xref: /freebsd/sys/dev/usb/storage/umass.c (revision 7ef62cebc2f965b0f640263e179276928885e33d)
1 #include <sys/cdefs.h>
2 __FBSDID("$FreeBSD$");
3 
4 /*-
5  * SPDX-License-Identifier: BSD-2-Clause
6  *
7  * Copyright (c) 1999 MAEKAWA Masahide <bishop@rr.iij4u.or.jp>,
8  *		      Nick Hibma <n_hibma@FreeBSD.org>
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  *	$FreeBSD$
33  *	$NetBSD: umass.c,v 1.28 2000/04/02 23:46:53 augustss Exp $
34  */
35 
36 /* Also already merged from NetBSD:
37  *	$NetBSD: umass.c,v 1.67 2001/11/25 19:05:22 augustss Exp $
38  *	$NetBSD: umass.c,v 1.90 2002/11/04 19:17:33 pooka Exp $
39  *	$NetBSD: umass.c,v 1.108 2003/11/07 17:03:25 wiz Exp $
40  *	$NetBSD: umass.c,v 1.109 2003/12/04 13:57:31 keihan Exp $
41  */
42 
43 /*
44  * Universal Serial Bus Mass Storage Class specs:
45  * http://www.usb.org/developers/devclass_docs/usb_msc_overview_1.2.pdf
46  * http://www.usb.org/developers/devclass_docs/usbmassbulk_10.pdf
47  * http://www.usb.org/developers/devclass_docs/usb_msc_cbi_1.1.pdf
48  * http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf
49  */
50 
51 /*
52  * Ported to NetBSD by Lennart Augustsson <augustss@NetBSD.org>.
53  * Parts of the code written by Jason R. Thorpe <thorpej@shagadelic.org>.
54  */
55 
56 /*
57  * The driver handles 3 Wire Protocols
58  * - Command/Bulk/Interrupt (CBI)
59  * - Command/Bulk/Interrupt with Command Completion Interrupt (CBI with CCI)
60  * - Mass Storage Bulk-Only (BBB)
61  *   (BBB refers Bulk/Bulk/Bulk for Command/Data/Status phases)
62  *
63  * Over these wire protocols it handles the following command protocols
64  * - SCSI
65  * - UFI (floppy command set)
66  * - 8070i (ATAPI)
67  *
68  * UFI and 8070i (ATAPI) are transformed versions of the SCSI command set. The
69  * sc->sc_transform method is used to convert the commands into the appropriate
70  * format (if at all necessary). For example, UFI requires all commands to be
71  * 12 bytes in length amongst other things.
72  *
73  * The source code below is marked and can be split into a number of pieces
74  * (in this order):
75  *
76  * - probe/attach/detach
77  * - generic transfer routines
78  * - BBB
79  * - CBI
80  * - CBI_I (in addition to functions from CBI)
81  * - CAM (Common Access Method)
82  * - SCSI
83  * - UFI
84  * - 8070i (ATAPI)
85  *
86  * The protocols are implemented using a state machine, for the transfers as
87  * well as for the resets. The state machine is contained in umass_t_*_callback.
88  * The state machine is started through either umass_command_start() or
89  * umass_reset().
90  *
91  * The reason for doing this is a) CAM performs a lot better this way and b) it
92  * avoids using tsleep from interrupt context (for example after a failed
93  * transfer).
94  */
95 
96 /*
97  * The SCSI related part of this driver has been derived from the
98  * dev/ppbus/vpo.c driver, by Nicolas Souchu (nsouch@FreeBSD.org).
99  *
100  * The CAM layer uses so called actions which are messages sent to the host
101  * adapter for completion. The actions come in through umass_cam_action. The
102  * appropriate block of routines is called depending on the transport protocol
103  * in use. When the transfer has finished, these routines call
104  * umass_cam_cb again to complete the CAM command.
105  */
106 
107 #include <sys/stdint.h>
108 #include <sys/stddef.h>
109 #include <sys/param.h>
110 #include <sys/queue.h>
111 #include <sys/types.h>
112 #include <sys/systm.h>
113 #include <sys/kernel.h>
114 #include <sys/bus.h>
115 #include <sys/module.h>
116 #include <sys/lock.h>
117 #include <sys/mutex.h>
118 #include <sys/condvar.h>
119 #include <sys/sysctl.h>
120 #include <sys/sx.h>
121 #include <sys/unistd.h>
122 #include <sys/callout.h>
123 #include <sys/malloc.h>
124 #include <sys/priv.h>
125 
126 #include <dev/usb/usb.h>
127 #include <dev/usb/usbdi.h>
128 #include <dev/usb/usbdi_util.h>
129 #include "usbdevs.h"
130 
131 #include <dev/usb/quirk/usb_quirk.h>
132 
133 #include <cam/cam.h>
134 #include <cam/cam_ccb.h>
135 #include <cam/cam_sim.h>
136 #include <cam/cam_xpt_sim.h>
137 #include <cam/scsi/scsi_all.h>
138 #include <cam/scsi/scsi_da.h>
139 
140 #include <cam/cam_periph.h>
141 
142 #ifdef USB_DEBUG
143 #define	DIF(m, x)				\
144   do {						\
145     if (umass_debug & (m)) { x ; }		\
146   } while (0)
147 
148 #define	DPRINTF(sc, m, fmt, ...)			\
149   do {							\
150     if (umass_debug & (m)) {				\
151         printf("%s:%s: " fmt,				\
152 	       (sc) ? (const char *)(sc)->sc_name :	\
153 	       (const char *)"umassX",			\
154 		__FUNCTION__ ,## __VA_ARGS__);		\
155     }							\
156   } while (0)
157 
158 #define	UDMASS_GEN	0x00010000	/* general */
159 #define	UDMASS_SCSI	0x00020000	/* scsi */
160 #define	UDMASS_UFI	0x00040000	/* ufi command set */
161 #define	UDMASS_ATAPI	0x00080000	/* 8070i command set */
162 #define	UDMASS_CMD	(UDMASS_SCSI|UDMASS_UFI|UDMASS_ATAPI)
163 #define	UDMASS_USB	0x00100000	/* USB general */
164 #define	UDMASS_BBB	0x00200000	/* Bulk-Only transfers */
165 #define	UDMASS_CBI	0x00400000	/* CBI transfers */
166 #define	UDMASS_WIRE	(UDMASS_BBB|UDMASS_CBI)
167 #define	UDMASS_ALL	0xffff0000	/* all of the above */
168 static int umass_debug;
169 static int umass_throttle;
170 
171 static SYSCTL_NODE(_hw_usb, OID_AUTO, umass, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
172     "USB umass");
173 SYSCTL_INT(_hw_usb_umass, OID_AUTO, debug, CTLFLAG_RWTUN,
174     &umass_debug, 0, "umass debug level");
175 SYSCTL_INT(_hw_usb_umass, OID_AUTO, throttle, CTLFLAG_RWTUN,
176     &umass_throttle, 0, "Forced delay between commands in milliseconds");
177 #else
178 #define	DIF(...) do { } while (0)
179 #define	DPRINTF(...) do { } while (0)
180 #endif
181 
182 #define	UMASS_BULK_SIZE (1 << 17)
183 #define	UMASS_CBI_DIAGNOSTIC_CMDLEN 12	/* bytes */
184 #define	UMASS_MAX_CMDLEN MAX(12, CAM_MAX_CDBLEN)	/* bytes */
185 
186 /* USB transfer definitions */
187 
188 #define	UMASS_T_BBB_RESET1      0	/* Bulk-Only */
189 #define	UMASS_T_BBB_RESET2      1
190 #define	UMASS_T_BBB_RESET3      2
191 #define	UMASS_T_BBB_COMMAND     3
192 #define	UMASS_T_BBB_DATA_READ   4
193 #define	UMASS_T_BBB_DATA_RD_CS  5
194 #define	UMASS_T_BBB_DATA_WRITE  6
195 #define	UMASS_T_BBB_DATA_WR_CS  7
196 #define	UMASS_T_BBB_STATUS      8
197 #define	UMASS_T_BBB_MAX         9
198 
199 #define	UMASS_T_CBI_RESET1      0	/* CBI */
200 #define	UMASS_T_CBI_RESET2      1
201 #define	UMASS_T_CBI_RESET3      2
202 #define	UMASS_T_CBI_COMMAND     3
203 #define	UMASS_T_CBI_DATA_READ   4
204 #define	UMASS_T_CBI_DATA_RD_CS  5
205 #define	UMASS_T_CBI_DATA_WRITE  6
206 #define	UMASS_T_CBI_DATA_WR_CS  7
207 #define	UMASS_T_CBI_STATUS      8
208 #define	UMASS_T_CBI_RESET4      9
209 #define	UMASS_T_CBI_MAX        10
210 
211 #define	UMASS_T_MAX MAX(UMASS_T_CBI_MAX, UMASS_T_BBB_MAX)
212 
213 /* Generic definitions */
214 
215 /* Direction for transfer */
216 #define	DIR_NONE	0
217 #define	DIR_IN		1
218 #define	DIR_OUT		2
219 
220 /* device name */
221 #define	DEVNAME		"umass"
222 #define	DEVNAME_SIM	"umass-sim"
223 
224 /* Approximate maximum transfer speeds (assumes 33% overhead). */
225 #define	UMASS_FULL_TRANSFER_SPEED	1000
226 #define	UMASS_HIGH_TRANSFER_SPEED	40000
227 #define	UMASS_SUPER_TRANSFER_SPEED	400000
228 #define	UMASS_FLOPPY_TRANSFER_SPEED	20
229 
230 #define	UMASS_TIMEOUT			5000	/* ms */
231 
232 /* CAM specific definitions */
233 
234 #define	UMASS_SCSIID_MAX	1	/* maximum number of drives expected */
235 #define	UMASS_SCSIID_HOST	UMASS_SCSIID_MAX
236 
237 /* Bulk-Only features */
238 
239 #define	UR_BBB_RESET		0xff	/* Bulk-Only reset */
240 #define	UR_BBB_GET_MAX_LUN	0xfe	/* Get maximum lun */
241 
242 /* Command Block Wrapper */
243 typedef struct {
244 	uDWord	dCBWSignature;
245 #define	CBWSIGNATURE	0x43425355
246 	uDWord	dCBWTag;
247 	uDWord	dCBWDataTransferLength;
248 	uByte	bCBWFlags;
249 #define	CBWFLAGS_OUT	0x00
250 #define	CBWFLAGS_IN	0x80
251 	uByte	bCBWLUN;
252 	uByte	bCDBLength;
253 #define	CBWCDBLENGTH	16
254 	uByte	CBWCDB[CBWCDBLENGTH];
255 } __packed umass_bbb_cbw_t;
256 
257 #define	UMASS_BBB_CBW_SIZE	31
258 
259 /* Command Status Wrapper */
260 typedef struct {
261 	uDWord	dCSWSignature;
262 #define	CSWSIGNATURE	0x53425355
263 #define	CSWSIGNATURE_IMAGINATION_DBX1	0x43425355
264 #define	CSWSIGNATURE_OLYMPUS_C1	0x55425355
265 	uDWord	dCSWTag;
266 	uDWord	dCSWDataResidue;
267 	uByte	bCSWStatus;
268 #define	CSWSTATUS_GOOD	0x0
269 #define	CSWSTATUS_FAILED	0x1
270 #define	CSWSTATUS_PHASE	0x2
271 } __packed umass_bbb_csw_t;
272 
273 #define	UMASS_BBB_CSW_SIZE	13
274 
275 /* CBI features */
276 
277 #define	UR_CBI_ADSC	0x00
278 
279 typedef union {
280 	struct {
281 		uint8_t	type;
282 #define	IDB_TYPE_CCI		0x00
283 		uint8_t	value;
284 #define	IDB_VALUE_PASS		0x00
285 #define	IDB_VALUE_FAIL		0x01
286 #define	IDB_VALUE_PHASE		0x02
287 #define	IDB_VALUE_PERSISTENT	0x03
288 #define	IDB_VALUE_STATUS_MASK	0x03
289 	} __packed common;
290 
291 	struct {
292 		uint8_t	asc;
293 		uint8_t	ascq;
294 	} __packed ufi;
295 } __packed umass_cbi_sbl_t;
296 
297 struct umass_softc;			/* see below */
298 
299 typedef void (umass_callback_t)(struct umass_softc *sc, union ccb *ccb,
300     	uint32_t residue, uint8_t status);
301 
302 #define	STATUS_CMD_OK		0	/* everything ok */
303 #define	STATUS_CMD_UNKNOWN	1	/* will have to fetch sense */
304 #define	STATUS_CMD_FAILED	2	/* transfer was ok, command failed */
305 #define	STATUS_WIRE_FAILED	3	/* couldn't even get command across */
306 
307 typedef uint8_t (umass_transform_t)(struct umass_softc *sc, uint8_t *cmd_ptr,
308     	uint8_t cmd_len);
309 
310 /* Wire and command protocol */
311 #define	UMASS_PROTO_BBB		0x0001	/* USB wire protocol */
312 #define	UMASS_PROTO_CBI		0x0002
313 #define	UMASS_PROTO_CBI_I	0x0004
314 #define	UMASS_PROTO_WIRE	0x00ff	/* USB wire protocol mask */
315 #define	UMASS_PROTO_SCSI	0x0100	/* command protocol */
316 #define	UMASS_PROTO_ATAPI	0x0200
317 #define	UMASS_PROTO_UFI		0x0400
318 #define	UMASS_PROTO_RBC		0x0800
319 #define	UMASS_PROTO_COMMAND	0xff00	/* command protocol mask */
320 
321 /* Device specific quirks */
322 #define	NO_QUIRKS		0x0000
323 	/*
324 	 * The drive does not support Test Unit Ready. Convert to Start Unit
325 	 */
326 #define	NO_TEST_UNIT_READY	0x0001
327 	/*
328 	 * The drive does not reset the Unit Attention state after REQUEST
329 	 * SENSE has been sent. The INQUIRY command does not reset the UA
330 	 * either, and so CAM runs in circles trying to retrieve the initial
331 	 * INQUIRY data.
332 	 */
333 #define	RS_NO_CLEAR_UA		0x0002
334 	/* The drive does not support START STOP.  */
335 #define	NO_START_STOP		0x0004
336 	/* Don't ask for full inquiry data (255b).  */
337 #define	FORCE_SHORT_INQUIRY	0x0008
338 	/* Needs to be initialised the Shuttle way */
339 #define	SHUTTLE_INIT		0x0010
340 	/* Drive needs to be switched to alternate iface 1 */
341 #define	ALT_IFACE_1		0x0020
342 	/* Drive does not do 1Mb/s, but just floppy speeds (20kb/s) */
343 #define	FLOPPY_SPEED		0x0040
344 	/* The device can't count and gets the residue of transfers wrong */
345 #define	IGNORE_RESIDUE		0x0080
346 	/* No GetMaxLun call */
347 #define	NO_GETMAXLUN		0x0100
348 	/* The device uses a weird CSWSIGNATURE. */
349 #define	WRONG_CSWSIG		0x0200
350 	/* Device cannot handle INQUIRY so fake a generic response */
351 #define	NO_INQUIRY		0x0400
352 	/* Device cannot handle INQUIRY EVPD, return CHECK CONDITION */
353 #define	NO_INQUIRY_EVPD		0x0800
354 	/* Pad all RBC requests to 12 bytes. */
355 #define	RBC_PAD_TO_12		0x1000
356 	/*
357 	 * Device reports number of sectors from READ_CAPACITY, not max
358 	 * sector number.
359 	 */
360 #define	READ_CAPACITY_OFFBY1	0x2000
361 	/*
362 	 * Device cannot handle a SCSI synchronize cache command.  Normally
363 	 * this quirk would be handled in the cam layer, but for IDE bridges
364 	 * we need to associate the quirk with the bridge and not the
365 	 * underlying disk device.  This is handled by faking a success
366 	 * result.
367 	 */
368 #define	NO_SYNCHRONIZE_CACHE	0x4000
369 	/* Device does not support 'PREVENT/ALLOW MEDIUM REMOVAL'. */
370 #define	NO_PREVENT_ALLOW	0x8000
371 
372 struct umass_softc {
373 	struct scsi_sense cam_scsi_sense;
374 	struct scsi_test_unit_ready cam_scsi_test_unit_ready;
375 	struct mtx sc_mtx;
376 	struct {
377 		uint8_t *data_ptr;
378 		union ccb *ccb;
379 		umass_callback_t *callback;
380 
381 		uint32_t data_len;	/* bytes */
382 		uint32_t data_rem;	/* bytes */
383 		uint32_t data_timeout;	/* ms */
384 		uint32_t actlen;	/* bytes */
385 
386 		uint8_t	cmd_data[UMASS_MAX_CMDLEN];
387 		uint8_t	cmd_len;	/* bytes */
388 		uint8_t	dir;
389 		uint8_t	lun;
390 	}	sc_transfer;
391 
392 	/* Bulk specific variables for transfers in progress */
393 	umass_bbb_cbw_t cbw;		/* command block wrapper */
394 	umass_bbb_csw_t csw;		/* command status wrapper */
395 
396 	/* CBI specific variables for transfers in progress */
397 	umass_cbi_sbl_t sbl;		/* status block */
398 
399 	device_t sc_dev;
400 	struct usb_device *sc_udev;
401 	struct cam_sim *sc_sim;		/* SCSI Interface Module */
402 	struct usb_xfer *sc_xfer[UMASS_T_MAX];
403 
404 	/*
405 	 * The command transform function is used to convert the SCSI
406 	 * commands into their derivatives, like UFI, ATAPI, and friends.
407 	 */
408 	umass_transform_t *sc_transform;
409 
410 	uint32_t sc_unit;
411 	uint32_t sc_quirks;		/* they got it almost right */
412 	uint32_t sc_proto;		/* wire and cmd protocol */
413 
414 	uint8_t	sc_name[16];
415 	uint8_t	sc_iface_no;		/* interface number */
416 	uint8_t	sc_maxlun;		/* maximum LUN number, inclusive */
417 	uint8_t	sc_last_xfer_index;
418 	uint8_t	sc_status_try;
419 };
420 
421 struct umass_probe_proto {
422 	uint32_t quirks;
423 	uint32_t proto;
424 
425 	int	error;
426 };
427 
428 /* prototypes */
429 
430 static device_probe_t umass_probe;
431 static device_attach_t umass_attach;
432 static device_detach_t umass_detach;
433 
434 static usb_callback_t umass_tr_error;
435 static usb_callback_t umass_t_bbb_reset1_callback;
436 static usb_callback_t umass_t_bbb_reset2_callback;
437 static usb_callback_t umass_t_bbb_reset3_callback;
438 static usb_callback_t umass_t_bbb_command_callback;
439 static usb_callback_t umass_t_bbb_data_read_callback;
440 static usb_callback_t umass_t_bbb_data_rd_cs_callback;
441 static usb_callback_t umass_t_bbb_data_write_callback;
442 static usb_callback_t umass_t_bbb_data_wr_cs_callback;
443 static usb_callback_t umass_t_bbb_status_callback;
444 static usb_callback_t umass_t_cbi_reset1_callback;
445 static usb_callback_t umass_t_cbi_reset2_callback;
446 static usb_callback_t umass_t_cbi_reset3_callback;
447 static usb_callback_t umass_t_cbi_reset4_callback;
448 static usb_callback_t umass_t_cbi_command_callback;
449 static usb_callback_t umass_t_cbi_data_read_callback;
450 static usb_callback_t umass_t_cbi_data_rd_cs_callback;
451 static usb_callback_t umass_t_cbi_data_write_callback;
452 static usb_callback_t umass_t_cbi_data_wr_cs_callback;
453 static usb_callback_t umass_t_cbi_status_callback;
454 
455 static void	umass_cancel_ccb(struct umass_softc *);
456 static void	umass_init_shuttle(struct umass_softc *);
457 static void	umass_reset(struct umass_softc *);
458 static void	umass_t_bbb_data_clear_stall_callback(struct usb_xfer *,
459 		    uint8_t, uint8_t, usb_error_t);
460 static void	umass_command_start(struct umass_softc *, uint8_t, void *,
461 		    uint32_t, uint32_t, umass_callback_t *, union ccb *);
462 static uint8_t	umass_bbb_get_max_lun(struct umass_softc *);
463 static void	umass_cbi_start_status(struct umass_softc *);
464 static void	umass_t_cbi_data_clear_stall_callback(struct usb_xfer *,
465 		    uint8_t, uint8_t, usb_error_t);
466 static int	umass_cam_attach_sim(struct umass_softc *);
467 static void	umass_cam_attach(struct umass_softc *);
468 static void	umass_cam_detach_sim(struct umass_softc *);
469 static void	umass_cam_action(struct cam_sim *, union ccb *);
470 static void	umass_cam_poll(struct cam_sim *);
471 static void	umass_cam_cb(struct umass_softc *, union ccb *, uint32_t,
472 		    uint8_t);
473 static void	umass_cam_sense_cb(struct umass_softc *, union ccb *, uint32_t,
474 		    uint8_t);
475 static void	umass_cam_quirk_cb(struct umass_softc *, union ccb *, uint32_t,
476 		    uint8_t);
477 static uint8_t	umass_scsi_transform(struct umass_softc *, uint8_t *, uint8_t);
478 static uint8_t	umass_rbc_transform(struct umass_softc *, uint8_t *, uint8_t);
479 static uint8_t	umass_ufi_transform(struct umass_softc *, uint8_t *, uint8_t);
480 static uint8_t	umass_atapi_transform(struct umass_softc *, uint8_t *,
481 		    uint8_t);
482 static uint8_t	umass_no_transform(struct umass_softc *, uint8_t *, uint8_t);
483 static uint8_t	umass_std_transform(struct umass_softc *, union ccb *, uint8_t
484 		    *, uint8_t);
485 
486 #ifdef USB_DEBUG
487 static void	umass_bbb_dump_cbw(struct umass_softc *, umass_bbb_cbw_t *);
488 static void	umass_bbb_dump_csw(struct umass_softc *, umass_bbb_csw_t *);
489 static void	umass_cbi_dump_cmd(struct umass_softc *, void *, uint8_t);
490 static void	umass_dump_buffer(struct umass_softc *, uint8_t *, uint32_t,
491 		    uint32_t);
492 #endif
493 
494 static struct usb_config umass_bbb_config[UMASS_T_BBB_MAX] = {
495 	[UMASS_T_BBB_RESET1] = {
496 		.type = UE_CONTROL,
497 		.endpoint = 0x00,	/* Control pipe */
498 		.direction = UE_DIR_ANY,
499 		.bufsize = sizeof(struct usb_device_request),
500 		.callback = &umass_t_bbb_reset1_callback,
501 		.timeout = 5000,	/* 5 seconds */
502 		.interval = 500,	/* 500 milliseconds */
503 	},
504 
505 	[UMASS_T_BBB_RESET2] = {
506 		.type = UE_CONTROL,
507 		.endpoint = 0x00,	/* Control pipe */
508 		.direction = UE_DIR_ANY,
509 		.bufsize = sizeof(struct usb_device_request),
510 		.callback = &umass_t_bbb_reset2_callback,
511 		.timeout = 5000,	/* 5 seconds */
512 		.interval = 50,	/* 50 milliseconds */
513 	},
514 
515 	[UMASS_T_BBB_RESET3] = {
516 		.type = UE_CONTROL,
517 		.endpoint = 0x00,	/* Control pipe */
518 		.direction = UE_DIR_ANY,
519 		.bufsize = sizeof(struct usb_device_request),
520 		.callback = &umass_t_bbb_reset3_callback,
521 		.timeout = 5000,	/* 5 seconds */
522 		.interval = 50,	/* 50 milliseconds */
523 	},
524 
525 	[UMASS_T_BBB_COMMAND] = {
526 		.type = UE_BULK,
527 		.endpoint = UE_ADDR_ANY,
528 		.direction = UE_DIR_OUT,
529 		.bufsize = sizeof(umass_bbb_cbw_t),
530 		.callback = &umass_t_bbb_command_callback,
531 		.timeout = 5000,	/* 5 seconds */
532 	},
533 
534 	[UMASS_T_BBB_DATA_READ] = {
535 		.type = UE_BULK,
536 		.endpoint = UE_ADDR_ANY,
537 		.direction = UE_DIR_IN,
538 		.bufsize = UMASS_BULK_SIZE,
539 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
540 		.callback = &umass_t_bbb_data_read_callback,
541 		.timeout = 0,	/* overwritten later */
542 	},
543 
544 	[UMASS_T_BBB_DATA_RD_CS] = {
545 		.type = UE_CONTROL,
546 		.endpoint = 0x00,	/* Control pipe */
547 		.direction = UE_DIR_ANY,
548 		.bufsize = sizeof(struct usb_device_request),
549 		.callback = &umass_t_bbb_data_rd_cs_callback,
550 		.timeout = 5000,	/* 5 seconds */
551 	},
552 
553 	[UMASS_T_BBB_DATA_WRITE] = {
554 		.type = UE_BULK,
555 		.endpoint = UE_ADDR_ANY,
556 		.direction = UE_DIR_OUT,
557 		.bufsize = UMASS_BULK_SIZE,
558 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
559 		.callback = &umass_t_bbb_data_write_callback,
560 		.timeout = 0,	/* overwritten later */
561 	},
562 
563 	[UMASS_T_BBB_DATA_WR_CS] = {
564 		.type = UE_CONTROL,
565 		.endpoint = 0x00,	/* Control pipe */
566 		.direction = UE_DIR_ANY,
567 		.bufsize = sizeof(struct usb_device_request),
568 		.callback = &umass_t_bbb_data_wr_cs_callback,
569 		.timeout = 5000,	/* 5 seconds */
570 	},
571 
572 	[UMASS_T_BBB_STATUS] = {
573 		.type = UE_BULK,
574 		.endpoint = UE_ADDR_ANY,
575 		.direction = UE_DIR_IN,
576 		.bufsize = sizeof(umass_bbb_csw_t),
577 		.flags = {.short_xfer_ok = 1,},
578 		.callback = &umass_t_bbb_status_callback,
579 		.timeout = 5000,	/* ms */
580 	},
581 };
582 
583 static struct usb_config umass_cbi_config[UMASS_T_CBI_MAX] = {
584 	[UMASS_T_CBI_RESET1] = {
585 		.type = UE_CONTROL,
586 		.endpoint = 0x00,	/* Control pipe */
587 		.direction = UE_DIR_ANY,
588 		.bufsize = (sizeof(struct usb_device_request) +
589 		    UMASS_CBI_DIAGNOSTIC_CMDLEN),
590 		.callback = &umass_t_cbi_reset1_callback,
591 		.timeout = 5000,	/* 5 seconds */
592 		.interval = 500,	/* 500 milliseconds */
593 	},
594 
595 	[UMASS_T_CBI_RESET2] = {
596 		.type = UE_CONTROL,
597 		.endpoint = 0x00,	/* Control pipe */
598 		.direction = UE_DIR_ANY,
599 		.bufsize = sizeof(struct usb_device_request),
600 		.callback = &umass_t_cbi_reset2_callback,
601 		.timeout = 5000,	/* 5 seconds */
602 		.interval = 50,	/* 50 milliseconds */
603 	},
604 
605 	[UMASS_T_CBI_RESET3] = {
606 		.type = UE_CONTROL,
607 		.endpoint = 0x00,	/* Control pipe */
608 		.direction = UE_DIR_ANY,
609 		.bufsize = sizeof(struct usb_device_request),
610 		.callback = &umass_t_cbi_reset3_callback,
611 		.timeout = 5000,	/* 5 seconds */
612 		.interval = 50,	/* 50 milliseconds */
613 	},
614 
615 	[UMASS_T_CBI_COMMAND] = {
616 		.type = UE_CONTROL,
617 		.endpoint = 0x00,	/* Control pipe */
618 		.direction = UE_DIR_ANY,
619 		.bufsize = (sizeof(struct usb_device_request) +
620 		    UMASS_MAX_CMDLEN),
621 		.callback = &umass_t_cbi_command_callback,
622 		.timeout = 5000,	/* 5 seconds */
623 	},
624 
625 	[UMASS_T_CBI_DATA_READ] = {
626 		.type = UE_BULK,
627 		.endpoint = UE_ADDR_ANY,
628 		.direction = UE_DIR_IN,
629 		.bufsize = UMASS_BULK_SIZE,
630 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
631 		.callback = &umass_t_cbi_data_read_callback,
632 		.timeout = 0,	/* overwritten later */
633 	},
634 
635 	[UMASS_T_CBI_DATA_RD_CS] = {
636 		.type = UE_CONTROL,
637 		.endpoint = 0x00,	/* Control pipe */
638 		.direction = UE_DIR_ANY,
639 		.bufsize = sizeof(struct usb_device_request),
640 		.callback = &umass_t_cbi_data_rd_cs_callback,
641 		.timeout = 5000,	/* 5 seconds */
642 	},
643 
644 	[UMASS_T_CBI_DATA_WRITE] = {
645 		.type = UE_BULK,
646 		.endpoint = UE_ADDR_ANY,
647 		.direction = UE_DIR_OUT,
648 		.bufsize = UMASS_BULK_SIZE,
649 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
650 		.callback = &umass_t_cbi_data_write_callback,
651 		.timeout = 0,	/* overwritten later */
652 	},
653 
654 	[UMASS_T_CBI_DATA_WR_CS] = {
655 		.type = UE_CONTROL,
656 		.endpoint = 0x00,	/* Control pipe */
657 		.direction = UE_DIR_ANY,
658 		.bufsize = sizeof(struct usb_device_request),
659 		.callback = &umass_t_cbi_data_wr_cs_callback,
660 		.timeout = 5000,	/* 5 seconds */
661 	},
662 
663 	[UMASS_T_CBI_STATUS] = {
664 		.type = UE_INTERRUPT,
665 		.endpoint = UE_ADDR_ANY,
666 		.direction = UE_DIR_IN,
667 		.flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
668 		.bufsize = sizeof(umass_cbi_sbl_t),
669 		.callback = &umass_t_cbi_status_callback,
670 		.timeout = 5000,	/* ms */
671 	},
672 
673 	[UMASS_T_CBI_RESET4] = {
674 		.type = UE_CONTROL,
675 		.endpoint = 0x00,	/* Control pipe */
676 		.direction = UE_DIR_ANY,
677 		.bufsize = sizeof(struct usb_device_request),
678 		.callback = &umass_t_cbi_reset4_callback,
679 		.timeout = 5000,	/* ms */
680 	},
681 };
682 
683 /* If device cannot return valid inquiry data, fake it */
684 static const uint8_t fake_inq_data[SHORT_INQUIRY_LENGTH] = {
685 	0, /* removable */ 0x80, SCSI_REV_2, SCSI_REV_2,
686 	 /* additional_length */ 31, 0, 0, 0
687 };
688 
689 #define	UFI_COMMAND_LENGTH	12	/* UFI commands are always 12 bytes */
690 #define	ATAPI_COMMAND_LENGTH	12	/* ATAPI commands are always 12 bytes */
691 
692 static device_method_t umass_methods[] = {
693 	/* Device interface */
694 	DEVMETHOD(device_probe, umass_probe),
695 	DEVMETHOD(device_attach, umass_attach),
696 	DEVMETHOD(device_detach, umass_detach),
697 
698 	DEVMETHOD_END
699 };
700 
701 static driver_t umass_driver = {
702 	.name = "umass",
703 	.methods = umass_methods,
704 	.size = sizeof(struct umass_softc),
705 };
706 
707 static const STRUCT_USB_HOST_ID __used umass_devs[] = {
708 	/* generic mass storage class */
709 	{USB_IFACE_CLASS(UICLASS_MASS),},
710 };
711 
712 DRIVER_MODULE(umass, uhub, umass_driver, NULL, NULL);
713 MODULE_DEPEND(umass, usb, 1, 1, 1);
714 MODULE_DEPEND(umass, cam, 1, 1, 1);
715 MODULE_VERSION(umass, 1);
716 USB_PNP_HOST_INFO(umass_devs);
717 
718 /*
719  * USB device probe/attach/detach
720  */
721 
722 static uint16_t
723 umass_get_proto(struct usb_interface *iface)
724 {
725 	struct usb_interface_descriptor *id;
726 	uint16_t retval;
727 
728 	retval = 0;
729 
730 	/* Check for a standards compliant device */
731 	id = usbd_get_interface_descriptor(iface);
732 	if ((id == NULL) ||
733 	    (id->bInterfaceClass != UICLASS_MASS)) {
734 		goto done;
735 	}
736 	switch (id->bInterfaceSubClass) {
737 	case UISUBCLASS_SCSI:
738 		retval |= UMASS_PROTO_SCSI;
739 		break;
740 	case UISUBCLASS_UFI:
741 		retval |= UMASS_PROTO_UFI;
742 		break;
743 	case UISUBCLASS_RBC:
744 		retval |= UMASS_PROTO_RBC;
745 		break;
746 	case UISUBCLASS_SFF8020I:
747 	case UISUBCLASS_SFF8070I:
748 		retval |= UMASS_PROTO_ATAPI;
749 		break;
750 	default:
751 		goto done;
752 	}
753 
754 	switch (id->bInterfaceProtocol) {
755 	case UIPROTO_MASS_CBI:
756 		retval |= UMASS_PROTO_CBI;
757 		break;
758 	case UIPROTO_MASS_CBI_I:
759 		retval |= UMASS_PROTO_CBI_I;
760 		break;
761 	case UIPROTO_MASS_BBB_OLD:
762 	case UIPROTO_MASS_BBB:
763 		retval |= UMASS_PROTO_BBB;
764 		break;
765 	default:
766 		goto done;
767 	}
768 done:
769 	return (retval);
770 }
771 
772 /*
773  * Match the device we are seeing with the devices supported.
774  */
775 static struct umass_probe_proto
776 umass_probe_proto(device_t dev, struct usb_attach_arg *uaa)
777 {
778 	struct umass_probe_proto ret;
779 	uint32_t quirks = NO_QUIRKS;
780 	uint32_t proto = umass_get_proto(uaa->iface);
781 
782 	memset(&ret, 0, sizeof(ret));
783 	ret.error = BUS_PROBE_GENERIC;
784 
785 	/* Check if we should deny probing. */
786 	if (usb_test_quirk(uaa, UQ_MSC_IGNORE)) {
787 		ret.error = ENXIO;
788 		goto done;
789 	}
790 
791 	/* Search for protocol enforcement */
792 
793 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_BBB)) {
794 		proto &= ~UMASS_PROTO_WIRE;
795 		proto |= UMASS_PROTO_BBB;
796 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI)) {
797 		proto &= ~UMASS_PROTO_WIRE;
798 		proto |= UMASS_PROTO_CBI;
799 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI_I)) {
800 		proto &= ~UMASS_PROTO_WIRE;
801 		proto |= UMASS_PROTO_CBI_I;
802 	}
803 
804 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_SCSI)) {
805 		proto &= ~UMASS_PROTO_COMMAND;
806 		proto |= UMASS_PROTO_SCSI;
807 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_ATAPI)) {
808 		proto &= ~UMASS_PROTO_COMMAND;
809 		proto |= UMASS_PROTO_ATAPI;
810 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_UFI)) {
811 		proto &= ~UMASS_PROTO_COMMAND;
812 		proto |= UMASS_PROTO_UFI;
813 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_RBC)) {
814 		proto &= ~UMASS_PROTO_COMMAND;
815 		proto |= UMASS_PROTO_RBC;
816 	}
817 
818 	/* Check if the protocol is invalid */
819 
820 	if ((proto & UMASS_PROTO_COMMAND) == 0) {
821 		ret.error = ENXIO;
822 		goto done;
823 	}
824 
825 	if ((proto & UMASS_PROTO_WIRE) == 0) {
826 		ret.error = ENXIO;
827 		goto done;
828 	}
829 
830 	/* Search for quirks */
831 
832 	if (usb_test_quirk(uaa, UQ_MSC_NO_TEST_UNIT_READY))
833 		quirks |= NO_TEST_UNIT_READY;
834 	if (usb_test_quirk(uaa, UQ_MSC_NO_RS_CLEAR_UA))
835 		quirks |= RS_NO_CLEAR_UA;
836 	if (usb_test_quirk(uaa, UQ_MSC_NO_START_STOP))
837 		quirks |= NO_START_STOP;
838 	if (usb_test_quirk(uaa, UQ_MSC_NO_GETMAXLUN))
839 		quirks |= NO_GETMAXLUN;
840 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY))
841 		quirks |= NO_INQUIRY;
842 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY_EVPD))
843 		quirks |= NO_INQUIRY_EVPD;
844 	if (usb_test_quirk(uaa, UQ_MSC_NO_PREVENT_ALLOW))
845 		quirks |= NO_PREVENT_ALLOW;
846 	if (usb_test_quirk(uaa, UQ_MSC_NO_SYNC_CACHE))
847 		quirks |= NO_SYNCHRONIZE_CACHE;
848 	if (usb_test_quirk(uaa, UQ_MSC_SHUTTLE_INIT))
849 		quirks |= SHUTTLE_INIT;
850 	if (usb_test_quirk(uaa, UQ_MSC_ALT_IFACE_1))
851 		quirks |= ALT_IFACE_1;
852 	if (usb_test_quirk(uaa, UQ_MSC_FLOPPY_SPEED))
853 		quirks |= FLOPPY_SPEED;
854 	if (usb_test_quirk(uaa, UQ_MSC_IGNORE_RESIDUE))
855 		quirks |= IGNORE_RESIDUE;
856 	if (usb_test_quirk(uaa, UQ_MSC_WRONG_CSWSIG))
857 		quirks |= WRONG_CSWSIG;
858 	if (usb_test_quirk(uaa, UQ_MSC_RBC_PAD_TO_12))
859 		quirks |= RBC_PAD_TO_12;
860 	if (usb_test_quirk(uaa, UQ_MSC_READ_CAP_OFFBY1))
861 		quirks |= READ_CAPACITY_OFFBY1;
862 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_SHORT_INQ))
863 		quirks |= FORCE_SHORT_INQUIRY;
864 
865 done:
866 	ret.quirks = quirks;
867 	ret.proto = proto;
868 	return (ret);
869 }
870 
871 static int
872 umass_probe(device_t dev)
873 {
874 	struct usb_attach_arg *uaa = device_get_ivars(dev);
875 	struct umass_probe_proto temp;
876 
877 	if (uaa->usb_mode != USB_MODE_HOST) {
878 		return (ENXIO);
879 	}
880 	temp = umass_probe_proto(dev, uaa);
881 
882 	return (temp.error);
883 }
884 
885 static int
886 umass_attach(device_t dev)
887 {
888 	struct umass_softc *sc = device_get_softc(dev);
889 	struct usb_attach_arg *uaa = device_get_ivars(dev);
890 	struct umass_probe_proto temp = umass_probe_proto(dev, uaa);
891 	struct usb_interface_descriptor *id;
892 	int err;
893 
894 	/*
895 	 * NOTE: the softc struct is cleared in device_set_driver.
896 	 * We can safely call umass_detach without specifically
897 	 * initializing the struct.
898 	 */
899 
900 	sc->sc_dev = dev;
901 	sc->sc_udev = uaa->device;
902 	sc->sc_proto = temp.proto;
903 	sc->sc_quirks = temp.quirks;
904 	sc->sc_unit = device_get_unit(dev);
905 
906 	snprintf(sc->sc_name, sizeof(sc->sc_name),
907 	    "%s", device_get_nameunit(dev));
908 
909 	device_set_usb_desc(dev);
910 
911         mtx_init(&sc->sc_mtx, device_get_nameunit(dev),
912 	    NULL, MTX_DEF | MTX_RECURSE);
913 
914 	/* get interface index */
915 
916 	id = usbd_get_interface_descriptor(uaa->iface);
917 	if (id == NULL) {
918 		device_printf(dev, "failed to get "
919 		    "interface number\n");
920 		goto detach;
921 	}
922 	sc->sc_iface_no = id->bInterfaceNumber;
923 
924 #ifdef USB_DEBUG
925 	device_printf(dev, " ");
926 
927 	switch (sc->sc_proto & UMASS_PROTO_COMMAND) {
928 	case UMASS_PROTO_SCSI:
929 		printf("SCSI");
930 		break;
931 	case UMASS_PROTO_ATAPI:
932 		printf("8070i (ATAPI)");
933 		break;
934 	case UMASS_PROTO_UFI:
935 		printf("UFI");
936 		break;
937 	case UMASS_PROTO_RBC:
938 		printf("RBC");
939 		break;
940 	default:
941 		printf("(unknown 0x%02x)",
942 		    sc->sc_proto & UMASS_PROTO_COMMAND);
943 		break;
944 	}
945 
946 	printf(" over ");
947 
948 	switch (sc->sc_proto & UMASS_PROTO_WIRE) {
949 	case UMASS_PROTO_BBB:
950 		printf("Bulk-Only");
951 		break;
952 	case UMASS_PROTO_CBI:		/* uses Comand/Bulk pipes */
953 		printf("CBI");
954 		break;
955 	case UMASS_PROTO_CBI_I:	/* uses Comand/Bulk/Interrupt pipes */
956 		printf("CBI with CCI");
957 		break;
958 	default:
959 		printf("(unknown 0x%02x)",
960 		    sc->sc_proto & UMASS_PROTO_WIRE);
961 	}
962 
963 	printf("; quirks = 0x%04x\n", sc->sc_quirks);
964 #endif
965 
966 	if (sc->sc_quirks & ALT_IFACE_1) {
967 		err = usbd_set_alt_interface_index
968 		    (uaa->device, uaa->info.bIfaceIndex, 1);
969 
970 		if (err) {
971 			DPRINTF(sc, UDMASS_USB, "could not switch to "
972 			    "Alt Interface 1\n");
973 			goto detach;
974 		}
975 	}
976 	/* allocate all required USB transfers */
977 
978 	if (sc->sc_proto & UMASS_PROTO_BBB) {
979 		err = usbd_transfer_setup(uaa->device,
980 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_bbb_config,
981 		    UMASS_T_BBB_MAX, sc, &sc->sc_mtx);
982 
983 		/* skip reset first time */
984 		sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
985 
986 	} else if (sc->sc_proto & (UMASS_PROTO_CBI | UMASS_PROTO_CBI_I)) {
987 		err = usbd_transfer_setup(uaa->device,
988 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_cbi_config,
989 		    UMASS_T_CBI_MAX, sc, &sc->sc_mtx);
990 
991 		/* skip reset first time */
992 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
993 
994 	} else {
995 		err = USB_ERR_INVAL;
996 	}
997 
998 	if (err) {
999 		device_printf(dev, "could not setup required "
1000 		    "transfers, %s\n", usbd_errstr(err));
1001 		goto detach;
1002 	}
1003 #ifdef USB_DEBUG
1004 	if (umass_throttle > 0) {
1005 		uint8_t x;
1006 		int iv;
1007 
1008 		iv = umass_throttle;
1009 
1010 		if (iv < 1)
1011 			iv = 1;
1012 		else if (iv > 8000)
1013 			iv = 8000;
1014 
1015 		for (x = 0; x != UMASS_T_MAX; x++) {
1016 			if (sc->sc_xfer[x] != NULL)
1017 				usbd_xfer_set_interval(sc->sc_xfer[x], iv);
1018 		}
1019 	}
1020 #endif
1021 	sc->sc_transform =
1022 	    (sc->sc_proto & UMASS_PROTO_SCSI) ? &umass_scsi_transform :
1023 	    (sc->sc_proto & UMASS_PROTO_UFI) ? &umass_ufi_transform :
1024 	    (sc->sc_proto & UMASS_PROTO_ATAPI) ? &umass_atapi_transform :
1025 	    (sc->sc_proto & UMASS_PROTO_RBC) ? &umass_rbc_transform :
1026 	    &umass_no_transform;
1027 
1028 	/* from here onwards the device can be used. */
1029 
1030 	if (sc->sc_quirks & SHUTTLE_INIT) {
1031 		umass_init_shuttle(sc);
1032 	}
1033 	/* get the maximum LUN supported by the device */
1034 
1035 	if (((sc->sc_proto & UMASS_PROTO_WIRE) == UMASS_PROTO_BBB) &&
1036 	    !(sc->sc_quirks & NO_GETMAXLUN))
1037 		sc->sc_maxlun = umass_bbb_get_max_lun(sc);
1038 	else
1039 		sc->sc_maxlun = 0;
1040 
1041 	/* Prepare the SCSI command block */
1042 	sc->cam_scsi_sense.opcode = REQUEST_SENSE;
1043 	sc->cam_scsi_test_unit_ready.opcode = TEST_UNIT_READY;
1044 
1045 	/* register the SIM */
1046 	err = umass_cam_attach_sim(sc);
1047 	if (err) {
1048 		goto detach;
1049 	}
1050 	/* scan the SIM */
1051 	umass_cam_attach(sc);
1052 
1053 	DPRINTF(sc, UDMASS_GEN, "Attach finished\n");
1054 
1055 	return (0);			/* success */
1056 
1057 detach:
1058 	umass_detach(dev);
1059 	return (ENXIO);			/* failure */
1060 }
1061 
1062 static int
1063 umass_detach(device_t dev)
1064 {
1065 	struct umass_softc *sc = device_get_softc(dev);
1066 
1067 	DPRINTF(sc, UDMASS_USB, "\n");
1068 
1069 	/* teardown our statemachine */
1070 
1071 	usbd_transfer_unsetup(sc->sc_xfer, UMASS_T_MAX);
1072 
1073 	mtx_lock(&sc->sc_mtx);
1074 
1075 	/* cancel any leftover CCB's */
1076 
1077 	umass_cancel_ccb(sc);
1078 
1079 	umass_cam_detach_sim(sc);
1080 
1081 	mtx_unlock(&sc->sc_mtx);
1082 
1083 	mtx_destroy(&sc->sc_mtx);
1084 
1085 	return (0);			/* success */
1086 }
1087 
1088 static void
1089 umass_init_shuttle(struct umass_softc *sc)
1090 {
1091 	struct usb_device_request req;
1092 	uint8_t status[2] = {0, 0};
1093 
1094 	/*
1095 	 * The Linux driver does this, but no one can tell us what the
1096 	 * command does.
1097 	 */
1098 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1099 	req.bRequest = 1;		/* XXX unknown command */
1100 	USETW(req.wValue, 0);
1101 	req.wIndex[0] = sc->sc_iface_no;
1102 	req.wIndex[1] = 0;
1103 	USETW(req.wLength, sizeof(status));
1104 	usbd_do_request(sc->sc_udev, NULL, &req, &status);
1105 
1106 	DPRINTF(sc, UDMASS_GEN, "Shuttle init returned 0x%02x%02x\n",
1107 	    status[0], status[1]);
1108 }
1109 
1110 /*
1111  * Generic functions to handle transfers
1112  */
1113 
1114 static void
1115 umass_transfer_start(struct umass_softc *sc, uint8_t xfer_index)
1116 {
1117 	DPRINTF(sc, UDMASS_GEN, "transfer index = "
1118 	    "%d\n", xfer_index);
1119 
1120 	if (sc->sc_xfer[xfer_index]) {
1121 		sc->sc_last_xfer_index = xfer_index;
1122 		usbd_transfer_start(sc->sc_xfer[xfer_index]);
1123 	} else {
1124 		umass_cancel_ccb(sc);
1125 	}
1126 }
1127 
1128 static void
1129 umass_reset(struct umass_softc *sc)
1130 {
1131 	DPRINTF(sc, UDMASS_GEN, "resetting device\n");
1132 
1133 	/*
1134 	 * stop the last transfer, if not already stopped:
1135 	 */
1136 	usbd_transfer_stop(sc->sc_xfer[sc->sc_last_xfer_index]);
1137 	umass_transfer_start(sc, 0);
1138 }
1139 
1140 static void
1141 umass_cancel_ccb(struct umass_softc *sc)
1142 {
1143 	union ccb *ccb;
1144 
1145 	USB_MTX_ASSERT(&sc->sc_mtx, MA_OWNED);
1146 
1147 	ccb = sc->sc_transfer.ccb;
1148 	sc->sc_transfer.ccb = NULL;
1149 	sc->sc_last_xfer_index = 0;
1150 
1151 	if (ccb) {
1152 		(sc->sc_transfer.callback)
1153 		    (sc, ccb, (sc->sc_transfer.data_len -
1154 		    sc->sc_transfer.actlen), STATUS_WIRE_FAILED);
1155 	}
1156 }
1157 
1158 static void
1159 umass_tr_error(struct usb_xfer *xfer, usb_error_t error)
1160 {
1161 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1162 
1163 	if (error != USB_ERR_CANCELLED) {
1164 		DPRINTF(sc, UDMASS_GEN, "transfer error, %s -> "
1165 		    "reset\n", usbd_errstr(error));
1166 	}
1167 	umass_cancel_ccb(sc);
1168 }
1169 
1170 /*
1171  * BBB protocol specific functions
1172  */
1173 
1174 static void
1175 umass_t_bbb_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1176 {
1177 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1178 	struct usb_device_request req;
1179 	struct usb_page_cache *pc;
1180 
1181 	switch (USB_GET_STATE(xfer)) {
1182 	case USB_ST_TRANSFERRED:
1183 		umass_transfer_start(sc, UMASS_T_BBB_RESET2);
1184 		return;
1185 
1186 	case USB_ST_SETUP:
1187 		/*
1188 		 * Reset recovery (5.3.4 in Universal Serial Bus Mass Storage Class)
1189 		 *
1190 		 * For Reset Recovery the host shall issue in the following order:
1191 		 * a) a Bulk-Only Mass Storage Reset
1192 		 * b) a Clear Feature HALT to the Bulk-In endpoint
1193 		 * c) a Clear Feature HALT to the Bulk-Out endpoint
1194 		 *
1195 		 * This is done in 3 steps, using 3 transfers:
1196 		 * UMASS_T_BBB_RESET1
1197 		 * UMASS_T_BBB_RESET2
1198 		 * UMASS_T_BBB_RESET3
1199 		 */
1200 
1201 		DPRINTF(sc, UDMASS_BBB, "BBB reset!\n");
1202 
1203 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1204 		req.bRequest = UR_BBB_RESET;	/* bulk only reset */
1205 		USETW(req.wValue, 0);
1206 		req.wIndex[0] = sc->sc_iface_no;
1207 		req.wIndex[1] = 0;
1208 		USETW(req.wLength, 0);
1209 
1210 		pc = usbd_xfer_get_frame(xfer, 0);
1211 		usbd_copy_in(pc, 0, &req, sizeof(req));
1212 
1213 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1214 		usbd_xfer_set_frames(xfer, 1);
1215 		usbd_transfer_submit(xfer);
1216 		return;
1217 
1218 	default:			/* Error */
1219 		umass_tr_error(xfer, error);
1220 		return;
1221 	}
1222 }
1223 
1224 static void
1225 umass_t_bbb_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1226 {
1227 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_RESET3,
1228 	    UMASS_T_BBB_DATA_READ, error);
1229 }
1230 
1231 static void
1232 umass_t_bbb_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1233 {
1234 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_COMMAND,
1235 	    UMASS_T_BBB_DATA_WRITE, error);
1236 }
1237 
1238 static void
1239 umass_t_bbb_data_clear_stall_callback(struct usb_xfer *xfer,
1240     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1241 {
1242 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1243 
1244 	switch (USB_GET_STATE(xfer)) {
1245 	case USB_ST_TRANSFERRED:
1246 tr_transferred:
1247 		umass_transfer_start(sc, next_xfer);
1248 		return;
1249 
1250 	case USB_ST_SETUP:
1251 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1252 			goto tr_transferred;
1253 		}
1254 		return;
1255 
1256 	default:			/* Error */
1257 		umass_tr_error(xfer, error);
1258 		return;
1259 	}
1260 }
1261 
1262 static void
1263 umass_t_bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
1264 {
1265 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1266 	union ccb *ccb = sc->sc_transfer.ccb;
1267 	struct usb_page_cache *pc;
1268 	uint32_t tag;
1269 
1270 	switch (USB_GET_STATE(xfer)) {
1271 	case USB_ST_TRANSFERRED:
1272 		umass_transfer_start
1273 		    (sc, ((sc->sc_transfer.dir == DIR_IN) ? UMASS_T_BBB_DATA_READ :
1274 		    (sc->sc_transfer.dir == DIR_OUT) ? UMASS_T_BBB_DATA_WRITE :
1275 		    UMASS_T_BBB_STATUS));
1276 		return;
1277 
1278 	case USB_ST_SETUP:
1279 
1280 		sc->sc_status_try = 0;
1281 
1282 		if (ccb) {
1283 			/*
1284 		         * the initial value is not important,
1285 		         * as long as the values are unique:
1286 		         */
1287 			tag = UGETDW(sc->cbw.dCBWTag) + 1;
1288 
1289 			USETDW(sc->cbw.dCBWSignature, CBWSIGNATURE);
1290 			USETDW(sc->cbw.dCBWTag, tag);
1291 
1292 			/*
1293 		         * dCBWDataTransferLength:
1294 		         *   This field indicates the number of bytes of data that the host
1295 		         *   intends to transfer on the IN or OUT Bulk endpoint(as indicated by
1296 		         *   the Direction bit) during the execution of this command. If this
1297 		         *   field is set to 0, the device will expect that no data will be
1298 		         *   transferred IN or OUT during this command, regardless of the value
1299 		         *   of the Direction bit defined in dCBWFlags.
1300 		         */
1301 			USETDW(sc->cbw.dCBWDataTransferLength, sc->sc_transfer.data_len);
1302 
1303 			/*
1304 		         * dCBWFlags:
1305 		         *   The bits of the Flags field are defined as follows:
1306 		         *     Bits 0-6  reserved
1307 		         *     Bit  7    Direction - this bit shall be ignored if the
1308 		         *                           dCBWDataTransferLength field is zero.
1309 		         *               0 = data Out from host to device
1310 		         *               1 = data In from device to host
1311 		         */
1312 			sc->cbw.bCBWFlags = ((sc->sc_transfer.dir == DIR_IN) ?
1313 			    CBWFLAGS_IN : CBWFLAGS_OUT);
1314 			sc->cbw.bCBWLUN = sc->sc_transfer.lun;
1315 
1316 			if (sc->sc_transfer.cmd_len > sizeof(sc->cbw.CBWCDB)) {
1317 				sc->sc_transfer.cmd_len = sizeof(sc->cbw.CBWCDB);
1318 				DPRINTF(sc, UDMASS_BBB, "Truncating long command!\n");
1319 			}
1320 			sc->cbw.bCDBLength = sc->sc_transfer.cmd_len;
1321 
1322 			/* copy SCSI command data */
1323 			memcpy(sc->cbw.CBWCDB, sc->sc_transfer.cmd_data,
1324 			    sc->sc_transfer.cmd_len);
1325 
1326 			/* clear remaining command area */
1327 			memset(sc->cbw.CBWCDB +
1328 			    sc->sc_transfer.cmd_len, 0,
1329 			    sizeof(sc->cbw.CBWCDB) -
1330 			    sc->sc_transfer.cmd_len);
1331 
1332 			DIF(UDMASS_BBB, umass_bbb_dump_cbw(sc, &sc->cbw));
1333 
1334 			pc = usbd_xfer_get_frame(xfer, 0);
1335 			usbd_copy_in(pc, 0, &sc->cbw, sizeof(sc->cbw));
1336 			usbd_xfer_set_frame_len(xfer, 0, sizeof(sc->cbw));
1337 
1338 			usbd_transfer_submit(xfer);
1339 		}
1340 		return;
1341 
1342 	default:			/* Error */
1343 		umass_tr_error(xfer, error);
1344 		return;
1345 	}
1346 }
1347 
1348 static void
1349 umass_t_bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1350 {
1351 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1352 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1353 	int actlen, sumlen;
1354 
1355 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1356 
1357 	switch (USB_GET_STATE(xfer)) {
1358 	case USB_ST_TRANSFERRED:
1359 		sc->sc_transfer.data_rem -= actlen;
1360 		sc->sc_transfer.data_ptr += actlen;
1361 		sc->sc_transfer.actlen += actlen;
1362 
1363 		if (actlen < sumlen) {
1364 			/* short transfer */
1365 			sc->sc_transfer.data_rem = 0;
1366 		}
1367 	case USB_ST_SETUP:
1368 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1369 		    max_bulk, sc->sc_transfer.data_rem);
1370 
1371 		if (sc->sc_transfer.data_rem == 0) {
1372 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1373 			return;
1374 		}
1375 		if (max_bulk > sc->sc_transfer.data_rem) {
1376 			max_bulk = sc->sc_transfer.data_rem;
1377 		}
1378 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1379 
1380 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1381 		    max_bulk);
1382 
1383 		usbd_transfer_submit(xfer);
1384 		return;
1385 
1386 	default:			/* Error */
1387 		if (error == USB_ERR_CANCELLED) {
1388 			umass_tr_error(xfer, error);
1389 		} else {
1390 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1391 		}
1392 		return;
1393 	}
1394 }
1395 
1396 static void
1397 umass_t_bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1398 {
1399 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1400 	    UMASS_T_BBB_DATA_READ, error);
1401 }
1402 
1403 static void
1404 umass_t_bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1405 {
1406 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1407 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1408 	int actlen, sumlen;
1409 
1410 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1411 
1412 	switch (USB_GET_STATE(xfer)) {
1413 	case USB_ST_TRANSFERRED:
1414 		sc->sc_transfer.data_rem -= actlen;
1415 		sc->sc_transfer.data_ptr += actlen;
1416 		sc->sc_transfer.actlen += actlen;
1417 
1418 		if (actlen < sumlen) {
1419 			/* short transfer */
1420 			sc->sc_transfer.data_rem = 0;
1421 		}
1422 	case USB_ST_SETUP:
1423 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1424 		    max_bulk, sc->sc_transfer.data_rem);
1425 
1426 		if (sc->sc_transfer.data_rem == 0) {
1427 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1428 			return;
1429 		}
1430 		if (max_bulk > sc->sc_transfer.data_rem) {
1431 			max_bulk = sc->sc_transfer.data_rem;
1432 		}
1433 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1434 
1435 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1436 		    max_bulk);
1437 
1438 		usbd_transfer_submit(xfer);
1439 		return;
1440 
1441 	default:			/* Error */
1442 		if (error == USB_ERR_CANCELLED) {
1443 			umass_tr_error(xfer, error);
1444 		} else {
1445 			umass_transfer_start(sc, UMASS_T_BBB_DATA_WR_CS);
1446 		}
1447 		return;
1448 	}
1449 }
1450 
1451 static void
1452 umass_t_bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1453 {
1454 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1455 	    UMASS_T_BBB_DATA_WRITE, error);
1456 }
1457 
1458 static void
1459 umass_t_bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
1460 {
1461 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1462 	union ccb *ccb = sc->sc_transfer.ccb;
1463 	struct usb_page_cache *pc;
1464 	uint32_t residue;
1465 	int actlen;
1466 
1467 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1468 
1469 	switch (USB_GET_STATE(xfer)) {
1470 	case USB_ST_TRANSFERRED:
1471 
1472 		/*
1473 		 * Do a full reset if there is something wrong with the CSW:
1474 		 */
1475 		sc->sc_status_try = 1;
1476 
1477 		/* Zero missing parts of the CSW: */
1478 
1479 		if (actlen < (int)sizeof(sc->csw))
1480 			memset(&sc->csw, 0, sizeof(sc->csw));
1481 
1482 		pc = usbd_xfer_get_frame(xfer, 0);
1483 		usbd_copy_out(pc, 0, &sc->csw, actlen);
1484 
1485 		DIF(UDMASS_BBB, umass_bbb_dump_csw(sc, &sc->csw));
1486 
1487 		residue = UGETDW(sc->csw.dCSWDataResidue);
1488 
1489 		if ((!residue) || (sc->sc_quirks & IGNORE_RESIDUE)) {
1490 			residue = (sc->sc_transfer.data_len -
1491 			    sc->sc_transfer.actlen);
1492 		}
1493 		if (residue > sc->sc_transfer.data_len) {
1494 			DPRINTF(sc, UDMASS_BBB, "truncating residue from %d "
1495 			    "to %d bytes\n", residue, sc->sc_transfer.data_len);
1496 			residue = sc->sc_transfer.data_len;
1497 		}
1498 		/* translate weird command-status signatures: */
1499 		if (sc->sc_quirks & WRONG_CSWSIG) {
1500 			uint32_t temp = UGETDW(sc->csw.dCSWSignature);
1501 
1502 			if ((temp == CSWSIGNATURE_OLYMPUS_C1) ||
1503 			    (temp == CSWSIGNATURE_IMAGINATION_DBX1)) {
1504 				USETDW(sc->csw.dCSWSignature, CSWSIGNATURE);
1505 			}
1506 		}
1507 		/* check CSW and handle eventual error */
1508 		if (UGETDW(sc->csw.dCSWSignature) != CSWSIGNATURE) {
1509 			DPRINTF(sc, UDMASS_BBB, "bad CSW signature 0x%08x != 0x%08x\n",
1510 			    UGETDW(sc->csw.dCSWSignature), CSWSIGNATURE);
1511 			/*
1512 			 * Invalid CSW: Wrong signature or wrong tag might
1513 			 * indicate that we lost synchronization. Reset the
1514 			 * device.
1515 			 */
1516 			goto tr_error;
1517 		} else if (UGETDW(sc->csw.dCSWTag) != UGETDW(sc->cbw.dCBWTag)) {
1518 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: tag 0x%08x should be "
1519 			    "0x%08x\n", UGETDW(sc->csw.dCSWTag),
1520 			    UGETDW(sc->cbw.dCBWTag));
1521 			goto tr_error;
1522 		} else if (sc->csw.bCSWStatus > CSWSTATUS_PHASE) {
1523 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: status %d > %d\n",
1524 			    sc->csw.bCSWStatus, CSWSTATUS_PHASE);
1525 			goto tr_error;
1526 		} else if (sc->csw.bCSWStatus == CSWSTATUS_PHASE) {
1527 			DPRINTF(sc, UDMASS_BBB, "Phase error, residue = "
1528 			    "%d\n", residue);
1529 			goto tr_error;
1530 		} else if (sc->sc_transfer.actlen > sc->sc_transfer.data_len) {
1531 			DPRINTF(sc, UDMASS_BBB, "Buffer overrun %d > %d\n",
1532 			    sc->sc_transfer.actlen, sc->sc_transfer.data_len);
1533 			goto tr_error;
1534 		} else if (sc->csw.bCSWStatus == CSWSTATUS_FAILED) {
1535 			DPRINTF(sc, UDMASS_BBB, "Command failed, residue = "
1536 			    "%d\n", residue);
1537 
1538 			sc->sc_transfer.ccb = NULL;
1539 
1540 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1541 
1542 			(sc->sc_transfer.callback)
1543 			    (sc, ccb, residue, STATUS_CMD_FAILED);
1544 		} else {
1545 			sc->sc_transfer.ccb = NULL;
1546 
1547 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1548 
1549 			(sc->sc_transfer.callback)
1550 			    (sc, ccb, residue, STATUS_CMD_OK);
1551 		}
1552 		return;
1553 
1554 	case USB_ST_SETUP:
1555 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1556 		usbd_transfer_submit(xfer);
1557 		return;
1558 
1559 	default:
1560 tr_error:
1561 		DPRINTF(sc, UDMASS_BBB, "Failed to read CSW: %s, try %d\n",
1562 		    usbd_errstr(error), sc->sc_status_try);
1563 
1564 		if ((error == USB_ERR_CANCELLED) ||
1565 		    (sc->sc_status_try)) {
1566 			umass_tr_error(xfer, error);
1567 		} else {
1568 			sc->sc_status_try = 1;
1569 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1570 		}
1571 		return;
1572 	}
1573 }
1574 
1575 static void
1576 umass_command_start(struct umass_softc *sc, uint8_t dir,
1577     void *data_ptr, uint32_t data_len,
1578     uint32_t data_timeout, umass_callback_t *callback,
1579     union ccb *ccb)
1580 {
1581 	sc->sc_transfer.lun = ccb->ccb_h.target_lun;
1582 
1583 	/*
1584 	 * NOTE: assumes that "sc->sc_transfer.cmd_data" and
1585 	 * "sc->sc_transfer.cmd_len" has been properly
1586 	 * initialized.
1587 	 */
1588 
1589 	sc->sc_transfer.dir = data_len ? dir : DIR_NONE;
1590 	sc->sc_transfer.data_ptr = data_ptr;
1591 	sc->sc_transfer.data_len = data_len;
1592 	sc->sc_transfer.data_rem = data_len;
1593 	sc->sc_transfer.data_timeout = (data_timeout + UMASS_TIMEOUT);
1594 
1595 	sc->sc_transfer.actlen = 0;
1596 	sc->sc_transfer.callback = callback;
1597 	sc->sc_transfer.ccb = ccb;
1598 
1599 	if (sc->sc_xfer[sc->sc_last_xfer_index]) {
1600 		usbd_transfer_start(sc->sc_xfer[sc->sc_last_xfer_index]);
1601 	} else {
1602 		umass_cancel_ccb(sc);
1603 	}
1604 }
1605 
1606 static uint8_t
1607 umass_bbb_get_max_lun(struct umass_softc *sc)
1608 {
1609 	struct usb_device_request req;
1610 	usb_error_t err;
1611 	uint8_t buf = 0;
1612 
1613 	/* The Get Max Lun command is a class-specific request. */
1614 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
1615 	req.bRequest = UR_BBB_GET_MAX_LUN;
1616 	USETW(req.wValue, 0);
1617 	req.wIndex[0] = sc->sc_iface_no;
1618 	req.wIndex[1] = 0;
1619 	USETW(req.wLength, 1);
1620 
1621 	err = usbd_do_request(sc->sc_udev, NULL, &req, &buf);
1622 	if (err) {
1623 		buf = 0;
1624 
1625 		/* Device doesn't support Get Max Lun request. */
1626 		printf("%s: Get Max Lun not supported (%s)\n",
1627 		    sc->sc_name, usbd_errstr(err));
1628 	}
1629 	return (buf);
1630 }
1631 
1632 /*
1633  * Command/Bulk/Interrupt (CBI) specific functions
1634  */
1635 
1636 static void
1637 umass_cbi_start_status(struct umass_softc *sc)
1638 {
1639 	if (sc->sc_xfer[UMASS_T_CBI_STATUS]) {
1640 		umass_transfer_start(sc, UMASS_T_CBI_STATUS);
1641 	} else {
1642 		union ccb *ccb = sc->sc_transfer.ccb;
1643 
1644 		sc->sc_transfer.ccb = NULL;
1645 
1646 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1647 
1648 		(sc->sc_transfer.callback)
1649 		    (sc, ccb, (sc->sc_transfer.data_len -
1650 		    sc->sc_transfer.actlen), STATUS_CMD_UNKNOWN);
1651 	}
1652 }
1653 
1654 static void
1655 umass_t_cbi_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1656 {
1657 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1658 	struct usb_device_request req;
1659 	struct usb_page_cache *pc;
1660 	uint8_t buf[UMASS_CBI_DIAGNOSTIC_CMDLEN];
1661 
1662 	uint8_t i;
1663 
1664 	switch (USB_GET_STATE(xfer)) {
1665 	case USB_ST_TRANSFERRED:
1666 		umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1667 		break;
1668 
1669 	case USB_ST_SETUP:
1670 		/*
1671 		 * Command Block Reset Protocol
1672 		 *
1673 		 * First send a reset request to the device. Then clear
1674 		 * any possibly stalled bulk endpoints.
1675 		 *
1676 		 * This is done in 3 steps, using 3 transfers:
1677 		 * UMASS_T_CBI_RESET1
1678 		 * UMASS_T_CBI_RESET2
1679 		 * UMASS_T_CBI_RESET3
1680 		 * UMASS_T_CBI_RESET4 (only if there is an interrupt endpoint)
1681 		 */
1682 
1683 		DPRINTF(sc, UDMASS_CBI, "CBI reset!\n");
1684 
1685 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1686 		req.bRequest = UR_CBI_ADSC;
1687 		USETW(req.wValue, 0);
1688 		req.wIndex[0] = sc->sc_iface_no;
1689 		req.wIndex[1] = 0;
1690 		USETW(req.wLength, UMASS_CBI_DIAGNOSTIC_CMDLEN);
1691 
1692 		/*
1693 		 * The 0x1d code is the SEND DIAGNOSTIC command. To
1694 		 * distinguish between the two, the last 10 bytes of the CBL
1695 		 * is filled with 0xff (section 2.2 of the CBI
1696 		 * specification)
1697 		 */
1698 		buf[0] = 0x1d;		/* Command Block Reset */
1699 		buf[1] = 0x04;
1700 
1701 		for (i = 2; i < UMASS_CBI_DIAGNOSTIC_CMDLEN; i++) {
1702 			buf[i] = 0xff;
1703 		}
1704 
1705 		pc = usbd_xfer_get_frame(xfer, 0);
1706 		usbd_copy_in(pc, 0, &req, sizeof(req));
1707 		pc = usbd_xfer_get_frame(xfer, 1);
1708 		usbd_copy_in(pc, 0, buf, sizeof(buf));
1709 
1710 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1711 		usbd_xfer_set_frame_len(xfer, 1, sizeof(buf));
1712 		usbd_xfer_set_frames(xfer, 2);
1713 		usbd_transfer_submit(xfer);
1714 		break;
1715 
1716 	default:			/* Error */
1717 		if (error == USB_ERR_CANCELLED)
1718 			umass_tr_error(xfer, error);
1719 		else
1720 			umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1721 		break;
1722 	}
1723 }
1724 
1725 static void
1726 umass_t_cbi_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1727 {
1728 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_RESET3,
1729 	    UMASS_T_CBI_DATA_READ, error);
1730 }
1731 
1732 static void
1733 umass_t_cbi_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1734 {
1735 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1736 
1737 	umass_t_cbi_data_clear_stall_callback
1738 	    (xfer, (sc->sc_xfer[UMASS_T_CBI_RESET4] &&
1739 	    sc->sc_xfer[UMASS_T_CBI_STATUS]) ?
1740 	    UMASS_T_CBI_RESET4 : UMASS_T_CBI_COMMAND,
1741 	    UMASS_T_CBI_DATA_WRITE, error);
1742 }
1743 
1744 static void
1745 umass_t_cbi_reset4_callback(struct usb_xfer *xfer, usb_error_t error)
1746 {
1747 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_COMMAND,
1748 	    UMASS_T_CBI_STATUS, error);
1749 }
1750 
1751 static void
1752 umass_t_cbi_data_clear_stall_callback(struct usb_xfer *xfer,
1753     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1754 {
1755 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1756 
1757 	switch (USB_GET_STATE(xfer)) {
1758 	case USB_ST_TRANSFERRED:
1759 tr_transferred:
1760 		if (next_xfer == UMASS_T_CBI_STATUS) {
1761 			umass_cbi_start_status(sc);
1762 		} else {
1763 			umass_transfer_start(sc, next_xfer);
1764 		}
1765 		break;
1766 
1767 	case USB_ST_SETUP:
1768 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1769 			goto tr_transferred;	/* should not happen */
1770 		}
1771 		break;
1772 
1773 	default:			/* Error */
1774 		umass_tr_error(xfer, error);
1775 		break;
1776 	}
1777 }
1778 
1779 static void
1780 umass_t_cbi_command_callback(struct usb_xfer *xfer, usb_error_t error)
1781 {
1782 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1783 	union ccb *ccb = sc->sc_transfer.ccb;
1784 	struct usb_device_request req;
1785 	struct usb_page_cache *pc;
1786 
1787 	switch (USB_GET_STATE(xfer)) {
1788 	case USB_ST_TRANSFERRED:
1789 
1790 		if (sc->sc_transfer.dir == DIR_NONE) {
1791 			umass_cbi_start_status(sc);
1792 		} else {
1793 			umass_transfer_start
1794 			    (sc, (sc->sc_transfer.dir == DIR_IN) ?
1795 			    UMASS_T_CBI_DATA_READ : UMASS_T_CBI_DATA_WRITE);
1796 		}
1797 		break;
1798 
1799 	case USB_ST_SETUP:
1800 
1801 		if (ccb) {
1802 			/*
1803 		         * do a CBI transfer with cmd_len bytes from
1804 		         * cmd_data, possibly a data phase of data_len
1805 		         * bytes from/to the device and finally a status
1806 		         * read phase.
1807 		         */
1808 
1809 			req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1810 			req.bRequest = UR_CBI_ADSC;
1811 			USETW(req.wValue, 0);
1812 			req.wIndex[0] = sc->sc_iface_no;
1813 			req.wIndex[1] = 0;
1814 			req.wLength[0] = sc->sc_transfer.cmd_len;
1815 			req.wLength[1] = 0;
1816 
1817 			pc = usbd_xfer_get_frame(xfer, 0);
1818 			usbd_copy_in(pc, 0, &req, sizeof(req));
1819 			pc = usbd_xfer_get_frame(xfer, 1);
1820 			usbd_copy_in(pc, 0, sc->sc_transfer.cmd_data,
1821 			    sc->sc_transfer.cmd_len);
1822 
1823 			usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1824 			usbd_xfer_set_frame_len(xfer, 1, sc->sc_transfer.cmd_len);
1825 			usbd_xfer_set_frames(xfer,
1826 			    sc->sc_transfer.cmd_len ? 2 : 1);
1827 
1828 			DIF(UDMASS_CBI,
1829 			    umass_cbi_dump_cmd(sc,
1830 			    sc->sc_transfer.cmd_data,
1831 			    sc->sc_transfer.cmd_len));
1832 
1833 			usbd_transfer_submit(xfer);
1834 		}
1835 		break;
1836 
1837 	default:			/* Error */
1838 		/*
1839 		 * STALL on the control pipe can be result of the command error.
1840 		 * Attempt to clear this STALL same as for bulk pipe also
1841 		 * results in command completion interrupt, but ASC/ASCQ there
1842 		 * look like not always valid, so don't bother about it.
1843 		 */
1844 		if ((error == USB_ERR_STALLED) ||
1845 		    (sc->sc_transfer.callback == &umass_cam_cb)) {
1846 			sc->sc_transfer.ccb = NULL;
1847 			(sc->sc_transfer.callback)
1848 			    (sc, ccb, sc->sc_transfer.data_len,
1849 			    STATUS_CMD_UNKNOWN);
1850 		} else {
1851 			umass_tr_error(xfer, error);
1852 			/* skip reset */
1853 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1854 		}
1855 		break;
1856 	}
1857 }
1858 
1859 static void
1860 umass_t_cbi_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1861 {
1862 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1863 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1864 	int actlen, sumlen;
1865 
1866 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1867 
1868 	switch (USB_GET_STATE(xfer)) {
1869 	case USB_ST_TRANSFERRED:
1870 		sc->sc_transfer.data_rem -= actlen;
1871 		sc->sc_transfer.data_ptr += actlen;
1872 		sc->sc_transfer.actlen += actlen;
1873 
1874 		if (actlen < sumlen) {
1875 			/* short transfer */
1876 			sc->sc_transfer.data_rem = 0;
1877 		}
1878 	case USB_ST_SETUP:
1879 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1880 		    max_bulk, sc->sc_transfer.data_rem);
1881 
1882 		if (sc->sc_transfer.data_rem == 0) {
1883 			umass_cbi_start_status(sc);
1884 			break;
1885 		}
1886 		if (max_bulk > sc->sc_transfer.data_rem) {
1887 			max_bulk = sc->sc_transfer.data_rem;
1888 		}
1889 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1890 
1891 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1892 		    max_bulk);
1893 
1894 		usbd_transfer_submit(xfer);
1895 		break;
1896 
1897 	default:			/* Error */
1898 		if ((error == USB_ERR_CANCELLED) ||
1899 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1900 			umass_tr_error(xfer, error);
1901 		} else {
1902 			umass_transfer_start(sc, UMASS_T_CBI_DATA_RD_CS);
1903 		}
1904 		break;
1905 	}
1906 }
1907 
1908 static void
1909 umass_t_cbi_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1910 {
1911 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1912 	    UMASS_T_CBI_DATA_READ, error);
1913 }
1914 
1915 static void
1916 umass_t_cbi_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1917 {
1918 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1919 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1920 	int actlen, sumlen;
1921 
1922 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1923 
1924 	switch (USB_GET_STATE(xfer)) {
1925 	case USB_ST_TRANSFERRED:
1926 		sc->sc_transfer.data_rem -= actlen;
1927 		sc->sc_transfer.data_ptr += actlen;
1928 		sc->sc_transfer.actlen += actlen;
1929 
1930 		if (actlen < sumlen) {
1931 			/* short transfer */
1932 			sc->sc_transfer.data_rem = 0;
1933 		}
1934 	case USB_ST_SETUP:
1935 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1936 		    max_bulk, sc->sc_transfer.data_rem);
1937 
1938 		if (sc->sc_transfer.data_rem == 0) {
1939 			umass_cbi_start_status(sc);
1940 			break;
1941 		}
1942 		if (max_bulk > sc->sc_transfer.data_rem) {
1943 			max_bulk = sc->sc_transfer.data_rem;
1944 		}
1945 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1946 
1947 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1948 		    max_bulk);
1949 
1950 		usbd_transfer_submit(xfer);
1951 		break;
1952 
1953 	default:			/* Error */
1954 		if ((error == USB_ERR_CANCELLED) ||
1955 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1956 			umass_tr_error(xfer, error);
1957 		} else {
1958 			umass_transfer_start(sc, UMASS_T_CBI_DATA_WR_CS);
1959 		}
1960 		break;
1961 	}
1962 }
1963 
1964 static void
1965 umass_t_cbi_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1966 {
1967 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1968 	    UMASS_T_CBI_DATA_WRITE, error);
1969 }
1970 
1971 static void
1972 umass_t_cbi_status_callback(struct usb_xfer *xfer, usb_error_t error)
1973 {
1974 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1975 	union ccb *ccb = sc->sc_transfer.ccb;
1976 	struct usb_page_cache *pc;
1977 	uint32_t residue;
1978 	uint8_t status;
1979 	int actlen;
1980 
1981 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1982 
1983 	switch (USB_GET_STATE(xfer)) {
1984 	case USB_ST_TRANSFERRED:
1985 
1986 		if (actlen < (int)sizeof(sc->sbl)) {
1987 			goto tr_setup;
1988 		}
1989 		pc = usbd_xfer_get_frame(xfer, 0);
1990 		usbd_copy_out(pc, 0, &sc->sbl, sizeof(sc->sbl));
1991 
1992 		residue = (sc->sc_transfer.data_len -
1993 		    sc->sc_transfer.actlen);
1994 
1995 		/* dissect the information in the buffer */
1996 
1997 		if (sc->sc_proto & UMASS_PROTO_UFI) {
1998 			/*
1999 			 * Section 3.4.3.1.3 specifies that the UFI command
2000 			 * protocol returns an ASC and ASCQ in the interrupt
2001 			 * data block.
2002 			 */
2003 
2004 			DPRINTF(sc, UDMASS_CBI, "UFI CCI, ASC = 0x%02x, "
2005 			    "ASCQ = 0x%02x\n", sc->sbl.ufi.asc,
2006 			    sc->sbl.ufi.ascq);
2007 
2008 			status = (((sc->sbl.ufi.asc == 0) &&
2009 			    (sc->sbl.ufi.ascq == 0)) ?
2010 			    STATUS_CMD_OK : STATUS_CMD_FAILED);
2011 
2012 			sc->sc_transfer.ccb = NULL;
2013 
2014 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2015 
2016 			(sc->sc_transfer.callback)
2017 			    (sc, ccb, residue, status);
2018 
2019 			break;
2020 
2021 		} else {
2022 			/* Command Interrupt Data Block */
2023 
2024 			DPRINTF(sc, UDMASS_CBI, "type=0x%02x, value=0x%02x\n",
2025 			    sc->sbl.common.type, sc->sbl.common.value);
2026 
2027 			if (sc->sbl.common.type == IDB_TYPE_CCI) {
2028 				status = (sc->sbl.common.value & IDB_VALUE_STATUS_MASK);
2029 
2030 				status = ((status == IDB_VALUE_PASS) ? STATUS_CMD_OK :
2031 				    (status == IDB_VALUE_FAIL) ? STATUS_CMD_FAILED :
2032 				    (status == IDB_VALUE_PERSISTENT) ? STATUS_CMD_FAILED :
2033 				    STATUS_WIRE_FAILED);
2034 
2035 				sc->sc_transfer.ccb = NULL;
2036 
2037 				sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2038 
2039 				(sc->sc_transfer.callback)
2040 				    (sc, ccb, residue, status);
2041 
2042 				break;
2043 			}
2044 		}
2045 
2046 		/* fallthrough */
2047 
2048 	case USB_ST_SETUP:
2049 tr_setup:
2050 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2051 		usbd_transfer_submit(xfer);
2052 		break;
2053 
2054 	default:			/* Error */
2055 		DPRINTF(sc, UDMASS_CBI, "Failed to read CSW: %s\n",
2056 		    usbd_errstr(error));
2057 		umass_tr_error(xfer, error);
2058 		break;
2059 	}
2060 }
2061 
2062 /*
2063  * CAM specific functions (used by SCSI, UFI, 8070i (ATAPI))
2064  */
2065 
2066 static int
2067 umass_cam_attach_sim(struct umass_softc *sc)
2068 {
2069 	struct cam_devq *devq;		/* Per device Queue */
2070 	cam_status status;
2071 
2072 	/*
2073 	 * A HBA is attached to the CAM layer.
2074 	 *
2075 	 * The CAM layer will then after a while start probing for devices on
2076 	 * the bus. The number of SIMs is limited to one.
2077 	 */
2078 
2079 	devq = cam_simq_alloc(1 /* maximum openings */ );
2080 	if (devq == NULL) {
2081 		return (ENOMEM);
2082 	}
2083 	sc->sc_sim = cam_sim_alloc
2084 	    (&umass_cam_action, &umass_cam_poll,
2085 	    DEVNAME_SIM,
2086 	    sc /* priv */ ,
2087 	    sc->sc_unit /* unit number */ ,
2088 	    &sc->sc_mtx /* mutex */ ,
2089 	    1 /* maximum device openings */ ,
2090 	    0 /* maximum tagged device openings */ ,
2091 	    devq);
2092 
2093 	if (sc->sc_sim == NULL) {
2094 		cam_simq_free(devq);
2095 		return (ENOMEM);
2096 	}
2097 
2098 	mtx_lock(&sc->sc_mtx);
2099 	status = xpt_bus_register(sc->sc_sim, sc->sc_dev, sc->sc_unit);
2100 	if (status != CAM_SUCCESS) {
2101 		cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2102 		mtx_unlock(&sc->sc_mtx);
2103 		printf("%s: xpt_bus_register failed with status %#x\n",
2104 		    __func__, status);
2105 		return (ENOMEM);
2106 	}
2107 	mtx_unlock(&sc->sc_mtx);
2108 
2109 	return (0);
2110 }
2111 
2112 static void
2113 umass_cam_attach(struct umass_softc *sc)
2114 {
2115 #ifndef USB_DEBUG
2116 	if (bootverbose)
2117 #endif
2118 		printf("%s:%d:%d: Attached to scbus%d\n",
2119 		    sc->sc_name, cam_sim_path(sc->sc_sim),
2120 		    sc->sc_unit, cam_sim_path(sc->sc_sim));
2121 }
2122 
2123 /* umass_cam_detach
2124  *	detach from the CAM layer
2125  */
2126 
2127 static void
2128 umass_cam_detach_sim(struct umass_softc *sc)
2129 {
2130 	int error;
2131 
2132 	if (sc->sc_sim != NULL) {
2133 		error = xpt_bus_deregister(cam_sim_path(sc->sc_sim));
2134 		if (error == 0) {
2135 			/* accessing the softc is not possible after this */
2136 			sc->sc_sim->softc = NULL;
2137 			DPRINTF(sc, UDMASS_SCSI, "%s: %s:%d:%d caling "
2138 			    "cam_sim_free sim %p refc %u mtx %p\n",
2139 			    __func__, sc->sc_name, cam_sim_path(sc->sc_sim),
2140 			    sc->sc_unit, sc->sc_sim,
2141 			    sc->sc_sim->refcount, sc->sc_sim->mtx);
2142 			cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2143 		} else {
2144 			panic("%s: %s: CAM layer is busy: errno %d\n",
2145 			    __func__, sc->sc_name, error);
2146 		}
2147 		sc->sc_sim = NULL;
2148 	}
2149 }
2150 
2151 /* umass_cam_action
2152  * 	CAM requests for action come through here
2153  */
2154 
2155 static void
2156 umass_cam_action(struct cam_sim *sim, union ccb *ccb)
2157 {
2158 	struct umass_softc *sc = cam_sim_softc(sim);
2159 
2160 	if (sc == NULL) {
2161 		ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2162 		xpt_done(ccb);
2163 		return;
2164 	}
2165 
2166 	/* Perform the requested action */
2167 	switch (ccb->ccb_h.func_code) {
2168 	case XPT_SCSI_IO:
2169 		{
2170 			uint8_t *cmd;
2171 			uint8_t dir;
2172 
2173 			if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2174 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2175 			} else {
2176 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2177 			}
2178 
2179 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_SCSI_IO: "
2180 			    "cmd: 0x%02x, flags: 0x%02x, "
2181 			    "%db cmd/%db data/%db sense\n",
2182 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2183 			    (uintmax_t)ccb->ccb_h.target_lun, cmd[0],
2184 			    ccb->ccb_h.flags & CAM_DIR_MASK, ccb->csio.cdb_len,
2185 			    ccb->csio.dxfer_len, ccb->csio.sense_len);
2186 
2187 			if (sc->sc_transfer.ccb) {
2188 				DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_SCSI_IO: "
2189 				    "I/O in progress, deferring\n",
2190 				    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2191 				    (uintmax_t)ccb->ccb_h.target_lun);
2192 				ccb->ccb_h.status = CAM_SCSI_BUSY;
2193 				xpt_done(ccb);
2194 				goto done;
2195 			}
2196 			switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
2197 			case CAM_DIR_IN:
2198 				dir = DIR_IN;
2199 				break;
2200 			case CAM_DIR_OUT:
2201 				dir = DIR_OUT;
2202 				DIF(UDMASS_SCSI,
2203 				    umass_dump_buffer(sc, ccb->csio.data_ptr,
2204 				    ccb->csio.dxfer_len, 48));
2205 				break;
2206 			default:
2207 				dir = DIR_NONE;
2208 			}
2209 
2210 			ccb->ccb_h.status = CAM_REQ_INPROG | CAM_SIM_QUEUED;
2211 
2212 			/*
2213 			 * sc->sc_transform will convert the command to the
2214 			 * command format needed by the specific command set
2215 			 * and return the converted command in
2216 			 * "sc->sc_transfer.cmd_data"
2217 			 */
2218 			if (umass_std_transform(sc, ccb, cmd, ccb->csio.cdb_len)) {
2219 				if (sc->sc_transfer.cmd_data[0] == INQUIRY) {
2220 					const char *pserial;
2221 
2222 					pserial = usb_get_serial(sc->sc_udev);
2223 
2224 					/*
2225 					 * Umass devices don't generally report their serial numbers
2226 					 * in the usual SCSI way.  Emulate it here.
2227 					 */
2228 					if ((sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2229 					    (sc->sc_transfer.cmd_data[2] == SVPD_UNIT_SERIAL_NUMBER) &&
2230 					    (pserial[0] != '\0')) {
2231 						struct scsi_vpd_unit_serial_number *vpd_serial;
2232 
2233 						vpd_serial = (struct scsi_vpd_unit_serial_number *)ccb->csio.data_ptr;
2234 						vpd_serial->length = strlen(pserial);
2235 						if (vpd_serial->length > sizeof(vpd_serial->serial_num))
2236 							vpd_serial->length = sizeof(vpd_serial->serial_num);
2237 						memcpy(vpd_serial->serial_num, pserial, vpd_serial->length);
2238 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2239 						ccb->ccb_h.status = CAM_REQ_CMP;
2240 						xpt_done(ccb);
2241 						goto done;
2242 					}
2243 
2244 					/*
2245 					 * Handle EVPD inquiry for broken devices first
2246 					 * NO_INQUIRY also implies NO_INQUIRY_EVPD
2247 					 */
2248 					if ((sc->sc_quirks & (NO_INQUIRY_EVPD | NO_INQUIRY)) &&
2249 					    (sc->sc_transfer.cmd_data[1] & SI_EVPD)) {
2250 						scsi_set_sense_data(&ccb->csio.sense_data,
2251 							/*sense_format*/ SSD_TYPE_NONE,
2252 							/*current_error*/ 1,
2253 							/*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2254 							/*asc*/ 0x24,
2255 							/*ascq*/ 0x00,
2256 							/*extra args*/ SSD_ELEM_NONE);
2257 						ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2258 						ccb->ccb_h.status =
2259 						    CAM_SCSI_STATUS_ERROR |
2260 						    CAM_AUTOSNS_VALID |
2261 						    CAM_DEV_QFRZN;
2262 						xpt_freeze_devq(ccb->ccb_h.path, 1);
2263 						xpt_done(ccb);
2264 						goto done;
2265 					}
2266 					/*
2267 					 * Return fake inquiry data for
2268 					 * broken devices
2269 					 */
2270 					if (sc->sc_quirks & NO_INQUIRY) {
2271 						memcpy(ccb->csio.data_ptr, &fake_inq_data,
2272 						    sizeof(fake_inq_data));
2273 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2274 						ccb->ccb_h.status = CAM_REQ_CMP;
2275 						xpt_done(ccb);
2276 						goto done;
2277 					}
2278 					if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2279 						ccb->csio.dxfer_len = SHORT_INQUIRY_LENGTH;
2280 					}
2281 				} else if (sc->sc_transfer.cmd_data[0] == PREVENT_ALLOW) {
2282 					if (sc->sc_quirks & NO_PREVENT_ALLOW) {
2283 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2284 						ccb->ccb_h.status = CAM_REQ_CMP;
2285 						xpt_done(ccb);
2286 						goto done;
2287 					}
2288 				} else if (sc->sc_transfer.cmd_data[0] == SYNCHRONIZE_CACHE) {
2289 					if (sc->sc_quirks & NO_SYNCHRONIZE_CACHE) {
2290 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2291 						ccb->ccb_h.status = CAM_REQ_CMP;
2292 						xpt_done(ccb);
2293 						goto done;
2294 					}
2295 				} else if (sc->sc_transfer.cmd_data[0] == START_STOP_UNIT) {
2296 					if (sc->sc_quirks & NO_START_STOP) {
2297 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2298 						ccb->ccb_h.status = CAM_REQ_CMP;
2299 						xpt_done(ccb);
2300 						goto done;
2301 					}
2302 				}
2303 				umass_command_start(sc, dir, ccb->csio.data_ptr,
2304 				    ccb->csio.dxfer_len,
2305 				    ccb->ccb_h.timeout,
2306 				    &umass_cam_cb, ccb);
2307 			}
2308 			break;
2309 		}
2310 	case XPT_PATH_INQ:
2311 		{
2312 			struct ccb_pathinq *cpi = &ccb->cpi;
2313 
2314 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_PATH_INQ:.\n",
2315 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2316 			    (uintmax_t)ccb->ccb_h.target_lun);
2317 
2318 			/* host specific information */
2319 			cpi->version_num = 1;
2320 			cpi->hba_inquiry = 0;
2321 			cpi->target_sprt = 0;
2322 			cpi->hba_misc = PIM_NO_6_BYTE;
2323 			cpi->hba_eng_cnt = 0;
2324 			cpi->max_target = UMASS_SCSIID_MAX;	/* one target */
2325 			cpi->initiator_id = UMASS_SCSIID_HOST;
2326 			strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2327 			strlcpy(cpi->hba_vid, "USB SCSI", HBA_IDLEN);
2328 			strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2329 			cpi->unit_number = cam_sim_unit(sim);
2330 			cpi->bus_id = sc->sc_unit;
2331 			cpi->protocol = PROTO_SCSI;
2332 			cpi->protocol_version = SCSI_REV_2;
2333 			cpi->transport = XPORT_USB;
2334 			cpi->transport_version = 0;
2335 
2336 			if (sc == NULL) {
2337 				cpi->base_transfer_speed = 0;
2338 				cpi->max_lun = 0;
2339 			} else {
2340 				if (sc->sc_quirks & FLOPPY_SPEED) {
2341 					cpi->base_transfer_speed =
2342 					    UMASS_FLOPPY_TRANSFER_SPEED;
2343 				} else {
2344 					switch (usbd_get_speed(sc->sc_udev)) {
2345 					case USB_SPEED_SUPER:
2346 						cpi->base_transfer_speed =
2347 						    UMASS_SUPER_TRANSFER_SPEED;
2348 						cpi->maxio = maxphys;
2349 						break;
2350 					case USB_SPEED_HIGH:
2351 						cpi->base_transfer_speed =
2352 						    UMASS_HIGH_TRANSFER_SPEED;
2353 						break;
2354 					default:
2355 						cpi->base_transfer_speed =
2356 						    UMASS_FULL_TRANSFER_SPEED;
2357 						break;
2358 					}
2359 				}
2360 				cpi->max_lun = sc->sc_maxlun;
2361 			}
2362 
2363 			cpi->ccb_h.status = CAM_REQ_CMP;
2364 			xpt_done(ccb);
2365 			break;
2366 		}
2367 	case XPT_RESET_DEV:
2368 		{
2369 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_RESET_DEV:.\n",
2370 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2371 			    (uintmax_t)ccb->ccb_h.target_lun);
2372 
2373 			umass_reset(sc);
2374 
2375 			ccb->ccb_h.status = CAM_REQ_CMP;
2376 			xpt_done(ccb);
2377 			break;
2378 		}
2379 	case XPT_GET_TRAN_SETTINGS:
2380 		{
2381 			struct ccb_trans_settings *cts = &ccb->cts;
2382 
2383 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_GET_TRAN_SETTINGS:.\n",
2384 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2385 			    (uintmax_t)ccb->ccb_h.target_lun);
2386 
2387 			cts->protocol = PROTO_SCSI;
2388 			cts->protocol_version = SCSI_REV_2;
2389 			cts->transport = XPORT_USB;
2390 			cts->transport_version = 0;
2391 			cts->xport_specific.valid = 0;
2392 
2393 			ccb->ccb_h.status = CAM_REQ_CMP;
2394 			xpt_done(ccb);
2395 			break;
2396 		}
2397 	case XPT_SET_TRAN_SETTINGS:
2398 		{
2399 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_SET_TRAN_SETTINGS:.\n",
2400 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2401 			    (uintmax_t)ccb->ccb_h.target_lun);
2402 
2403 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2404 			xpt_done(ccb);
2405 			break;
2406 		}
2407 	case XPT_CALC_GEOMETRY:
2408 		{
2409 			cam_calc_geometry(&ccb->ccg, /* extended */ 1);
2410 			xpt_done(ccb);
2411 			break;
2412 		}
2413 	case XPT_NOOP:
2414 		{
2415 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_NOOP:.\n",
2416 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2417 			    (uintmax_t)ccb->ccb_h.target_lun);
2418 
2419 			ccb->ccb_h.status = CAM_REQ_CMP;
2420 			xpt_done(ccb);
2421 			break;
2422 		}
2423 	default:
2424 		DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:func_code 0x%04x: "
2425 		    "Not implemented\n",
2426 		    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2427 		    (uintmax_t)ccb->ccb_h.target_lun, ccb->ccb_h.func_code);
2428 
2429 		ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2430 		xpt_done(ccb);
2431 		break;
2432 	}
2433 
2434 done:
2435 	return;
2436 }
2437 
2438 static void
2439 umass_cam_poll(struct cam_sim *sim)
2440 {
2441 	struct umass_softc *sc = cam_sim_softc(sim);
2442 
2443 	if (sc == NULL)
2444 		return;
2445 
2446 	DPRINTF(sc, UDMASS_SCSI, "CAM poll\n");
2447 
2448 	usbd_transfer_poll(sc->sc_xfer, UMASS_T_MAX);
2449 }
2450 
2451 /* umass_cam_cb
2452  *	finalise a completed CAM command
2453  */
2454 
2455 static void
2456 umass_cam_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2457     uint8_t status)
2458 {
2459 	ccb->csio.resid = residue;
2460 
2461 	switch (status) {
2462 	case STATUS_CMD_OK:
2463 		ccb->ccb_h.status = CAM_REQ_CMP;
2464 		if ((sc->sc_quirks & READ_CAPACITY_OFFBY1) &&
2465 		    (ccb->ccb_h.func_code == XPT_SCSI_IO) &&
2466 		    (ccb->csio.cdb_io.cdb_bytes[0] == READ_CAPACITY)) {
2467 			struct scsi_read_capacity_data *rcap;
2468 			uint32_t maxsector;
2469 
2470 			rcap = (void *)(ccb->csio.data_ptr);
2471 			maxsector = scsi_4btoul(rcap->addr) - 1;
2472 			scsi_ulto4b(maxsector, rcap->addr);
2473 		}
2474 		/*
2475 		 * We have to add SVPD_UNIT_SERIAL_NUMBER to the list
2476 		 * of pages supported by the device - otherwise, CAM
2477 		 * will never ask us for the serial number if the
2478 		 * device cannot handle that by itself.
2479 		 */
2480 		if (ccb->ccb_h.func_code == XPT_SCSI_IO &&
2481 		    sc->sc_transfer.cmd_data[0] == INQUIRY &&
2482 		    (sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2483 		    sc->sc_transfer.cmd_data[2] == SVPD_SUPPORTED_PAGE_LIST &&
2484 		    (usb_get_serial(sc->sc_udev)[0] != '\0')) {
2485 			struct ccb_scsiio *csio;
2486 			struct scsi_vpd_supported_page_list *page_list;
2487 
2488 			csio = &ccb->csio;
2489 			page_list = (struct scsi_vpd_supported_page_list *)csio->data_ptr;
2490 			if (page_list->length + 1 < SVPD_SUPPORTED_PAGES_SIZE) {
2491 				page_list->list[page_list->length] = SVPD_UNIT_SERIAL_NUMBER;
2492 				page_list->length++;
2493 			}
2494 		}
2495 		xpt_done(ccb);
2496 		break;
2497 
2498 	case STATUS_CMD_UNKNOWN:
2499 	case STATUS_CMD_FAILED:
2500 
2501 		/* fetch sense data */
2502 
2503 		/* the rest of the command was filled in at attach */
2504 		sc->cam_scsi_sense.length = ccb->csio.sense_len;
2505 
2506 		DPRINTF(sc, UDMASS_SCSI, "Fetching %d bytes of "
2507 		    "sense data\n", ccb->csio.sense_len);
2508 
2509 		if (umass_std_transform(sc, ccb, &sc->cam_scsi_sense.opcode,
2510 		    sizeof(sc->cam_scsi_sense))) {
2511 			if ((sc->sc_quirks & FORCE_SHORT_INQUIRY) &&
2512 			    (sc->sc_transfer.cmd_data[0] == INQUIRY)) {
2513 				ccb->csio.sense_len = SHORT_INQUIRY_LENGTH;
2514 			}
2515 			umass_command_start(sc, DIR_IN, &ccb->csio.sense_data.error_code,
2516 			    ccb->csio.sense_len, ccb->ccb_h.timeout,
2517 			    &umass_cam_sense_cb, ccb);
2518 		}
2519 		break;
2520 
2521 	default:
2522 		/*
2523 		 * The wire protocol failed and will hopefully have
2524 		 * recovered. We return an error to CAM and let CAM
2525 		 * retry the command if necessary.
2526 		 */
2527 		xpt_freeze_devq(ccb->ccb_h.path, 1);
2528 		ccb->ccb_h.status = CAM_REQ_CMP_ERR | CAM_DEV_QFRZN;
2529 		xpt_done(ccb);
2530 		break;
2531 	}
2532 }
2533 
2534 /*
2535  * Finalise a completed autosense operation
2536  */
2537 static void
2538 umass_cam_sense_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2539     uint8_t status)
2540 {
2541 	uint8_t *cmd;
2542 
2543 	switch (status) {
2544 	case STATUS_CMD_OK:
2545 	case STATUS_CMD_UNKNOWN:
2546 	case STATUS_CMD_FAILED: {
2547 		int key, sense_len;
2548 
2549 		ccb->csio.sense_resid = residue;
2550 		sense_len = ccb->csio.sense_len - ccb->csio.sense_resid;
2551 		key = scsi_get_sense_key(&ccb->csio.sense_data, sense_len,
2552 					 /*show_errors*/ 1);
2553 
2554 		if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2555 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2556 		} else {
2557 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2558 		}
2559 
2560 		/*
2561 		 * Getting sense data always succeeds (apart from wire
2562 		 * failures):
2563 		 */
2564 		if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2565 		    (cmd[0] == INQUIRY) &&
2566 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2567 			/*
2568 			 * Ignore unit attention errors in the case where
2569 			 * the Unit Attention state is not cleared on
2570 			 * REQUEST SENSE. They will appear again at the next
2571 			 * command.
2572 			 */
2573 			ccb->ccb_h.status = CAM_REQ_CMP;
2574 		} else if (key == SSD_KEY_NO_SENSE) {
2575 			/*
2576 			 * No problem after all (in the case of CBI without
2577 			 * CCI)
2578 			 */
2579 			ccb->ccb_h.status = CAM_REQ_CMP;
2580 		} else if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2581 			    (cmd[0] == READ_CAPACITY) &&
2582 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2583 			/*
2584 			 * Some devices do not clear the unit attention error
2585 			 * on request sense. We insert a test unit ready
2586 			 * command to make sure we clear the unit attention
2587 			 * condition, then allow the retry to proceed as
2588 			 * usual.
2589 			 */
2590 
2591 			xpt_freeze_devq(ccb->ccb_h.path, 1);
2592 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2593 			    | CAM_AUTOSNS_VALID | CAM_DEV_QFRZN;
2594 			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2595 
2596 #if 0
2597 			DELAY(300000);
2598 #endif
2599 			DPRINTF(sc, UDMASS_SCSI, "Doing a sneaky"
2600 			    "TEST_UNIT_READY\n");
2601 
2602 			/* the rest of the command was filled in at attach */
2603 
2604 			if ((sc->sc_transform)(sc,
2605 			    &sc->cam_scsi_test_unit_ready.opcode,
2606 			    sizeof(sc->cam_scsi_test_unit_ready)) == 1) {
2607 				umass_command_start(sc, DIR_NONE, NULL, 0,
2608 				    ccb->ccb_h.timeout,
2609 				    &umass_cam_quirk_cb, ccb);
2610 				break;
2611 			}
2612 		} else {
2613 			xpt_freeze_devq(ccb->ccb_h.path, 1);
2614 			if (key >= 0) {
2615 				ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2616 				    | CAM_AUTOSNS_VALID | CAM_DEV_QFRZN;
2617 				ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2618 			} else
2619 				ccb->ccb_h.status = CAM_AUTOSENSE_FAIL
2620 				    | CAM_DEV_QFRZN;
2621 		}
2622 		xpt_done(ccb);
2623 		break;
2624 	}
2625 	default:
2626 		DPRINTF(sc, UDMASS_SCSI, "Autosense failed, "
2627 		    "status %d\n", status);
2628 		xpt_freeze_devq(ccb->ccb_h.path, 1);
2629 		ccb->ccb_h.status = CAM_AUTOSENSE_FAIL | CAM_DEV_QFRZN;
2630 		xpt_done(ccb);
2631 	}
2632 }
2633 
2634 /*
2635  * This completion code just handles the fact that we sent a test-unit-ready
2636  * after having previously failed a READ CAPACITY with CHECK_COND.  The CCB
2637  * status for CAM is already set earlier.
2638  */
2639 static void
2640 umass_cam_quirk_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2641     uint8_t status)
2642 {
2643 	DPRINTF(sc, UDMASS_SCSI, "Test unit ready "
2644 	    "returned status %d\n", status);
2645 
2646 	xpt_done(ccb);
2647 }
2648 
2649 /*
2650  * SCSI specific functions
2651  */
2652 
2653 static uint8_t
2654 umass_scsi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2655     uint8_t cmd_len)
2656 {
2657 	if ((cmd_len == 0) ||
2658 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2659 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2660 		    "length: %d bytes\n", cmd_len);
2661 		return (0);		/* failure */
2662 	}
2663 	sc->sc_transfer.cmd_len = cmd_len;
2664 
2665 	switch (cmd_ptr[0]) {
2666 	case TEST_UNIT_READY:
2667 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2668 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2669 			    "to START_UNIT\n");
2670 			memset(sc->sc_transfer.cmd_data, 0, cmd_len);
2671 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2672 			sc->sc_transfer.cmd_data[4] = SSS_START;
2673 			return (1);
2674 		}
2675 		break;
2676 
2677 	case INQUIRY:
2678 		/*
2679 		 * some drives wedge when asked for full inquiry
2680 		 * information.
2681 		 */
2682 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2683 			memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2684 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2685 			return (1);
2686 		}
2687 		break;
2688 	}
2689 
2690 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2691 	return (1);
2692 }
2693 
2694 static uint8_t
2695 umass_rbc_transform(struct umass_softc *sc, uint8_t *cmd_ptr, uint8_t cmd_len)
2696 {
2697 	if ((cmd_len == 0) ||
2698 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2699 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2700 		    "length: %d bytes\n", cmd_len);
2701 		return (0);		/* failure */
2702 	}
2703 	switch (cmd_ptr[0]) {
2704 		/* these commands are defined in RBC: */
2705 	case READ_10:
2706 	case READ_CAPACITY:
2707 	case START_STOP_UNIT:
2708 	case SYNCHRONIZE_CACHE:
2709 	case WRITE_10:
2710 	case VERIFY_10:
2711 	case INQUIRY:
2712 	case MODE_SELECT_10:
2713 	case MODE_SENSE_10:
2714 	case TEST_UNIT_READY:
2715 	case WRITE_BUFFER:
2716 		/*
2717 		 * The following commands are not listed in my copy of the
2718 		 * RBC specs. CAM however seems to want those, and at least
2719 		 * the Sony DSC device appears to support those as well
2720 		 */
2721 	case REQUEST_SENSE:
2722 	case PREVENT_ALLOW:
2723 
2724 		memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2725 
2726 		if ((sc->sc_quirks & RBC_PAD_TO_12) && (cmd_len < 12)) {
2727 			memset(sc->sc_transfer.cmd_data + cmd_len,
2728 			    0, 12 - cmd_len);
2729 			cmd_len = 12;
2730 		}
2731 		sc->sc_transfer.cmd_len = cmd_len;
2732 		return (1);		/* success */
2733 
2734 		/* All other commands are not legal in RBC */
2735 	default:
2736 		DPRINTF(sc, UDMASS_SCSI, "Unsupported RBC "
2737 		    "command 0x%02x\n", cmd_ptr[0]);
2738 		return (0);		/* failure */
2739 	}
2740 }
2741 
2742 static uint8_t
2743 umass_ufi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2744     uint8_t cmd_len)
2745 {
2746 	if ((cmd_len == 0) ||
2747 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2748 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2749 		    "length: %d bytes\n", cmd_len);
2750 		return (0);		/* failure */
2751 	}
2752 	/* An UFI command is always 12 bytes in length */
2753 	sc->sc_transfer.cmd_len = UFI_COMMAND_LENGTH;
2754 
2755 	/* Zero the command data */
2756 	memset(sc->sc_transfer.cmd_data, 0, UFI_COMMAND_LENGTH);
2757 
2758 	switch (cmd_ptr[0]) {
2759 		/*
2760 		 * Commands of which the format has been verified. They
2761 		 * should work. Copy the command into the (zeroed out)
2762 		 * destination buffer.
2763 		 */
2764 	case TEST_UNIT_READY:
2765 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2766 			/*
2767 			 * Some devices do not support this command. Start
2768 			 * Stop Unit should give the same results
2769 			 */
2770 			DPRINTF(sc, UDMASS_UFI, "Converted TEST_UNIT_READY "
2771 			    "to START_UNIT\n");
2772 
2773 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2774 			sc->sc_transfer.cmd_data[4] = SSS_START;
2775 			return (1);
2776 		}
2777 		break;
2778 
2779 	case REZERO_UNIT:
2780 	case REQUEST_SENSE:
2781 	case FORMAT_UNIT:
2782 	case INQUIRY:
2783 	case START_STOP_UNIT:
2784 	case SEND_DIAGNOSTIC:
2785 	case PREVENT_ALLOW:
2786 	case READ_CAPACITY:
2787 	case READ_10:
2788 	case WRITE_10:
2789 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2790 	case WRITE_AND_VERIFY:
2791 	case VERIFY:
2792 	case MODE_SELECT_10:
2793 	case MODE_SENSE_10:
2794 	case READ_12:
2795 	case WRITE_12:
2796 	case READ_FORMAT_CAPACITIES:
2797 		break;
2798 
2799 		/*
2800 		 * SYNCHRONIZE_CACHE isn't supported by UFI, nor should it be
2801 		 * required for UFI devices, so it is appropriate to fake
2802 		 * success.
2803 		 */
2804 	case SYNCHRONIZE_CACHE:
2805 		return (2);
2806 
2807 	default:
2808 		DPRINTF(sc, UDMASS_SCSI, "Unsupported UFI "
2809 		    "command 0x%02x\n", cmd_ptr[0]);
2810 		return (0);		/* failure */
2811 	}
2812 
2813 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2814 	return (1);			/* success */
2815 }
2816 
2817 /*
2818  * 8070i (ATAPI) specific functions
2819  */
2820 static uint8_t
2821 umass_atapi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2822     uint8_t cmd_len)
2823 {
2824 	if ((cmd_len == 0) ||
2825 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2826 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2827 		    "length: %d bytes\n", cmd_len);
2828 		return (0);		/* failure */
2829 	}
2830 	/* An ATAPI command is always 12 bytes in length. */
2831 	sc->sc_transfer.cmd_len = ATAPI_COMMAND_LENGTH;
2832 
2833 	/* Zero the command data */
2834 	memset(sc->sc_transfer.cmd_data, 0, ATAPI_COMMAND_LENGTH);
2835 
2836 	switch (cmd_ptr[0]) {
2837 		/*
2838 		 * Commands of which the format has been verified. They
2839 		 * should work. Copy the command into the destination
2840 		 * buffer.
2841 		 */
2842 	case INQUIRY:
2843 		/*
2844 		 * some drives wedge when asked for full inquiry
2845 		 * information.
2846 		 */
2847 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2848 			memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2849 
2850 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2851 			return (1);
2852 		}
2853 		break;
2854 
2855 	case TEST_UNIT_READY:
2856 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2857 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2858 			    "to START_UNIT\n");
2859 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2860 			sc->sc_transfer.cmd_data[4] = SSS_START;
2861 			return (1);
2862 		}
2863 		break;
2864 
2865 	case REZERO_UNIT:
2866 	case REQUEST_SENSE:
2867 	case START_STOP_UNIT:
2868 	case SEND_DIAGNOSTIC:
2869 	case PREVENT_ALLOW:
2870 	case READ_CAPACITY:
2871 	case READ_10:
2872 	case WRITE_10:
2873 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2874 	case SYNCHRONIZE_CACHE:
2875 	case MODE_SELECT_10:
2876 	case MODE_SENSE_10:
2877 	case READ_BUFFER:
2878 	case 0x42:			/* READ_SUBCHANNEL */
2879 	case 0x43:			/* READ_TOC */
2880 	case 0x44:			/* READ_HEADER */
2881 	case 0x47:			/* PLAY_MSF (Play Minute/Second/Frame) */
2882 	case 0x48:			/* PLAY_TRACK */
2883 	case 0x49:			/* PLAY_TRACK_REL */
2884 	case 0x4b:			/* PAUSE */
2885 	case 0x51:			/* READ_DISK_INFO */
2886 	case 0x52:			/* READ_TRACK_INFO */
2887 	case 0x54:			/* SEND_OPC */
2888 	case 0x59:			/* READ_MASTER_CUE */
2889 	case 0x5b:			/* CLOSE_TR_SESSION */
2890 	case 0x5c:			/* READ_BUFFER_CAP */
2891 	case 0x5d:			/* SEND_CUE_SHEET */
2892 	case 0xa1:			/* BLANK */
2893 	case 0xa5:			/* PLAY_12 */
2894 	case 0xa6:			/* EXCHANGE_MEDIUM */
2895 	case 0xad:			/* READ_DVD_STRUCTURE */
2896 	case 0xbb:			/* SET_CD_SPEED */
2897 	case 0xe5:			/* READ_TRACK_INFO_PHILIPS */
2898 		break;
2899 
2900 	case READ_12:
2901 	case WRITE_12:
2902 	default:
2903 		DPRINTF(sc, UDMASS_SCSI, "Unsupported ATAPI "
2904 		    "command 0x%02x - trying anyway\n",
2905 		    cmd_ptr[0]);
2906 		break;
2907 	}
2908 
2909 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2910 	return (1);			/* success */
2911 }
2912 
2913 static uint8_t
2914 umass_no_transform(struct umass_softc *sc, uint8_t *cmd,
2915     uint8_t cmdlen)
2916 {
2917 	return (0);			/* failure */
2918 }
2919 
2920 static uint8_t
2921 umass_std_transform(struct umass_softc *sc, union ccb *ccb,
2922     uint8_t *cmd, uint8_t cmdlen)
2923 {
2924 	uint8_t retval;
2925 
2926 	retval = (sc->sc_transform) (sc, cmd, cmdlen);
2927 
2928 	if (retval == 2) {
2929 		ccb->ccb_h.status = CAM_REQ_CMP;
2930 		xpt_done(ccb);
2931 		return (0);
2932 	} else if (retval == 0) {
2933 		xpt_freeze_devq(ccb->ccb_h.path, 1);
2934 		ccb->ccb_h.status = CAM_REQ_INVALID | CAM_DEV_QFRZN;
2935 		xpt_done(ccb);
2936 		return (0);
2937 	}
2938 	/* Command should be executed */
2939 	return (1);
2940 }
2941 
2942 #ifdef USB_DEBUG
2943 static void
2944 umass_bbb_dump_cbw(struct umass_softc *sc, umass_bbb_cbw_t *cbw)
2945 {
2946 	uint8_t *c = cbw->CBWCDB;
2947 
2948 	uint32_t dlen = UGETDW(cbw->dCBWDataTransferLength);
2949 	uint32_t tag = UGETDW(cbw->dCBWTag);
2950 
2951 	uint8_t clen = cbw->bCDBLength;
2952 	uint8_t flags = cbw->bCBWFlags;
2953 	uint8_t lun = cbw->bCBWLUN;
2954 
2955 	DPRINTF(sc, UDMASS_BBB, "CBW %d: cmd = %db "
2956 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
2957 	    "data = %db, lun = %d, dir = %s\n",
2958 	    tag, clen,
2959 	    c[0], c[1], c[2], c[3], c[4], c[5], (clen > 6 ? "..." : ""),
2960 	    dlen, lun, (flags == CBWFLAGS_IN ? "in" :
2961 	    (flags == CBWFLAGS_OUT ? "out" : "<invalid>")));
2962 }
2963 
2964 static void
2965 umass_bbb_dump_csw(struct umass_softc *sc, umass_bbb_csw_t *csw)
2966 {
2967 	uint32_t sig = UGETDW(csw->dCSWSignature);
2968 	uint32_t tag = UGETDW(csw->dCSWTag);
2969 	uint32_t res = UGETDW(csw->dCSWDataResidue);
2970 	uint8_t status = csw->bCSWStatus;
2971 
2972 	DPRINTF(sc, UDMASS_BBB, "CSW %d: sig = 0x%08x (%s), tag = 0x%08x, "
2973 	    "res = %d, status = 0x%02x (%s)\n",
2974 	    tag, sig, (sig == CSWSIGNATURE ? "valid" : "invalid"),
2975 	    tag, res,
2976 	    status, (status == CSWSTATUS_GOOD ? "good" :
2977 	    (status == CSWSTATUS_FAILED ? "failed" :
2978 	    (status == CSWSTATUS_PHASE ? "phase" : "<invalid>"))));
2979 }
2980 
2981 static void
2982 umass_cbi_dump_cmd(struct umass_softc *sc, void *cmd, uint8_t cmdlen)
2983 {
2984 	uint8_t *c = cmd;
2985 	uint8_t dir = sc->sc_transfer.dir;
2986 
2987 	DPRINTF(sc, UDMASS_BBB, "cmd = %db "
2988 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
2989 	    "data = %db, dir = %s\n",
2990 	    cmdlen,
2991 	    c[0], c[1], c[2], c[3], c[4], c[5], (cmdlen > 6 ? "..." : ""),
2992 	    sc->sc_transfer.data_len,
2993 	    (dir == DIR_IN ? "in" :
2994 	    (dir == DIR_OUT ? "out" :
2995 	    (dir == DIR_NONE ? "no data phase" : "<invalid>"))));
2996 }
2997 
2998 static void
2999 umass_dump_buffer(struct umass_softc *sc, uint8_t *buffer, uint32_t buflen,
3000     uint32_t printlen)
3001 {
3002 	uint32_t i, j;
3003 	char s1[40];
3004 	char s2[40];
3005 	char s3[5];
3006 
3007 	s1[0] = '\0';
3008 	s3[0] = '\0';
3009 
3010 	sprintf(s2, " buffer=%p, buflen=%d", buffer, buflen);
3011 	for (i = 0; (i < buflen) && (i < printlen); i++) {
3012 		j = i % 16;
3013 		if (j == 0 && i != 0) {
3014 			DPRINTF(sc, UDMASS_GEN, "0x %s%s\n",
3015 			    s1, s2);
3016 			s2[0] = '\0';
3017 		}
3018 		sprintf(&s1[j * 2], "%02x", buffer[i] & 0xff);
3019 	}
3020 	if (buflen > printlen)
3021 		sprintf(s3, " ...");
3022 	DPRINTF(sc, UDMASS_GEN, "0x %s%s%s\n",
3023 	    s1, s2, s3);
3024 }
3025 
3026 #endif
3027