xref: /freebsd/sys/dev/usb/storage/umass.c (revision 9a41df2a0e6408e9b329bbd8b9e37c2b44461a1b)
1 #include <sys/cdefs.h>
2 __FBSDID("$FreeBSD$");
3 
4 /*-
5  * Copyright (c) 1999 MAEKAWA Masahide <bishop@rr.iij4u.or.jp>,
6  *		      Nick Hibma <n_hibma@FreeBSD.org>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  *	$FreeBSD$
31  *	$NetBSD: umass.c,v 1.28 2000/04/02 23:46:53 augustss Exp $
32  */
33 
34 /* Also already merged from NetBSD:
35  *	$NetBSD: umass.c,v 1.67 2001/11/25 19:05:22 augustss Exp $
36  *	$NetBSD: umass.c,v 1.90 2002/11/04 19:17:33 pooka Exp $
37  *	$NetBSD: umass.c,v 1.108 2003/11/07 17:03:25 wiz Exp $
38  *	$NetBSD: umass.c,v 1.109 2003/12/04 13:57:31 keihan Exp $
39  */
40 
41 /*
42  * Universal Serial Bus Mass Storage Class specs:
43  * http://www.usb.org/developers/devclass_docs/usb_msc_overview_1.2.pdf
44  * http://www.usb.org/developers/devclass_docs/usbmassbulk_10.pdf
45  * http://www.usb.org/developers/devclass_docs/usb_msc_cbi_1.1.pdf
46  * http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf
47  */
48 
49 /*
50  * Ported to NetBSD by Lennart Augustsson <augustss@NetBSD.org>.
51  * Parts of the code written by Jason R. Thorpe <thorpej@shagadelic.org>.
52  */
53 
54 /*
55  * The driver handles 3 Wire Protocols
56  * - Command/Bulk/Interrupt (CBI)
57  * - Command/Bulk/Interrupt with Command Completion Interrupt (CBI with CCI)
58  * - Mass Storage Bulk-Only (BBB)
59  *   (BBB refers Bulk/Bulk/Bulk for Command/Data/Status phases)
60  *
61  * Over these wire protocols it handles the following command protocols
62  * - SCSI
63  * - UFI (floppy command set)
64  * - 8070i (ATAPI)
65  *
66  * UFI and 8070i (ATAPI) are transformed versions of the SCSI command set. The
67  * sc->sc_transform method is used to convert the commands into the appropriate
68  * format (if at all necessary). For example, UFI requires all commands to be
69  * 12 bytes in length amongst other things.
70  *
71  * The source code below is marked and can be split into a number of pieces
72  * (in this order):
73  *
74  * - probe/attach/detach
75  * - generic transfer routines
76  * - BBB
77  * - CBI
78  * - CBI_I (in addition to functions from CBI)
79  * - CAM (Common Access Method)
80  * - SCSI
81  * - UFI
82  * - 8070i (ATAPI)
83  *
84  * The protocols are implemented using a state machine, for the transfers as
85  * well as for the resets. The state machine is contained in umass_t_*_callback.
86  * The state machine is started through either umass_command_start() or
87  * umass_reset().
88  *
89  * The reason for doing this is a) CAM performs a lot better this way and b) it
90  * avoids using tsleep from interrupt context (for example after a failed
91  * transfer).
92  */
93 
94 /*
95  * The SCSI related part of this driver has been derived from the
96  * dev/ppbus/vpo.c driver, by Nicolas Souchu (nsouch@FreeBSD.org).
97  *
98  * The CAM layer uses so called actions which are messages sent to the host
99  * adapter for completion. The actions come in through umass_cam_action. The
100  * appropriate block of routines is called depending on the transport protocol
101  * in use. When the transfer has finished, these routines call
102  * umass_cam_cb again to complete the CAM command.
103  */
104 
105 #include <sys/stdint.h>
106 #include <sys/stddef.h>
107 #include <sys/param.h>
108 #include <sys/queue.h>
109 #include <sys/types.h>
110 #include <sys/systm.h>
111 #include <sys/kernel.h>
112 #include <sys/bus.h>
113 #include <sys/module.h>
114 #include <sys/lock.h>
115 #include <sys/mutex.h>
116 #include <sys/condvar.h>
117 #include <sys/sysctl.h>
118 #include <sys/sx.h>
119 #include <sys/unistd.h>
120 #include <sys/callout.h>
121 #include <sys/malloc.h>
122 #include <sys/priv.h>
123 
124 #include <dev/usb/usb.h>
125 #include <dev/usb/usbdi.h>
126 #include <dev/usb/usbdi_util.h>
127 #include "usbdevs.h"
128 
129 #include <dev/usb/quirk/usb_quirk.h>
130 
131 #include <cam/cam.h>
132 #include <cam/cam_ccb.h>
133 #include <cam/cam_sim.h>
134 #include <cam/cam_xpt_sim.h>
135 #include <cam/scsi/scsi_all.h>
136 #include <cam/scsi/scsi_da.h>
137 
138 #include <cam/cam_periph.h>
139 
140 #ifdef USB_DEBUG
141 #define	DIF(m, x)				\
142   do {						\
143     if (umass_debug & (m)) { x ; }		\
144   } while (0)
145 
146 #define	DPRINTF(sc, m, fmt, ...)			\
147   do {							\
148     if (umass_debug & (m)) {				\
149         printf("%s:%s: " fmt,				\
150 	       (sc) ? (const char *)(sc)->sc_name :	\
151 	       (const char *)"umassX",			\
152 		__FUNCTION__ ,## __VA_ARGS__);		\
153     }							\
154   } while (0)
155 
156 #define	UDMASS_GEN	0x00010000	/* general */
157 #define	UDMASS_SCSI	0x00020000	/* scsi */
158 #define	UDMASS_UFI	0x00040000	/* ufi command set */
159 #define	UDMASS_ATAPI	0x00080000	/* 8070i command set */
160 #define	UDMASS_CMD	(UDMASS_SCSI|UDMASS_UFI|UDMASS_ATAPI)
161 #define	UDMASS_USB	0x00100000	/* USB general */
162 #define	UDMASS_BBB	0x00200000	/* Bulk-Only transfers */
163 #define	UDMASS_CBI	0x00400000	/* CBI transfers */
164 #define	UDMASS_WIRE	(UDMASS_BBB|UDMASS_CBI)
165 #define	UDMASS_ALL	0xffff0000	/* all of the above */
166 static int umass_debug = 0;
167 
168 static SYSCTL_NODE(_hw_usb, OID_AUTO, umass, CTLFLAG_RW, 0, "USB umass");
169 SYSCTL_INT(_hw_usb_umass, OID_AUTO, debug, CTLFLAG_RW,
170     &umass_debug, 0, "umass debug level");
171 
172 TUNABLE_INT("hw.usb.umass.debug", &umass_debug);
173 #else
174 #define	DIF(...) do { } while (0)
175 #define	DPRINTF(...) do { } while (0)
176 #endif
177 
178 #define	UMASS_BULK_SIZE (1 << 17)
179 #define	UMASS_CBI_DIAGNOSTIC_CMDLEN 12	/* bytes */
180 #define	UMASS_MAX_CMDLEN MAX(12, CAM_MAX_CDBLEN)	/* bytes */
181 
182 /* USB transfer definitions */
183 
184 #define	UMASS_T_BBB_RESET1      0	/* Bulk-Only */
185 #define	UMASS_T_BBB_RESET2      1
186 #define	UMASS_T_BBB_RESET3      2
187 #define	UMASS_T_BBB_COMMAND     3
188 #define	UMASS_T_BBB_DATA_READ   4
189 #define	UMASS_T_BBB_DATA_RD_CS  5
190 #define	UMASS_T_BBB_DATA_WRITE  6
191 #define	UMASS_T_BBB_DATA_WR_CS  7
192 #define	UMASS_T_BBB_STATUS      8
193 #define	UMASS_T_BBB_MAX         9
194 
195 #define	UMASS_T_CBI_RESET1      0	/* CBI */
196 #define	UMASS_T_CBI_RESET2      1
197 #define	UMASS_T_CBI_RESET3      2
198 #define	UMASS_T_CBI_COMMAND     3
199 #define	UMASS_T_CBI_DATA_READ   4
200 #define	UMASS_T_CBI_DATA_RD_CS  5
201 #define	UMASS_T_CBI_DATA_WRITE  6
202 #define	UMASS_T_CBI_DATA_WR_CS  7
203 #define	UMASS_T_CBI_STATUS      8
204 #define	UMASS_T_CBI_RESET4      9
205 #define	UMASS_T_CBI_MAX        10
206 
207 #define	UMASS_T_MAX MAX(UMASS_T_CBI_MAX, UMASS_T_BBB_MAX)
208 
209 /* Generic definitions */
210 
211 /* Direction for transfer */
212 #define	DIR_NONE	0
213 #define	DIR_IN		1
214 #define	DIR_OUT		2
215 
216 /* device name */
217 #define	DEVNAME		"umass"
218 #define	DEVNAME_SIM	"umass-sim"
219 
220 /* Approximate maximum transfer speeds (assumes 33% overhead). */
221 #define	UMASS_FULL_TRANSFER_SPEED	1000
222 #define	UMASS_HIGH_TRANSFER_SPEED	40000
223 #define	UMASS_SUPER_TRANSFER_SPEED	400000
224 #define	UMASS_FLOPPY_TRANSFER_SPEED	20
225 
226 #define	UMASS_TIMEOUT			5000	/* ms */
227 
228 /* CAM specific definitions */
229 
230 #define	UMASS_SCSIID_MAX	1	/* maximum number of drives expected */
231 #define	UMASS_SCSIID_HOST	UMASS_SCSIID_MAX
232 
233 /* Bulk-Only features */
234 
235 #define	UR_BBB_RESET		0xff	/* Bulk-Only reset */
236 #define	UR_BBB_GET_MAX_LUN	0xfe	/* Get maximum lun */
237 
238 /* Command Block Wrapper */
239 typedef struct {
240 	uDWord	dCBWSignature;
241 #define	CBWSIGNATURE	0x43425355
242 	uDWord	dCBWTag;
243 	uDWord	dCBWDataTransferLength;
244 	uByte	bCBWFlags;
245 #define	CBWFLAGS_OUT	0x00
246 #define	CBWFLAGS_IN	0x80
247 	uByte	bCBWLUN;
248 	uByte	bCDBLength;
249 #define	CBWCDBLENGTH	16
250 	uByte	CBWCDB[CBWCDBLENGTH];
251 } __packed umass_bbb_cbw_t;
252 
253 #define	UMASS_BBB_CBW_SIZE	31
254 
255 /* Command Status Wrapper */
256 typedef struct {
257 	uDWord	dCSWSignature;
258 #define	CSWSIGNATURE	0x53425355
259 #define	CSWSIGNATURE_IMAGINATION_DBX1	0x43425355
260 #define	CSWSIGNATURE_OLYMPUS_C1	0x55425355
261 	uDWord	dCSWTag;
262 	uDWord	dCSWDataResidue;
263 	uByte	bCSWStatus;
264 #define	CSWSTATUS_GOOD	0x0
265 #define	CSWSTATUS_FAILED	0x1
266 #define	CSWSTATUS_PHASE	0x2
267 } __packed umass_bbb_csw_t;
268 
269 #define	UMASS_BBB_CSW_SIZE	13
270 
271 /* CBI features */
272 
273 #define	UR_CBI_ADSC	0x00
274 
275 typedef union {
276 	struct {
277 		uint8_t	type;
278 #define	IDB_TYPE_CCI		0x00
279 		uint8_t	value;
280 #define	IDB_VALUE_PASS		0x00
281 #define	IDB_VALUE_FAIL		0x01
282 #define	IDB_VALUE_PHASE		0x02
283 #define	IDB_VALUE_PERSISTENT	0x03
284 #define	IDB_VALUE_STATUS_MASK	0x03
285 	} __packed common;
286 
287 	struct {
288 		uint8_t	asc;
289 		uint8_t	ascq;
290 	} __packed ufi;
291 } __packed umass_cbi_sbl_t;
292 
293 struct umass_softc;			/* see below */
294 
295 typedef void (umass_callback_t)(struct umass_softc *sc, union ccb *ccb,
296     	uint32_t residue, uint8_t status);
297 
298 #define	STATUS_CMD_OK		0	/* everything ok */
299 #define	STATUS_CMD_UNKNOWN	1	/* will have to fetch sense */
300 #define	STATUS_CMD_FAILED	2	/* transfer was ok, command failed */
301 #define	STATUS_WIRE_FAILED	3	/* couldn't even get command across */
302 
303 typedef uint8_t (umass_transform_t)(struct umass_softc *sc, uint8_t *cmd_ptr,
304     	uint8_t cmd_len);
305 
306 /* Wire and command protocol */
307 #define	UMASS_PROTO_BBB		0x0001	/* USB wire protocol */
308 #define	UMASS_PROTO_CBI		0x0002
309 #define	UMASS_PROTO_CBI_I	0x0004
310 #define	UMASS_PROTO_WIRE	0x00ff	/* USB wire protocol mask */
311 #define	UMASS_PROTO_SCSI	0x0100	/* command protocol */
312 #define	UMASS_PROTO_ATAPI	0x0200
313 #define	UMASS_PROTO_UFI		0x0400
314 #define	UMASS_PROTO_RBC		0x0800
315 #define	UMASS_PROTO_COMMAND	0xff00	/* command protocol mask */
316 
317 /* Device specific quirks */
318 #define	NO_QUIRKS		0x0000
319 	/*
320 	 * The drive does not support Test Unit Ready. Convert to Start Unit
321 	 */
322 #define	NO_TEST_UNIT_READY	0x0001
323 	/*
324 	 * The drive does not reset the Unit Attention state after REQUEST
325 	 * SENSE has been sent. The INQUIRY command does not reset the UA
326 	 * either, and so CAM runs in circles trying to retrieve the initial
327 	 * INQUIRY data.
328 	 */
329 #define	RS_NO_CLEAR_UA		0x0002
330 	/* The drive does not support START STOP.  */
331 #define	NO_START_STOP		0x0004
332 	/* Don't ask for full inquiry data (255b).  */
333 #define	FORCE_SHORT_INQUIRY	0x0008
334 	/* Needs to be initialised the Shuttle way */
335 #define	SHUTTLE_INIT		0x0010
336 	/* Drive needs to be switched to alternate iface 1 */
337 #define	ALT_IFACE_1		0x0020
338 	/* Drive does not do 1Mb/s, but just floppy speeds (20kb/s) */
339 #define	FLOPPY_SPEED		0x0040
340 	/* The device can't count and gets the residue of transfers wrong */
341 #define	IGNORE_RESIDUE		0x0080
342 	/* No GetMaxLun call */
343 #define	NO_GETMAXLUN		0x0100
344 	/* The device uses a weird CSWSIGNATURE. */
345 #define	WRONG_CSWSIG		0x0200
346 	/* Device cannot handle INQUIRY so fake a generic response */
347 #define	NO_INQUIRY		0x0400
348 	/* Device cannot handle INQUIRY EVPD, return CHECK CONDITION */
349 #define	NO_INQUIRY_EVPD		0x0800
350 	/* Pad all RBC requests to 12 bytes. */
351 #define	RBC_PAD_TO_12		0x1000
352 	/*
353 	 * Device reports number of sectors from READ_CAPACITY, not max
354 	 * sector number.
355 	 */
356 #define	READ_CAPACITY_OFFBY1	0x2000
357 	/*
358 	 * Device cannot handle a SCSI synchronize cache command.  Normally
359 	 * this quirk would be handled in the cam layer, but for IDE bridges
360 	 * we need to associate the quirk with the bridge and not the
361 	 * underlying disk device.  This is handled by faking a success
362 	 * result.
363 	 */
364 #define	NO_SYNCHRONIZE_CACHE	0x4000
365 
366 struct umass_softc {
367 
368 	struct scsi_sense cam_scsi_sense;
369 	struct scsi_test_unit_ready cam_scsi_test_unit_ready;
370 	struct mtx sc_mtx;
371 	struct {
372 		uint8_t *data_ptr;
373 		union ccb *ccb;
374 		umass_callback_t *callback;
375 
376 		uint32_t data_len;	/* bytes */
377 		uint32_t data_rem;	/* bytes */
378 		uint32_t data_timeout;	/* ms */
379 		uint32_t actlen;	/* bytes */
380 
381 		uint8_t	cmd_data[UMASS_MAX_CMDLEN];
382 		uint8_t	cmd_len;	/* bytes */
383 		uint8_t	dir;
384 		uint8_t	lun;
385 	}	sc_transfer;
386 
387 	/* Bulk specific variables for transfers in progress */
388 	umass_bbb_cbw_t cbw;		/* command block wrapper */
389 	umass_bbb_csw_t csw;		/* command status wrapper */
390 
391 	/* CBI specific variables for transfers in progress */
392 	umass_cbi_sbl_t sbl;		/* status block */
393 
394 	device_t sc_dev;
395 	struct usb_device *sc_udev;
396 	struct cam_sim *sc_sim;		/* SCSI Interface Module */
397 	struct usb_xfer *sc_xfer[UMASS_T_MAX];
398 
399 	/*
400 	 * The command transform function is used to convert the SCSI
401 	 * commands into their derivatives, like UFI, ATAPI, and friends.
402 	 */
403 	umass_transform_t *sc_transform;
404 
405 	uint32_t sc_unit;
406 	uint32_t sc_quirks;		/* they got it almost right */
407 	uint32_t sc_proto;		/* wire and cmd protocol */
408 
409 	uint8_t	sc_name[16];
410 	uint8_t	sc_iface_no;		/* interface number */
411 	uint8_t	sc_maxlun;		/* maximum LUN number, inclusive */
412 	uint8_t	sc_last_xfer_index;
413 	uint8_t	sc_status_try;
414 };
415 
416 struct umass_probe_proto {
417 	uint32_t quirks;
418 	uint32_t proto;
419 
420 	int	error;
421 };
422 
423 /* prototypes */
424 
425 static device_probe_t umass_probe;
426 static device_attach_t umass_attach;
427 static device_detach_t umass_detach;
428 
429 static usb_callback_t umass_tr_error;
430 static usb_callback_t umass_t_bbb_reset1_callback;
431 static usb_callback_t umass_t_bbb_reset2_callback;
432 static usb_callback_t umass_t_bbb_reset3_callback;
433 static usb_callback_t umass_t_bbb_command_callback;
434 static usb_callback_t umass_t_bbb_data_read_callback;
435 static usb_callback_t umass_t_bbb_data_rd_cs_callback;
436 static usb_callback_t umass_t_bbb_data_write_callback;
437 static usb_callback_t umass_t_bbb_data_wr_cs_callback;
438 static usb_callback_t umass_t_bbb_status_callback;
439 static usb_callback_t umass_t_cbi_reset1_callback;
440 static usb_callback_t umass_t_cbi_reset2_callback;
441 static usb_callback_t umass_t_cbi_reset3_callback;
442 static usb_callback_t umass_t_cbi_reset4_callback;
443 static usb_callback_t umass_t_cbi_command_callback;
444 static usb_callback_t umass_t_cbi_data_read_callback;
445 static usb_callback_t umass_t_cbi_data_rd_cs_callback;
446 static usb_callback_t umass_t_cbi_data_write_callback;
447 static usb_callback_t umass_t_cbi_data_wr_cs_callback;
448 static usb_callback_t umass_t_cbi_status_callback;
449 
450 static void	umass_cancel_ccb(struct umass_softc *);
451 static void	umass_init_shuttle(struct umass_softc *);
452 static void	umass_reset(struct umass_softc *);
453 static void	umass_t_bbb_data_clear_stall_callback(struct usb_xfer *,
454 		    uint8_t, uint8_t, usb_error_t);
455 static void	umass_command_start(struct umass_softc *, uint8_t, void *,
456 		    uint32_t, uint32_t, umass_callback_t *, union ccb *);
457 static uint8_t	umass_bbb_get_max_lun(struct umass_softc *);
458 static void	umass_cbi_start_status(struct umass_softc *);
459 static void	umass_t_cbi_data_clear_stall_callback(struct usb_xfer *,
460 		    uint8_t, uint8_t, usb_error_t);
461 static int	umass_cam_attach_sim(struct umass_softc *);
462 static void	umass_cam_attach(struct umass_softc *);
463 static void	umass_cam_detach_sim(struct umass_softc *);
464 static void	umass_cam_action(struct cam_sim *, union ccb *);
465 static void	umass_cam_poll(struct cam_sim *);
466 static void	umass_cam_cb(struct umass_softc *, union ccb *, uint32_t,
467 		    uint8_t);
468 static void	umass_cam_sense_cb(struct umass_softc *, union ccb *, uint32_t,
469 		    uint8_t);
470 static void	umass_cam_quirk_cb(struct umass_softc *, union ccb *, uint32_t,
471 		    uint8_t);
472 static uint8_t	umass_scsi_transform(struct umass_softc *, uint8_t *, uint8_t);
473 static uint8_t	umass_rbc_transform(struct umass_softc *, uint8_t *, uint8_t);
474 static uint8_t	umass_ufi_transform(struct umass_softc *, uint8_t *, uint8_t);
475 static uint8_t	umass_atapi_transform(struct umass_softc *, uint8_t *,
476 		    uint8_t);
477 static uint8_t	umass_no_transform(struct umass_softc *, uint8_t *, uint8_t);
478 static uint8_t	umass_std_transform(struct umass_softc *, union ccb *, uint8_t
479 		    *, uint8_t);
480 
481 #ifdef USB_DEBUG
482 static void	umass_bbb_dump_cbw(struct umass_softc *, umass_bbb_cbw_t *);
483 static void	umass_bbb_dump_csw(struct umass_softc *, umass_bbb_csw_t *);
484 static void	umass_cbi_dump_cmd(struct umass_softc *, void *, uint8_t);
485 static void	umass_dump_buffer(struct umass_softc *, uint8_t *, uint32_t,
486 		    uint32_t);
487 #endif
488 
489 static struct usb_config umass_bbb_config[UMASS_T_BBB_MAX] = {
490 
491 	[UMASS_T_BBB_RESET1] = {
492 		.type = UE_CONTROL,
493 		.endpoint = 0x00,	/* Control pipe */
494 		.direction = UE_DIR_ANY,
495 		.bufsize = sizeof(struct usb_device_request),
496 		.callback = &umass_t_bbb_reset1_callback,
497 		.timeout = 5000,	/* 5 seconds */
498 		.interval = 500,	/* 500 milliseconds */
499 	},
500 
501 	[UMASS_T_BBB_RESET2] = {
502 		.type = UE_CONTROL,
503 		.endpoint = 0x00,	/* Control pipe */
504 		.direction = UE_DIR_ANY,
505 		.bufsize = sizeof(struct usb_device_request),
506 		.callback = &umass_t_bbb_reset2_callback,
507 		.timeout = 5000,	/* 5 seconds */
508 		.interval = 50,	/* 50 milliseconds */
509 	},
510 
511 	[UMASS_T_BBB_RESET3] = {
512 		.type = UE_CONTROL,
513 		.endpoint = 0x00,	/* Control pipe */
514 		.direction = UE_DIR_ANY,
515 		.bufsize = sizeof(struct usb_device_request),
516 		.callback = &umass_t_bbb_reset3_callback,
517 		.timeout = 5000,	/* 5 seconds */
518 		.interval = 50,	/* 50 milliseconds */
519 	},
520 
521 	[UMASS_T_BBB_COMMAND] = {
522 		.type = UE_BULK,
523 		.endpoint = UE_ADDR_ANY,
524 		.direction = UE_DIR_OUT,
525 		.bufsize = sizeof(umass_bbb_cbw_t),
526 		.callback = &umass_t_bbb_command_callback,
527 		.timeout = 5000,	/* 5 seconds */
528 	},
529 
530 	[UMASS_T_BBB_DATA_READ] = {
531 		.type = UE_BULK,
532 		.endpoint = UE_ADDR_ANY,
533 		.direction = UE_DIR_IN,
534 		.bufsize = UMASS_BULK_SIZE,
535 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
536 		.callback = &umass_t_bbb_data_read_callback,
537 		.timeout = 0,	/* overwritten later */
538 	},
539 
540 	[UMASS_T_BBB_DATA_RD_CS] = {
541 		.type = UE_CONTROL,
542 		.endpoint = 0x00,	/* Control pipe */
543 		.direction = UE_DIR_ANY,
544 		.bufsize = sizeof(struct usb_device_request),
545 		.callback = &umass_t_bbb_data_rd_cs_callback,
546 		.timeout = 5000,	/* 5 seconds */
547 	},
548 
549 	[UMASS_T_BBB_DATA_WRITE] = {
550 		.type = UE_BULK,
551 		.endpoint = UE_ADDR_ANY,
552 		.direction = UE_DIR_OUT,
553 		.bufsize = UMASS_BULK_SIZE,
554 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
555 		.callback = &umass_t_bbb_data_write_callback,
556 		.timeout = 0,	/* overwritten later */
557 	},
558 
559 	[UMASS_T_BBB_DATA_WR_CS] = {
560 		.type = UE_CONTROL,
561 		.endpoint = 0x00,	/* Control pipe */
562 		.direction = UE_DIR_ANY,
563 		.bufsize = sizeof(struct usb_device_request),
564 		.callback = &umass_t_bbb_data_wr_cs_callback,
565 		.timeout = 5000,	/* 5 seconds */
566 	},
567 
568 	[UMASS_T_BBB_STATUS] = {
569 		.type = UE_BULK,
570 		.endpoint = UE_ADDR_ANY,
571 		.direction = UE_DIR_IN,
572 		.bufsize = sizeof(umass_bbb_csw_t),
573 		.flags = {.short_xfer_ok = 1,},
574 		.callback = &umass_t_bbb_status_callback,
575 		.timeout = 5000,	/* ms */
576 	},
577 };
578 
579 static struct usb_config umass_cbi_config[UMASS_T_CBI_MAX] = {
580 
581 	[UMASS_T_CBI_RESET1] = {
582 		.type = UE_CONTROL,
583 		.endpoint = 0x00,	/* Control pipe */
584 		.direction = UE_DIR_ANY,
585 		.bufsize = (sizeof(struct usb_device_request) +
586 		    UMASS_CBI_DIAGNOSTIC_CMDLEN),
587 		.callback = &umass_t_cbi_reset1_callback,
588 		.timeout = 5000,	/* 5 seconds */
589 		.interval = 500,	/* 500 milliseconds */
590 	},
591 
592 	[UMASS_T_CBI_RESET2] = {
593 		.type = UE_CONTROL,
594 		.endpoint = 0x00,	/* Control pipe */
595 		.direction = UE_DIR_ANY,
596 		.bufsize = sizeof(struct usb_device_request),
597 		.callback = &umass_t_cbi_reset2_callback,
598 		.timeout = 5000,	/* 5 seconds */
599 		.interval = 50,	/* 50 milliseconds */
600 	},
601 
602 	[UMASS_T_CBI_RESET3] = {
603 		.type = UE_CONTROL,
604 		.endpoint = 0x00,	/* Control pipe */
605 		.direction = UE_DIR_ANY,
606 		.bufsize = sizeof(struct usb_device_request),
607 		.callback = &umass_t_cbi_reset3_callback,
608 		.timeout = 5000,	/* 5 seconds */
609 		.interval = 50,	/* 50 milliseconds */
610 	},
611 
612 	[UMASS_T_CBI_COMMAND] = {
613 		.type = UE_CONTROL,
614 		.endpoint = 0x00,	/* Control pipe */
615 		.direction = UE_DIR_ANY,
616 		.bufsize = (sizeof(struct usb_device_request) +
617 		    UMASS_MAX_CMDLEN),
618 		.callback = &umass_t_cbi_command_callback,
619 		.timeout = 5000,	/* 5 seconds */
620 	},
621 
622 	[UMASS_T_CBI_DATA_READ] = {
623 		.type = UE_BULK,
624 		.endpoint = UE_ADDR_ANY,
625 		.direction = UE_DIR_IN,
626 		.bufsize = UMASS_BULK_SIZE,
627 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
628 		.callback = &umass_t_cbi_data_read_callback,
629 		.timeout = 0,	/* overwritten later */
630 	},
631 
632 	[UMASS_T_CBI_DATA_RD_CS] = {
633 		.type = UE_CONTROL,
634 		.endpoint = 0x00,	/* Control pipe */
635 		.direction = UE_DIR_ANY,
636 		.bufsize = sizeof(struct usb_device_request),
637 		.callback = &umass_t_cbi_data_rd_cs_callback,
638 		.timeout = 5000,	/* 5 seconds */
639 	},
640 
641 	[UMASS_T_CBI_DATA_WRITE] = {
642 		.type = UE_BULK,
643 		.endpoint = UE_ADDR_ANY,
644 		.direction = UE_DIR_OUT,
645 		.bufsize = UMASS_BULK_SIZE,
646 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
647 		.callback = &umass_t_cbi_data_write_callback,
648 		.timeout = 0,	/* overwritten later */
649 	},
650 
651 	[UMASS_T_CBI_DATA_WR_CS] = {
652 		.type = UE_CONTROL,
653 		.endpoint = 0x00,	/* Control pipe */
654 		.direction = UE_DIR_ANY,
655 		.bufsize = sizeof(struct usb_device_request),
656 		.callback = &umass_t_cbi_data_wr_cs_callback,
657 		.timeout = 5000,	/* 5 seconds */
658 	},
659 
660 	[UMASS_T_CBI_STATUS] = {
661 		.type = UE_INTERRUPT,
662 		.endpoint = UE_ADDR_ANY,
663 		.direction = UE_DIR_IN,
664 		.flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
665 		.bufsize = sizeof(umass_cbi_sbl_t),
666 		.callback = &umass_t_cbi_status_callback,
667 		.timeout = 5000,	/* ms */
668 	},
669 
670 	[UMASS_T_CBI_RESET4] = {
671 		.type = UE_CONTROL,
672 		.endpoint = 0x00,	/* Control pipe */
673 		.direction = UE_DIR_ANY,
674 		.bufsize = sizeof(struct usb_device_request),
675 		.callback = &umass_t_cbi_reset4_callback,
676 		.timeout = 5000,	/* ms */
677 	},
678 };
679 
680 /* If device cannot return valid inquiry data, fake it */
681 static const uint8_t fake_inq_data[SHORT_INQUIRY_LENGTH] = {
682 	0, /* removable */ 0x80, SCSI_REV_2, SCSI_REV_2,
683 	 /* additional_length */ 31, 0, 0, 0
684 };
685 
686 #define	UFI_COMMAND_LENGTH	12	/* UFI commands are always 12 bytes */
687 #define	ATAPI_COMMAND_LENGTH	12	/* ATAPI commands are always 12 bytes */
688 
689 static devclass_t umass_devclass;
690 
691 static device_method_t umass_methods[] = {
692 	/* Device interface */
693 	DEVMETHOD(device_probe, umass_probe),
694 	DEVMETHOD(device_attach, umass_attach),
695 	DEVMETHOD(device_detach, umass_detach),
696 	{0, 0}
697 };
698 
699 static driver_t umass_driver = {
700 	.name = "umass",
701 	.methods = umass_methods,
702 	.size = sizeof(struct umass_softc),
703 };
704 
705 DRIVER_MODULE(umass, uhub, umass_driver, umass_devclass, NULL, 0);
706 MODULE_DEPEND(umass, usb, 1, 1, 1);
707 MODULE_DEPEND(umass, cam, 1, 1, 1);
708 MODULE_VERSION(umass, 1);
709 
710 /*
711  * USB device probe/attach/detach
712  */
713 
714 static const STRUCT_USB_HOST_ID __used umass_devs[] = {
715 	/* generic mass storage class */
716 	{USB_IFACE_CLASS(UICLASS_MASS),},
717 };
718 
719 static uint16_t
720 umass_get_proto(struct usb_interface *iface)
721 {
722 	struct usb_interface_descriptor *id;
723 	uint16_t retval;
724 
725 	retval = 0;
726 
727 	/* Check for a standards compliant device */
728 	id = usbd_get_interface_descriptor(iface);
729 	if ((id == NULL) ||
730 	    (id->bInterfaceClass != UICLASS_MASS)) {
731 		goto done;
732 	}
733 	switch (id->bInterfaceSubClass) {
734 	case UISUBCLASS_SCSI:
735 		retval |= UMASS_PROTO_SCSI;
736 		break;
737 	case UISUBCLASS_UFI:
738 		retval |= UMASS_PROTO_UFI;
739 		break;
740 	case UISUBCLASS_RBC:
741 		retval |= UMASS_PROTO_RBC;
742 		break;
743 	case UISUBCLASS_SFF8020I:
744 	case UISUBCLASS_SFF8070I:
745 		retval |= UMASS_PROTO_ATAPI;
746 		break;
747 	default:
748 		goto done;
749 	}
750 
751 	switch (id->bInterfaceProtocol) {
752 	case UIPROTO_MASS_CBI:
753 		retval |= UMASS_PROTO_CBI;
754 		break;
755 	case UIPROTO_MASS_CBI_I:
756 		retval |= UMASS_PROTO_CBI_I;
757 		break;
758 	case UIPROTO_MASS_BBB_OLD:
759 	case UIPROTO_MASS_BBB:
760 		retval |= UMASS_PROTO_BBB;
761 		break;
762 	default:
763 		goto done;
764 	}
765 done:
766 	return (retval);
767 }
768 
769 /*
770  * Match the device we are seeing with the devices supported.
771  */
772 static struct umass_probe_proto
773 umass_probe_proto(device_t dev, struct usb_attach_arg *uaa)
774 {
775 	struct umass_probe_proto ret;
776 	uint32_t quirks = NO_QUIRKS;
777 	uint32_t proto = umass_get_proto(uaa->iface);
778 
779 	memset(&ret, 0, sizeof(ret));
780 	ret.error = BUS_PROBE_GENERIC;
781 
782 	/* Search for protocol enforcement */
783 
784 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_BBB)) {
785 		proto &= ~UMASS_PROTO_WIRE;
786 		proto |= UMASS_PROTO_BBB;
787 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI)) {
788 		proto &= ~UMASS_PROTO_WIRE;
789 		proto |= UMASS_PROTO_CBI;
790 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI_I)) {
791 		proto &= ~UMASS_PROTO_WIRE;
792 		proto |= UMASS_PROTO_CBI_I;
793 	}
794 
795 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_SCSI)) {
796 		proto &= ~UMASS_PROTO_COMMAND;
797 		proto |= UMASS_PROTO_SCSI;
798 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_ATAPI)) {
799 		proto &= ~UMASS_PROTO_COMMAND;
800 		proto |= UMASS_PROTO_ATAPI;
801 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_UFI)) {
802 		proto &= ~UMASS_PROTO_COMMAND;
803 		proto |= UMASS_PROTO_UFI;
804 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_RBC)) {
805 		proto &= ~UMASS_PROTO_COMMAND;
806 		proto |= UMASS_PROTO_RBC;
807 	}
808 
809 	/* Check if the protocol is invalid */
810 
811 	if ((proto & UMASS_PROTO_COMMAND) == 0) {
812 		ret.error = ENXIO;
813 		goto done;
814 	}
815 
816 	if ((proto & UMASS_PROTO_WIRE) == 0) {
817 		ret.error = ENXIO;
818 		goto done;
819 	}
820 
821 	/* Search for quirks */
822 
823 	if (usb_test_quirk(uaa, UQ_MSC_NO_TEST_UNIT_READY))
824 		quirks |= NO_TEST_UNIT_READY;
825 	if (usb_test_quirk(uaa, UQ_MSC_NO_RS_CLEAR_UA))
826 		quirks |= RS_NO_CLEAR_UA;
827 	if (usb_test_quirk(uaa, UQ_MSC_NO_START_STOP))
828 		quirks |= NO_START_STOP;
829 	if (usb_test_quirk(uaa, UQ_MSC_NO_GETMAXLUN))
830 		quirks |= NO_GETMAXLUN;
831 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY))
832 		quirks |= NO_INQUIRY;
833 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY_EVPD))
834 		quirks |= NO_INQUIRY_EVPD;
835 	if (usb_test_quirk(uaa, UQ_MSC_NO_SYNC_CACHE))
836 		quirks |= NO_SYNCHRONIZE_CACHE;
837 	if (usb_test_quirk(uaa, UQ_MSC_SHUTTLE_INIT))
838 		quirks |= SHUTTLE_INIT;
839 	if (usb_test_quirk(uaa, UQ_MSC_ALT_IFACE_1))
840 		quirks |= ALT_IFACE_1;
841 	if (usb_test_quirk(uaa, UQ_MSC_FLOPPY_SPEED))
842 		quirks |= FLOPPY_SPEED;
843 	if (usb_test_quirk(uaa, UQ_MSC_IGNORE_RESIDUE))
844 		quirks |= IGNORE_RESIDUE;
845 	if (usb_test_quirk(uaa, UQ_MSC_WRONG_CSWSIG))
846 		quirks |= WRONG_CSWSIG;
847 	if (usb_test_quirk(uaa, UQ_MSC_RBC_PAD_TO_12))
848 		quirks |= RBC_PAD_TO_12;
849 	if (usb_test_quirk(uaa, UQ_MSC_READ_CAP_OFFBY1))
850 		quirks |= READ_CAPACITY_OFFBY1;
851 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_SHORT_INQ))
852 		quirks |= FORCE_SHORT_INQUIRY;
853 
854 done:
855 	ret.quirks = quirks;
856 	ret.proto = proto;
857 	return (ret);
858 }
859 
860 static int
861 umass_probe(device_t dev)
862 {
863 	struct usb_attach_arg *uaa = device_get_ivars(dev);
864 	struct umass_probe_proto temp;
865 
866 	if (uaa->usb_mode != USB_MODE_HOST) {
867 		return (ENXIO);
868 	}
869 	temp = umass_probe_proto(dev, uaa);
870 
871 	return (temp.error);
872 }
873 
874 static int
875 umass_attach(device_t dev)
876 {
877 	struct umass_softc *sc = device_get_softc(dev);
878 	struct usb_attach_arg *uaa = device_get_ivars(dev);
879 	struct umass_probe_proto temp = umass_probe_proto(dev, uaa);
880 	struct usb_interface_descriptor *id;
881 	int32_t err;
882 
883 	/*
884 	 * NOTE: the softc struct is cleared in device_set_driver.
885 	 * We can safely call umass_detach without specifically
886 	 * initializing the struct.
887 	 */
888 
889 	sc->sc_dev = dev;
890 	sc->sc_udev = uaa->device;
891 	sc->sc_proto = temp.proto;
892 	sc->sc_quirks = temp.quirks;
893 	sc->sc_unit = device_get_unit(dev);
894 
895 	snprintf(sc->sc_name, sizeof(sc->sc_name),
896 	    "%s", device_get_nameunit(dev));
897 
898 	device_set_usb_desc(dev);
899 
900         mtx_init(&sc->sc_mtx, device_get_nameunit(dev),
901 	    NULL, MTX_DEF | MTX_RECURSE);
902 
903 	/* get interface index */
904 
905 	id = usbd_get_interface_descriptor(uaa->iface);
906 	if (id == NULL) {
907 		device_printf(dev, "failed to get "
908 		    "interface number\n");
909 		goto detach;
910 	}
911 	sc->sc_iface_no = id->bInterfaceNumber;
912 
913 #ifdef USB_DEBUG
914 	device_printf(dev, " ");
915 
916 	switch (sc->sc_proto & UMASS_PROTO_COMMAND) {
917 	case UMASS_PROTO_SCSI:
918 		printf("SCSI");
919 		break;
920 	case UMASS_PROTO_ATAPI:
921 		printf("8070i (ATAPI)");
922 		break;
923 	case UMASS_PROTO_UFI:
924 		printf("UFI");
925 		break;
926 	case UMASS_PROTO_RBC:
927 		printf("RBC");
928 		break;
929 	default:
930 		printf("(unknown 0x%02x)",
931 		    sc->sc_proto & UMASS_PROTO_COMMAND);
932 		break;
933 	}
934 
935 	printf(" over ");
936 
937 	switch (sc->sc_proto & UMASS_PROTO_WIRE) {
938 	case UMASS_PROTO_BBB:
939 		printf("Bulk-Only");
940 		break;
941 	case UMASS_PROTO_CBI:		/* uses Comand/Bulk pipes */
942 		printf("CBI");
943 		break;
944 	case UMASS_PROTO_CBI_I:	/* uses Comand/Bulk/Interrupt pipes */
945 		printf("CBI with CCI");
946 		break;
947 	default:
948 		printf("(unknown 0x%02x)",
949 		    sc->sc_proto & UMASS_PROTO_WIRE);
950 	}
951 
952 	printf("; quirks = 0x%04x\n", sc->sc_quirks);
953 #endif
954 
955 	if (sc->sc_quirks & ALT_IFACE_1) {
956 		err = usbd_set_alt_interface_index
957 		    (uaa->device, uaa->info.bIfaceIndex, 1);
958 
959 		if (err) {
960 			DPRINTF(sc, UDMASS_USB, "could not switch to "
961 			    "Alt Interface 1\n");
962 			goto detach;
963 		}
964 	}
965 	/* allocate all required USB transfers */
966 
967 	if (sc->sc_proto & UMASS_PROTO_BBB) {
968 
969 		err = usbd_transfer_setup(uaa->device,
970 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_bbb_config,
971 		    UMASS_T_BBB_MAX, sc, &sc->sc_mtx);
972 
973 		/* skip reset first time */
974 		sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
975 
976 	} else if (sc->sc_proto & (UMASS_PROTO_CBI | UMASS_PROTO_CBI_I)) {
977 
978 		err = usbd_transfer_setup(uaa->device,
979 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_cbi_config,
980 		    UMASS_T_CBI_MAX, sc, &sc->sc_mtx);
981 
982 		/* skip reset first time */
983 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
984 
985 	} else {
986 		err = USB_ERR_INVAL;
987 	}
988 
989 	if (err) {
990 		device_printf(dev, "could not setup required "
991 		    "transfers, %s\n", usbd_errstr(err));
992 		goto detach;
993 	}
994 	sc->sc_transform =
995 	    (sc->sc_proto & UMASS_PROTO_SCSI) ? &umass_scsi_transform :
996 	    (sc->sc_proto & UMASS_PROTO_UFI) ? &umass_ufi_transform :
997 	    (sc->sc_proto & UMASS_PROTO_ATAPI) ? &umass_atapi_transform :
998 	    (sc->sc_proto & UMASS_PROTO_RBC) ? &umass_rbc_transform :
999 	    &umass_no_transform;
1000 
1001 	/* from here onwards the device can be used. */
1002 
1003 	if (sc->sc_quirks & SHUTTLE_INIT) {
1004 		umass_init_shuttle(sc);
1005 	}
1006 	/* get the maximum LUN supported by the device */
1007 
1008 	if (((sc->sc_proto & UMASS_PROTO_WIRE) == UMASS_PROTO_BBB) &&
1009 	    !(sc->sc_quirks & NO_GETMAXLUN))
1010 		sc->sc_maxlun = umass_bbb_get_max_lun(sc);
1011 	else
1012 		sc->sc_maxlun = 0;
1013 
1014 	/* Prepare the SCSI command block */
1015 	sc->cam_scsi_sense.opcode = REQUEST_SENSE;
1016 	sc->cam_scsi_test_unit_ready.opcode = TEST_UNIT_READY;
1017 
1018 	/* register the SIM */
1019 	err = umass_cam_attach_sim(sc);
1020 	if (err) {
1021 		goto detach;
1022 	}
1023 	/* scan the SIM */
1024 	umass_cam_attach(sc);
1025 
1026 	DPRINTF(sc, UDMASS_GEN, "Attach finished\n");
1027 
1028 	return (0);			/* success */
1029 
1030 detach:
1031 	umass_detach(dev);
1032 	return (ENXIO);			/* failure */
1033 }
1034 
1035 static int
1036 umass_detach(device_t dev)
1037 {
1038 	struct umass_softc *sc = device_get_softc(dev);
1039 
1040 	DPRINTF(sc, UDMASS_USB, "\n");
1041 
1042 	/* teardown our statemachine */
1043 
1044 	usbd_transfer_unsetup(sc->sc_xfer, UMASS_T_MAX);
1045 
1046 	mtx_lock(&sc->sc_mtx);
1047 
1048 	/* cancel any leftover CCB's */
1049 
1050 	umass_cancel_ccb(sc);
1051 
1052 	umass_cam_detach_sim(sc);
1053 
1054 	mtx_unlock(&sc->sc_mtx);
1055 
1056 	mtx_destroy(&sc->sc_mtx);
1057 
1058 	return (0);			/* success */
1059 }
1060 
1061 static void
1062 umass_init_shuttle(struct umass_softc *sc)
1063 {
1064 	struct usb_device_request req;
1065 	usb_error_t err;
1066 	uint8_t status[2] = {0, 0};
1067 
1068 	/*
1069 	 * The Linux driver does this, but no one can tell us what the
1070 	 * command does.
1071 	 */
1072 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1073 	req.bRequest = 1;		/* XXX unknown command */
1074 	USETW(req.wValue, 0);
1075 	req.wIndex[0] = sc->sc_iface_no;
1076 	req.wIndex[1] = 0;
1077 	USETW(req.wLength, sizeof(status));
1078 	err = usbd_do_request(sc->sc_udev, NULL, &req, &status);
1079 
1080 	DPRINTF(sc, UDMASS_GEN, "Shuttle init returned 0x%02x%02x\n",
1081 	    status[0], status[1]);
1082 }
1083 
1084 /*
1085  * Generic functions to handle transfers
1086  */
1087 
1088 static void
1089 umass_transfer_start(struct umass_softc *sc, uint8_t xfer_index)
1090 {
1091 	DPRINTF(sc, UDMASS_GEN, "transfer index = "
1092 	    "%d\n", xfer_index);
1093 
1094 	if (sc->sc_xfer[xfer_index]) {
1095 		sc->sc_last_xfer_index = xfer_index;
1096 		usbd_transfer_start(sc->sc_xfer[xfer_index]);
1097 	} else {
1098 		umass_cancel_ccb(sc);
1099 	}
1100 }
1101 
1102 static void
1103 umass_reset(struct umass_softc *sc)
1104 {
1105 	DPRINTF(sc, UDMASS_GEN, "resetting device\n");
1106 
1107 	/*
1108 	 * stop the last transfer, if not already stopped:
1109 	 */
1110 	usbd_transfer_stop(sc->sc_xfer[sc->sc_last_xfer_index]);
1111 	umass_transfer_start(sc, 0);
1112 }
1113 
1114 static void
1115 umass_cancel_ccb(struct umass_softc *sc)
1116 {
1117 	union ccb *ccb;
1118 
1119 	mtx_assert(&sc->sc_mtx, MA_OWNED);
1120 
1121 	ccb = sc->sc_transfer.ccb;
1122 	sc->sc_transfer.ccb = NULL;
1123 	sc->sc_last_xfer_index = 0;
1124 
1125 	if (ccb) {
1126 		(sc->sc_transfer.callback)
1127 		    (sc, ccb, (sc->sc_transfer.data_len -
1128 		    sc->sc_transfer.actlen), STATUS_WIRE_FAILED);
1129 	}
1130 }
1131 
1132 static void
1133 umass_tr_error(struct usb_xfer *xfer, usb_error_t error)
1134 {
1135 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1136 
1137 	if (error != USB_ERR_CANCELLED) {
1138 
1139 		DPRINTF(sc, UDMASS_GEN, "transfer error, %s -> "
1140 		    "reset\n", usbd_errstr(error));
1141 	}
1142 	umass_cancel_ccb(sc);
1143 }
1144 
1145 /*
1146  * BBB protocol specific functions
1147  */
1148 
1149 static void
1150 umass_t_bbb_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1151 {
1152 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1153 	struct usb_device_request req;
1154 	struct usb_page_cache *pc;
1155 
1156 	switch (USB_GET_STATE(xfer)) {
1157 	case USB_ST_TRANSFERRED:
1158 		umass_transfer_start(sc, UMASS_T_BBB_RESET2);
1159 		return;
1160 
1161 	case USB_ST_SETUP:
1162 		/*
1163 		 * Reset recovery (5.3.4 in Universal Serial Bus Mass Storage Class)
1164 		 *
1165 		 * For Reset Recovery the host shall issue in the following order:
1166 		 * a) a Bulk-Only Mass Storage Reset
1167 		 * b) a Clear Feature HALT to the Bulk-In endpoint
1168 		 * c) a Clear Feature HALT to the Bulk-Out endpoint
1169 		 *
1170 		 * This is done in 3 steps, using 3 transfers:
1171 		 * UMASS_T_BBB_RESET1
1172 		 * UMASS_T_BBB_RESET2
1173 		 * UMASS_T_BBB_RESET3
1174 		 */
1175 
1176 		DPRINTF(sc, UDMASS_BBB, "BBB reset!\n");
1177 
1178 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1179 		req.bRequest = UR_BBB_RESET;	/* bulk only reset */
1180 		USETW(req.wValue, 0);
1181 		req.wIndex[0] = sc->sc_iface_no;
1182 		req.wIndex[1] = 0;
1183 		USETW(req.wLength, 0);
1184 
1185 		pc = usbd_xfer_get_frame(xfer, 0);
1186 		usbd_copy_in(pc, 0, &req, sizeof(req));
1187 
1188 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1189 		usbd_xfer_set_frames(xfer, 1);
1190 		usbd_transfer_submit(xfer);
1191 		return;
1192 
1193 	default:			/* Error */
1194 		umass_tr_error(xfer, error);
1195 		return;
1196 	}
1197 }
1198 
1199 static void
1200 umass_t_bbb_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1201 {
1202 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_RESET3,
1203 	    UMASS_T_BBB_DATA_READ, error);
1204 }
1205 
1206 static void
1207 umass_t_bbb_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1208 {
1209 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_COMMAND,
1210 	    UMASS_T_BBB_DATA_WRITE, error);
1211 }
1212 
1213 static void
1214 umass_t_bbb_data_clear_stall_callback(struct usb_xfer *xfer,
1215     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1216 {
1217 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1218 
1219 	switch (USB_GET_STATE(xfer)) {
1220 	case USB_ST_TRANSFERRED:
1221 tr_transferred:
1222 		umass_transfer_start(sc, next_xfer);
1223 		return;
1224 
1225 	case USB_ST_SETUP:
1226 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1227 			goto tr_transferred;
1228 		}
1229 		return;
1230 
1231 	default:			/* Error */
1232 		umass_tr_error(xfer, error);
1233 		return;
1234 	}
1235 }
1236 
1237 static void
1238 umass_t_bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
1239 {
1240 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1241 	union ccb *ccb = sc->sc_transfer.ccb;
1242 	struct usb_page_cache *pc;
1243 	uint32_t tag;
1244 
1245 	switch (USB_GET_STATE(xfer)) {
1246 	case USB_ST_TRANSFERRED:
1247 		umass_transfer_start
1248 		    (sc, ((sc->sc_transfer.dir == DIR_IN) ? UMASS_T_BBB_DATA_READ :
1249 		    (sc->sc_transfer.dir == DIR_OUT) ? UMASS_T_BBB_DATA_WRITE :
1250 		    UMASS_T_BBB_STATUS));
1251 		return;
1252 
1253 	case USB_ST_SETUP:
1254 
1255 		sc->sc_status_try = 0;
1256 
1257 		if (ccb) {
1258 
1259 			/*
1260 		         * the initial value is not important,
1261 		         * as long as the values are unique:
1262 		         */
1263 			tag = UGETDW(sc->cbw.dCBWTag) + 1;
1264 
1265 			USETDW(sc->cbw.dCBWSignature, CBWSIGNATURE);
1266 			USETDW(sc->cbw.dCBWTag, tag);
1267 
1268 			/*
1269 		         * dCBWDataTransferLength:
1270 		         *   This field indicates the number of bytes of data that the host
1271 		         *   intends to transfer on the IN or OUT Bulk endpoint(as indicated by
1272 		         *   the Direction bit) during the execution of this command. If this
1273 		         *   field is set to 0, the device will expect that no data will be
1274 		         *   transferred IN or OUT during this command, regardless of the value
1275 		         *   of the Direction bit defined in dCBWFlags.
1276 		         */
1277 			USETDW(sc->cbw.dCBWDataTransferLength, sc->sc_transfer.data_len);
1278 
1279 			/*
1280 		         * dCBWFlags:
1281 		         *   The bits of the Flags field are defined as follows:
1282 		         *     Bits 0-6  reserved
1283 		         *     Bit  7    Direction - this bit shall be ignored if the
1284 		         *                           dCBWDataTransferLength field is zero.
1285 		         *               0 = data Out from host to device
1286 		         *               1 = data In from device to host
1287 		         */
1288 			sc->cbw.bCBWFlags = ((sc->sc_transfer.dir == DIR_IN) ?
1289 			    CBWFLAGS_IN : CBWFLAGS_OUT);
1290 			sc->cbw.bCBWLUN = sc->sc_transfer.lun;
1291 
1292 			if (sc->sc_transfer.cmd_len > sizeof(sc->cbw.CBWCDB)) {
1293 				sc->sc_transfer.cmd_len = sizeof(sc->cbw.CBWCDB);
1294 				DPRINTF(sc, UDMASS_BBB, "Truncating long command!\n");
1295 			}
1296 			sc->cbw.bCDBLength = sc->sc_transfer.cmd_len;
1297 
1298 			memcpy(sc->cbw.CBWCDB, sc->sc_transfer.cmd_data,
1299 			    sc->sc_transfer.cmd_len);
1300 
1301 			memset(sc->sc_transfer.cmd_data +
1302 			    sc->sc_transfer.cmd_len, 0,
1303 			    sizeof(sc->cbw.CBWCDB) -
1304 			    sc->sc_transfer.cmd_len);
1305 
1306 			DIF(UDMASS_BBB, umass_bbb_dump_cbw(sc, &sc->cbw));
1307 
1308 			pc = usbd_xfer_get_frame(xfer, 0);
1309 			usbd_copy_in(pc, 0, &sc->cbw, sizeof(sc->cbw));
1310 			usbd_xfer_set_frame_len(xfer, 0, sizeof(sc->cbw));
1311 
1312 			usbd_transfer_submit(xfer);
1313 		}
1314 		return;
1315 
1316 	default:			/* Error */
1317 		umass_tr_error(xfer, error);
1318 		return;
1319 	}
1320 }
1321 
1322 static void
1323 umass_t_bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1324 {
1325 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1326 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1327 	int actlen, sumlen;
1328 
1329 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1330 
1331 	switch (USB_GET_STATE(xfer)) {
1332 	case USB_ST_TRANSFERRED:
1333 		sc->sc_transfer.data_rem -= actlen;
1334 		sc->sc_transfer.data_ptr += actlen;
1335 		sc->sc_transfer.actlen += actlen;
1336 
1337 		if (actlen < sumlen) {
1338 			/* short transfer */
1339 			sc->sc_transfer.data_rem = 0;
1340 		}
1341 	case USB_ST_SETUP:
1342 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1343 		    max_bulk, sc->sc_transfer.data_rem);
1344 
1345 		if (sc->sc_transfer.data_rem == 0) {
1346 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1347 			return;
1348 		}
1349 		if (max_bulk > sc->sc_transfer.data_rem) {
1350 			max_bulk = sc->sc_transfer.data_rem;
1351 		}
1352 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1353 
1354 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1355 		    max_bulk);
1356 
1357 		usbd_transfer_submit(xfer);
1358 		return;
1359 
1360 	default:			/* Error */
1361 		if (error == USB_ERR_CANCELLED) {
1362 			umass_tr_error(xfer, error);
1363 		} else {
1364 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1365 		}
1366 		return;
1367 	}
1368 }
1369 
1370 static void
1371 umass_t_bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1372 {
1373 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1374 	    UMASS_T_BBB_DATA_READ, error);
1375 }
1376 
1377 static void
1378 umass_t_bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1379 {
1380 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1381 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1382 	int actlen, sumlen;
1383 
1384 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1385 
1386 	switch (USB_GET_STATE(xfer)) {
1387 	case USB_ST_TRANSFERRED:
1388 		sc->sc_transfer.data_rem -= actlen;
1389 		sc->sc_transfer.data_ptr += actlen;
1390 		sc->sc_transfer.actlen += actlen;
1391 
1392 		if (actlen < sumlen) {
1393 			/* short transfer */
1394 			sc->sc_transfer.data_rem = 0;
1395 		}
1396 	case USB_ST_SETUP:
1397 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1398 		    max_bulk, sc->sc_transfer.data_rem);
1399 
1400 		if (sc->sc_transfer.data_rem == 0) {
1401 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1402 			return;
1403 		}
1404 		if (max_bulk > sc->sc_transfer.data_rem) {
1405 			max_bulk = sc->sc_transfer.data_rem;
1406 		}
1407 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1408 
1409 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1410 		    max_bulk);
1411 
1412 		usbd_transfer_submit(xfer);
1413 		return;
1414 
1415 	default:			/* Error */
1416 		if (error == USB_ERR_CANCELLED) {
1417 			umass_tr_error(xfer, error);
1418 		} else {
1419 			umass_transfer_start(sc, UMASS_T_BBB_DATA_WR_CS);
1420 		}
1421 		return;
1422 	}
1423 }
1424 
1425 static void
1426 umass_t_bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1427 {
1428 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1429 	    UMASS_T_BBB_DATA_WRITE, error);
1430 }
1431 
1432 static void
1433 umass_t_bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
1434 {
1435 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1436 	union ccb *ccb = sc->sc_transfer.ccb;
1437 	struct usb_page_cache *pc;
1438 	uint32_t residue;
1439 	int actlen;
1440 
1441 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1442 
1443 	switch (USB_GET_STATE(xfer)) {
1444 	case USB_ST_TRANSFERRED:
1445 
1446 		/*
1447 		 * Do a full reset if there is something wrong with the CSW:
1448 		 */
1449 		sc->sc_status_try = 1;
1450 
1451 		/* Zero missing parts of the CSW: */
1452 
1453 		if (actlen < (int)sizeof(sc->csw))
1454 			memset(&sc->csw, 0, sizeof(sc->csw));
1455 
1456 		pc = usbd_xfer_get_frame(xfer, 0);
1457 		usbd_copy_out(pc, 0, &sc->csw, actlen);
1458 
1459 		DIF(UDMASS_BBB, umass_bbb_dump_csw(sc, &sc->csw));
1460 
1461 		residue = UGETDW(sc->csw.dCSWDataResidue);
1462 
1463 		if ((!residue) || (sc->sc_quirks & IGNORE_RESIDUE)) {
1464 			residue = (sc->sc_transfer.data_len -
1465 			    sc->sc_transfer.actlen);
1466 		}
1467 		if (residue > sc->sc_transfer.data_len) {
1468 			DPRINTF(sc, UDMASS_BBB, "truncating residue from %d "
1469 			    "to %d bytes\n", residue, sc->sc_transfer.data_len);
1470 			residue = sc->sc_transfer.data_len;
1471 		}
1472 		/* translate weird command-status signatures: */
1473 		if (sc->sc_quirks & WRONG_CSWSIG) {
1474 
1475 			uint32_t temp = UGETDW(sc->csw.dCSWSignature);
1476 
1477 			if ((temp == CSWSIGNATURE_OLYMPUS_C1) ||
1478 			    (temp == CSWSIGNATURE_IMAGINATION_DBX1)) {
1479 				USETDW(sc->csw.dCSWSignature, CSWSIGNATURE);
1480 			}
1481 		}
1482 		/* check CSW and handle eventual error */
1483 		if (UGETDW(sc->csw.dCSWSignature) != CSWSIGNATURE) {
1484 			DPRINTF(sc, UDMASS_BBB, "bad CSW signature 0x%08x != 0x%08x\n",
1485 			    UGETDW(sc->csw.dCSWSignature), CSWSIGNATURE);
1486 			/*
1487 			 * Invalid CSW: Wrong signature or wrong tag might
1488 			 * indicate that we lost synchronization. Reset the
1489 			 * device.
1490 			 */
1491 			goto tr_error;
1492 		} else if (UGETDW(sc->csw.dCSWTag) != UGETDW(sc->cbw.dCBWTag)) {
1493 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: tag 0x%08x should be "
1494 			    "0x%08x\n", UGETDW(sc->csw.dCSWTag),
1495 			    UGETDW(sc->cbw.dCBWTag));
1496 			goto tr_error;
1497 		} else if (sc->csw.bCSWStatus > CSWSTATUS_PHASE) {
1498 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: status %d > %d\n",
1499 			    sc->csw.bCSWStatus, CSWSTATUS_PHASE);
1500 			goto tr_error;
1501 		} else if (sc->csw.bCSWStatus == CSWSTATUS_PHASE) {
1502 			DPRINTF(sc, UDMASS_BBB, "Phase error, residue = "
1503 			    "%d\n", residue);
1504 			goto tr_error;
1505 		} else if (sc->sc_transfer.actlen > sc->sc_transfer.data_len) {
1506 			DPRINTF(sc, UDMASS_BBB, "Buffer overrun %d > %d\n",
1507 			    sc->sc_transfer.actlen, sc->sc_transfer.data_len);
1508 			goto tr_error;
1509 		} else if (sc->csw.bCSWStatus == CSWSTATUS_FAILED) {
1510 			DPRINTF(sc, UDMASS_BBB, "Command failed, residue = "
1511 			    "%d\n", residue);
1512 
1513 			sc->sc_transfer.ccb = NULL;
1514 
1515 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1516 
1517 			(sc->sc_transfer.callback)
1518 			    (sc, ccb, residue, STATUS_CMD_FAILED);
1519 		} else {
1520 			sc->sc_transfer.ccb = NULL;
1521 
1522 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1523 
1524 			(sc->sc_transfer.callback)
1525 			    (sc, ccb, residue, STATUS_CMD_OK);
1526 		}
1527 		return;
1528 
1529 	case USB_ST_SETUP:
1530 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1531 		usbd_transfer_submit(xfer);
1532 		return;
1533 
1534 	default:
1535 tr_error:
1536 		DPRINTF(sc, UDMASS_BBB, "Failed to read CSW: %s, try %d\n",
1537 		    usbd_errstr(error), sc->sc_status_try);
1538 
1539 		if ((error == USB_ERR_CANCELLED) ||
1540 		    (sc->sc_status_try)) {
1541 			umass_tr_error(xfer, error);
1542 		} else {
1543 			sc->sc_status_try = 1;
1544 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1545 		}
1546 		return;
1547 	}
1548 }
1549 
1550 static void
1551 umass_command_start(struct umass_softc *sc, uint8_t dir,
1552     void *data_ptr, uint32_t data_len,
1553     uint32_t data_timeout, umass_callback_t *callback,
1554     union ccb *ccb)
1555 {
1556 	sc->sc_transfer.lun = ccb->ccb_h.target_lun;
1557 
1558 	/*
1559 	 * NOTE: assumes that "sc->sc_transfer.cmd_data" and
1560 	 * "sc->sc_transfer.cmd_len" has been properly
1561 	 * initialized.
1562 	 */
1563 
1564 	sc->sc_transfer.dir = data_len ? dir : DIR_NONE;
1565 	sc->sc_transfer.data_ptr = data_ptr;
1566 	sc->sc_transfer.data_len = data_len;
1567 	sc->sc_transfer.data_rem = data_len;
1568 	sc->sc_transfer.data_timeout = (data_timeout + UMASS_TIMEOUT);
1569 
1570 	sc->sc_transfer.actlen = 0;
1571 	sc->sc_transfer.callback = callback;
1572 	sc->sc_transfer.ccb = ccb;
1573 
1574 	if (sc->sc_xfer[sc->sc_last_xfer_index]) {
1575 		usbd_transfer_start(sc->sc_xfer[sc->sc_last_xfer_index]);
1576 	} else {
1577 		umass_cancel_ccb(sc);
1578 	}
1579 }
1580 
1581 static uint8_t
1582 umass_bbb_get_max_lun(struct umass_softc *sc)
1583 {
1584 	struct usb_device_request req;
1585 	usb_error_t err;
1586 	uint8_t buf = 0;
1587 
1588 	/* The Get Max Lun command is a class-specific request. */
1589 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
1590 	req.bRequest = UR_BBB_GET_MAX_LUN;
1591 	USETW(req.wValue, 0);
1592 	req.wIndex[0] = sc->sc_iface_no;
1593 	req.wIndex[1] = 0;
1594 	USETW(req.wLength, 1);
1595 
1596 	err = usbd_do_request(sc->sc_udev, NULL, &req, &buf);
1597 	if (err) {
1598 		buf = 0;
1599 
1600 		/* Device doesn't support Get Max Lun request. */
1601 		printf("%s: Get Max Lun not supported (%s)\n",
1602 		    sc->sc_name, usbd_errstr(err));
1603 	}
1604 	return (buf);
1605 }
1606 
1607 /*
1608  * Command/Bulk/Interrupt (CBI) specific functions
1609  */
1610 
1611 static void
1612 umass_cbi_start_status(struct umass_softc *sc)
1613 {
1614 	if (sc->sc_xfer[UMASS_T_CBI_STATUS]) {
1615 		umass_transfer_start(sc, UMASS_T_CBI_STATUS);
1616 	} else {
1617 		union ccb *ccb = sc->sc_transfer.ccb;
1618 
1619 		sc->sc_transfer.ccb = NULL;
1620 
1621 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1622 
1623 		(sc->sc_transfer.callback)
1624 		    (sc, ccb, (sc->sc_transfer.data_len -
1625 		    sc->sc_transfer.actlen), STATUS_CMD_UNKNOWN);
1626 	}
1627 }
1628 
1629 static void
1630 umass_t_cbi_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1631 {
1632 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1633 	struct usb_device_request req;
1634 	struct usb_page_cache *pc;
1635 	uint8_t buf[UMASS_CBI_DIAGNOSTIC_CMDLEN];
1636 
1637 	uint8_t i;
1638 
1639 	switch (USB_GET_STATE(xfer)) {
1640 	case USB_ST_TRANSFERRED:
1641 		umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1642 		break;
1643 
1644 	case USB_ST_SETUP:
1645 		/*
1646 		 * Command Block Reset Protocol
1647 		 *
1648 		 * First send a reset request to the device. Then clear
1649 		 * any possibly stalled bulk endpoints.
1650 		 *
1651 		 * This is done in 3 steps, using 3 transfers:
1652 		 * UMASS_T_CBI_RESET1
1653 		 * UMASS_T_CBI_RESET2
1654 		 * UMASS_T_CBI_RESET3
1655 		 * UMASS_T_CBI_RESET4 (only if there is an interrupt endpoint)
1656 		 */
1657 
1658 		DPRINTF(sc, UDMASS_CBI, "CBI reset!\n");
1659 
1660 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1661 		req.bRequest = UR_CBI_ADSC;
1662 		USETW(req.wValue, 0);
1663 		req.wIndex[0] = sc->sc_iface_no;
1664 		req.wIndex[1] = 0;
1665 		USETW(req.wLength, UMASS_CBI_DIAGNOSTIC_CMDLEN);
1666 
1667 		/*
1668 		 * The 0x1d code is the SEND DIAGNOSTIC command. To
1669 		 * distinguish between the two, the last 10 bytes of the CBL
1670 		 * is filled with 0xff (section 2.2 of the CBI
1671 		 * specification)
1672 		 */
1673 		buf[0] = 0x1d;		/* Command Block Reset */
1674 		buf[1] = 0x04;
1675 
1676 		for (i = 2; i < UMASS_CBI_DIAGNOSTIC_CMDLEN; i++) {
1677 			buf[i] = 0xff;
1678 		}
1679 
1680 		pc = usbd_xfer_get_frame(xfer, 0);
1681 		usbd_copy_in(pc, 0, &req, sizeof(req));
1682 		pc = usbd_xfer_get_frame(xfer, 1);
1683 		usbd_copy_in(pc, 0, buf, sizeof(buf));
1684 
1685 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1686 		usbd_xfer_set_frame_len(xfer, 1, sizeof(buf));
1687 		usbd_xfer_set_frames(xfer, 2);
1688 		usbd_transfer_submit(xfer);
1689 		break;
1690 
1691 	default:			/* Error */
1692 		if (error == USB_ERR_CANCELLED)
1693 			umass_tr_error(xfer, error);
1694 		else
1695 			umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1696 		break;
1697 	}
1698 }
1699 
1700 static void
1701 umass_t_cbi_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1702 {
1703 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_RESET3,
1704 	    UMASS_T_CBI_DATA_READ, error);
1705 }
1706 
1707 static void
1708 umass_t_cbi_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1709 {
1710 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1711 
1712 	umass_t_cbi_data_clear_stall_callback
1713 	    (xfer, (sc->sc_xfer[UMASS_T_CBI_RESET4] &&
1714 	    sc->sc_xfer[UMASS_T_CBI_STATUS]) ?
1715 	    UMASS_T_CBI_RESET4 : UMASS_T_CBI_COMMAND,
1716 	    UMASS_T_CBI_DATA_WRITE, error);
1717 }
1718 
1719 static void
1720 umass_t_cbi_reset4_callback(struct usb_xfer *xfer, usb_error_t error)
1721 {
1722 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_COMMAND,
1723 	    UMASS_T_CBI_STATUS, error);
1724 }
1725 
1726 static void
1727 umass_t_cbi_data_clear_stall_callback(struct usb_xfer *xfer,
1728     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1729 {
1730 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1731 
1732 	switch (USB_GET_STATE(xfer)) {
1733 	case USB_ST_TRANSFERRED:
1734 tr_transferred:
1735 		if (next_xfer == UMASS_T_CBI_STATUS) {
1736 			umass_cbi_start_status(sc);
1737 		} else {
1738 			umass_transfer_start(sc, next_xfer);
1739 		}
1740 		break;
1741 
1742 	case USB_ST_SETUP:
1743 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1744 			goto tr_transferred;	/* should not happen */
1745 		}
1746 		break;
1747 
1748 	default:			/* Error */
1749 		umass_tr_error(xfer, error);
1750 		break;
1751 	}
1752 }
1753 
1754 static void
1755 umass_t_cbi_command_callback(struct usb_xfer *xfer, usb_error_t error)
1756 {
1757 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1758 	union ccb *ccb = sc->sc_transfer.ccb;
1759 	struct usb_device_request req;
1760 	struct usb_page_cache *pc;
1761 
1762 	switch (USB_GET_STATE(xfer)) {
1763 	case USB_ST_TRANSFERRED:
1764 
1765 		if (sc->sc_transfer.dir == DIR_NONE) {
1766 			umass_cbi_start_status(sc);
1767 		} else {
1768 			umass_transfer_start
1769 			    (sc, (sc->sc_transfer.dir == DIR_IN) ?
1770 			    UMASS_T_CBI_DATA_READ : UMASS_T_CBI_DATA_WRITE);
1771 		}
1772 		break;
1773 
1774 	case USB_ST_SETUP:
1775 
1776 		if (ccb) {
1777 
1778 			/*
1779 		         * do a CBI transfer with cmd_len bytes from
1780 		         * cmd_data, possibly a data phase of data_len
1781 		         * bytes from/to the device and finally a status
1782 		         * read phase.
1783 		         */
1784 
1785 			req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1786 			req.bRequest = UR_CBI_ADSC;
1787 			USETW(req.wValue, 0);
1788 			req.wIndex[0] = sc->sc_iface_no;
1789 			req.wIndex[1] = 0;
1790 			req.wLength[0] = sc->sc_transfer.cmd_len;
1791 			req.wLength[1] = 0;
1792 
1793 			pc = usbd_xfer_get_frame(xfer, 0);
1794 			usbd_copy_in(pc, 0, &req, sizeof(req));
1795 			pc = usbd_xfer_get_frame(xfer, 1);
1796 			usbd_copy_in(pc, 0, sc->sc_transfer.cmd_data,
1797 			    sc->sc_transfer.cmd_len);
1798 
1799 			usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1800 			usbd_xfer_set_frame_len(xfer, 1, sc->sc_transfer.cmd_len);
1801 			usbd_xfer_set_frames(xfer,
1802 			    sc->sc_transfer.cmd_len ? 2 : 1);
1803 
1804 			DIF(UDMASS_CBI,
1805 			    umass_cbi_dump_cmd(sc,
1806 			    sc->sc_transfer.cmd_data,
1807 			    sc->sc_transfer.cmd_len));
1808 
1809 			usbd_transfer_submit(xfer);
1810 		}
1811 		break;
1812 
1813 	default:			/* Error */
1814 		/*
1815 		 * STALL on the control pipe can be result of the command error.
1816 		 * Attempt to clear this STALL same as for bulk pipe also
1817 		 * results in command completion interrupt, but ASC/ASCQ there
1818 		 * look like not always valid, so don't bother about it.
1819 		 */
1820 		if ((error == USB_ERR_STALLED) ||
1821 		    (sc->sc_transfer.callback == &umass_cam_cb)) {
1822 			sc->sc_transfer.ccb = NULL;
1823 			(sc->sc_transfer.callback)
1824 			    (sc, ccb, sc->sc_transfer.data_len,
1825 			    STATUS_CMD_UNKNOWN);
1826 		} else {
1827 			umass_tr_error(xfer, error);
1828 			/* skip reset */
1829 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1830 		}
1831 		break;
1832 	}
1833 }
1834 
1835 static void
1836 umass_t_cbi_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1837 {
1838 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1839 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1840 	int actlen, sumlen;
1841 
1842 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1843 
1844 	switch (USB_GET_STATE(xfer)) {
1845 	case USB_ST_TRANSFERRED:
1846 		sc->sc_transfer.data_rem -= actlen;
1847 		sc->sc_transfer.data_ptr += actlen;
1848 		sc->sc_transfer.actlen += actlen;
1849 
1850 		if (actlen < sumlen) {
1851 			/* short transfer */
1852 			sc->sc_transfer.data_rem = 0;
1853 		}
1854 	case USB_ST_SETUP:
1855 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1856 		    max_bulk, sc->sc_transfer.data_rem);
1857 
1858 		if (sc->sc_transfer.data_rem == 0) {
1859 			umass_cbi_start_status(sc);
1860 			break;
1861 		}
1862 		if (max_bulk > sc->sc_transfer.data_rem) {
1863 			max_bulk = sc->sc_transfer.data_rem;
1864 		}
1865 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1866 
1867 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1868 		    max_bulk);
1869 
1870 		usbd_transfer_submit(xfer);
1871 		break;
1872 
1873 	default:			/* Error */
1874 		if ((error == USB_ERR_CANCELLED) ||
1875 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1876 			umass_tr_error(xfer, error);
1877 		} else {
1878 			umass_transfer_start(sc, UMASS_T_CBI_DATA_RD_CS);
1879 		}
1880 		break;
1881 	}
1882 }
1883 
1884 static void
1885 umass_t_cbi_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1886 {
1887 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1888 	    UMASS_T_CBI_DATA_READ, error);
1889 }
1890 
1891 static void
1892 umass_t_cbi_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1893 {
1894 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1895 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1896 	int actlen, sumlen;
1897 
1898 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1899 
1900 	switch (USB_GET_STATE(xfer)) {
1901 	case USB_ST_TRANSFERRED:
1902 		sc->sc_transfer.data_rem -= actlen;
1903 		sc->sc_transfer.data_ptr += actlen;
1904 		sc->sc_transfer.actlen += actlen;
1905 
1906 		if (actlen < sumlen) {
1907 			/* short transfer */
1908 			sc->sc_transfer.data_rem = 0;
1909 		}
1910 	case USB_ST_SETUP:
1911 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1912 		    max_bulk, sc->sc_transfer.data_rem);
1913 
1914 		if (sc->sc_transfer.data_rem == 0) {
1915 			umass_cbi_start_status(sc);
1916 			break;
1917 		}
1918 		if (max_bulk > sc->sc_transfer.data_rem) {
1919 			max_bulk = sc->sc_transfer.data_rem;
1920 		}
1921 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1922 
1923 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1924 		    max_bulk);
1925 
1926 		usbd_transfer_submit(xfer);
1927 		break;
1928 
1929 	default:			/* Error */
1930 		if ((error == USB_ERR_CANCELLED) ||
1931 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1932 			umass_tr_error(xfer, error);
1933 		} else {
1934 			umass_transfer_start(sc, UMASS_T_CBI_DATA_WR_CS);
1935 		}
1936 		break;
1937 	}
1938 }
1939 
1940 static void
1941 umass_t_cbi_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1942 {
1943 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1944 	    UMASS_T_CBI_DATA_WRITE, error);
1945 }
1946 
1947 static void
1948 umass_t_cbi_status_callback(struct usb_xfer *xfer, usb_error_t error)
1949 {
1950 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1951 	union ccb *ccb = sc->sc_transfer.ccb;
1952 	struct usb_page_cache *pc;
1953 	uint32_t residue;
1954 	uint8_t status;
1955 	int actlen;
1956 
1957 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1958 
1959 	switch (USB_GET_STATE(xfer)) {
1960 	case USB_ST_TRANSFERRED:
1961 
1962 		if (actlen < (int)sizeof(sc->sbl)) {
1963 			goto tr_setup;
1964 		}
1965 		pc = usbd_xfer_get_frame(xfer, 0);
1966 		usbd_copy_out(pc, 0, &sc->sbl, sizeof(sc->sbl));
1967 
1968 		residue = (sc->sc_transfer.data_len -
1969 		    sc->sc_transfer.actlen);
1970 
1971 		/* dissect the information in the buffer */
1972 
1973 		if (sc->sc_proto & UMASS_PROTO_UFI) {
1974 
1975 			/*
1976 			 * Section 3.4.3.1.3 specifies that the UFI command
1977 			 * protocol returns an ASC and ASCQ in the interrupt
1978 			 * data block.
1979 			 */
1980 
1981 			DPRINTF(sc, UDMASS_CBI, "UFI CCI, ASC = 0x%02x, "
1982 			    "ASCQ = 0x%02x\n", sc->sbl.ufi.asc,
1983 			    sc->sbl.ufi.ascq);
1984 
1985 			status = (((sc->sbl.ufi.asc == 0) &&
1986 			    (sc->sbl.ufi.ascq == 0)) ?
1987 			    STATUS_CMD_OK : STATUS_CMD_FAILED);
1988 
1989 			sc->sc_transfer.ccb = NULL;
1990 
1991 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1992 
1993 			(sc->sc_transfer.callback)
1994 			    (sc, ccb, residue, status);
1995 
1996 			break;
1997 
1998 		} else {
1999 
2000 			/* Command Interrupt Data Block */
2001 
2002 			DPRINTF(sc, UDMASS_CBI, "type=0x%02x, value=0x%02x\n",
2003 			    sc->sbl.common.type, sc->sbl.common.value);
2004 
2005 			if (sc->sbl.common.type == IDB_TYPE_CCI) {
2006 
2007 				status = (sc->sbl.common.value & IDB_VALUE_STATUS_MASK);
2008 
2009 				status = ((status == IDB_VALUE_PASS) ? STATUS_CMD_OK :
2010 				    (status == IDB_VALUE_FAIL) ? STATUS_CMD_FAILED :
2011 				    (status == IDB_VALUE_PERSISTENT) ? STATUS_CMD_FAILED :
2012 				    STATUS_WIRE_FAILED);
2013 
2014 				sc->sc_transfer.ccb = NULL;
2015 
2016 				sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2017 
2018 				(sc->sc_transfer.callback)
2019 				    (sc, ccb, residue, status);
2020 
2021 				break;
2022 			}
2023 		}
2024 
2025 		/* fallthrough */
2026 
2027 	case USB_ST_SETUP:
2028 tr_setup:
2029 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2030 		usbd_transfer_submit(xfer);
2031 		break;
2032 
2033 	default:			/* Error */
2034 		DPRINTF(sc, UDMASS_CBI, "Failed to read CSW: %s\n",
2035 		    usbd_errstr(error));
2036 		umass_tr_error(xfer, error);
2037 		break;
2038 	}
2039 }
2040 
2041 /*
2042  * CAM specific functions (used by SCSI, UFI, 8070i (ATAPI))
2043  */
2044 
2045 static int
2046 umass_cam_attach_sim(struct umass_softc *sc)
2047 {
2048 	struct cam_devq *devq;		/* Per device Queue */
2049 
2050 	/*
2051 	 * A HBA is attached to the CAM layer.
2052 	 *
2053 	 * The CAM layer will then after a while start probing for devices on
2054 	 * the bus. The number of SIMs is limited to one.
2055 	 */
2056 
2057 	devq = cam_simq_alloc(1 /* maximum openings */ );
2058 	if (devq == NULL) {
2059 		return (ENOMEM);
2060 	}
2061 	sc->sc_sim = cam_sim_alloc
2062 	    (&umass_cam_action, &umass_cam_poll,
2063 	    DEVNAME_SIM,
2064 	    sc /* priv */ ,
2065 	    sc->sc_unit /* unit number */ ,
2066 	    &sc->sc_mtx /* mutex */ ,
2067 	    1 /* maximum device openings */ ,
2068 	    0 /* maximum tagged device openings */ ,
2069 	    devq);
2070 
2071 	if (sc->sc_sim == NULL) {
2072 		cam_simq_free(devq);
2073 		return (ENOMEM);
2074 	}
2075 
2076 	mtx_lock(&sc->sc_mtx);
2077 
2078 	if (xpt_bus_register(sc->sc_sim, sc->sc_dev,
2079 	    sc->sc_unit) != CAM_SUCCESS) {
2080 		mtx_unlock(&sc->sc_mtx);
2081 		return (ENOMEM);
2082 	}
2083 	mtx_unlock(&sc->sc_mtx);
2084 
2085 	return (0);
2086 }
2087 
2088 static void
2089 umass_cam_attach(struct umass_softc *sc)
2090 {
2091 #ifndef USB_DEBUG
2092 	if (bootverbose)
2093 #endif
2094 		printf("%s:%d:%d:%d: Attached to scbus%d\n",
2095 		    sc->sc_name, cam_sim_path(sc->sc_sim),
2096 		    sc->sc_unit, CAM_LUN_WILDCARD,
2097 		    cam_sim_path(sc->sc_sim));
2098 }
2099 
2100 /* umass_cam_detach
2101  *	detach from the CAM layer
2102  */
2103 
2104 static void
2105 umass_cam_detach_sim(struct umass_softc *sc)
2106 {
2107 	if (sc->sc_sim != NULL) {
2108 		if (xpt_bus_deregister(cam_sim_path(sc->sc_sim))) {
2109 			/* accessing the softc is not possible after this */
2110 			sc->sc_sim->softc = NULL;
2111 			cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2112 		} else {
2113 			panic("%s: CAM layer is busy\n",
2114 			    sc->sc_name);
2115 		}
2116 		sc->sc_sim = NULL;
2117 	}
2118 }
2119 
2120 /* umass_cam_action
2121  * 	CAM requests for action come through here
2122  */
2123 
2124 static void
2125 umass_cam_action(struct cam_sim *sim, union ccb *ccb)
2126 {
2127 	struct umass_softc *sc = (struct umass_softc *)sim->softc;
2128 
2129 	if (sc == NULL) {
2130 		ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2131 		xpt_done(ccb);
2132 		return;
2133 	}
2134 
2135 	/* Perform the requested action */
2136 	switch (ccb->ccb_h.func_code) {
2137 	case XPT_SCSI_IO:
2138 		{
2139 			uint8_t *cmd;
2140 			uint8_t dir;
2141 
2142 			if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2143 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2144 			} else {
2145 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2146 			}
2147 
2148 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2149 			    "cmd: 0x%02x, flags: 0x%02x, "
2150 			    "%db cmd/%db data/%db sense\n",
2151 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2152 			    ccb->ccb_h.target_lun, cmd[0],
2153 			    ccb->ccb_h.flags & CAM_DIR_MASK, ccb->csio.cdb_len,
2154 			    ccb->csio.dxfer_len, ccb->csio.sense_len);
2155 
2156 			if (sc->sc_transfer.ccb) {
2157 				DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2158 				    "I/O in progress, deferring\n",
2159 				    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2160 				    ccb->ccb_h.target_lun);
2161 				ccb->ccb_h.status = CAM_SCSI_BUSY;
2162 				xpt_done(ccb);
2163 				goto done;
2164 			}
2165 			switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
2166 			case CAM_DIR_IN:
2167 				dir = DIR_IN;
2168 				break;
2169 			case CAM_DIR_OUT:
2170 				dir = DIR_OUT;
2171 				DIF(UDMASS_SCSI,
2172 				    umass_dump_buffer(sc, ccb->csio.data_ptr,
2173 				    ccb->csio.dxfer_len, 48));
2174 				break;
2175 			default:
2176 				dir = DIR_NONE;
2177 			}
2178 
2179 			ccb->ccb_h.status = CAM_REQ_INPROG | CAM_SIM_QUEUED;
2180 
2181 			/*
2182 			 * sc->sc_transform will convert the command to the
2183 			 * command format needed by the specific command set
2184 			 * and return the converted command in
2185 			 * "sc->sc_transfer.cmd_data"
2186 			 */
2187 			if (umass_std_transform(sc, ccb, cmd, ccb->csio.cdb_len)) {
2188 
2189 				if (sc->sc_transfer.cmd_data[0] == INQUIRY) {
2190 					const char *pserial;
2191 
2192 					pserial = usb_get_serial(sc->sc_udev);
2193 
2194 					/*
2195 					 * Umass devices don't generally report their serial numbers
2196 					 * in the usual SCSI way.  Emulate it here.
2197 					 */
2198 					if ((sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2199 					    (sc->sc_transfer.cmd_data[2] == SVPD_UNIT_SERIAL_NUMBER) &&
2200 					    (pserial[0] != '\0')) {
2201 						struct scsi_vpd_unit_serial_number *vpd_serial;
2202 
2203 						vpd_serial = (struct scsi_vpd_unit_serial_number *)ccb->csio.data_ptr;
2204 						vpd_serial->length = strlen(pserial);
2205 						if (vpd_serial->length > sizeof(vpd_serial->serial_num))
2206 							vpd_serial->length = sizeof(vpd_serial->serial_num);
2207 						memcpy(vpd_serial->serial_num, pserial, vpd_serial->length);
2208 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2209 						ccb->ccb_h.status = CAM_REQ_CMP;
2210 						xpt_done(ccb);
2211 						goto done;
2212 					}
2213 
2214 					/*
2215 					 * Handle EVPD inquiry for broken devices first
2216 					 * NO_INQUIRY also implies NO_INQUIRY_EVPD
2217 					 */
2218 					if ((sc->sc_quirks & (NO_INQUIRY_EVPD | NO_INQUIRY)) &&
2219 					    (sc->sc_transfer.cmd_data[1] & SI_EVPD)) {
2220 
2221 						scsi_set_sense_data(&ccb->csio.sense_data,
2222 							/*sense_format*/ SSD_TYPE_NONE,
2223 							/*current_error*/ 1,
2224 							/*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2225 							/*asc*/ 0x24,
2226 							/*ascq*/ 0x00,
2227 							/*extra args*/ SSD_ELEM_NONE);
2228 						ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2229 						ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR |
2230 						    CAM_AUTOSNS_VALID;
2231 						xpt_done(ccb);
2232 						goto done;
2233 					}
2234 					/*
2235 					 * Return fake inquiry data for
2236 					 * broken devices
2237 					 */
2238 					if (sc->sc_quirks & NO_INQUIRY) {
2239 						memcpy(ccb->csio.data_ptr, &fake_inq_data,
2240 						    sizeof(fake_inq_data));
2241 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2242 						ccb->ccb_h.status = CAM_REQ_CMP;
2243 						xpt_done(ccb);
2244 						goto done;
2245 					}
2246 					if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2247 						ccb->csio.dxfer_len = SHORT_INQUIRY_LENGTH;
2248 					}
2249 				} else if (sc->sc_transfer.cmd_data[0] == SYNCHRONIZE_CACHE) {
2250 					if (sc->sc_quirks & NO_SYNCHRONIZE_CACHE) {
2251 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2252 						ccb->ccb_h.status = CAM_REQ_CMP;
2253 						xpt_done(ccb);
2254 						goto done;
2255 					}
2256 				}
2257 				umass_command_start(sc, dir, ccb->csio.data_ptr,
2258 				    ccb->csio.dxfer_len,
2259 				    ccb->ccb_h.timeout,
2260 				    &umass_cam_cb, ccb);
2261 			}
2262 			break;
2263 		}
2264 	case XPT_PATH_INQ:
2265 		{
2266 			struct ccb_pathinq *cpi = &ccb->cpi;
2267 
2268 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_PATH_INQ:.\n",
2269 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2270 			    ccb->ccb_h.target_lun);
2271 
2272 			/* host specific information */
2273 			cpi->version_num = 1;
2274 			cpi->hba_inquiry = 0;
2275 			cpi->target_sprt = 0;
2276 			cpi->hba_misc = PIM_NO_6_BYTE;
2277 			cpi->hba_eng_cnt = 0;
2278 			cpi->max_target = UMASS_SCSIID_MAX;	/* one target */
2279 			cpi->initiator_id = UMASS_SCSIID_HOST;
2280 			strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2281 			strlcpy(cpi->hba_vid, "USB SCSI", HBA_IDLEN);
2282 			strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2283 			cpi->unit_number = cam_sim_unit(sim);
2284 			cpi->bus_id = sc->sc_unit;
2285 			cpi->protocol = PROTO_SCSI;
2286 			cpi->protocol_version = SCSI_REV_2;
2287 			cpi->transport = XPORT_USB;
2288 			cpi->transport_version = 0;
2289 
2290 			if (sc == NULL) {
2291 				cpi->base_transfer_speed = 0;
2292 				cpi->max_lun = 0;
2293 			} else {
2294 				if (sc->sc_quirks & FLOPPY_SPEED) {
2295 					cpi->base_transfer_speed =
2296 					    UMASS_FLOPPY_TRANSFER_SPEED;
2297 				} else {
2298 					switch (usbd_get_speed(sc->sc_udev)) {
2299 					case USB_SPEED_SUPER:
2300 						cpi->base_transfer_speed =
2301 						    UMASS_SUPER_TRANSFER_SPEED;
2302 						cpi->maxio = MAXPHYS;
2303 						break;
2304 					case USB_SPEED_HIGH:
2305 						cpi->base_transfer_speed =
2306 						    UMASS_HIGH_TRANSFER_SPEED;
2307 						break;
2308 					default:
2309 						cpi->base_transfer_speed =
2310 						    UMASS_FULL_TRANSFER_SPEED;
2311 						break;
2312 					}
2313 				}
2314 				cpi->max_lun = sc->sc_maxlun;
2315 			}
2316 
2317 			cpi->ccb_h.status = CAM_REQ_CMP;
2318 			xpt_done(ccb);
2319 			break;
2320 		}
2321 	case XPT_RESET_DEV:
2322 		{
2323 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_RESET_DEV:.\n",
2324 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2325 			    ccb->ccb_h.target_lun);
2326 
2327 			umass_reset(sc);
2328 
2329 			ccb->ccb_h.status = CAM_REQ_CMP;
2330 			xpt_done(ccb);
2331 			break;
2332 		}
2333 	case XPT_GET_TRAN_SETTINGS:
2334 		{
2335 			struct ccb_trans_settings *cts = &ccb->cts;
2336 
2337 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_GET_TRAN_SETTINGS:.\n",
2338 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2339 			    ccb->ccb_h.target_lun);
2340 
2341 			cts->protocol = PROTO_SCSI;
2342 			cts->protocol_version = SCSI_REV_2;
2343 			cts->transport = XPORT_USB;
2344 			cts->transport_version = 0;
2345 			cts->xport_specific.valid = 0;
2346 
2347 			ccb->ccb_h.status = CAM_REQ_CMP;
2348 			xpt_done(ccb);
2349 			break;
2350 		}
2351 	case XPT_SET_TRAN_SETTINGS:
2352 		{
2353 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SET_TRAN_SETTINGS:.\n",
2354 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2355 			    ccb->ccb_h.target_lun);
2356 
2357 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2358 			xpt_done(ccb);
2359 			break;
2360 		}
2361 	case XPT_CALC_GEOMETRY:
2362 		{
2363 			cam_calc_geometry(&ccb->ccg, /* extended */ 1);
2364 			xpt_done(ccb);
2365 			break;
2366 		}
2367 	case XPT_NOOP:
2368 		{
2369 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_NOOP:.\n",
2370 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2371 			    ccb->ccb_h.target_lun);
2372 
2373 			ccb->ccb_h.status = CAM_REQ_CMP;
2374 			xpt_done(ccb);
2375 			break;
2376 		}
2377 	default:
2378 		DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:func_code 0x%04x: "
2379 		    "Not implemented\n",
2380 		    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2381 		    ccb->ccb_h.target_lun, ccb->ccb_h.func_code);
2382 
2383 		ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2384 		xpt_done(ccb);
2385 		break;
2386 	}
2387 
2388 done:
2389 	return;
2390 }
2391 
2392 static void
2393 umass_cam_poll(struct cam_sim *sim)
2394 {
2395 	struct umass_softc *sc = (struct umass_softc *)sim->softc;
2396 
2397 	if (sc == NULL)
2398 		return;
2399 
2400 	DPRINTF(sc, UDMASS_SCSI, "CAM poll\n");
2401 
2402 	usbd_transfer_poll(sc->sc_xfer, UMASS_T_MAX);
2403 }
2404 
2405 
2406 /* umass_cam_cb
2407  *	finalise a completed CAM command
2408  */
2409 
2410 static void
2411 umass_cam_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2412     uint8_t status)
2413 {
2414 	ccb->csio.resid = residue;
2415 
2416 	switch (status) {
2417 	case STATUS_CMD_OK:
2418 		ccb->ccb_h.status = CAM_REQ_CMP;
2419 		if ((sc->sc_quirks & READ_CAPACITY_OFFBY1) &&
2420 		    (ccb->ccb_h.func_code == XPT_SCSI_IO) &&
2421 		    (ccb->csio.cdb_io.cdb_bytes[0] == READ_CAPACITY)) {
2422 			struct scsi_read_capacity_data *rcap;
2423 			uint32_t maxsector;
2424 
2425 			rcap = (void *)(ccb->csio.data_ptr);
2426 			maxsector = scsi_4btoul(rcap->addr) - 1;
2427 			scsi_ulto4b(maxsector, rcap->addr);
2428 		}
2429 		/*
2430 		 * We have to add SVPD_UNIT_SERIAL_NUMBER to the list
2431 		 * of pages supported by the device - otherwise, CAM
2432 		 * will never ask us for the serial number if the
2433 		 * device cannot handle that by itself.
2434 		 */
2435 		if (ccb->ccb_h.func_code == XPT_SCSI_IO &&
2436 		    sc->sc_transfer.cmd_data[0] == INQUIRY &&
2437 		    (sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2438 		    sc->sc_transfer.cmd_data[2] == SVPD_SUPPORTED_PAGE_LIST &&
2439 		    (usb_get_serial(sc->sc_udev)[0] != '\0')) {
2440 			struct ccb_scsiio *csio;
2441 			struct scsi_vpd_supported_page_list *page_list;
2442 
2443 			csio = &ccb->csio;
2444 			page_list = (struct scsi_vpd_supported_page_list *)csio->data_ptr;
2445 			if (page_list->length + 1 < SVPD_SUPPORTED_PAGES_SIZE) {
2446 				page_list->list[page_list->length] = SVPD_UNIT_SERIAL_NUMBER;
2447 				page_list->length++;
2448 			}
2449 		}
2450 		xpt_done(ccb);
2451 		break;
2452 
2453 	case STATUS_CMD_UNKNOWN:
2454 	case STATUS_CMD_FAILED:
2455 
2456 		/* fetch sense data */
2457 
2458 		/* the rest of the command was filled in at attach */
2459 		sc->cam_scsi_sense.length = ccb->csio.sense_len;
2460 
2461 		DPRINTF(sc, UDMASS_SCSI, "Fetching %d bytes of "
2462 		    "sense data\n", ccb->csio.sense_len);
2463 
2464 		if (umass_std_transform(sc, ccb, &sc->cam_scsi_sense.opcode,
2465 		    sizeof(sc->cam_scsi_sense))) {
2466 
2467 			if ((sc->sc_quirks & FORCE_SHORT_INQUIRY) &&
2468 			    (sc->sc_transfer.cmd_data[0] == INQUIRY)) {
2469 				ccb->csio.sense_len = SHORT_INQUIRY_LENGTH;
2470 			}
2471 			umass_command_start(sc, DIR_IN, &ccb->csio.sense_data.error_code,
2472 			    ccb->csio.sense_len, ccb->ccb_h.timeout,
2473 			    &umass_cam_sense_cb, ccb);
2474 		}
2475 		break;
2476 
2477 	default:
2478 		/*
2479 		 * The wire protocol failed and will hopefully have
2480 		 * recovered. We return an error to CAM and let CAM
2481 		 * retry the command if necessary.
2482 		 */
2483 		ccb->ccb_h.status = CAM_REQ_CMP_ERR;
2484 		xpt_done(ccb);
2485 		break;
2486 	}
2487 }
2488 
2489 /*
2490  * Finalise a completed autosense operation
2491  */
2492 static void
2493 umass_cam_sense_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2494     uint8_t status)
2495 {
2496 	uint8_t *cmd;
2497 
2498 	switch (status) {
2499 	case STATUS_CMD_OK:
2500 	case STATUS_CMD_UNKNOWN:
2501 	case STATUS_CMD_FAILED: {
2502 		int key, sense_len;
2503 
2504 		ccb->csio.sense_resid = residue;
2505 		sense_len = ccb->csio.sense_len - ccb->csio.sense_resid;
2506 		key = scsi_get_sense_key(&ccb->csio.sense_data, sense_len,
2507 					 /*show_errors*/ 1);
2508 
2509 		if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2510 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2511 		} else {
2512 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2513 		}
2514 
2515 		/*
2516 		 * Getting sense data always succeeds (apart from wire
2517 		 * failures):
2518 		 */
2519 		if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2520 		    (cmd[0] == INQUIRY) &&
2521 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2522 			/*
2523 			 * Ignore unit attention errors in the case where
2524 			 * the Unit Attention state is not cleared on
2525 			 * REQUEST SENSE. They will appear again at the next
2526 			 * command.
2527 			 */
2528 			ccb->ccb_h.status = CAM_REQ_CMP;
2529 		} else if (key == SSD_KEY_NO_SENSE) {
2530 			/*
2531 			 * No problem after all (in the case of CBI without
2532 			 * CCI)
2533 			 */
2534 			ccb->ccb_h.status = CAM_REQ_CMP;
2535 		} else if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2536 			    (cmd[0] == READ_CAPACITY) &&
2537 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2538 			/*
2539 			 * Some devices do not clear the unit attention error
2540 			 * on request sense. We insert a test unit ready
2541 			 * command to make sure we clear the unit attention
2542 			 * condition, then allow the retry to proceed as
2543 			 * usual.
2544 			 */
2545 
2546 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2547 			    | CAM_AUTOSNS_VALID;
2548 			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2549 
2550 #if 0
2551 			DELAY(300000);
2552 #endif
2553 			DPRINTF(sc, UDMASS_SCSI, "Doing a sneaky"
2554 			    "TEST_UNIT_READY\n");
2555 
2556 			/* the rest of the command was filled in at attach */
2557 
2558 			if (umass_std_transform(sc, ccb,
2559 			    &sc->cam_scsi_test_unit_ready.opcode,
2560 			    sizeof(sc->cam_scsi_test_unit_ready))) {
2561 				umass_command_start(sc, DIR_NONE, NULL, 0,
2562 				    ccb->ccb_h.timeout,
2563 				    &umass_cam_quirk_cb, ccb);
2564 			}
2565 			break;
2566 		} else {
2567 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2568 			    | CAM_AUTOSNS_VALID;
2569 			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2570 		}
2571 		xpt_done(ccb);
2572 		break;
2573 	}
2574 	default:
2575 		DPRINTF(sc, UDMASS_SCSI, "Autosense failed, "
2576 		    "status %d\n", status);
2577 		ccb->ccb_h.status = CAM_AUTOSENSE_FAIL;
2578 		xpt_done(ccb);
2579 	}
2580 }
2581 
2582 /*
2583  * This completion code just handles the fact that we sent a test-unit-ready
2584  * after having previously failed a READ CAPACITY with CHECK_COND.  Even
2585  * though this command succeeded, we have to tell CAM to retry.
2586  */
2587 static void
2588 umass_cam_quirk_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2589     uint8_t status)
2590 {
2591 	DPRINTF(sc, UDMASS_SCSI, "Test unit ready "
2592 	    "returned status %d\n", status);
2593 
2594 	ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2595 	    | CAM_AUTOSNS_VALID;
2596 	ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2597 	xpt_done(ccb);
2598 }
2599 
2600 /*
2601  * SCSI specific functions
2602  */
2603 
2604 static uint8_t
2605 umass_scsi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2606     uint8_t cmd_len)
2607 {
2608 	if ((cmd_len == 0) ||
2609 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2610 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2611 		    "length: %d bytes\n", cmd_len);
2612 		return (0);		/* failure */
2613 	}
2614 	sc->sc_transfer.cmd_len = cmd_len;
2615 
2616 	switch (cmd_ptr[0]) {
2617 	case TEST_UNIT_READY:
2618 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2619 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2620 			    "to START_UNIT\n");
2621 			memset(sc->sc_transfer.cmd_data, 0, cmd_len);
2622 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2623 			sc->sc_transfer.cmd_data[4] = SSS_START;
2624 			return (1);
2625 		}
2626 		break;
2627 
2628 	case INQUIRY:
2629 		/*
2630 		 * some drives wedge when asked for full inquiry
2631 		 * information.
2632 		 */
2633 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2634 			memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2635 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2636 			return (1);
2637 		}
2638 		break;
2639 	}
2640 
2641 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2642 	return (1);
2643 }
2644 
2645 static uint8_t
2646 umass_rbc_transform(struct umass_softc *sc, uint8_t *cmd_ptr, uint8_t cmd_len)
2647 {
2648 	if ((cmd_len == 0) ||
2649 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2650 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2651 		    "length: %d bytes\n", cmd_len);
2652 		return (0);		/* failure */
2653 	}
2654 	switch (cmd_ptr[0]) {
2655 		/* these commands are defined in RBC: */
2656 	case READ_10:
2657 	case READ_CAPACITY:
2658 	case START_STOP_UNIT:
2659 	case SYNCHRONIZE_CACHE:
2660 	case WRITE_10:
2661 	case 0x2f:			/* VERIFY_10 is absent from
2662 					 * scsi_all.h??? */
2663 	case INQUIRY:
2664 	case MODE_SELECT_10:
2665 	case MODE_SENSE_10:
2666 	case TEST_UNIT_READY:
2667 	case WRITE_BUFFER:
2668 		/*
2669 		 * The following commands are not listed in my copy of the
2670 		 * RBC specs. CAM however seems to want those, and at least
2671 		 * the Sony DSC device appears to support those as well
2672 		 */
2673 	case REQUEST_SENSE:
2674 	case PREVENT_ALLOW:
2675 
2676 		memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2677 
2678 		if ((sc->sc_quirks & RBC_PAD_TO_12) && (cmd_len < 12)) {
2679 			memset(sc->sc_transfer.cmd_data + cmd_len,
2680 			    0, 12 - cmd_len);
2681 			cmd_len = 12;
2682 		}
2683 		sc->sc_transfer.cmd_len = cmd_len;
2684 		return (1);		/* sucess */
2685 
2686 		/* All other commands are not legal in RBC */
2687 	default:
2688 		DPRINTF(sc, UDMASS_SCSI, "Unsupported RBC "
2689 		    "command 0x%02x\n", cmd_ptr[0]);
2690 		return (0);		/* failure */
2691 	}
2692 }
2693 
2694 static uint8_t
2695 umass_ufi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2696     uint8_t cmd_len)
2697 {
2698 	if ((cmd_len == 0) ||
2699 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2700 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2701 		    "length: %d bytes\n", cmd_len);
2702 		return (0);		/* failure */
2703 	}
2704 	/* An UFI command is always 12 bytes in length */
2705 	sc->sc_transfer.cmd_len = UFI_COMMAND_LENGTH;
2706 
2707 	/* Zero the command data */
2708 	memset(sc->sc_transfer.cmd_data, 0, UFI_COMMAND_LENGTH);
2709 
2710 	switch (cmd_ptr[0]) {
2711 		/*
2712 		 * Commands of which the format has been verified. They
2713 		 * should work. Copy the command into the (zeroed out)
2714 		 * destination buffer.
2715 		 */
2716 	case TEST_UNIT_READY:
2717 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2718 			/*
2719 			 * Some devices do not support this command. Start
2720 			 * Stop Unit should give the same results
2721 			 */
2722 			DPRINTF(sc, UDMASS_UFI, "Converted TEST_UNIT_READY "
2723 			    "to START_UNIT\n");
2724 
2725 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2726 			sc->sc_transfer.cmd_data[4] = SSS_START;
2727 			return (1);
2728 		}
2729 		break;
2730 
2731 	case REZERO_UNIT:
2732 	case REQUEST_SENSE:
2733 	case FORMAT_UNIT:
2734 	case INQUIRY:
2735 	case START_STOP_UNIT:
2736 	case SEND_DIAGNOSTIC:
2737 	case PREVENT_ALLOW:
2738 	case READ_CAPACITY:
2739 	case READ_10:
2740 	case WRITE_10:
2741 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2742 	case WRITE_AND_VERIFY:
2743 	case VERIFY:
2744 	case MODE_SELECT_10:
2745 	case MODE_SENSE_10:
2746 	case READ_12:
2747 	case WRITE_12:
2748 	case READ_FORMAT_CAPACITIES:
2749 		break;
2750 
2751 		/*
2752 		 * SYNCHRONIZE_CACHE isn't supported by UFI, nor should it be
2753 		 * required for UFI devices, so it is appropriate to fake
2754 		 * success.
2755 		 */
2756 	case SYNCHRONIZE_CACHE:
2757 		return (2);
2758 
2759 	default:
2760 		DPRINTF(sc, UDMASS_SCSI, "Unsupported UFI "
2761 		    "command 0x%02x\n", cmd_ptr[0]);
2762 		return (0);		/* failure */
2763 	}
2764 
2765 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2766 	return (1);			/* success */
2767 }
2768 
2769 /*
2770  * 8070i (ATAPI) specific functions
2771  */
2772 static uint8_t
2773 umass_atapi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2774     uint8_t cmd_len)
2775 {
2776 	if ((cmd_len == 0) ||
2777 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2778 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2779 		    "length: %d bytes\n", cmd_len);
2780 		return (0);		/* failure */
2781 	}
2782 	/* An ATAPI command is always 12 bytes in length. */
2783 	sc->sc_transfer.cmd_len = ATAPI_COMMAND_LENGTH;
2784 
2785 	/* Zero the command data */
2786 	memset(sc->sc_transfer.cmd_data, 0, ATAPI_COMMAND_LENGTH);
2787 
2788 	switch (cmd_ptr[0]) {
2789 		/*
2790 		 * Commands of which the format has been verified. They
2791 		 * should work. Copy the command into the destination
2792 		 * buffer.
2793 		 */
2794 	case INQUIRY:
2795 		/*
2796 		 * some drives wedge when asked for full inquiry
2797 		 * information.
2798 		 */
2799 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2800 			memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2801 
2802 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2803 			return (1);
2804 		}
2805 		break;
2806 
2807 	case TEST_UNIT_READY:
2808 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2809 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2810 			    "to START_UNIT\n");
2811 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2812 			sc->sc_transfer.cmd_data[4] = SSS_START;
2813 			return (1);
2814 		}
2815 		break;
2816 
2817 	case REZERO_UNIT:
2818 	case REQUEST_SENSE:
2819 	case START_STOP_UNIT:
2820 	case SEND_DIAGNOSTIC:
2821 	case PREVENT_ALLOW:
2822 	case READ_CAPACITY:
2823 	case READ_10:
2824 	case WRITE_10:
2825 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2826 	case SYNCHRONIZE_CACHE:
2827 	case MODE_SELECT_10:
2828 	case MODE_SENSE_10:
2829 	case READ_BUFFER:
2830 	case 0x42:			/* READ_SUBCHANNEL */
2831 	case 0x43:			/* READ_TOC */
2832 	case 0x44:			/* READ_HEADER */
2833 	case 0x47:			/* PLAY_MSF (Play Minute/Second/Frame) */
2834 	case 0x48:			/* PLAY_TRACK */
2835 	case 0x49:			/* PLAY_TRACK_REL */
2836 	case 0x4b:			/* PAUSE */
2837 	case 0x51:			/* READ_DISK_INFO */
2838 	case 0x52:			/* READ_TRACK_INFO */
2839 	case 0x54:			/* SEND_OPC */
2840 	case 0x59:			/* READ_MASTER_CUE */
2841 	case 0x5b:			/* CLOSE_TR_SESSION */
2842 	case 0x5c:			/* READ_BUFFER_CAP */
2843 	case 0x5d:			/* SEND_CUE_SHEET */
2844 	case 0xa1:			/* BLANK */
2845 	case 0xa5:			/* PLAY_12 */
2846 	case 0xa6:			/* EXCHANGE_MEDIUM */
2847 	case 0xad:			/* READ_DVD_STRUCTURE */
2848 	case 0xbb:			/* SET_CD_SPEED */
2849 	case 0xe5:			/* READ_TRACK_INFO_PHILIPS */
2850 		break;
2851 
2852 	case READ_12:
2853 	case WRITE_12:
2854 	default:
2855 		DPRINTF(sc, UDMASS_SCSI, "Unsupported ATAPI "
2856 		    "command 0x%02x - trying anyway\n",
2857 		    cmd_ptr[0]);
2858 		break;
2859 	}
2860 
2861 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2862 	return (1);			/* success */
2863 }
2864 
2865 static uint8_t
2866 umass_no_transform(struct umass_softc *sc, uint8_t *cmd,
2867     uint8_t cmdlen)
2868 {
2869 	return (0);			/* failure */
2870 }
2871 
2872 static uint8_t
2873 umass_std_transform(struct umass_softc *sc, union ccb *ccb,
2874     uint8_t *cmd, uint8_t cmdlen)
2875 {
2876 	uint8_t retval;
2877 
2878 	retval = (sc->sc_transform) (sc, cmd, cmdlen);
2879 
2880 	if (retval == 2) {
2881 		ccb->ccb_h.status = CAM_REQ_CMP;
2882 		xpt_done(ccb);
2883 		return (0);
2884 	} else if (retval == 0) {
2885 		ccb->ccb_h.status = CAM_REQ_INVALID;
2886 		xpt_done(ccb);
2887 		return (0);
2888 	}
2889 	/* Command should be executed */
2890 	return (1);
2891 }
2892 
2893 #ifdef USB_DEBUG
2894 static void
2895 umass_bbb_dump_cbw(struct umass_softc *sc, umass_bbb_cbw_t *cbw)
2896 {
2897 	uint8_t *c = cbw->CBWCDB;
2898 
2899 	uint32_t dlen = UGETDW(cbw->dCBWDataTransferLength);
2900 	uint32_t tag = UGETDW(cbw->dCBWTag);
2901 
2902 	uint8_t clen = cbw->bCDBLength;
2903 	uint8_t flags = cbw->bCBWFlags;
2904 	uint8_t lun = cbw->bCBWLUN;
2905 
2906 	DPRINTF(sc, UDMASS_BBB, "CBW %d: cmd = %db "
2907 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
2908 	    "data = %db, lun = %d, dir = %s\n",
2909 	    tag, clen,
2910 	    c[0], c[1], c[2], c[3], c[4], c[5], (clen > 6 ? "..." : ""),
2911 	    dlen, lun, (flags == CBWFLAGS_IN ? "in" :
2912 	    (flags == CBWFLAGS_OUT ? "out" : "<invalid>")));
2913 }
2914 
2915 static void
2916 umass_bbb_dump_csw(struct umass_softc *sc, umass_bbb_csw_t *csw)
2917 {
2918 	uint32_t sig = UGETDW(csw->dCSWSignature);
2919 	uint32_t tag = UGETDW(csw->dCSWTag);
2920 	uint32_t res = UGETDW(csw->dCSWDataResidue);
2921 	uint8_t status = csw->bCSWStatus;
2922 
2923 	DPRINTF(sc, UDMASS_BBB, "CSW %d: sig = 0x%08x (%s), tag = 0x%08x, "
2924 	    "res = %d, status = 0x%02x (%s)\n",
2925 	    tag, sig, (sig == CSWSIGNATURE ? "valid" : "invalid"),
2926 	    tag, res,
2927 	    status, (status == CSWSTATUS_GOOD ? "good" :
2928 	    (status == CSWSTATUS_FAILED ? "failed" :
2929 	    (status == CSWSTATUS_PHASE ? "phase" : "<invalid>"))));
2930 }
2931 
2932 static void
2933 umass_cbi_dump_cmd(struct umass_softc *sc, void *cmd, uint8_t cmdlen)
2934 {
2935 	uint8_t *c = cmd;
2936 	uint8_t dir = sc->sc_transfer.dir;
2937 
2938 	DPRINTF(sc, UDMASS_BBB, "cmd = %db "
2939 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
2940 	    "data = %db, dir = %s\n",
2941 	    cmdlen,
2942 	    c[0], c[1], c[2], c[3], c[4], c[5], (cmdlen > 6 ? "..." : ""),
2943 	    sc->sc_transfer.data_len,
2944 	    (dir == DIR_IN ? "in" :
2945 	    (dir == DIR_OUT ? "out" :
2946 	    (dir == DIR_NONE ? "no data phase" : "<invalid>"))));
2947 }
2948 
2949 static void
2950 umass_dump_buffer(struct umass_softc *sc, uint8_t *buffer, uint32_t buflen,
2951     uint32_t printlen)
2952 {
2953 	uint32_t i, j;
2954 	char s1[40];
2955 	char s2[40];
2956 	char s3[5];
2957 
2958 	s1[0] = '\0';
2959 	s3[0] = '\0';
2960 
2961 	sprintf(s2, " buffer=%p, buflen=%d", buffer, buflen);
2962 	for (i = 0; (i < buflen) && (i < printlen); i++) {
2963 		j = i % 16;
2964 		if (j == 0 && i != 0) {
2965 			DPRINTF(sc, UDMASS_GEN, "0x %s%s\n",
2966 			    s1, s2);
2967 			s2[0] = '\0';
2968 		}
2969 		sprintf(&s1[j * 2], "%02x", buffer[i] & 0xff);
2970 	}
2971 	if (buflen > printlen)
2972 		sprintf(s3, " ...");
2973 	DPRINTF(sc, UDMASS_GEN, "0x %s%s%s\n",
2974 	    s1, s2, s3);
2975 }
2976 
2977 #endif
2978