		break;
746 	default:
747 		goto done;
748 	}
749 
750 	switch (id->bInterfaceProtocol) {
751 	case UIPROTO_MASS_CBI:
752 		retval |= UMASS_PROTO_CBI;
753 		break;
754 	case UIPROTO_MASS_CBI_I:
755 		retval |= UMASS_PROTO_CBI_I;
756 		break;
757 	case UIPROTO_MASS_BBB_OLD:
758 	case UIPROTO_MASS_BBB:
759 		retval |= UMASS_PROTO_BBB;
760 		break;
761 	default:
762 		goto done;
763 	}
764 done:
765 	return (retval);
766 }
767 
768 /*
769  * Match the device we are seeing with the devices supported.
770  */
771 static struct umass_probe_proto
772 umass_probe_proto(device_t dev, struct usb_attach_arg *uaa)
773 {
774 	struct umass_probe_proto ret;
775 	uint32_t quirks = NO_QUIRKS;
776 	uint32_t proto = umass_get_proto(uaa->iface);
777 
778 	memset(&ret, 0, sizeof(ret));
779 	ret.error = BUS_PROBE_GENERIC;
780 
781 	/* Search for protocol enforcement */
782 
783 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_BBB)) {
784 		proto &= ~UMASS_PROTO_WIRE;
785 		proto |= UMASS_PROTO_BBB;
786 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI)) {
787 		proto &= ~UMASS_PROTO_WIRE;
788 		proto |= UMASS_PROTO_CBI;
789 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI_I)) {
790 		proto &= ~UMASS_PROTO_WIRE;
791 		proto |= UMASS_PROTO_CBI_I;
792 	}
793 
794 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_SCSI)) {
795 		proto &= ~UMASS_PROTO_COMMAND;
796 		proto |= UMASS_PROTO_SCSI;
797 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_ATAPI)) {
798 		proto &= ~UMASS_PROTO_COMMAND;
799 		proto |= UMASS_PROTO_ATAPI;
800 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_UFI)) {
801 		proto &= ~UMASS_PROTO_COMMAND;
802 		proto |= UMASS_PROTO_UFI;
803 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_RBC)) {
804 		proto &= ~UMASS_PROTO_COMMAND;
805 		proto |= UMASS_PROTO_RBC;
806 	}
807 
808 	/* Check if the protocol is invalid */
809 
810 	if ((proto & UMASS_PROTO_COMMAND) == 0) {
811 		ret.error = ENXIO;
812 		goto done;
813 	}
814 
815 	if ((proto & UMASS_PROTO_WIRE) == 0) {
816 		ret.error = ENXIO;
817 		goto done;
818 	}
819 
820 	/* Search for quirks */
821 
822 	if (usb_test_quirk(uaa, UQ_MSC_NO_TEST_UNIT_READY))
823 		quirks |= NO_TEST_UNIT_READY;
824 	if (usb_test_quirk(uaa, UQ_MSC_NO_RS_CLEAR_UA))
825 		quirks |= RS_NO_CLEAR_UA;
826 	if (usb_test_quirk(uaa, UQ_MSC_NO_START_STOP))
827 		quirks |= NO_START_STOP;
828 	if (usb_test_quirk(uaa, UQ_MSC_NO_GETMAXLUN))
829 		quirks |= NO_GETMAXLUN;
830 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY))
831 		quirks |= NO_INQUIRY;
832 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY_EVPD))
833 		quirks |= NO_INQUIRY_EVPD;
834 	if (usb_test_quirk(uaa, UQ_MSC_NO_SYNC_CACHE))
835 		quirks |= NO_SYNCHRONIZE_CACHE;
836 	if (usb_test_quirk(uaa, UQ_MSC_SHUTTLE_INIT))
837 		quirks |= SHUTTLE_INIT;
838 	if (usb_test_quirk(uaa, UQ_MSC_ALT_IFACE_1))
839 		quirks |= ALT_IFACE_1;
840 	if (usb_test_quirk(uaa, UQ_MSC_FLOPPY_SPEED))
841 		quirks |= FLOPPY_SPEED;
842 	if (usb_test_quirk(uaa, UQ_MSC_IGNORE_RESIDUE))
843 		quirks |= IGNORE_RESIDUE;
844 	if (usb_test_quirk(uaa, UQ_MSC_WRONG_CSWSIG))
845 		quirks |= WRONG_CSWSIG;
846 	if (usb_test_quirk(uaa, UQ_MSC_RBC_PAD_TO_12))
847 		quirks |= RBC_PAD_TO_12;
848 	if (usb_test_quirk(uaa, UQ_MSC_READ_CAP_OFFBY1))
849 		quirks |= READ_CAPACITY_OFFBY1;
850 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_SHORT_INQ))
851 		quirks |= FORCE_SHORT_INQUIRY;
852 
853 done:
854 	ret.quirks = quirks;
855 	ret.proto = proto;
856 	return (ret);
857 }
858 
859 static int
860 umass_probe(device_t dev)
861 {
862 	struct usb_attach_arg *uaa = device_get_ivars(dev);
863 	struct umass_probe_proto temp;
864 
865 	if (uaa->usb_mode != USB_MODE_HOST) {
866 		return (ENXIO);
867 	}
868 	temp = umass_probe_proto(dev, uaa);
869 
870 	return (temp.error);
871 }
872 
873 static int
874 umass_attach(device_t dev)
875 {
876 	struct umass_softc *sc = device_get_softc(dev);
877 	struct usb_attach_arg *uaa = device_get_ivars(dev);
878 	struct umass_probe_proto temp = umass_probe_proto(dev, uaa);
879 	struct usb_interface_descriptor *id;
880 	int32_t err;
881 
882 	/*
883 	 * NOTE: the softc struct is cleared in device_set_driver.
884 	 * We can safely call umass_detach without specifically
885 	 * initializing the struct.
886 	 */
887 
888 	sc->sc_dev = dev;
889 	sc->sc_udev = uaa->device;
890 	sc->sc_proto = temp.proto;
891 	sc->sc_quirks = temp.quirks;
892 	sc->sc_unit = device_get_unit(dev);
893 
894 	snprintf(sc->sc_name, sizeof(sc->sc_name),
895 	    "%s", device_get_nameunit(dev));
896 
897 	device_set_usb_desc(dev);
898 
899         mtx_init(&sc->sc_mtx, device_get_nameunit(dev),
900 	    NULL, MTX_DEF | MTX_RECURSE);
901 
902 	/* get interface index */
903 
904 	id = usbd_get_interface_descriptor(uaa->iface);
905 	if (id == NULL) {
906 		device_printf(dev, "failed to get "
907 		    "interface number\n");
908 		goto detach;
909 	}
910 	sc->sc_iface_no = id->bInterfaceNumber;
911 
912 #ifdef USB_DEBUG
913 	device_printf(dev, " ");
914 
915 	switch (sc->sc_proto & UMASS_PROTO_COMMAND) {
916 	case UMASS_PROTO_SCSI:
917 		printf("SCSI");
918 		break;
919 	case UMASS_PROTO_ATAPI:
920 		printf("8070i (ATAPI)");
921 		break;
922 	case UMASS_PROTO_UFI:
923 		printf("UFI");
924 		break;
925 	case UMASS_PROTO_RBC:
926 		printf("RBC");
927 		break;
928 	default:
929 		printf("(unknown 0x%02x)",
930 		    sc->sc_proto & UMASS_PROTO_COMMAND);
931 		break;
932 	}
933 
934 	printf(" over ");
935 
936 	switch (sc->sc_proto & UMASS_PROTO_WIRE) {
937 	case UMASS_PROTO_BBB:
938 		printf("Bulk-Only");
939 		break;
940 	case UMASS_PROTO_CBI:		/* uses Comand/Bulk pipes */
941 		printf("CBI");
942 		break;
943 	case UMASS_PROTO_CBI_I:	/* uses Comand/Bulk/Interrupt pipes */
944 		printf("CBI with CCI");
945 		break;
946 	default:
947 		printf("(unknown 0x%02x)",
948 		    sc->sc_proto & UMASS_PROTO_WIRE);
949 	}
950 
951 	printf("; quirks = 0x%04x\n", sc->sc_quirks);
952 #endif
953 
954 	if (sc->sc_quirks & ALT_IFACE_1) {
955 		err = usbd_set_alt_interface_index
956 		    (uaa->device, uaa->info.bIfaceIndex, 1);
957 
958 		if (err) {
959 			DPRINTF(sc, UDMASS_USB, "could not switch to "
960 			    "Alt Interface 1\n");
961 			goto detach;
962 		}
963 	}
964 	/* allocate all required USB transfers */
965 
966 	if (sc->sc_proto & UMASS_PROTO_BBB) {
967 
968 		err = usbd_transfer_setup(uaa->device,
969 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_bbb_config,
970 		    UMASS_T_BBB_MAX, sc, &sc->sc_mtx);
971 
972 		/* skip reset first time */
973 		sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
974 
975 	} else if (sc->sc_proto & (UMASS_PROTO_CBI | UMASS_PROTO_CBI_I)) {
976 
977 		err = usbd_transfer_setup(uaa->device,
978 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_cbi_config,
979 		    UMASS_T_CBI_MAX, sc, &sc->sc_mtx);
980 
981 		/* skip reset first time */
982 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
983 
984 	} else {
985 		err = USB_ERR_INVAL;
986 	}
987 
988 	if (err) {
989 		device_printf(dev, "could not setup required "
990 		    "transfers, %s\n", usbd_errstr(err));
991 		goto detach;
992 	}
993 	sc->sc_transform =
994 	    (sc->sc_proto & UMASS_PROTO_SCSI) ? &umass_scsi_transform :
995 	    (sc->sc_proto & UMASS_PROTO_UFI) ? &umass_ufi_transform :
996 	    (sc->sc_proto & UMASS_PROTO_ATAPI) ? &umass_atapi_transform :
997 	    (sc->sc_proto & UMASS_PROTO_RBC) ? &umass_rbc_transform :
998 	    &umass_no_transform;
999 
1000 	/* from here onwards the device can be used. */
1001 
1002 	if (sc->sc_quirks & SHUTTLE_INIT) {
1003 		umass_init_shuttle(sc);
1004 	}
1005 	/* get the maximum LUN supported by the device */
1006 
1007 	if (((sc->sc_proto & UMASS_PROTO_WIRE) == UMASS_PROTO_BBB) &&
1008 	    !(sc->sc_quirks & NO_GETMAXLUN))
1009 		sc->sc_maxlun = umass_bbb_get_max_lun(sc);
1010 	else
1011 		sc->sc_maxlun = 0;
1012 
1013 	/* Prepare the SCSI command block */
1014 	sc->cam_scsi_sense.opcode = REQUEST_SENSE;
1015 	sc->cam_scsi_test_unit_ready.opcode = TEST_UNIT_READY;
1016 
1017 	/* register the SIM */
1018 	err = umass_cam_attach_sim(sc);
1019 	if (err) {
1020 		goto detach;
1021 	}
1022 	/* scan the SIM */
1023 	umass_cam_attach(sc);
1024 
1025 	DPRINTF(sc, UDMASS_GEN, "Attach finished\n");
1026 
1027 	return (0);			/* success */
1028 
1029 detach:
1030 	umass_detach(dev);
1031 	return (ENXIO);			/* failure */
1032 }
1033 
1034 static int
1035 umass_detach(device_t dev)
1036 {
1037 	struct umass_softc *sc = device_get_softc(dev);
1038 
1039 	DPRINTF(sc, UDMASS_USB, "\n");
1040 
1041 	/* teardown our statemachine */
1042 
1043 	usbd_transfer_unsetup(sc->sc_xfer, UMASS_T_MAX);
1044 
1045 	mtx_lock(&sc->sc_mtx);
1046 
1047 	/* cancel any leftover CCB's */
1048 
1049 	umass_cancel_ccb(sc);
1050 
1051 	umass_cam_detach_sim(sc);
1052 
1053 	mtx_unlock(&sc->sc_mtx);
1054 
1055 	mtx_destroy(&sc->sc_mtx);
1056 
1057 	return (0);			/* success */
1058 }
1059 
1060 static void
1061 umass_init_shuttle(struct umass_softc *sc)
1062 {
1063 	struct usb_device_request req;
1064 	usb_error_t err;
1065 	uint8_t status[2] = {0, 0};
1066 
1067 	/*
1068 	 * The Linux driver does this, but no one can tell us what the
1069 	 * command does.
1070 	 */
1071 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1072 	req.bRequest = 1;		/* XXX unknown command */
1073 	USETW(req.wValue, 0);
1074 	req.wIndex[0] = sc->sc_iface_no;
1075 	req.wIndex[1] = 0;
1076 	USETW(req.wLength, sizeof(status));
1077 	err = usbd_do_request(sc->sc_udev, NULL, &req, &status);
1078 
1079 	DPRINTF(sc, UDMASS_GEN, "Shuttle init returned 0x%02x%02x\n",
1080 	    status[0], status[1]);
1081 }
1082 
1083 /*
1084  * Generic functions to handle transfers
1085  */
1086 
1087 static void
1088 umass_transfer_start(struct umass_softc *sc, uint8_t xfer_index)
1089 {
1090 	DPRINTF(sc, UDMASS_GEN, "transfer index = "
1091 	    "%d\n", xfer_index);
1092 
1093 	if (sc->sc_xfer[xfer_index]) {
1094 		sc->sc_last_xfer_index = xfer_index;
1095 		usbd_transfer_start(sc->sc_xfer[xfer_index]);
1096 	} else {
1097 		umass_cancel_ccb(sc);
1098 	}
1099 }
1100 
1101 static void
1102 umass_reset(struct umass_softc *sc)
1103 {
1104 	DPRINTF(sc, UDMASS_GEN, "resetting device\n");
1105 
1106 	/*
1107 	 * stop the last transfer, if not already stopped:
1108 	 */
1109 	usbd_transfer_stop(sc->sc_xfer[sc->sc_last_xfer_index]);
1110 	umass_transfer_start(sc, 0);
1111 }
1112 
1113 static void
1114 umass_cancel_ccb(struct umass_softc *sc)
1115 {
1116 	union ccb *ccb;
1117 
1118 	mtx_assert(&sc->sc_mtx, MA_OWNED);
1119 
1120 	ccb = sc->sc_transfer.ccb;
1121 	sc->sc_transfer.ccb = NULL;
1122 	sc->sc_last_xfer_index = 0;
1123 
1124 	if (ccb) {
1125 		(sc->sc_transfer.callback)
1126 		    (sc, ccb, (sc->sc_transfer.data_len -
1127 		    sc->sc_transfer.actlen), STATUS_WIRE_FAILED);
1128 	}
1129 }
1130 
1131 static void
1132 umass_tr_error(struct usb_xfer *xfer, usb_error_t error)
1133 {
1134 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1135 
1136 	if (error != USB_ERR_CANCELLED) {
1137 
1138 		DPRINTF(sc, UDMASS_GEN, "transfer error, %s -> "
1139 		    "reset\n", usbd_errstr(error));
1140 	}
1141 	umass_cancel_ccb(sc);
1142 }
1143 
1144 /*
1145  * BBB protocol specific functions
1146  */
1147 
1148 static void
1149 umass_t_bbb_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1150 {
1151 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1152 	struct usb_device_request req;
1153 	struct usb_page_cache *pc;
1154 
1155 	switch (USB_GET_STATE(xfer)) {
1156 	case USB_ST_TRANSFERRED:
1157 		umass_transfer_start(sc, UMASS_T_BBB_RESET2);
1158 		return;
1159 
1160 	case USB_ST_SETUP:
1161 		/*
1162 		 * Reset recovery (5.3.4 in Universal Serial Bus Mass Storage Class)
1163 		 *
1164 		 * For Reset Recovery the host shall issue in the following order:
1165 		 * a) a Bulk-Only Mass Storage Reset
1166 		 * b) a Clear Feature HALT to the Bulk-In endpoint
1167 		 * c) a Clear Feature HALT to the Bulk-Out endpoint
1168 		 *
1169 		 * This is done in 3 steps, using 3 transfers:
1170 		 * UMASS_T_BBB_RESET1
1171 		 * UMASS_T_BBB_RESET2
1172 		 * UMASS_T_BBB_RESET3
1173 		 */
1174 
1175 		DPRINTF(sc, UDMASS_BBB, "BBB reset!\n");
1176 
1177 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1178 		req.bRequest = UR_BBB_RESET;	/* bulk only reset */
1179 		USETW(req.wValue, 0);
1180 		req.wIndex[0] = sc->sc_iface_no;
1181 		req.wIndex[1] = 0;
1182 		USETW(req.wLength, 0);
1183 
1184 		pc = usbd_xfer_get_frame(xfer, 0);
1185 		usbd_copy_in(pc, 0, &req, sizeof(req));
1186 
1187 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1188 		usbd_xfer_set_frames(xfer, 1);
1189 		usbd_transfer_submit(xfer);
1190 		return;
1191 
1192 	default:			/* Error */
1193 		umass_tr_error(xfer, error);
1194 		return;
1195 	}
1196 }
1197 
1198 static void
1199 umass_t_bbb_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1200 {
1201 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_RESET3,
1202 	    UMASS_T_BBB_DATA_READ, error);
1203 }
1204 
1205 static void
1206 umass_t_bbb_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1207 {
1208 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_COMMAND,
1209 	    UMASS_T_BBB_DATA_WRITE, error);
1210 }
1211 
1212 static void
1213 umass_t_bbb_data_clear_stall_callback(struct usb_xfer *xfer,
1214     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1215 {
1216 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1217 
1218 	switch (USB_GET_STATE(xfer)) {
1219 	case USB_ST_TRANSFERRED:
1220 tr_transferred:
1221 		umass_transfer_start(sc, next_xfer);
1222 		return;
1223 
1224 	case USB_ST_SETUP:
1225 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1226 			goto tr_transferred;
1227 		}
1228 		return;
1229 
1230 	default:			/* Error */
1231 		umass_tr_error(xfer, error);
1232 		return;
1233 	}
1234 }
1235 
1236 static void
1237 umass_t_bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
1238 {
1239 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1240 	union ccb *ccb = sc->sc_transfer.ccb;
1241 	struct usb_page_cache *pc;
1242 	uint32_t tag;
1243 
1244 	switch (USB_GET_STATE(xfer)) {
1245 	case USB_ST_TRANSFERRED:
1246 		umass_transfer_start
1247 		    (sc, ((sc->sc_transfer.dir == DIR_IN) ? UMASS_T_BBB_DATA_READ :
1248 		    (sc->sc_transfer.dir == DIR_OUT) ? UMASS_T_BBB_DATA_WRITE :
1249 		    UMASS_T_BBB_STATUS));
1250 		return;
1251 
1252 	case USB_ST_SETUP:
1253 
1254 		sc->sc_status_try = 0;
1255 
1256 		if (ccb) {
1257 
1258 			/*
1259 		         * the initial value is not important,
1260 		         * as long as the values are unique:
1261 		         */
1262 			tag = UGETDW(sc->cbw.dCBWTag) + 1;
1263 
1264 			USETDW(sc->cbw.dCBWSignature, CBWSIGNATURE);
1265 			USETDW(sc->cbw.dCBWTag, tag);
1266 
1267 			/*
1268 		         * dCBWDataTransferLength:
1269 		         *   This field indicates the number of bytes of data that the host
1270 		         *   intends to transfer on the IN or OUT Bulk endpoint(as indicated by
1271 		         *   the Direction bit) during the execution of this command. If this
1272 		         *   field is set to 0, the device will expect that no data will be
1273 		         *   transferred IN or OUT during this command, regardless of the value
1274 		         *   of the Direction bit defined in dCBWFlags.
1275 		         */
1276 			USETDW(sc->cbw.dCBWDataTransferLength, sc->sc_transfer.data_len);
1277 
1278 			/*
1279 		         * dCBWFlags:
1280 		         *   The bits of the Flags field are defined as follows:
1281 		         *     Bits 0-6  reserved
1282 		         *     Bit  7    Direction - this bit shall be ignored if the
1283 		         *                           dCBWDataTransferLength field is zero.
1284 		         *               0 = data Out from host to device
1285 		         *               1 = data In from device to host
1286 		         */
1287 			sc->cbw.bCBWFlags = ((sc->sc_transfer.dir == DIR_IN) ?
1288 			    CBWFLAGS_IN : CBWFLAGS_OUT);
1289 			sc->cbw.bCBWLUN = sc->sc_transfer.lun;
1290 
1291 			if (sc->sc_transfer.cmd_len > sizeof(sc->cbw.CBWCDB)) {
1292 				sc->sc_transfer.cmd_len = sizeof(sc->cbw.CBWCDB);
1293 				DPRINTF(sc, UDMASS_BBB, "Truncating long command!\n");
1294 			}
1295 			sc->cbw.bCDBLength = sc->sc_transfer.cmd_len;
1296 
1297 			memcpy(sc->cbw.CBWCDB, sc->sc_transfer.cmd_data,
1298 			    sc->sc_transfer.cmd_len);
1299 
1300 			memset(sc->sc_transfer.cmd_data +
1301 			    sc->sc_transfer.cmd_len, 0,
1302 			    sizeof(sc->cbw.CBWCDB) -
1303 			    sc->sc_transfer.cmd_len);
1304 
1305 			DIF(UDMASS_BBB, umass_bbb_dump_cbw(sc, &sc->cbw));
1306 
1307 			pc = usbd_xfer_get_frame(xfer, 0);
1308 			usbd_copy_in(pc, 0, &sc->cbw, sizeof(sc->cbw));
1309 			usbd_xfer_set_frame_len(xfer, 0, sizeof(sc->cbw));
1310 
1311 			usbd_transfer_submit(xfer);
1312 		}
1313 		return;
1314 
1315 	default:			/* Error */
1316 		umass_tr_error(xfer, error);
1317 		return;
1318 	}
1319 }
1320 
1321 static void
1322 umass_t_bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1323 {
1324 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1325 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1326 	int actlen, sumlen;
1327 
1328 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1329 
1330 	switch (USB_GET_STATE(xfer)) {
1331 	case USB_ST_TRANSFERRED:
1332 		sc->sc_transfer.data_rem -= actlen;
1333 		sc->sc_transfer.data_ptr += actlen;
1334 		sc->sc_transfer.actlen += actlen;
1335 
1336 		if (actlen < sumlen) {
1337 			/* short transfer */
1338 			sc->sc_transfer.data_rem = 0;
1339 		}
1340 	case USB_ST_SETUP:
1341 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1342 		    max_bulk, sc->sc_transfer.data_rem);
1343 
1344 		if (sc->sc_transfer.data_rem == 0) {
1345 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1346 			return;
1347 		}
1348 		if (max_bulk > sc->sc_transfer.data_rem) {
1349 			max_bulk = sc->sc_transfer.data_rem;
1350 		}
1351 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1352 
1353 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1354 		    max_bulk);
1355 
1356 		usbd_transfer_submit(xfer);
1357 		return;
1358 
1359 	default:			/* Error */
1360 		if (error == USB_ERR_CANCELLED) {
1361 			umass_tr_error(xfer, error);
1362 		} else {
1363 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1364 		}
1365 		return;
1366 	}
1367 }
1368 
1369 static void
1370 umass_t_bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1371 {
1372 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1373 	    UMASS_T_BBB_DATA_READ, error);
1374 }
1375 
1376 static void
1377 umass_t_bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1378 {
1379 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1380 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1381 	int actlen, sumlen;
1382 
1383 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1384 
1385 	switch (USB_GET_STATE(xfer)) {
1386 	case USB_ST_TRANSFERRED:
1387 		sc->sc_transfer.data_rem -= actlen;
1388 		sc->sc_transfer.data_ptr += actlen;
1389 		sc->sc_transfer.actlen += actlen;
1390 
1391 		if (actlen < sumlen) {
1392 			/* short transfer */
1393 			sc->sc_transfer.data_rem = 0;
1394 		}
1395 	case USB_ST_SETUP:
1396 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1397 		    max_bulk, sc->sc_transfer.data_rem);
1398 
1399 		if (sc->sc_transfer.data_rem == 0) {
1400 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1401 			return;
1402 		}
1403 		if (max_bulk > sc->sc_transfer.data_rem) {
1404 			max_bulk = sc->sc_transfer.data_rem;
1405 		}
1406 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1407 
1408 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1409 		    max_bulk);
1410 
1411 		usbd_transfer_submit(xfer);
1412 		return;
1413 
1414 	default:			/* Error */
1415 		if (error == USB_ERR_CANCELLED) {
1416 			umass_tr_error(xfer, error);
1417 		} else {
1418 			umass_transfer_start(sc, UMASS_T_BBB_DATA_WR_CS);
1419 		}
1420 		return;
1421 	}
1422 }
1423 
1424 static void
1425 umass_t_bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1426 {
1427 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1428 	    UMASS_T_BBB_DATA_WRITE, error);
1429 }
1430 
1431 static void
1432 umass_t_bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
1433 {
1434 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1435 	union ccb *ccb = sc->sc_transfer.ccb;
1436 	struct usb_page_cache *pc;
1437 	uint32_t residue;
1438 	int actlen;
1439 
1440 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1441 
1442 	switch (USB_GET_STATE(xfer)) {
1443 	case USB_ST_TRANSFERRED:
1444 
1445 		/*
1446 		 * Do a full reset if there is something wrong with the CSW:
1447 		 */
1448 		sc->sc_status_try = 1;
1449 
1450 		/* Zero missing parts of the CSW: */
1451 
1452 		if (actlen < (int)sizeof(sc->csw))
1453 			memset(&sc->csw, 0, sizeof(sc->csw));
1454 
1455 		pc = usbd_xfer_get_frame(xfer, 0);
1456 		usbd_copy_out(pc, 0, &sc->csw, actlen);
1457 
1458 		DIF(UDMASS_BBB, umass_bbb_dump_csw(sc, &sc->csw));
1459 
1460 		residue = UGETDW(sc->csw.dCSWDataResidue);
1461 
1462 		if ((!residue) || (sc->sc_quirks & IGNORE_RESIDUE)) {
1463 			residue = (sc->sc_transfer.data_len -
1464 			    sc->sc_transfer.actlen);
1465 		}
1466 		if (residue > sc->sc_transfer.data_len) {
1467 			DPRINTF(sc, UDMASS_BBB, "truncating residue from %d "
1468 			    "to %d bytes\n", residue, sc->sc_transfer.data_len);
1469 			residue = sc->sc_transfer.data_len;
1470 		}
1471 		/* translate weird command-status signatures: */
1472 		if (sc->sc_quirks & WRONG_CSWSIG) {
1473 
1474 			uint32_t temp = UGETDW(sc->csw.dCSWSignature);
1475 
1476 			if ((temp == CSWSIGNATURE_OLYMPUS_C1) ||
1477 			    (temp == CSWSIGNATURE_IMAGINATION_DBX1)) {
1478 				USETDW(sc->csw.dCSWSignature, CSWSIGNATURE);
1479 			}
1480 		}
1481 		/* check CSW and handle eventual error */
1482 		if (UGETDW(sc->csw.dCSWSignature) != CSWSIGNATURE) {
1483 			DPRINTF(sc, UDMASS_BBB, "bad CSW signature 0x%08x != 0x%08x\n",
1484 			    UGETDW(sc->csw.dCSWSignature), CSWSIGNATURE);
1485 			/*
1486 			 * Invalid CSW: Wrong signature or wrong tag might
1487 			 * indicate that we lost synchronization. Reset the
1488 			 * device.
1489 			 */
1490 			goto tr_error;
1491 		} else if (UGETDW(sc->csw.dCSWTag) != UGETDW(sc->cbw.dCBWTag)) {
1492 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: tag 0x%08x should be "
1493 			    "0x%08x\n", UGETDW(sc->csw.dCSWTag),
1494 			    UGETDW(sc->cbw.dCBWTag));
1495 			goto tr_error;
1496 		} else if (sc->csw.bCSWStatus > CSWSTATUS_PHASE) {
1497 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: status %d > %d\n",
1498 			    sc->csw.bCSWStatus, CSWSTATUS_PHASE);
1499 			goto tr_error;
1500 		} else if (sc->csw.bCSWStatus == CSWSTATUS_PHASE) {
1501 			DPRINTF(sc, UDMASS_BBB, "Phase error, residue = "
1502 			    "%d\n", residue);
1503 			goto tr_error;
1504 		} else if (sc->sc_transfer.actlen > sc->sc_transfer.data_len) {
1505 			DPRINTF(sc, UDMASS_BBB, "Buffer overrun %d > %d\n",
1506 			    sc->sc_transfer.actlen, sc->sc_transfer.data_len);
1507 			goto tr_error;
1508 		} else if (sc->csw.bCSWStatus == CSWSTATUS_FAILED) {
1509 			DPRINTF(sc, UDMASS_BBB, "Command failed, residue = "
1510 			    "%d\n", residue);
1511 
1512 			sc->sc_transfer.ccb = NULL;
1513 
1514 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1515 
1516 			(sc->sc_transfer.callback)
1517 			    (sc, ccb, residue, STATUS_CMD_FAILED);
1518 		} else {
1519 			sc->sc_transfer.ccb = NULL;
1520 
1521 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1522 
1523 			(sc->sc_transfer.callback)
1524 			    (sc, ccb, residue, STATUS_CMD_OK);
1525 		}
1526 		return;
1527 
1528 	case USB_ST_SETUP:
1529 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1530 		usbd_transfer_submit(xfer);
1531 		return;
1532 
1533 	default:
1534 tr_error:
1535 		DPRINTF(sc, UDMASS_BBB, "Failed to read CSW: %s, try %d\n",
1536 		    usbd_errstr(error), sc->sc_status_try);
1537 
1538 		if ((error == USB_ERR_CANCELLED) ||
1539 		    (sc->sc_status_try)) {
1540 			umass_tr_error(xfer, error);
1541 		} else {
1542 			sc->sc_status_try = 1;
1543 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1544 		}
1545 		return;
1546 	}
1547 }
1548 
1549 static void
1550 umass_command_start(struct umass_softc *sc, uint8_t dir,
1551     void *data_ptr, uint32_t data_len,
1552     uint32_t data_timeout, umass_callback_t *callback,
1553     union ccb *ccb)
1554 {
1555 	sc->sc_transfer.lun = ccb->ccb_h.target_lun;
1556 
1557 	/*
1558 	 * NOTE: assumes that "sc->sc_transfer.cmd_data" and
1559 	 * "sc->sc_transfer.cmd_len" has been properly
1560 	 * initialized.
1561 	 */
1562 
1563 	sc->sc_transfer.dir = data_len ? dir : DIR_NONE;
1564 	sc->sc_transfer.data_ptr = data_ptr;
1565 	sc->sc_transfer.data_len = data_len;
1566 	sc->sc_transfer.data_rem = data_len;
1567 	sc->sc_transfer.data_timeout = (data_timeout + UMASS_TIMEOUT);
1568 
1569 	sc->sc_transfer.actlen = 0;
1570 	sc->sc_transfer.callback = callback;
1571 	sc->sc_transfer.ccb = ccb;
1572 
1573 	if (sc->sc_xfer[sc->sc_last_xfer_index]) {
1574 		usbd_transfer_start(sc->sc_xfer[sc->sc_last_xfer_index]);
1575 	} else {
1576 		umass_cancel_ccb(sc);
1577 	}
1578 }
1579 
1580 static uint8_t
1581 umass_bbb_get_max_lun(struct umass_softc *sc)
1582 {
1583 	struct usb_device_request req;
1584 	usb_error_t err;
1585 	uint8_t buf = 0;
1586 
1587 	/* The Get Max Lun command is a class-specific request. */
1588 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
1589 	req.bRequest = UR_BBB_GET_MAX_LUN;
1590 	USETW(req.wValue, 0);
1591 	req.wIndex[0] = sc->sc_iface_no;
1592 	req.wIndex[1] = 0;
1593 	USETW(req.wLength, 1);
1594 
1595 	err = usbd_do_request(sc->sc_udev, NULL, &req, &buf);
1596 	if (err) {
1597 		buf = 0;
1598 
1599 		/* Device doesn't support Get Max Lun request. */
1600 		printf("%s: Get Max Lun not supported (%s)\n",
1601 		    sc->sc_name, usbd_errstr(err));
1602 	}
1603 	return (buf);
1604 }
1605 
1606 /*
1607  * Command/Bulk/Interrupt (CBI) specific functions
1608  */
1609 
1610 static void
1611 umass_cbi_start_status(struct umass_softc *sc)
1612 {
1613 	if (sc->sc_xfer[UMASS_T_CBI_STATUS]) {
1614 		umass_transfer_start(sc, UMASS_T_CBI_STATUS);
1615 	} else {
1616 		union ccb *ccb = sc->sc_transfer.ccb;
1617 
1618 		sc->sc_transfer.ccb = NULL;
1619 
1620 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1621 
1622 		(sc->sc_transfer.callback)
1623 		    (sc, ccb, (sc->sc_transfer.data_len -
1624 		    sc->sc_transfer.actlen), STATUS_CMD_UNKNOWN);
1625 	}
1626 }
1627 
1628 static void
1629 umass_t_cbi_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1630 {
1631 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1632 	struct usb_device_request req;
1633 	struct usb_page_cache *pc;
1634 	uint8_t buf[UMASS_CBI_DIAGNOSTIC_CMDLEN];
1635 
1636 	uint8_t i;
1637 
1638 	switch (USB_GET_STATE(xfer)) {
1639 	case USB_ST_TRANSFERRED:
1640 		umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1641 		break;
1642 
1643 	case USB_ST_SETUP:
1644 		/*
1645 		 * Command Block Reset Protocol
1646 		 *
1647 		 * First send a reset request to the device. Then clear
1648 		 * any possibly stalled bulk endpoints.
1649 		 *
1650 		 * This is done in 3 steps, using 3 transfers:
1651 		 * UMASS_T_CBI_RESET1
1652 		 * UMASS_T_CBI_RESET2
1653 		 * UMASS_T_CBI_RESET3
1654 		 * UMASS_T_CBI_RESET4 (only if there is an interrupt endpoint)
1655 		 */
1656 
1657 		DPRINTF(sc, UDMASS_CBI, "CBI reset!\n");
1658 
1659 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1660 		req.bRequest = UR_CBI_ADSC;
1661 		USETW(req.wValue, 0);
1662 		req.wIndex[0] = sc->sc_iface_no;
1663 		req.wIndex[1] = 0;
1664 		USETW(req.wLength, UMASS_CBI_DIAGNOSTIC_CMDLEN);
1665 
1666 		/*
1667 		 * The 0x1d code is the SEND DIAGNOSTIC command. To
1668 		 * distinguish between the two, the last 10 bytes of the CBL
1669 		 * is filled with 0xff (section 2.2 of the CBI
1670 		 * specification)
1671 		 */
1672 		buf[0] = 0x1d;		/* Command Block Reset */
1673 		buf[1] = 0x04;
1674 
1675 		for (i = 2; i < UMASS_CBI_DIAGNOSTIC_CMDLEN; i++) {
1676 			buf[i] = 0xff;
1677 		}
1678 
1679 		pc = usbd_xfer_get_frame(xfer, 0);
1680 		usbd_copy_in(pc, 0, &req, sizeof(req));
1681 		pc = usbd_xfer_get_frame(xfer, 1);
1682 		usbd_copy_in(pc, 0, buf, sizeof(buf));
1683 
1684 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1685 		usbd_xfer_set_frame_len(xfer, 1, sizeof(buf));
1686 		usbd_xfer_set_frames(xfer, 2);
1687 		usbd_transfer_submit(xfer);
1688 		break;
1689 
1690 	default:			/* Error */
1691 		if (error == USB_ERR_CANCELLED)
1692 			umass_tr_error(xfer, error);
1693 		else
1694 			umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1695 		break;
1696 	}
1697 }
1698 
1699 static void
1700 umass_t_cbi_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1701 {
1702 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_RESET3,
1703 	    UMASS_T_CBI_DATA_READ, error);
1704 }
1705 
1706 static void
1707 umass_t_cbi_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1708 {
1709 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1710 
1711 	umass_t_cbi_data_clear_stall_callback
1712 	    (xfer, (sc->sc_xfer[UMASS_T_CBI_RESET4] &&
1713 	    sc->sc_xfer[UMASS_T_CBI_STATUS]) ?
1714 	    UMASS_T_CBI_RESET4 : UMASS_T_CBI_COMMAND,
1715 	    UMASS_T_CBI_DATA_WRITE, error);
1716 }
1717 
1718 static void
1719 umass_t_cbi_reset4_callback(struct usb_xfer *xfer, usb_error_t error)
1720 {
1721 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_COMMAND,
1722 	    UMASS_T_CBI_STATUS, error);
1723 }
1724 
1725 static void
1726 umass_t_cbi_data_clear_stall_callback(struct usb_xfer *xfer,
1727     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1728 {
1729 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1730 
1731 	switch (USB_GET_STATE(xfer)) {
1732 	case USB_ST_TRANSFERRED:
1733 tr_transferred:
1734 		if (next_xfer == UMASS_T_CBI_STATUS) {
1735 			umass_cbi_start_status(sc);
1736 		} else {
1737 			umass_transfer_start(sc, next_xfer);
1738 		}
1739 		break;
1740 
1741 	case USB_ST_SETUP:
1742 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1743 			goto tr_transferred;	/* should not happen */
1744 		}
1745 		break;
1746 
1747 	default:			/* Error */
1748 		umass_tr_error(xfer, error);
1749 		break;
1750 	}
1751 }
1752 
1753 static void
1754 umass_t_cbi_command_callback(struct usb_xfer *xfer, usb_error_t error)
1755 {
1756 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1757 	union ccb *ccb = sc->sc_transfer.ccb;
1758 	struct usb_device_request req;
1759 	struct usb_page_cache *pc;
1760 
1761 	switch (USB_GET_STATE(xfer)) {
1762 	case USB_ST_TRANSFERRED:
1763 
1764 		if (sc->sc_transfer.dir == DIR_NONE) {
1765 			umass_cbi_start_status(sc);
1766 		} else {
1767 			umass_transfer_start
1768 			    (sc, (sc->sc_transfer.dir == DIR_IN) ?
1769 			    UMASS_T_CBI_DATA_READ : UMASS_T_CBI_DATA_WRITE);
1770 		}
1771 		break;
1772 
1773 	case USB_ST_SETUP:
1774 
1775 		if (ccb) {
1776 
1777 			/*
1778 		         * do a CBI transfer with cmd_len bytes from
1779 		         * cmd_data, possibly a data phase of data_len
1780 		         * bytes from/to the device and finally a status
1781 		         * read phase.
1782 		         */
1783 
1784 			req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1785 			req.bRequest = UR_CBI_ADSC;
1786 			USETW(req.wValue, 0);
1787 			req.wIndex[0] = sc->sc_iface_no;
1788 			req.wIndex[1] = 0;
1789 			req.wLength[0] = sc->sc_transfer.cmd_len;
1790 			req.wLength[1] = 0;
1791 
1792 			pc = usbd_xfer_get_frame(xfer, 0);
1793 			usbd_copy_in(pc, 0, &req, sizeof(req));
1794 			pc = usbd_xfer_get_frame(xfer, 1);
1795 			usbd_copy_in(pc, 0, sc->sc_transfer.cmd_data,
1796 			    sc->sc_transfer.cmd_len);
1797 
1798 			usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1799 			usbd_xfer_set_frame_len(xfer, 1, sc->sc_transfer.cmd_len);
1800 			usbd_xfer_set_frames(xfer,
1801 			    sc->sc_transfer.cmd_len ? 2 : 1);
1802 
1803 			DIF(UDMASS_CBI,
1804 			    umass_cbi_dump_cmd(sc,
1805 			    sc->sc_transfer.cmd_data,
1806 			    sc->sc_transfer.cmd_len));
1807 
1808 			usbd_transfer_submit(xfer);
1809 		}
1810 		break;
1811 
1812 	default:			/* Error */
1813 		/*
1814 		 * STALL on the control pipe can be result of the command error.
1815 		 * Attempt to clear this STALL same as for bulk pipe also
1816 		 * results in command completion interrupt, but ASC/ASCQ there
1817 		 * look like not always valid, so don't bother about it.
1818 		 */
1819 		if ((error == USB_ERR_STALLED) ||
1820 		    (sc->sc_transfer.callback == &umass_cam_cb)) {
1821 			sc->sc_transfer.ccb = NULL;
1822 			(sc->sc_transfer.callback)
1823 			    (sc, ccb, sc->sc_transfer.data_len,
1824 			    STATUS_CMD_UNKNOWN);
1825 		} else {
1826 			umass_tr_error(xfer, error);
1827 			/* skip reset */
1828 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1829 		}
1830 		break;
1831 	}
1832 }
1833 
1834 static void
1835 umass_t_cbi_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1836 {
1837 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1838 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1839 	int actlen, sumlen;
1840 
1841 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1842 
1843 	switch (USB_GET_STATE(xfer)) {
1844 	case USB_ST_TRANSFERRED:
1845 		sc->sc_transfer.data_rem -= actlen;
1846 		sc->sc_transfer.data_ptr += actlen;
1847 		sc->sc_transfer.actlen += actlen;
1848 
1849 		if (actlen < sumlen) {
1850 			/* short transfer */
1851 			sc->sc_transfer.data_rem = 0;
1852 		}
1853 	case USB_ST_SETUP:
1854 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1855 		    max_bulk, sc->sc_transfer.data_rem);
1856 
1857 		if (sc->sc_transfer.data_rem == 0) {
1858 			umass_cbi_start_status(sc);
1859 			break;
1860 		}
1861 		if (max_bulk > sc->sc_transfer.data_rem) {
1862 			max_bulk = sc->sc_transfer.data_rem;
1863 		}
1864 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1865 
1866 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1867 		    max_bulk);
1868 
1869 		usbd_transfer_submit(xfer);
1870 		break;
1871 
1872 	default:			/* Error */
1873 		if ((error == USB_ERR_CANCELLED) ||
1874 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1875 			umass_tr_error(xfer, error);
1876 		} else {
1877 			umass_transfer_start(sc, UMASS_T_CBI_DATA_RD_CS);
1878 		}
1879 		break;
1880 	}
1881 }
1882 
1883 static void
1884 umass_t_cbi_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1885 {
1886 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1887 	    UMASS_T_CBI_DATA_READ, error);
1888 }
1889 
1890 static void
1891 umass_t_cbi_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1892 {
1893 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1894 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1895 	int actlen, sumlen;
1896 
1897 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1898 
1899 	switch (USB_GET_STATE(xfer)) {
1900 	case USB_ST_TRANSFERRED:
1901 		sc->sc_transfer.data_rem -= actlen;
1902 		sc->sc_transfer.data_ptr += actlen;
1903 		sc->sc_transfer.actlen += actlen;
1904 
1905 		if (actlen < sumlen) {
1906 			/* short transfer */
1907 			sc->sc_transfer.data_rem = 0;
1908 		}
1909 	case USB_ST_SETUP:
1910 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1911 		    max_bulk, sc->sc_transfer.data_rem);
1912 
1913 		if (sc->sc_transfer.data_rem == 0) {
1914 			umass_cbi_start_status(sc);
1915 			break;
1916 		}
1917 		if (max_bulk > sc->sc_transfer.data_rem) {
1918 			max_bulk = sc->sc_transfer.data_rem;
1919 		}
1920 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1921 
1922 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1923 		    max_bulk);
1924 
1925 		usbd_transfer_submit(xfer);
1926 		break;
1927 
1928 	default:			/* Error */
1929 		if ((error == USB_ERR_CANCELLED) ||
1930 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1931 			umass_tr_error(xfer, error);
1932 		} else {
1933 			umass_transfer_start(sc, UMASS_T_CBI_DATA_WR_CS);
1934 		}
1935 		break;
1936 	}
1937 }
1938 
1939 static void
1940 umass_t_cbi_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1941 {
1942 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1943 	    UMASS_T_CBI_DATA_WRITE, error);
1944 }
1945 
1946 static void
1947 umass_t_cbi_status_callback(struct usb_xfer *xfer, usb_error_t error)
1948 {
1949 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1950 	union ccb *ccb = sc->sc_transfer.ccb;
1951 	struct usb_page_cache *pc;
1952 	uint32_t residue;
1953 	uint8_t status;
1954 	int actlen;
1955 
1956 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1957 
1958 	switch (USB_GET_STATE(xfer)) {
1959 	case USB_ST_TRANSFERRED:
1960 
1961 		if (actlen < (int)sizeof(sc->sbl)) {
1962 			goto tr_setup;
1963 		}
1964 		pc = usbd_xfer_get_frame(xfer, 0);
1965 		usbd_copy_out(pc, 0, &sc->sbl, sizeof(sc->sbl));
1966 
1967 		residue = (sc->sc_transfer.data_len -
1968 		    sc->sc_transfer.actlen);
1969 
1970 		/* dissect the information in the buffer */
1971 
1972 		if (sc->sc_proto & UMASS_PROTO_UFI) {
1973 
1974 			/*
1975 			 * Section 3.4.3.1.3 specifies that the UFI command
1976 			 * protocol returns an ASC and ASCQ in the interrupt
1977 			 * data block.
1978 			 */
1979 
1980 			DPRINTF(sc, UDMASS_CBI, "UFI CCI, ASC = 0x%02x, "
1981 			    "ASCQ = 0x%02x\n", sc->sbl.ufi.asc,
1982 			    sc->sbl.ufi.ascq);
1983 
1984 			status = (((sc->sbl.ufi.asc == 0) &&
1985 			    (sc->sbl.ufi.ascq == 0)) ?
1986 			    STATUS_CMD_OK : STATUS_CMD_FAILED);
1987 
1988 			sc->sc_transfer.ccb = NULL;
1989 
1990 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1991 
1992 			(sc->sc_transfer.callback)
1993 			    (sc, ccb, residue, status);
1994 
1995 			break;
1996 
1997 		} else {
1998 
1999 			/* Command Interrupt Data Block */
2000 
2001 			DPRINTF(sc, UDMASS_CBI, "type=0x%02x, value=0x%02x\n",
2002 			    sc->sbl.common.type, sc->sbl.common.value);
2003 
2004 			if (sc->sbl.common.type == IDB_TYPE_CCI) {
2005 
2006 				status = (sc->sbl.common.value & IDB_VALUE_STATUS_MASK);
2007 
2008 				status = ((status == IDB_VALUE_PASS) ? STATUS_CMD_OK :
2009 				    (status == IDB_VALUE_FAIL) ? STATUS_CMD_FAILED :
2010 				    (status == IDB_VALUE_PERSISTENT) ? STATUS_CMD_FAILED :
2011 				    STATUS_WIRE_FAILED);
2012 
2013 				sc->sc_transfer.ccb = NULL;
2014 
2015 				sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2016 
2017 				(sc->sc_transfer.callback)
2018 				    (sc, ccb, residue, status);
2019 
2020 				break;
2021 			}
2022 		}
2023 
2024 		/* fallthrough */
2025 
2026 	case USB_ST_SETUP:
2027 tr_setup:
2028 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2029 		usbd_transfer_submit(xfer);
2030 		break;
2031 
2032 	default:			/* Error */
2033 		DPRINTF(sc, UDMASS_CBI, "Failed to read CSW: %s\n",
2034 		    usbd_errstr(error));
2035 		umass_tr_error(xfer, error);
2036 		break;
2037 	}
2038 }
2039 
2040 /*
2041  * CAM specific functions (used by SCSI, UFI, 8070i (ATAPI))
2042  */
2043 
2044 static int
2045 umass_cam_attach_sim(struct umass_softc *sc)
2046 {
2047 	struct cam_devq *devq;		/* Per device Queue */
2048 
2049 	/*
2050 	 * A HBA is attached to the CAM layer.
2051 	 *
2052 	 * The CAM layer will then after a while start probing for devices on
2053 	 * the bus. The number of SIMs is limited to one.
2054 	 */
2055 
2056 	devq = cam_simq_alloc(1 /* maximum openings */ );
2057 	if (devq == NULL) {
2058 		return (ENOMEM);
2059 	}
2060 	sc->sc_sim = cam_sim_alloc
2061 	    (&umass_cam_action, &umass_cam_poll,
2062 	    DEVNAME_SIM,
2063 	    sc /* priv */ ,
2064 	    sc->sc_unit /* unit number */ ,
2065 	    &sc->sc_mtx /* mutex */ ,
2066 	    1 /* maximum device openings */ ,
2067 	    0 /* maximum tagged device openings */ ,
2068 	    devq);
2069 
2070 	if (sc->sc_sim == NULL) {
2071 		cam_simq_free(devq);
2072 		return (ENOMEM);
2073 	}
2074 
2075 	mtx_lock(&sc->sc_mtx);
2076 
2077 	if (xpt_bus_register(sc->sc_sim, sc->sc_dev,
2078 	    sc->sc_unit) != CAM_SUCCESS) {
2079 		mtx_unlock(&sc->sc_mtx);
2080 		return (ENOMEM);
2081 	}
2082 	mtx_unlock(&sc->sc_mtx);
2083 
2084 	return (0);
2085 }
2086 
2087 static void
2088 umass_cam_attach(struct umass_softc *sc)
2089 {
2090 #ifndef USB_DEBUG
2091 	if (bootverbose)
2092 #endif
2093 		printf("%s:%d:%d:%d: Attached to scbus%d\n",
2094 		    sc->sc_name, cam_sim_path(sc->sc_sim),
2095 		    sc->sc_unit, CAM_LUN_WILDCARD,
2096 		    cam_sim_path(sc->sc_sim));
2097 }
2098 
2099 /* umass_cam_detach
2100  *	detach from the CAM layer
2101  */
2102 
2103 static void
2104 umass_cam_detach_sim(struct umass_softc *sc)
2105 {
2106 	if (sc->sc_sim != NULL) {
2107 		if (xpt_bus_deregister(cam_sim_path(sc->sc_sim))) {
2108 			/* accessing the softc is not possible after this */
2109 			sc->sc_sim->softc = NULL;
2110 			cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2111 		} else {
2112 			panic("%s: CAM layer is busy\n",
2113 			    sc->sc_name);
2114 		}
2115 		sc->sc_sim = NULL;
2116 	}
2117 }
2118 
2119 /* umass_cam_action
2120  * 	CAM requests for action come through here
2121  */
2122 
2123 static void
2124 umass_cam_action(struct cam_sim *sim, union ccb *ccb)
2125 {
2126 	struct umass_softc *sc = (struct umass_softc *)sim->softc;
2127 
2128 	if (sc == NULL) {
2129 		ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2130 		xpt_done(ccb);
2131 		return;
2132 	}
2133 
2134 	/* Perform the requested action */
2135 	switch (ccb->ccb_h.func_code) {
2136 	case XPT_SCSI_IO:
2137 		{
2138 			uint8_t *cmd;
2139 			uint8_t dir;
2140 
2141 			if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2142 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2143 			} else {
2144 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2145 			}
2146 
2147 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2148 			    "cmd: 0x%02x, flags: 0x%02x, "
2149 			    "%db cmd/%db data/%db sense\n",
2150 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2151 			    ccb->ccb_h.target_lun, cmd[0],
2152 			    ccb->ccb_h.flags & CAM_DIR_MASK, ccb->csio.cdb_len,
2153 			    ccb->csio.dxfer_len, ccb->csio.sense_len);
2154 
2155 			if (sc->sc_transfer.ccb) {
2156 				DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2157 				    "I/O in progress, deferring\n",
2158 				    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2159 				    ccb->ccb_h.target_lun);
2160 				ccb->ccb_h.status = CAM_SCSI_BUSY;
2161 				xpt_done(ccb);
2162 				goto done;
2163 			}
2164 			switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
2165 			case CAM_DIR_IN:
2166 				dir = DIR_IN;
2167 				break;
2168 			case CAM_DIR_OUT:
2169 				dir = DIR_OUT;
2170 				DIF(UDMASS_SCSI,
2171 				    umass_dump_buffer(sc, ccb->csio.data_ptr,
2172 				    ccb->csio.dxfer_len, 48));
2173 				break;
2174 			default:
2175 				dir = DIR_NONE;
2176 			}
2177 
2178 			ccb->ccb_h.status = CAM_REQ_INPROG | CAM_SIM_QUEUED;
2179 
2180 			/*
2181 			 * sc->sc_transform will convert the command to the
2182 			 * command format needed by the specific command set
2183 			 * and return the converted command in
2184 			 * "sc->sc_transfer.cmd_data"
2185 			 */
2186 			if (umass_std_transform(sc, ccb, cmd, ccb->csio.cdb_len)) {
2187 
2188 				if (sc->sc_transfer.cmd_data[0] == INQUIRY) {
2189 					const char *pserial;
2190 
2191 					pserial = usb_get_serial(sc->sc_udev);
2192 
2193 					/*
2194 					 * Umass devices don't generally report their serial numbers
2195 					 * in the usual SCSI way.  Emulate it here.
2196 					 */
2197 					if ((sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2198 					    (sc->sc_transfer.cmd_data[2] == SVPD_UNIT_SERIAL_NUMBER) &&
2199 					    (pserial[0] != '\0')) {
2200 						struct scsi_vpd_unit_serial_number *vpd_serial;
2201 
2202 						vpd_serial = (struct scsi_vpd_unit_serial_number *)ccb->csio.data_ptr;
2203 						vpd_serial->length = strlen(pserial);
2204 						if (vpd_serial->length > sizeof(vpd_serial->serial_num))
2205 							vpd_serial->length = sizeof(vpd_serial->serial_num);
2206 						memcpy(vpd_serial->serial_num, pserial, vpd_serial->length);
2207 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2208 						ccb->ccb_h.status = CAM_REQ_CMP;
2209 						xpt_done(ccb);
2210 						goto done;
2211 					}
2212 
2213 					/*
2214 					 * Handle EVPD inquiry for broken devices first
2215 					 * NO_INQUIRY also implies NO_INQUIRY_EVPD
2216 					 */
2217 					if ((sc->sc_quirks & (NO_INQUIRY_EVPD | NO_INQUIRY)) &&
2218 					    (sc->sc_transfer.cmd_data[1] & SI_EVPD)) {
2219 
2220 						scsi_set_sense_data(&ccb->csio.sense_data,
2221 							/*sense_format*/ SSD_TYPE_NONE,
2222 							/*current_error*/ 1,
2223 							/*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2224 							/*asc*/ 0x24,
2225 							/*ascq*/ 0x00,
2226 							/*extra args*/ SSD_ELEM_NONE);
2227 						ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2228 						ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR |
2229 						    CAM_AUTOSNS_VALID;
2230 						xpt_done(ccb);
2231 						goto done;
2232 					}
2233 					/*
2234 					 * Return fake inquiry data for
2235 					 * broken devices
2236 					 */
2237 					if (sc->sc_quirks & NO_INQUIRY) {
2238 						memcpy(ccb->csio.data_ptr, &fake_inq_data,
2239 						    sizeof(fake_inq_data));
2240 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2241 						ccb->ccb_h.status = CAM_REQ_CMP;
2242 						xpt_done(ccb);
2243 						goto done;
2244 					}
2245 					if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2246 						ccb->csio.dxfer_len = SHORT_INQUIRY_LENGTH;
2247 					}
2248 				} else if (sc->sc_transfer.cmd_data[0] == SYNCHRONIZE_CACHE) {
2249 					if (sc->sc_quirks & NO_SYNCHRONIZE_CACHE) {
2250 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2251 						ccb->ccb_h.status = CAM_REQ_CMP;
2252 						xpt_done(ccb);
2253 						goto done;
2254 					}
2255 				}
2256 				umass_command_start(sc, dir, ccb->csio.data_ptr,
2257 				    ccb->csio.dxfer_len,
2258 				    ccb->ccb_h.timeout,
2259 				    &umass_cam_cb, ccb);
2260 			}
2261 			break;
2262 		}
2263 	case XPT_PATH_INQ:
2264 		{
2265 			struct ccb_pathinq *cpi = &ccb->cpi;
2266 
2267 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_PATH_INQ:.\n",
2268 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2269 			    ccb->ccb_h.target_lun);
2270 
2271 			/* host specific information */
2272 			cpi->version_num = 1;
2273 			cpi->hba_inquiry = 0;
2274 			cpi->target_sprt = 0;
2275 			cpi->hba_misc = PIM_NO_6_BYTE;
2276 			cpi->hba_eng_cnt = 0;
2277 			cpi->max_target = UMASS_SCSIID_MAX;	/* one target */
2278 			cpi->initiator_id = UMASS_SCSIID_HOST;
2279 			strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2280 			strlcpy(cpi->hba_vid, "USB SCSI", HBA_IDLEN);
2281 			strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2282 			cpi->unit_number = cam_sim_unit(sim);
2283 			cpi->bus_id = sc->sc_unit;
2284 			cpi->protocol = PROTO_SCSI;
2285 			cpi->protocol_version = SCSI_REV_2;
2286 			cpi->transport = XPORT_USB;
2287 			cpi->transport_version = 0;
2288 
2289 			if (sc == NULL) {
2290 				cpi->base_transfer_speed = 0;
2291 				cpi->max_lun = 0;
2292 			} else {
2293 				if (sc->sc_quirks & FLOPPY_SPEED) {
2294 					cpi->base_transfer_speed =
2295 					    UMASS_FLOPPY_TRANSFER_SPEED;
2296 				} else {
2297 					switch (usbd_get_speed(sc->sc_udev)) {
2298 					case USB_SPEED_SUPER:
2299 						cpi->base_transfer_speed =
2300 						    UMASS_SUPER_TRANSFER_SPEED;
2301 						cpi->maxio = MAXPHYS;
2302 						break;
2303 					case USB_SPEED_HIGH:
2304 						cpi->base_transfer_speed =
2305 						    UMASS_HIGH_TRANSFER_SPEED;
2306 						break;
2307 					default:
2308 						cpi->base_transfer_speed =
2309 						    UMASS_FULL_TRANSFER_SPEED;
2310 						break;
2311 					}
2312 				}
2313 				cpi->max_lun = sc->sc_maxlun;
2314 			}
2315 
2316 			cpi->ccb_h.status = CAM_REQ_CMP;
2317 			xpt_done(ccb);
2318 			break;
2319 		}
2320 	case XPT_RESET_DEV:
2321 		{
2322 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_RESET_DEV:.\n",
2323 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2324 			    ccb->ccb_h.target_lun);
2325 
2326 			umass_reset(sc);
2327 
2328 			ccb->ccb_h.status = CAM_REQ_CMP;
2329 			xpt_done(ccb);
2330 			break;
2331 		}
2332 	case XPT_GET_TRAN_SETTINGS:
2333 		{
2334 			struct ccb_trans_settings *cts = &ccb->cts;
2335 
2336 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_GET_TRAN_SETTINGS:.\n",
2337 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2338 			    ccb->ccb_h.target_lun);
2339 
2340 			cts->protocol = PROTO_SCSI;
2341 			cts->protocol_version = SCSI_REV_2;
2342 			cts->transport = XPORT_USB;
2343 			cts->transport_version = 0;
2344 			cts->xport_specific.valid = 0;
2345 
2346 			ccb->ccb_h.status = CAM_REQ_CMP;
2347 			xpt_done(ccb);
2348 			break;
2349 		}
2350 	case XPT_SET_TRAN_SETTINGS:
2351 		{
2352 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SET_TRAN_SETTINGS:.\n",
2353 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2354 			    ccb->ccb_h.target_lun);
2355 
2356 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2357 			xpt_done(ccb);
2358 			break;
2359 		}
2360 	case XPT_CALC_GEOMETRY:
2361 		{
2362 			cam_calc_geometry(&ccb->ccg, /* extended */ 1);
2363 			xpt_done(ccb);
2364 			break;
2365 		}
2366 	case XPT_NOOP:
2367 		{
2368 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_NOOP:.\n",
2369 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2370 			    ccb->ccb_h.target_lun);
2371 
2372 			ccb->ccb_h.status = CAM_REQ_CMP;
2373 			xpt_done(ccb);
2374 			break;
2375 		}
2376 	default:
2377 		DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:func_code 0x%04x: "
2378 		    "Not implemented\n",
2379 		    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2380 		    ccb->ccb_h.target_lun, ccb->ccb_h.func_code);
2381 
2382 		ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2383 		xpt_done(ccb);
2384 		break;
2385 	}
2386 
2387 done:
2388 	return;
2389 }
2390 
2391 static void
2392 umass_cam_poll(struct cam_sim *sim)
2393 {
2394 	struct umass_softc *sc = (struct umass_softc *)sim->softc;
2395 
2396 	if (sc == NULL)
2397 		return;
2398 
2399 	DPRINTF(sc, UDMASS_SCSI, "CAM poll\n");
2400 
2401 	usbd_transfer_poll(sc->sc_xfer, UMASS_T_MAX);
2402 }
2403 
2404 
2405 /* umass_cam_cb
2406  *	finalise a completed CAM command
2407  */
2408 
2409 static void
2410 umass_cam_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2411     uint8_t status)
2412 {
2413 	ccb->csio.resid = residue;
2414 
2415 	switch (status) {
2416 	case STATUS_CMD_OK:
2417 		ccb->ccb_h.status = CAM_REQ_CMP;
2418 		if ((sc->sc_quirks & READ_CAPACITY_OFFBY1) &&
2419 		    (ccb->ccb_h.func_code == XPT_SCSI_IO) &&
2420 		    (ccb->csio.cdb_io.cdb_bytes[0] == READ_CAPACITY)) {
2421 			struct scsi_read_capacity_data *rcap;
2422 			uint32_t maxsector;
2423 
2424 			rcap = (void *)(ccb->csio.data_ptr);
2425 			maxsector = scsi_4btoul(rcap->addr) - 1;
2426 			scsi_ulto4b(maxsector, rcap->addr);
2427 		}
2428 		/*
2429 		 * We have to add SVPD_UNIT_SERIAL_NUMBER to the list
2430 		 * of pages supported by the device - otherwise, CAM
2431 		 * will never ask us for the serial number if the
2432 		 * device cannot handle that by itself.
2433 		 */
2434 		if (ccb->ccb_h.func_code == XPT_SCSI_IO &&
2435 		    sc->sc_transfer.cmd_data[0] == INQUIRY &&
2436 		    (sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2437 		    sc->sc_transfer.cmd_data[2] == SVPD_SUPPORTED_PAGE_LIST &&
2438 		    (usb_get_serial(sc->sc_udev)[0] != '\0')) {
2439 			struct ccb_scsiio *csio;
2440 			struct scsi_vpd_supported_page_list *page_list;
2441 
2442 			csio = &ccb->csio;
2443 			page_list = (struct scsi_vpd_supported_page_list *)csio->data_ptr;
2444 			if (page_list->length + 1 < SVPD_SUPPORTED_PAGES_SIZE) {
2445 				page_list->list[page_list->length] = SVPD_UNIT_SERIAL_NUMBER;
2446 				page_list->length++;
2447 			}
2448 		}
2449 		xpt_done(ccb);
2450 		break;
2451 
2452 	case STATUS_CMD_UNKNOWN:
2453 	case STATUS_CMD_FAILED:
2454 
2455 		/* fetch sense data */
2456 
2457 		/* the rest of the command was filled in at attach */
2458 		sc->cam_scsi_sense.length = ccb->csio.sense_len;
2459 
2460 		DPRINTF(sc, UDMASS_SCSI, "Fetching %d bytes of "
2461 		    "sense data\n", ccb->csio.sense_len);
2462 
2463 		if (umass_std_transform(sc, ccb, &sc->cam_scsi_sense.opcode,
2464 		    sizeof(sc->cam_scsi_sense))) {
2465 
2466 			if ((sc->sc_quirks & FORCE_SHORT_INQUIRY) &&
2467 			    (sc->sc_transfer.cmd_data[0] == INQUIRY)) {
2468 				ccb->csio.sense_len = SHORT_INQUIRY_LENGTH;
2469 			}
2470 			umass_command_start(sc, DIR_IN, &ccb->csio.sense_data.error_code,
2471 			    ccb->csio.sense_len, ccb->ccb_h.timeout,
2472 			    &umass_cam_sense_cb, ccb);
2473 		}
2474 		break;
2475 
2476 	default:
2477 		/*
2478 		 * The wire protocol failed and will hopefully have
2479 		 * recovered. We return an error to CAM and let CAM
2480 		 * retry the command if necessary.
2481 		 */
2482 		ccb->ccb_h.status = CAM_REQ_CMP_ERR;
2483 		xpt_done(ccb);
2484 		break;
2485 	}
2486 }
2487 
2488 /*
2489  * Finalise a completed autosense operation
2490  */
2491 static void
2492 umass_cam_sense_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2493     uint8_t status)
2494 {
2495 	uint8_t *cmd;
2496 
2497 	switch (status) {
2498 	case STATUS_CMD_OK:
2499 	case STATUS_CMD_UNKNOWN:
2500 	case STATUS_CMD_FAILED: {
2501 		int key, sense_len;
2502 
2503 		ccb->csio.sense_resid = residue;
2504 		sense_len = ccb->csio.sense_len - ccb->csio.sense_resid;
2505 		key = scsi_get_sense_key(&ccb->csio.sense_data, sense_len,
2506 					 /*show_errors*/ 1);
2507 
2508 		if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2509 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2510 		} else {
2511 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2512 		}
2513 
2514 		/*
2515 		 * Getting sense data always succeeds (apart from wire
2516 		 * failures):
2517 		 */
2518 		if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2519 		    (cmd[0] == INQUIRY) &&
2520 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2521 			/*
2522 			 * Ignore unit attention errors in the case where
2523 			 * the Unit Attention state is not cleared on
2524 			 * REQUEST SENSE. They will appear again at the next
2525 			 * command.
2526 			 */
2527 			ccb->ccb_h.status = CAM_REQ_CMP;
2528 		} else if (key == SSD_KEY_NO_SENSE) {
2529 			/*
2530 			 * No problem after all (in the case of CBI without
2531 			 * CCI)
2532 			 */
2533 			ccb->ccb_h.status = CAM_REQ_CMP;
2534 		} else if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2535 			    (cmd[0] == READ_CAPACITY) &&
2536 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2537 			/*
2538 			 * Some devices do not clear the unit attention error
2539 			 * on request sense. We insert a test unit ready
2540 			 * command to make sure we clear the unit attention
2541 			 * condition, then allow the retry to proceed as
2542 			 * usual.
2543 			 */
2544 
2545 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2546 			    | CAM_AUTOSNS_VALID;
2547 			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2548 
2549 #if 0
2550 			DELAY(300000);
2551 #endif
2552 			DPRINTF(sc, UDMASS_SCSI, "Doing a sneaky"
2553 			    "TEST_UNIT_READY\n");
2554 
2555 			/* the rest of the command was filled in at attach */
2556 
2557 			if (umass_std_transform(sc, ccb,
2558 			    &sc->cam_scsi_test_unit_ready.opcode,
2559 			    sizeof(sc->cam_scsi_test_unit_ready))) {
2560 				umass_command_start(sc, DIR_NONE, NULL, 0,
2561 				    ccb->ccb_h.timeout,
2562 				    &umass_cam_quirk_cb, ccb);
2563 			}
2564 			break;
2565 		} else {
2566 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2567 			    | CAM_AUTOSNS_VALID;
2568 			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2569 		}
2570 		xpt_done(ccb);
2571 		break;
2572 	}
2573 	default:
2574 		DPRINTF(sc, UDMASS_SCSI, "Autosense failed, "
2575 		    "status %d\n", status);
2576 		ccb->ccb_h.status = CAM_AUTOSENSE_FAIL;
2577 		xpt_done(ccb);
2578 	}
2579 }
2580 
2581 /*
2582  * This completion code just handles the fact that we sent a test-unit-ready
2583  * after having previously failed a READ CAPACITY with CHECK_COND.  Even
2584  * though this command succeeded, we have to tell CAM to retry.
2585  */
2586 static void
2587 umass_cam_quirk_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2588     uint8_t status)
2589 {
2590 	DPRINTF(sc, UDMASS_SCSI, "Test unit ready "
2591 	    "returned status %d\n", status);
2592 
2593 	ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2594 	    | CAM_AUTOSNS_VALID;
2595 	ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2596 	xpt_done(ccb);
2597 }
2598 
2599 /*
2600  * SCSI specific functions
2601  */
2602 
2603 static uint8_t
2604 umass_scsi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2605     uint8_t cmd_len)
2606 {
2607 	if ((cmd_len == 0) ||
2608 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2609 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2610 		    "length: %d bytes\n", cmd_len);
2611 		return (0);		/* failure */
2612 	}
2613 	sc->sc_transfer.cmd_len = cmd_len;
2614 
2615 	switch (cmd_ptr[0]) {
2616 	case TEST_UNIT_READY:
2617 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2618 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2619 			    "to START_UNIT\n");
2620 			memset(sc->sc_transfer.cmd_data, 0, cmd_len);
2621 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2622 			sc->sc_transfer.cmd_data[4] = SSS_START;
2623 			return (1);
2624 		}
2625 		break;
2626 
2627 	case INQUIRY:
2628 		/*
2629 		 * some drives wedge when asked for full inquiry
2630 		 * information.
2631 		 */
2632 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2633 			memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2634 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2635 			return (1);
2636 		}
2637 		break;
2638 	}
2639 
2640 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2641 	return (1);
2642 }
2643 
2644 static uint8_t
2645 umass_rbc_transform(struct umass_softc *sc, uint8_t *cmd_ptr, uint8_t cmd_len)
2646 {
2647 	if ((cmd_len == 0) ||
2648 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2649 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2650 		    "length: %d bytes\n", cmd_len);
2651 		return (0);		/* failure */
2652 	}
2653 	switch (cmd_ptr[0]) {
2654 		/* these commands are defined in RBC: */
2655 	case READ_10:
2656 	case READ_CAPACITY:
2657 	case START_STOP_UNIT:
2658 	case SYNCHRONIZE_CACHE:
2659 	case WRITE_10:
2660 	case 0x2f:			/* VERIFY_10 is absent from
2661 					 * scsi_all.h??? */
2662 	case INQUIRY:
2663 	case MODE_SELECT_10:
2664 	case MODE_SENSE_10:
2665 	case TEST_UNIT_READY:
2666 	case WRITE_BUFFER:
2667 		/*
2668 		 * The following commands are not listed in my copy of the
2669 		 * RBC specs. CAM however seems to want those, and at least
2670 		 * the Sony DSC device appears to support those as well
2671 		 */
2672 	case REQUEST_SENSE:
2673 	case PREVENT_ALLOW:
2674 
2675 		memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2676 
2677 		if ((sc->sc_quirks & RBC_PAD_TO_12) && (cmd_len < 12)) {
2678 			memset(sc->sc_transfer.cmd_data + cmd_len,
2679 			    0, 12 - cmd_len);
2680 			cmd_len = 12;
2681 		}
2682 		sc->sc_transfer.cmd_len = cmd_len;
2683 		return (1);		/* sucess */
2684 
2685 		/* All other commands are not legal in RBC */
2686 	default:
2687 		DPRINTF(sc, UDMASS_SCSI, "Unsupported RBC "
2688 		    "command 0x%02x\n", cmd_ptr[0]);
2689 		return (0);		/* failure */
2690 	}
2691 }
2692 
2693 static uint8_t
2694 umass_ufi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2695     uint8_t cmd_len)
2696 {
2697 	if ((cmd_len == 0) ||
2698 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2699 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2700 		    "length: %d bytes\n", cmd_len);
2701 		return (0);		/* failure */
2702 	}
2703 	/* An UFI command is always 12 bytes in length */
2704 	sc->sc_transfer.cmd_len = UFI_COMMAND_LENGTH;
2705 
2706 	/* Zero the command data */
2707 	memset(sc->sc_transfer.cmd_data, 0, UFI_COMMAND_LENGTH);
2708 
2709 	switch (cmd_ptr[0]) {
2710 		/*
2711 		 * Commands of which the format has been verified. They
2712 		 * should work. Copy the command into the (zeroed out)
2713 		 * destination buffer.
2714 		 */
2715 	case TEST_UNIT_READY:
2716 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2717 			/*
2718 			 * Some devices do not support this command. Start
2719 			 * Stop Unit should give the same results
2720 			 */
2721 			DPRINTF(sc, UDMASS_UFI, "Converted TEST_UNIT_READY "
2722 			    "to START_UNIT\n");
2723 
2724 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2725 			sc->sc_transfer.cmd_data[4] = SSS_START;
2726 			return (1);
2727 		}
2728 		break;
2729 
2730 	case REZERO_UNIT:
2731 	case REQUEST_SENSE:
2732 	case FORMAT_UNIT:
2733 	case INQUIRY:
2734 	case START_STOP_UNIT:
2735 	case SEND_DIAGNOSTIC:
2736 	case PREVENT_ALLOW:
2737 	case READ_CAPACITY:
2738 	case READ_10:
2739 	case WRITE_10:
2740 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2741 	case WRITE_AND_VERIFY:
2742 	case VERIFY:
2743 	case MODE_SELECT_10:
2744 	case MODE_SENSE_10:
2745 	case READ_12:
2746 	case WRITE_12:
2747 	case READ_FORMAT_CAPACITIES:
2748 		break;
2749 
2750 		/*
2751 		 * SYNCHRONIZE_CACHE isn't supported by UFI, nor should it be
2752 		 * required for UFI devices, so it is appropriate to fake
2753 		 * success.
2754 		 */
2755 	case SYNCHRONIZE_CACHE:
2756 		return (2);
2757 
2758 	default:
2759 		DPRINTF(sc, UDMASS_SCSI, "Unsupported UFI "
2760 		    "command 0x%02x\n", cmd_ptr[0]);
2761 		return (0);		/* failure */
2762 	}
2763 
2764 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2765 	return (1);			/* success */
2766 }
2767 
2768 /*
2769  * 8070i (ATAPI) specific functions
2770  */
2771 static uint8_t
2772 umass_atapi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2773     uint8_t cmd_len)
2774 {
2775 	if ((cmd_len == 0) ||
2776 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2777 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2778 		    "length: %d bytes\n", cmd_len);
2779 		return (0);		/* failure */
2780 	}
2781 	/* An ATAPI command is always 12 bytes in length. */
2782 	sc->sc_transfer.cmd_len = ATAPI_COMMAND_LENGTH;
2783 
2784 	/* Zero the command data */
2785 	memset(sc->sc_transfer.cmd_data, 0, ATAPI_COMMAND_LENGTH);
2786 
2787 	switch (cmd_ptr[0]) {
2788 		/*
2789 		 * Commands of which the format has been verified. They
2790 		 * should work. Copy the command into the destination
2791 		 * buffer.
2792 		 */
2793 	case INQUIRY:
2794 		/*
2795 		 * some drives wedge when asked for full inquiry
2796 		 * information.
2797 		 */
2798 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2799 			memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2800 
2801 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2802 			return (1);
2803 		}
2804 		break;
2805 
2806 	case TEST_UNIT_READY:
2807 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2808 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2809 			    "to START_UNIT\n");
2810 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2811 			sc->sc_transfer.cmd_data[4] = SSS_START;
2812 			return (1);
2813 		}
2814 		break;
2815 
2816 	case REZERO_UNIT:
2817 	case REQUEST_SENSE:
2818 	case START_STOP_UNIT:
2819 	case SEND_DIAGNOSTIC:
2820 	case PREVENT_ALLOW:
2821 	case READ_CAPACITY:
2822 	case READ_10:
2823 	case WRITE_10:
2824 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2825 	case SYNCHRONIZE_CACHE:
2826 	case MODE_SELECT_10:
2827 	case MODE_SENSE_10:
2828 	case READ_BUFFER:
2829 	case 0x42:			/* READ_SUBCHANNEL */
2830 	case 0x43:			/* READ_TOC */
2831 	case 0x44:			/* READ_HEADER */
2832 	case 0x47:			/* PLAY_MSF (Play Minute/Second/Frame) */
2833 	case 0x48:			/* PLAY_TRACK */
2834 	case 0x49:			/* PLAY_TRACK_REL */
2835 	case 0x4b:			/* PAUSE */
2836 	case 0x51:			/* READ_DISK_INFO */
2837 	case 0x52:			/* READ_TRACK_INFO */
2838 	case 0x54:			/* SEND_OPC */
2839 	case 0x59:			/* READ_MASTER_CUE */
2840 	case 0x5b:			/* CLOSE_TR_SESSION */
2841 	case 0x5c:			/* READ_BUFFER_CAP */
2842 	case 0x5d:			/* SEND_CUE_SHEET */
2843 	case 0xa1:			/* BLANK */
2844 	case 0xa5:			/* PLAY_12 */
2845 	case 0xa6:			/* EXCHANGE_MEDIUM */
2846 	case 0xad:			/* READ_DVD_STRUCTURE */
2847 	case 0xbb:			/* SET_CD_SPEED */
2848 	case 0xe5:			/* READ_TRACK_INFO_PHILIPS */
2849 		break;
2850 
2851 	case READ_12:
2852 	case WRITE_12:
2853 	default:
2854 		DPRINTF(sc, UDMASS_SCSI, "Unsupported ATAPI "
2855 		    "command 0x%02x - trying anyway\n",
2856 		    cmd_ptr[0]);
2857 		break;
2858 	}
2859 
2860 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2861 	return (1);			/* success */
2862 }
2863 
2864 static uint8_t
2865 umass_no_transform(struct umass_softc *sc, uint8_t *cmd,
2866     uint8_t cmdlen)
2867 {
2868 	return (0);			/* failure */
2869 }
2870 
2871 static uint8_t
2872 umass_std_transform(struct umass_softc *sc, union ccb *ccb,
2873     uint8_t *cmd, uint8_t cmdlen)
2874 {
2875 	uint8_t retval;
2876 
2877 	retval = (sc->sc_transform) (sc, cmd, cmdlen);
2878 
2879 	if (retval == 2) {
2880 		ccb->ccb_h.status = CAM_REQ_CMP;
2881 		xpt_done(ccb);
2882 		return (0);
2883 	} else if (retval == 0) {
2884 		ccb->ccb_h.status = CAM_REQ_INVALID;
2885 		xpt_done(ccb);
2886 		return (0);
2887 	}
2888 	/* Command should be executed */
2889 	return (1);
2890 }
2891 
2892 #ifdef USB_DEBUG
2893 static void
2894 umass_bbb_dump_cbw(struct umass_softc *sc, umass_bbb_cbw_t *cbw)
2895 {
2896 	uint8_t *c = cbw->CBWCDB;
2897 
2898 	uint32_t dlen = UGETDW(cbw->dCBWDataTransferLength);
2899 	uint32_t tag = UGETDW(cbw->dCBWTag);
2900 
2901 	uint8_t clen = cbw->bCDBLength;
2902 	uint8_t flags = cbw->bCBWFlags;
2903 	uint8_t lun = cbw->bCBWLUN;
2904 
2905 	DPRINTF(sc, UDMASS_BBB, "CBW %d: cmd = %db "
2906 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
2907 	    "data = %db, lun = %d, dir = %s\n",
2908 	    tag, clen,
2909 	    c[0], c[1], c[2], c[3], c[4], c[5], (clen > 6 ? "..." : ""),
2910 	    dlen, lun, (flags == CBWFLAGS_IN ? "in" :
2911 	    (flags == CBWFLAGS_OUT ? "out" : "<invalid>")));
2912 }
2913 
2914 static void
2915 umass_bbb_dump_csw(struct umass_softc *sc, umass_bbb_csw_t *csw)
2916 {
2917 	uint32_t sig = UGETDW(csw->dCSWSignature);
2918 	uint32_t tag = UGETDW(csw->dCSWTag);
2919 	uint32_t res = UGETDW(csw->dCSWDataResidue);
2920 	uint8_t status = csw->bCSWStatus;
2921 
2922 	DPRINTF(sc, UDMASS_BBB, "CSW %d: sig = 0x%08x (%s), tag = 0x%08x, "
2923 	    "res = %d, status = 0x%02x (%s)\n",
2924 	    tag, sig, (sig == CSWSIGNATURE ? "valid" : "invalid"),
2925 	    tag, res,
2926 	    status, (status == CSWSTATUS_GOOD ? "good" :
2927 	    (status == CSWSTATUS_FAILED ? "failed" :
2928 	    (status == CSWSTATUS_PHASE ? "phase" : "<invalid>"))));
2929 }
2930 
2931 static void
2932 umass_cbi_dump_cmd(struct umass_softc *sc, void *cmd, uint8_t cmdlen)
2933 {
2934 	uint8_t *c = cmd;
2935 	uint8_t dir = sc->sc_transfer.dir;
2936 
2937 	DPRINTF(sc, UDMASS_BBB, "cmd = %db "
2938 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
2939 	    "data = %db, dir = %s\n",
2940 	    cmdlen,
2941 	    c[0], c[1], c[2], c[3], c[4], c[5], (cmdlen > 6 ? "..." : ""),
2942 	    sc->sc_transfer.data_len,
2943 	    (dir == DIR_IN ? "in" :
2944 	    (dir == DIR_OUT ? "out" :
2945 	    (dir == DIR_NONE ? "no data phase" : "<invalid>"))));
2946 }
2947 
2948 static void
2949 umass_dump_buffer(struct umass_softc *sc, uint8_t *buffer, uint32_t buflen,
2950     uint32_t printlen)
2951 {
2952 	uint32_t i, j;
2953 	char s1[40];
2954 	char s2[40];
2955 	char s3[5];
2956 
2957 	s1[0] = '\0';
2958 	s3[0] = '\0';
2959 
2960 	sprintf(s2, " buffer=%p, buflen=%d", buffer, buflen);
2961 	for (i = 0; (i < buflen) && (i < printlen); i++) {
2962 		j = i % 16;
2963 		if (j == 0 && i != 0) {
2964 			DPRINTF(sc, UDMASS_GEN, "0x %s%s\n",
2965 			    s1, s2);
2966 			s2[0] = '\0';
2967 		}
2968 		sprintf(&s1[j * 2], "%02x", buffer[i] & 0xff);
2969 	}
2970 	if (buflen > printlen)
2971 		sprintf(s3, " ...");
2972 	DPRINTF(sc, UDMASS_GEN, "0x %s%s%s\n",
2973 	    s1, s2, s3);
2974 }
2975 
2976 #endif
2977