xref: /freebsd/sys/dev/usb/storage/umass.c (revision a10cee30c94cf5944826d2a495e9cdf339dfbcc8)
1 #include <sys/cdefs.h>
2 __FBSDID("$FreeBSD$");
3 
4 /*-
5  * Copyright (c) 1999 MAEKAWA Masahide <bishop@rr.iij4u.or.jp>,
6  *		      Nick Hibma <n_hibma@FreeBSD.org>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  *	$FreeBSD$
31  *	$NetBSD: umass.c,v 1.28 2000/04/02 23:46:53 augustss Exp $
32  */
33 
34 /* Also already merged from NetBSD:
35  *	$NetBSD: umass.c,v 1.67 2001/11/25 19:05:22 augustss Exp $
36  *	$NetBSD: umass.c,v 1.90 2002/11/04 19:17:33 pooka Exp $
37  *	$NetBSD: umass.c,v 1.108 2003/11/07 17:03:25 wiz Exp $
38  *	$NetBSD: umass.c,v 1.109 2003/12/04 13:57:31 keihan Exp $
39  */
40 
41 /*
42  * Universal Serial Bus Mass Storage Class specs:
43  * http://www.usb.org/developers/devclass_docs/usb_msc_overview_1.2.pdf
44  * http://www.usb.org/developers/devclass_docs/usbmassbulk_10.pdf
45  * http://www.usb.org/developers/devclass_docs/usb_msc_cbi_1.1.pdf
46  * http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf
47  */
48 
49 /*
50  * Ported to NetBSD by Lennart Augustsson <augustss@NetBSD.org>.
51  * Parts of the code written by Jason R. Thorpe <thorpej@shagadelic.org>.
52  */
53 
54 /*
55  * The driver handles 3 Wire Protocols
56  * - Command/Bulk/Interrupt (CBI)
57  * - Command/Bulk/Interrupt with Command Completion Interrupt (CBI with CCI)
58  * - Mass Storage Bulk-Only (BBB)
59  *   (BBB refers Bulk/Bulk/Bulk for Command/Data/Status phases)
60  *
61  * Over these wire protocols it handles the following command protocols
62  * - SCSI
63  * - UFI (floppy command set)
64  * - 8070i (ATAPI)
65  *
66  * UFI and 8070i (ATAPI) are transformed versions of the SCSI command set. The
67  * sc->sc_transform method is used to convert the commands into the appropriate
68  * format (if at all necessary). For example, UFI requires all commands to be
69  * 12 bytes in length amongst other things.
70  *
71  * The source code below is marked and can be split into a number of pieces
72  * (in this order):
73  *
74  * - probe/attach/detach
75  * - generic transfer routines
76  * - BBB
77  * - CBI
78  * - CBI_I (in addition to functions from CBI)
79  * - CAM (Common Access Method)
80  * - SCSI
81  * - UFI
82  * - 8070i (ATAPI)
83  *
84  * The protocols are implemented using a state machine, for the transfers as
85  * well as for the resets. The state machine is contained in umass_t_*_callback.
86  * The state machine is started through either umass_command_start() or
87  * umass_reset().
88  *
89  * The reason for doing this is a) CAM performs a lot better this way and b) it
90  * avoids using tsleep from interrupt context (for example after a failed
91  * transfer).
92  */
93 
94 /*
95  * The SCSI related part of this driver has been derived from the
96  * dev/ppbus/vpo.c driver, by Nicolas Souchu (nsouch@FreeBSD.org).
97  *
98  * The CAM layer uses so called actions which are messages sent to the host
99  * adapter for completion. The actions come in through umass_cam_action. The
100  * appropriate block of routines is called depending on the transport protocol
101  * in use. When the transfer has finished, these routines call
102  * umass_cam_cb again to complete the CAM command.
103  */
104 
105 #include <sys/stdint.h>
106 #include <sys/stddef.h>
107 #include <sys/param.h>
108 #include <sys/queue.h>
109 #include <sys/types.h>
110 #include <sys/systm.h>
111 #include <sys/kernel.h>
112 #include <sys/bus.h>
113 #include <sys/module.h>
114 #include <sys/lock.h>
115 #include <sys/mutex.h>
116 #include <sys/condvar.h>
117 #include <sys/sysctl.h>
118 #include <sys/sx.h>
119 #include <sys/unistd.h>
120 #include <sys/callout.h>
121 #include <sys/malloc.h>
122 #include <sys/priv.h>
123 
124 #include <dev/usb/usb.h>
125 #include <dev/usb/usbdi.h>
126 #include <dev/usb/usbdi_util.h>
127 #include "usbdevs.h"
128 
129 #include <dev/usb/quirk/usb_quirk.h>
130 
131 #include <cam/cam.h>
132 #include <cam/cam_ccb.h>
133 #include <cam/cam_sim.h>
134 #include <cam/cam_xpt_sim.h>
135 #include <cam/scsi/scsi_all.h>
136 #include <cam/scsi/scsi_da.h>
137 
138 #include <cam/cam_periph.h>
139 
140 #ifdef USB_DEBUG
141 #define	DIF(m, x)				\
142   do {						\
143     if (umass_debug & (m)) { x ; }		\
144   } while (0)
145 
146 #define	DPRINTF(sc, m, fmt, ...)			\
147   do {							\
148     if (umass_debug & (m)) {				\
149         printf("%s:%s: " fmt,				\
150 	       (sc) ? (const char *)(sc)->sc_name :	\
151 	       (const char *)"umassX",			\
152 		__FUNCTION__ ,## __VA_ARGS__);		\
153     }							\
154   } while (0)
155 
156 #define	UDMASS_GEN	0x00010000	/* general */
157 #define	UDMASS_SCSI	0x00020000	/* scsi */
158 #define	UDMASS_UFI	0x00040000	/* ufi command set */
159 #define	UDMASS_ATAPI	0x00080000	/* 8070i command set */
160 #define	UDMASS_CMD	(UDMASS_SCSI|UDMASS_UFI|UDMASS_ATAPI)
161 #define	UDMASS_USB	0x00100000	/* USB general */
162 #define	UDMASS_BBB	0x00200000	/* Bulk-Only transfers */
163 #define	UDMASS_CBI	0x00400000	/* CBI transfers */
164 #define	UDMASS_WIRE	(UDMASS_BBB|UDMASS_CBI)
165 #define	UDMASS_ALL	0xffff0000	/* all of the above */
166 static int umass_debug = 0;
167 
168 static SYSCTL_NODE(_hw_usb, OID_AUTO, umass, CTLFLAG_RW, 0, "USB umass");
169 SYSCTL_INT(_hw_usb_umass, OID_AUTO, debug, CTLFLAG_RW,
170     &umass_debug, 0, "umass debug level");
171 
172 TUNABLE_INT("hw.usb.umass.debug", &umass_debug);
173 #else
174 #define	DIF(...) do { } while (0)
175 #define	DPRINTF(...) do { } while (0)
176 #endif
177 
178 #define	UMASS_GONE ((struct umass_softc *)1)
179 
180 #define	UMASS_BULK_SIZE (1 << 17)
181 #define	UMASS_CBI_DIAGNOSTIC_CMDLEN 12	/* bytes */
182 #define	UMASS_MAX_CMDLEN MAX(12, CAM_MAX_CDBLEN)	/* bytes */
183 
184 /* USB transfer definitions */
185 
186 #define	UMASS_T_BBB_RESET1      0	/* Bulk-Only */
187 #define	UMASS_T_BBB_RESET2      1
188 #define	UMASS_T_BBB_RESET3      2
189 #define	UMASS_T_BBB_COMMAND     3
190 #define	UMASS_T_BBB_DATA_READ   4
191 #define	UMASS_T_BBB_DATA_RD_CS  5
192 #define	UMASS_T_BBB_DATA_WRITE  6
193 #define	UMASS_T_BBB_DATA_WR_CS  7
194 #define	UMASS_T_BBB_STATUS      8
195 #define	UMASS_T_BBB_MAX         9
196 
197 #define	UMASS_T_CBI_RESET1      0	/* CBI */
198 #define	UMASS_T_CBI_RESET2      1
199 #define	UMASS_T_CBI_RESET3      2
200 #define	UMASS_T_CBI_COMMAND     3
201 #define	UMASS_T_CBI_DATA_READ   4
202 #define	UMASS_T_CBI_DATA_RD_CS  5
203 #define	UMASS_T_CBI_DATA_WRITE  6
204 #define	UMASS_T_CBI_DATA_WR_CS  7
205 #define	UMASS_T_CBI_STATUS      8
206 #define	UMASS_T_CBI_RESET4      9
207 #define	UMASS_T_CBI_MAX        10
208 
209 #define	UMASS_T_MAX MAX(UMASS_T_CBI_MAX, UMASS_T_BBB_MAX)
210 
211 /* Generic definitions */
212 
213 /* Direction for transfer */
214 #define	DIR_NONE	0
215 #define	DIR_IN		1
216 #define	DIR_OUT		2
217 
218 /* device name */
219 #define	DEVNAME		"umass"
220 #define	DEVNAME_SIM	"umass-sim"
221 
222 /* Approximate maximum transfer speeds (assumes 33% overhead). */
223 #define	UMASS_FULL_TRANSFER_SPEED	1000
224 #define	UMASS_HIGH_TRANSFER_SPEED	40000
225 #define	UMASS_SUPER_TRANSFER_SPEED	400000
226 #define	UMASS_FLOPPY_TRANSFER_SPEED	20
227 
228 #define	UMASS_TIMEOUT			5000	/* ms */
229 
230 /* CAM specific definitions */
231 
232 #define	UMASS_SCSIID_MAX	1	/* maximum number of drives expected */
233 #define	UMASS_SCSIID_HOST	UMASS_SCSIID_MAX
234 
235 /* Bulk-Only features */
236 
237 #define	UR_BBB_RESET		0xff	/* Bulk-Only reset */
238 #define	UR_BBB_GET_MAX_LUN	0xfe	/* Get maximum lun */
239 
240 /* Command Block Wrapper */
241 typedef struct {
242 	uDWord	dCBWSignature;
243 #define	CBWSIGNATURE	0x43425355
244 	uDWord	dCBWTag;
245 	uDWord	dCBWDataTransferLength;
246 	uByte	bCBWFlags;
247 #define	CBWFLAGS_OUT	0x00
248 #define	CBWFLAGS_IN	0x80
249 	uByte	bCBWLUN;
250 	uByte	bCDBLength;
251 #define	CBWCDBLENGTH	16
252 	uByte	CBWCDB[CBWCDBLENGTH];
253 } __packed umass_bbb_cbw_t;
254 
255 #define	UMASS_BBB_CBW_SIZE	31
256 
257 /* Command Status Wrapper */
258 typedef struct {
259 	uDWord	dCSWSignature;
260 #define	CSWSIGNATURE	0x53425355
261 #define	CSWSIGNATURE_IMAGINATION_DBX1	0x43425355
262 #define	CSWSIGNATURE_OLYMPUS_C1	0x55425355
263 	uDWord	dCSWTag;
264 	uDWord	dCSWDataResidue;
265 	uByte	bCSWStatus;
266 #define	CSWSTATUS_GOOD	0x0
267 #define	CSWSTATUS_FAILED	0x1
268 #define	CSWSTATUS_PHASE	0x2
269 } __packed umass_bbb_csw_t;
270 
271 #define	UMASS_BBB_CSW_SIZE	13
272 
273 /* CBI features */
274 
275 #define	UR_CBI_ADSC	0x00
276 
277 typedef union {
278 	struct {
279 		uint8_t	type;
280 #define	IDB_TYPE_CCI		0x00
281 		uint8_t	value;
282 #define	IDB_VALUE_PASS		0x00
283 #define	IDB_VALUE_FAIL		0x01
284 #define	IDB_VALUE_PHASE		0x02
285 #define	IDB_VALUE_PERSISTENT	0x03
286 #define	IDB_VALUE_STATUS_MASK	0x03
287 	} __packed common;
288 
289 	struct {
290 		uint8_t	asc;
291 		uint8_t	ascq;
292 	} __packed ufi;
293 } __packed umass_cbi_sbl_t;
294 
295 struct umass_softc;			/* see below */
296 
297 typedef void (umass_callback_t)(struct umass_softc *sc, union ccb *ccb,
298     	uint32_t residue, uint8_t status);
299 
300 #define	STATUS_CMD_OK		0	/* everything ok */
301 #define	STATUS_CMD_UNKNOWN	1	/* will have to fetch sense */
302 #define	STATUS_CMD_FAILED	2	/* transfer was ok, command failed */
303 #define	STATUS_WIRE_FAILED	3	/* couldn't even get command across */
304 
305 typedef uint8_t (umass_transform_t)(struct umass_softc *sc, uint8_t *cmd_ptr,
306     	uint8_t cmd_len);
307 
308 /* Wire and command protocol */
309 #define	UMASS_PROTO_BBB		0x0001	/* USB wire protocol */
310 #define	UMASS_PROTO_CBI		0x0002
311 #define	UMASS_PROTO_CBI_I	0x0004
312 #define	UMASS_PROTO_WIRE	0x00ff	/* USB wire protocol mask */
313 #define	UMASS_PROTO_SCSI	0x0100	/* command protocol */
314 #define	UMASS_PROTO_ATAPI	0x0200
315 #define	UMASS_PROTO_UFI		0x0400
316 #define	UMASS_PROTO_RBC		0x0800
317 #define	UMASS_PROTO_COMMAND	0xff00	/* command protocol mask */
318 
319 /* Device specific quirks */
320 #define	NO_QUIRKS		0x0000
321 	/*
322 	 * The drive does not support Test Unit Ready. Convert to Start Unit
323 	 */
324 #define	NO_TEST_UNIT_READY	0x0001
325 	/*
326 	 * The drive does not reset the Unit Attention state after REQUEST
327 	 * SENSE has been sent. The INQUIRY command does not reset the UA
328 	 * either, and so CAM runs in circles trying to retrieve the initial
329 	 * INQUIRY data.
330 	 */
331 #define	RS_NO_CLEAR_UA		0x0002
332 	/* The drive does not support START STOP.  */
333 #define	NO_START_STOP		0x0004
334 	/* Don't ask for full inquiry data (255b).  */
335 #define	FORCE_SHORT_INQUIRY	0x0008
336 	/* Needs to be initialised the Shuttle way */
337 #define	SHUTTLE_INIT		0x0010
338 	/* Drive needs to be switched to alternate iface 1 */
339 #define	ALT_IFACE_1		0x0020
340 	/* Drive does not do 1Mb/s, but just floppy speeds (20kb/s) */
341 #define	FLOPPY_SPEED		0x0040
342 	/* The device can't count and gets the residue of transfers wrong */
343 #define	IGNORE_RESIDUE		0x0080
344 	/* No GetMaxLun call */
345 #define	NO_GETMAXLUN		0x0100
346 	/* The device uses a weird CSWSIGNATURE. */
347 #define	WRONG_CSWSIG		0x0200
348 	/* Device cannot handle INQUIRY so fake a generic response */
349 #define	NO_INQUIRY		0x0400
350 	/* Device cannot handle INQUIRY EVPD, return CHECK CONDITION */
351 #define	NO_INQUIRY_EVPD		0x0800
352 	/* Pad all RBC requests to 12 bytes. */
353 #define	RBC_PAD_TO_12		0x1000
354 	/*
355 	 * Device reports number of sectors from READ_CAPACITY, not max
356 	 * sector number.
357 	 */
358 #define	READ_CAPACITY_OFFBY1	0x2000
359 	/*
360 	 * Device cannot handle a SCSI synchronize cache command.  Normally
361 	 * this quirk would be handled in the cam layer, but for IDE bridges
362 	 * we need to associate the quirk with the bridge and not the
363 	 * underlying disk device.  This is handled by faking a success
364 	 * result.
365 	 */
366 #define	NO_SYNCHRONIZE_CACHE	0x4000
367 
368 struct umass_softc {
369 
370 	struct scsi_sense cam_scsi_sense;
371 	struct scsi_test_unit_ready cam_scsi_test_unit_ready;
372 	struct mtx sc_mtx;
373 	struct {
374 		uint8_t *data_ptr;
375 		union ccb *ccb;
376 		umass_callback_t *callback;
377 
378 		uint32_t data_len;	/* bytes */
379 		uint32_t data_rem;	/* bytes */
380 		uint32_t data_timeout;	/* ms */
381 		uint32_t actlen;	/* bytes */
382 
383 		uint8_t	cmd_data[UMASS_MAX_CMDLEN];
384 		uint8_t	cmd_len;	/* bytes */
385 		uint8_t	dir;
386 		uint8_t	lun;
387 	}	sc_transfer;
388 
389 	/* Bulk specific variables for transfers in progress */
390 	umass_bbb_cbw_t cbw;		/* command block wrapper */
391 	umass_bbb_csw_t csw;		/* command status wrapper */
392 
393 	/* CBI specific variables for transfers in progress */
394 	umass_cbi_sbl_t sbl;		/* status block */
395 
396 	device_t sc_dev;
397 	struct usb_device *sc_udev;
398 	struct cam_sim *sc_sim;		/* SCSI Interface Module */
399 	struct usb_xfer *sc_xfer[UMASS_T_MAX];
400 
401 	/*
402 	 * The command transform function is used to convert the SCSI
403 	 * commands into their derivatives, like UFI, ATAPI, and friends.
404 	 */
405 	umass_transform_t *sc_transform;
406 
407 	uint32_t sc_unit;
408 	uint32_t sc_quirks;		/* they got it almost right */
409 	uint32_t sc_proto;		/* wire and cmd protocol */
410 
411 	uint8_t	sc_name[16];
412 	uint8_t	sc_iface_no;		/* interface number */
413 	uint8_t	sc_maxlun;		/* maximum LUN number, inclusive */
414 	uint8_t	sc_last_xfer_index;
415 	uint8_t	sc_status_try;
416 };
417 
418 struct umass_probe_proto {
419 	uint32_t quirks;
420 	uint32_t proto;
421 
422 	int	error;
423 };
424 
425 /* prototypes */
426 
427 static device_probe_t umass_probe;
428 static device_attach_t umass_attach;
429 static device_detach_t umass_detach;
430 
431 static usb_callback_t umass_tr_error;
432 static usb_callback_t umass_t_bbb_reset1_callback;
433 static usb_callback_t umass_t_bbb_reset2_callback;
434 static usb_callback_t umass_t_bbb_reset3_callback;
435 static usb_callback_t umass_t_bbb_command_callback;
436 static usb_callback_t umass_t_bbb_data_read_callback;
437 static usb_callback_t umass_t_bbb_data_rd_cs_callback;
438 static usb_callback_t umass_t_bbb_data_write_callback;
439 static usb_callback_t umass_t_bbb_data_wr_cs_callback;
440 static usb_callback_t umass_t_bbb_status_callback;
441 static usb_callback_t umass_t_cbi_reset1_callback;
442 static usb_callback_t umass_t_cbi_reset2_callback;
443 static usb_callback_t umass_t_cbi_reset3_callback;
444 static usb_callback_t umass_t_cbi_reset4_callback;
445 static usb_callback_t umass_t_cbi_command_callback;
446 static usb_callback_t umass_t_cbi_data_read_callback;
447 static usb_callback_t umass_t_cbi_data_rd_cs_callback;
448 static usb_callback_t umass_t_cbi_data_write_callback;
449 static usb_callback_t umass_t_cbi_data_wr_cs_callback;
450 static usb_callback_t umass_t_cbi_status_callback;
451 
452 static void	umass_cancel_ccb(struct umass_softc *);
453 static void	umass_init_shuttle(struct umass_softc *);
454 static void	umass_reset(struct umass_softc *);
455 static void	umass_t_bbb_data_clear_stall_callback(struct usb_xfer *,
456 		    uint8_t, uint8_t, usb_error_t);
457 static void	umass_command_start(struct umass_softc *, uint8_t, void *,
458 		    uint32_t, uint32_t, umass_callback_t *, union ccb *);
459 static uint8_t	umass_bbb_get_max_lun(struct umass_softc *);
460 static void	umass_cbi_start_status(struct umass_softc *);
461 static void	umass_t_cbi_data_clear_stall_callback(struct usb_xfer *,
462 		    uint8_t, uint8_t, usb_error_t);
463 static int	umass_cam_attach_sim(struct umass_softc *);
464 static void	umass_cam_attach(struct umass_softc *);
465 static void	umass_cam_detach_sim(struct umass_softc *);
466 static void	umass_cam_action(struct cam_sim *, union ccb *);
467 static void	umass_cam_poll(struct cam_sim *);
468 static void	umass_cam_cb(struct umass_softc *, union ccb *, uint32_t,
469 		    uint8_t);
470 static void	umass_cam_sense_cb(struct umass_softc *, union ccb *, uint32_t,
471 		    uint8_t);
472 static void	umass_cam_quirk_cb(struct umass_softc *, union ccb *, uint32_t,
473 		    uint8_t);
474 static uint8_t	umass_scsi_transform(struct umass_softc *, uint8_t *, uint8_t);
475 static uint8_t	umass_rbc_transform(struct umass_softc *, uint8_t *, uint8_t);
476 static uint8_t	umass_ufi_transform(struct umass_softc *, uint8_t *, uint8_t);
477 static uint8_t	umass_atapi_transform(struct umass_softc *, uint8_t *,
478 		    uint8_t);
479 static uint8_t	umass_no_transform(struct umass_softc *, uint8_t *, uint8_t);
480 static uint8_t	umass_std_transform(struct umass_softc *, union ccb *, uint8_t
481 		    *, uint8_t);
482 
483 #ifdef USB_DEBUG
484 static void	umass_bbb_dump_cbw(struct umass_softc *, umass_bbb_cbw_t *);
485 static void	umass_bbb_dump_csw(struct umass_softc *, umass_bbb_csw_t *);
486 static void	umass_cbi_dump_cmd(struct umass_softc *, void *, uint8_t);
487 static void	umass_dump_buffer(struct umass_softc *, uint8_t *, uint32_t,
488 		    uint32_t);
489 #endif
490 
491 static struct usb_config umass_bbb_config[UMASS_T_BBB_MAX] = {
492 
493 	[UMASS_T_BBB_RESET1] = {
494 		.type = UE_CONTROL,
495 		.endpoint = 0x00,	/* Control pipe */
496 		.direction = UE_DIR_ANY,
497 		.bufsize = sizeof(struct usb_device_request),
498 		.callback = &umass_t_bbb_reset1_callback,
499 		.timeout = 5000,	/* 5 seconds */
500 		.interval = 500,	/* 500 milliseconds */
501 	},
502 
503 	[UMASS_T_BBB_RESET2] = {
504 		.type = UE_CONTROL,
505 		.endpoint = 0x00,	/* Control pipe */
506 		.direction = UE_DIR_ANY,
507 		.bufsize = sizeof(struct usb_device_request),
508 		.callback = &umass_t_bbb_reset2_callback,
509 		.timeout = 5000,	/* 5 seconds */
510 		.interval = 50,	/* 50 milliseconds */
511 	},
512 
513 	[UMASS_T_BBB_RESET3] = {
514 		.type = UE_CONTROL,
515 		.endpoint = 0x00,	/* Control pipe */
516 		.direction = UE_DIR_ANY,
517 		.bufsize = sizeof(struct usb_device_request),
518 		.callback = &umass_t_bbb_reset3_callback,
519 		.timeout = 5000,	/* 5 seconds */
520 		.interval = 50,	/* 50 milliseconds */
521 	},
522 
523 	[UMASS_T_BBB_COMMAND] = {
524 		.type = UE_BULK,
525 		.endpoint = UE_ADDR_ANY,
526 		.direction = UE_DIR_OUT,
527 		.bufsize = sizeof(umass_bbb_cbw_t),
528 		.callback = &umass_t_bbb_command_callback,
529 		.timeout = 5000,	/* 5 seconds */
530 	},
531 
532 	[UMASS_T_BBB_DATA_READ] = {
533 		.type = UE_BULK,
534 		.endpoint = UE_ADDR_ANY,
535 		.direction = UE_DIR_IN,
536 		.bufsize = UMASS_BULK_SIZE,
537 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
538 		.callback = &umass_t_bbb_data_read_callback,
539 		.timeout = 0,	/* overwritten later */
540 	},
541 
542 	[UMASS_T_BBB_DATA_RD_CS] = {
543 		.type = UE_CONTROL,
544 		.endpoint = 0x00,	/* Control pipe */
545 		.direction = UE_DIR_ANY,
546 		.bufsize = sizeof(struct usb_device_request),
547 		.callback = &umass_t_bbb_data_rd_cs_callback,
548 		.timeout = 5000,	/* 5 seconds */
549 	},
550 
551 	[UMASS_T_BBB_DATA_WRITE] = {
552 		.type = UE_BULK,
553 		.endpoint = UE_ADDR_ANY,
554 		.direction = UE_DIR_OUT,
555 		.bufsize = UMASS_BULK_SIZE,
556 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
557 		.callback = &umass_t_bbb_data_write_callback,
558 		.timeout = 0,	/* overwritten later */
559 	},
560 
561 	[UMASS_T_BBB_DATA_WR_CS] = {
562 		.type = UE_CONTROL,
563 		.endpoint = 0x00,	/* Control pipe */
564 		.direction = UE_DIR_ANY,
565 		.bufsize = sizeof(struct usb_device_request),
566 		.callback = &umass_t_bbb_data_wr_cs_callback,
567 		.timeout = 5000,	/* 5 seconds */
568 	},
569 
570 	[UMASS_T_BBB_STATUS] = {
571 		.type = UE_BULK,
572 		.endpoint = UE_ADDR_ANY,
573 		.direction = UE_DIR_IN,
574 		.bufsize = sizeof(umass_bbb_csw_t),
575 		.flags = {.short_xfer_ok = 1,},
576 		.callback = &umass_t_bbb_status_callback,
577 		.timeout = 5000,	/* ms */
578 	},
579 };
580 
581 static struct usb_config umass_cbi_config[UMASS_T_CBI_MAX] = {
582 
583 	[UMASS_T_CBI_RESET1] = {
584 		.type = UE_CONTROL,
585 		.endpoint = 0x00,	/* Control pipe */
586 		.direction = UE_DIR_ANY,
587 		.bufsize = (sizeof(struct usb_device_request) +
588 		    UMASS_CBI_DIAGNOSTIC_CMDLEN),
589 		.callback = &umass_t_cbi_reset1_callback,
590 		.timeout = 5000,	/* 5 seconds */
591 		.interval = 500,	/* 500 milliseconds */
592 	},
593 
594 	[UMASS_T_CBI_RESET2] = {
595 		.type = UE_CONTROL,
596 		.endpoint = 0x00,	/* Control pipe */
597 		.direction = UE_DIR_ANY,
598 		.bufsize = sizeof(struct usb_device_request),
599 		.callback = &umass_t_cbi_reset2_callback,
600 		.timeout = 5000,	/* 5 seconds */
601 		.interval = 50,	/* 50 milliseconds */
602 	},
603 
604 	[UMASS_T_CBI_RESET3] = {
605 		.type = UE_CONTROL,
606 		.endpoint = 0x00,	/* Control pipe */
607 		.direction = UE_DIR_ANY,
608 		.bufsize = sizeof(struct usb_device_request),
609 		.callback = &umass_t_cbi_reset3_callback,
610 		.timeout = 5000,	/* 5 seconds */
611 		.interval = 50,	/* 50 milliseconds */
612 	},
613 
614 	[UMASS_T_CBI_COMMAND] = {
615 		.type = UE_CONTROL,
616 		.endpoint = 0x00,	/* Control pipe */
617 		.direction = UE_DIR_ANY,
618 		.bufsize = (sizeof(struct usb_device_request) +
619 		    UMASS_MAX_CMDLEN),
620 		.callback = &umass_t_cbi_command_callback,
621 		.timeout = 5000,	/* 5 seconds */
622 	},
623 
624 	[UMASS_T_CBI_DATA_READ] = {
625 		.type = UE_BULK,
626 		.endpoint = UE_ADDR_ANY,
627 		.direction = UE_DIR_IN,
628 		.bufsize = UMASS_BULK_SIZE,
629 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
630 		.callback = &umass_t_cbi_data_read_callback,
631 		.timeout = 0,	/* overwritten later */
632 	},
633 
634 	[UMASS_T_CBI_DATA_RD_CS] = {
635 		.type = UE_CONTROL,
636 		.endpoint = 0x00,	/* Control pipe */
637 		.direction = UE_DIR_ANY,
638 		.bufsize = sizeof(struct usb_device_request),
639 		.callback = &umass_t_cbi_data_rd_cs_callback,
640 		.timeout = 5000,	/* 5 seconds */
641 	},
642 
643 	[UMASS_T_CBI_DATA_WRITE] = {
644 		.type = UE_BULK,
645 		.endpoint = UE_ADDR_ANY,
646 		.direction = UE_DIR_OUT,
647 		.bufsize = UMASS_BULK_SIZE,
648 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
649 		.callback = &umass_t_cbi_data_write_callback,
650 		.timeout = 0,	/* overwritten later */
651 	},
652 
653 	[UMASS_T_CBI_DATA_WR_CS] = {
654 		.type = UE_CONTROL,
655 		.endpoint = 0x00,	/* Control pipe */
656 		.direction = UE_DIR_ANY,
657 		.bufsize = sizeof(struct usb_device_request),
658 		.callback = &umass_t_cbi_data_wr_cs_callback,
659 		.timeout = 5000,	/* 5 seconds */
660 	},
661 
662 	[UMASS_T_CBI_STATUS] = {
663 		.type = UE_INTERRUPT,
664 		.endpoint = UE_ADDR_ANY,
665 		.direction = UE_DIR_IN,
666 		.flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
667 		.bufsize = sizeof(umass_cbi_sbl_t),
668 		.callback = &umass_t_cbi_status_callback,
669 		.timeout = 5000,	/* ms */
670 	},
671 
672 	[UMASS_T_CBI_RESET4] = {
673 		.type = UE_CONTROL,
674 		.endpoint = 0x00,	/* Control pipe */
675 		.direction = UE_DIR_ANY,
676 		.bufsize = sizeof(struct usb_device_request),
677 		.callback = &umass_t_cbi_reset4_callback,
678 		.timeout = 5000,	/* ms */
679 	},
680 };
681 
682 /* If device cannot return valid inquiry data, fake it */
683 static const uint8_t fake_inq_data[SHORT_INQUIRY_LENGTH] = {
684 	0, /* removable */ 0x80, SCSI_REV_2, SCSI_REV_2,
685 	 /* additional_length */ 31, 0, 0, 0
686 };
687 
688 #define	UFI_COMMAND_LENGTH	12	/* UFI commands are always 12 bytes */
689 #define	ATAPI_COMMAND_LENGTH	12	/* ATAPI commands are always 12 bytes */
690 
691 static devclass_t umass_devclass;
692 
693 static device_method_t umass_methods[] = {
694 	/* Device interface */
695 	DEVMETHOD(device_probe, umass_probe),
696 	DEVMETHOD(device_attach, umass_attach),
697 	DEVMETHOD(device_detach, umass_detach),
698 	{0, 0}
699 };
700 
701 static driver_t umass_driver = {
702 	.name = "umass",
703 	.methods = umass_methods,
704 	.size = sizeof(struct umass_softc),
705 };
706 
707 DRIVER_MODULE(umass, uhub, umass_driver, umass_devclass, NULL, 0);
708 MODULE_DEPEND(umass, usb, 1, 1, 1);
709 MODULE_DEPEND(umass, cam, 1, 1, 1);
710 MODULE_VERSION(umass, 1);
711 
712 /*
713  * USB device probe/attach/detach
714  */
715 
716 static const STRUCT_USB_HOST_ID __used umass_devs[] = {
717 	/* generic mass storage class */
718 	{USB_IFACE_CLASS(UICLASS_MASS),},
719 };
720 
721 static uint16_t
722 umass_get_proto(struct usb_interface *iface)
723 {
724 	struct usb_interface_descriptor *id;
725 	uint16_t retval;
726 
727 	retval = 0;
728 
729 	/* Check for a standards compliant device */
730 	id = usbd_get_interface_descriptor(iface);
731 	if ((id == NULL) ||
732 	    (id->bInterfaceClass != UICLASS_MASS)) {
733 		goto done;
734 	}
735 	switch (id->bInterfaceSubClass) {
736 	case UISUBCLASS_SCSI:
737 		retval |= UMASS_PROTO_SCSI;
738 		break;
739 	case UISUBCLASS_UFI:
740 		retval |= UMASS_PROTO_UFI;
741 		break;
742 	case UISUBCLASS_RBC:
743 		retval |= UMASS_PROTO_RBC;
744 		break;
745 	case UISUBCLASS_SFF8020I:
746 	case UISUBCLASS_SFF8070I:
747 		retval |= UMASS_PROTO_ATAPI;
748 		break;
749 	default:
750 		goto done;
751 	}
752 
753 	switch (id->bInterfaceProtocol) {
754 	case UIPROTO_MASS_CBI:
755 		retval |= UMASS_PROTO_CBI;
756 		break;
757 	case UIPROTO_MASS_CBI_I:
758 		retval |= UMASS_PROTO_CBI_I;
759 		break;
760 	case UIPROTO_MASS_BBB_OLD:
761 	case UIPROTO_MASS_BBB:
762 		retval |= UMASS_PROTO_BBB;
763 		break;
764 	default:
765 		goto done;
766 	}
767 done:
768 	return (retval);
769 }
770 
771 /*
772  * Match the device we are seeing with the devices supported.
773  */
774 static struct umass_probe_proto
775 umass_probe_proto(device_t dev, struct usb_attach_arg *uaa)
776 {
777 	struct umass_probe_proto ret;
778 	uint32_t quirks = NO_QUIRKS;
779 	uint32_t proto = umass_get_proto(uaa->iface);
780 
781 	memset(&ret, 0, sizeof(ret));
782 	ret.error = BUS_PROBE_GENERIC;
783 
784 	/* Search for protocol enforcement */
785 
786 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_BBB)) {
787 		proto &= ~UMASS_PROTO_WIRE;
788 		proto |= UMASS_PROTO_BBB;
789 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI)) {
790 		proto &= ~UMASS_PROTO_WIRE;
791 		proto |= UMASS_PROTO_CBI;
792 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI_I)) {
793 		proto &= ~UMASS_PROTO_WIRE;
794 		proto |= UMASS_PROTO_CBI_I;
795 	}
796 
797 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_SCSI)) {
798 		proto &= ~UMASS_PROTO_COMMAND;
799 		proto |= UMASS_PROTO_SCSI;
800 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_ATAPI)) {
801 		proto &= ~UMASS_PROTO_COMMAND;
802 		proto |= UMASS_PROTO_ATAPI;
803 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_UFI)) {
804 		proto &= ~UMASS_PROTO_COMMAND;
805 		proto |= UMASS_PROTO_UFI;
806 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_RBC)) {
807 		proto &= ~UMASS_PROTO_COMMAND;
808 		proto |= UMASS_PROTO_RBC;
809 	}
810 
811 	/* Check if the protocol is invalid */
812 
813 	if ((proto & UMASS_PROTO_COMMAND) == 0) {
814 		ret.error = ENXIO;
815 		goto done;
816 	}
817 
818 	if ((proto & UMASS_PROTO_WIRE) == 0) {
819 		ret.error = ENXIO;
820 		goto done;
821 	}
822 
823 	/* Search for quirks */
824 
825 	if (usb_test_quirk(uaa, UQ_MSC_NO_TEST_UNIT_READY))
826 		quirks |= NO_TEST_UNIT_READY;
827 	if (usb_test_quirk(uaa, UQ_MSC_NO_RS_CLEAR_UA))
828 		quirks |= RS_NO_CLEAR_UA;
829 	if (usb_test_quirk(uaa, UQ_MSC_NO_START_STOP))
830 		quirks |= NO_START_STOP;
831 	if (usb_test_quirk(uaa, UQ_MSC_NO_GETMAXLUN))
832 		quirks |= NO_GETMAXLUN;
833 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY))
834 		quirks |= NO_INQUIRY;
835 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY_EVPD))
836 		quirks |= NO_INQUIRY_EVPD;
837 	if (usb_test_quirk(uaa, UQ_MSC_NO_SYNC_CACHE))
838 		quirks |= NO_SYNCHRONIZE_CACHE;
839 	if (usb_test_quirk(uaa, UQ_MSC_SHUTTLE_INIT))
840 		quirks |= SHUTTLE_INIT;
841 	if (usb_test_quirk(uaa, UQ_MSC_ALT_IFACE_1))
842 		quirks |= ALT_IFACE_1;
843 	if (usb_test_quirk(uaa, UQ_MSC_FLOPPY_SPEED))
844 		quirks |= FLOPPY_SPEED;
845 	if (usb_test_quirk(uaa, UQ_MSC_IGNORE_RESIDUE))
846 		quirks |= IGNORE_RESIDUE;
847 	if (usb_test_quirk(uaa, UQ_MSC_WRONG_CSWSIG))
848 		quirks |= WRONG_CSWSIG;
849 	if (usb_test_quirk(uaa, UQ_MSC_RBC_PAD_TO_12))
850 		quirks |= RBC_PAD_TO_12;
851 	if (usb_test_quirk(uaa, UQ_MSC_READ_CAP_OFFBY1))
852 		quirks |= READ_CAPACITY_OFFBY1;
853 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_SHORT_INQ))
854 		quirks |= FORCE_SHORT_INQUIRY;
855 
856 done:
857 	ret.quirks = quirks;
858 	ret.proto = proto;
859 	return (ret);
860 }
861 
862 static int
863 umass_probe(device_t dev)
864 {
865 	struct usb_attach_arg *uaa = device_get_ivars(dev);
866 	struct umass_probe_proto temp;
867 
868 	if (uaa->usb_mode != USB_MODE_HOST) {
869 		return (ENXIO);
870 	}
871 	temp = umass_probe_proto(dev, uaa);
872 
873 	return (temp.error);
874 }
875 
876 static int
877 umass_attach(device_t dev)
878 {
879 	struct umass_softc *sc = device_get_softc(dev);
880 	struct usb_attach_arg *uaa = device_get_ivars(dev);
881 	struct umass_probe_proto temp = umass_probe_proto(dev, uaa);
882 	struct usb_interface_descriptor *id;
883 	int32_t err;
884 
885 	/*
886 	 * NOTE: the softc struct is cleared in device_set_driver.
887 	 * We can safely call umass_detach without specifically
888 	 * initializing the struct.
889 	 */
890 
891 	sc->sc_dev = dev;
892 	sc->sc_udev = uaa->device;
893 	sc->sc_proto = temp.proto;
894 	sc->sc_quirks = temp.quirks;
895 	sc->sc_unit = device_get_unit(dev);
896 
897 	snprintf(sc->sc_name, sizeof(sc->sc_name),
898 	    "%s", device_get_nameunit(dev));
899 
900 	device_set_usb_desc(dev);
901 
902         mtx_init(&sc->sc_mtx, device_get_nameunit(dev),
903 	    NULL, MTX_DEF | MTX_RECURSE);
904 
905 	/* get interface index */
906 
907 	id = usbd_get_interface_descriptor(uaa->iface);
908 	if (id == NULL) {
909 		device_printf(dev, "failed to get "
910 		    "interface number\n");
911 		goto detach;
912 	}
913 	sc->sc_iface_no = id->bInterfaceNumber;
914 
915 #ifdef USB_DEBUG
916 	device_printf(dev, " ");
917 
918 	switch (sc->sc_proto & UMASS_PROTO_COMMAND) {
919 	case UMASS_PROTO_SCSI:
920 		printf("SCSI");
921 		break;
922 	case UMASS_PROTO_ATAPI:
923 		printf("8070i (ATAPI)");
924 		break;
925 	case UMASS_PROTO_UFI:
926 		printf("UFI");
927 		break;
928 	case UMASS_PROTO_RBC:
929 		printf("RBC");
930 		break;
931 	default:
932 		printf("(unknown 0x%02x)",
933 		    sc->sc_proto & UMASS_PROTO_COMMAND);
934 		break;
935 	}
936 
937 	printf(" over ");
938 
939 	switch (sc->sc_proto & UMASS_PROTO_WIRE) {
940 	case UMASS_PROTO_BBB:
941 		printf("Bulk-Only");
942 		break;
943 	case UMASS_PROTO_CBI:		/* uses Comand/Bulk pipes */
944 		printf("CBI");
945 		break;
946 	case UMASS_PROTO_CBI_I:	/* uses Comand/Bulk/Interrupt pipes */
947 		printf("CBI with CCI");
948 		break;
949 	default:
950 		printf("(unknown 0x%02x)",
951 		    sc->sc_proto & UMASS_PROTO_WIRE);
952 	}
953 
954 	printf("; quirks = 0x%04x\n", sc->sc_quirks);
955 #endif
956 
957 	if (sc->sc_quirks & ALT_IFACE_1) {
958 		err = usbd_set_alt_interface_index
959 		    (uaa->device, uaa->info.bIfaceIndex, 1);
960 
961 		if (err) {
962 			DPRINTF(sc, UDMASS_USB, "could not switch to "
963 			    "Alt Interface 1\n");
964 			goto detach;
965 		}
966 	}
967 	/* allocate all required USB transfers */
968 
969 	if (sc->sc_proto & UMASS_PROTO_BBB) {
970 
971 		err = usbd_transfer_setup(uaa->device,
972 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_bbb_config,
973 		    UMASS_T_BBB_MAX, sc, &sc->sc_mtx);
974 
975 		/* skip reset first time */
976 		sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
977 
978 	} else if (sc->sc_proto & (UMASS_PROTO_CBI | UMASS_PROTO_CBI_I)) {
979 
980 		err = usbd_transfer_setup(uaa->device,
981 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_cbi_config,
982 		    UMASS_T_CBI_MAX, sc, &sc->sc_mtx);
983 
984 		/* skip reset first time */
985 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
986 
987 	} else {
988 		err = USB_ERR_INVAL;
989 	}
990 
991 	if (err) {
992 		device_printf(dev, "could not setup required "
993 		    "transfers, %s\n", usbd_errstr(err));
994 		goto detach;
995 	}
996 	sc->sc_transform =
997 	    (sc->sc_proto & UMASS_PROTO_SCSI) ? &umass_scsi_transform :
998 	    (sc->sc_proto & UMASS_PROTO_UFI) ? &umass_ufi_transform :
999 	    (sc->sc_proto & UMASS_PROTO_ATAPI) ? &umass_atapi_transform :
1000 	    (sc->sc_proto & UMASS_PROTO_RBC) ? &umass_rbc_transform :
1001 	    &umass_no_transform;
1002 
1003 	/* from here onwards the device can be used. */
1004 
1005 	if (sc->sc_quirks & SHUTTLE_INIT) {
1006 		umass_init_shuttle(sc);
1007 	}
1008 	/* get the maximum LUN supported by the device */
1009 
1010 	if (((sc->sc_proto & UMASS_PROTO_WIRE) == UMASS_PROTO_BBB) &&
1011 	    !(sc->sc_quirks & NO_GETMAXLUN))
1012 		sc->sc_maxlun = umass_bbb_get_max_lun(sc);
1013 	else
1014 		sc->sc_maxlun = 0;
1015 
1016 	/* Prepare the SCSI command block */
1017 	sc->cam_scsi_sense.opcode = REQUEST_SENSE;
1018 	sc->cam_scsi_test_unit_ready.opcode = TEST_UNIT_READY;
1019 
1020 	/* register the SIM */
1021 	err = umass_cam_attach_sim(sc);
1022 	if (err) {
1023 		goto detach;
1024 	}
1025 	/* scan the SIM */
1026 	umass_cam_attach(sc);
1027 
1028 	DPRINTF(sc, UDMASS_GEN, "Attach finished\n");
1029 
1030 	return (0);			/* success */
1031 
1032 detach:
1033 	umass_detach(dev);
1034 	return (ENXIO);			/* failure */
1035 }
1036 
1037 static int
1038 umass_detach(device_t dev)
1039 {
1040 	struct umass_softc *sc = device_get_softc(dev);
1041 
1042 	DPRINTF(sc, UDMASS_USB, "\n");
1043 
1044 	/* teardown our statemachine */
1045 
1046 	usbd_transfer_unsetup(sc->sc_xfer, UMASS_T_MAX);
1047 
1048 	mtx_lock(&sc->sc_mtx);
1049 
1050 	/* cancel any leftover CCB's */
1051 
1052 	umass_cancel_ccb(sc);
1053 
1054 	umass_cam_detach_sim(sc);
1055 
1056 	mtx_unlock(&sc->sc_mtx);
1057 
1058 	mtx_destroy(&sc->sc_mtx);
1059 
1060 	return (0);			/* success */
1061 }
1062 
1063 static void
1064 umass_init_shuttle(struct umass_softc *sc)
1065 {
1066 	struct usb_device_request req;
1067 	usb_error_t err;
1068 	uint8_t status[2] = {0, 0};
1069 
1070 	/*
1071 	 * The Linux driver does this, but no one can tell us what the
1072 	 * command does.
1073 	 */
1074 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1075 	req.bRequest = 1;		/* XXX unknown command */
1076 	USETW(req.wValue, 0);
1077 	req.wIndex[0] = sc->sc_iface_no;
1078 	req.wIndex[1] = 0;
1079 	USETW(req.wLength, sizeof(status));
1080 	err = usbd_do_request(sc->sc_udev, NULL, &req, &status);
1081 
1082 	DPRINTF(sc, UDMASS_GEN, "Shuttle init returned 0x%02x%02x\n",
1083 	    status[0], status[1]);
1084 }
1085 
1086 /*
1087  * Generic functions to handle transfers
1088  */
1089 
1090 static void
1091 umass_transfer_start(struct umass_softc *sc, uint8_t xfer_index)
1092 {
1093 	DPRINTF(sc, UDMASS_GEN, "transfer index = "
1094 	    "%d\n", xfer_index);
1095 
1096 	if (sc->sc_xfer[xfer_index]) {
1097 		sc->sc_last_xfer_index = xfer_index;
1098 		usbd_transfer_start(sc->sc_xfer[xfer_index]);
1099 	} else {
1100 		umass_cancel_ccb(sc);
1101 	}
1102 }
1103 
1104 static void
1105 umass_reset(struct umass_softc *sc)
1106 {
1107 	DPRINTF(sc, UDMASS_GEN, "resetting device\n");
1108 
1109 	/*
1110 	 * stop the last transfer, if not already stopped:
1111 	 */
1112 	usbd_transfer_stop(sc->sc_xfer[sc->sc_last_xfer_index]);
1113 	umass_transfer_start(sc, 0);
1114 }
1115 
1116 static void
1117 umass_cancel_ccb(struct umass_softc *sc)
1118 {
1119 	union ccb *ccb;
1120 
1121 	mtx_assert(&sc->sc_mtx, MA_OWNED);
1122 
1123 	ccb = sc->sc_transfer.ccb;
1124 	sc->sc_transfer.ccb = NULL;
1125 	sc->sc_last_xfer_index = 0;
1126 
1127 	if (ccb) {
1128 		(sc->sc_transfer.callback)
1129 		    (sc, ccb, (sc->sc_transfer.data_len -
1130 		    sc->sc_transfer.actlen), STATUS_WIRE_FAILED);
1131 	}
1132 }
1133 
1134 static void
1135 umass_tr_error(struct usb_xfer *xfer, usb_error_t error)
1136 {
1137 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1138 
1139 	if (error != USB_ERR_CANCELLED) {
1140 
1141 		DPRINTF(sc, UDMASS_GEN, "transfer error, %s -> "
1142 		    "reset\n", usbd_errstr(error));
1143 	}
1144 	umass_cancel_ccb(sc);
1145 }
1146 
1147 /*
1148  * BBB protocol specific functions
1149  */
1150 
1151 static void
1152 umass_t_bbb_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1153 {
1154 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1155 	struct usb_device_request req;
1156 	struct usb_page_cache *pc;
1157 
1158 	switch (USB_GET_STATE(xfer)) {
1159 	case USB_ST_TRANSFERRED:
1160 		umass_transfer_start(sc, UMASS_T_BBB_RESET2);
1161 		return;
1162 
1163 	case USB_ST_SETUP:
1164 		/*
1165 		 * Reset recovery (5.3.4 in Universal Serial Bus Mass Storage Class)
1166 		 *
1167 		 * For Reset Recovery the host shall issue in the following order:
1168 		 * a) a Bulk-Only Mass Storage Reset
1169 		 * b) a Clear Feature HALT to the Bulk-In endpoint
1170 		 * c) a Clear Feature HALT to the Bulk-Out endpoint
1171 		 *
1172 		 * This is done in 3 steps, using 3 transfers:
1173 		 * UMASS_T_BBB_RESET1
1174 		 * UMASS_T_BBB_RESET2
1175 		 * UMASS_T_BBB_RESET3
1176 		 */
1177 
1178 		DPRINTF(sc, UDMASS_BBB, "BBB reset!\n");
1179 
1180 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1181 		req.bRequest = UR_BBB_RESET;	/* bulk only reset */
1182 		USETW(req.wValue, 0);
1183 		req.wIndex[0] = sc->sc_iface_no;
1184 		req.wIndex[1] = 0;
1185 		USETW(req.wLength, 0);
1186 
1187 		pc = usbd_xfer_get_frame(xfer, 0);
1188 		usbd_copy_in(pc, 0, &req, sizeof(req));
1189 
1190 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1191 		usbd_xfer_set_frames(xfer, 1);
1192 		usbd_transfer_submit(xfer);
1193 		return;
1194 
1195 	default:			/* Error */
1196 		umass_tr_error(xfer, error);
1197 		return;
1198 	}
1199 }
1200 
1201 static void
1202 umass_t_bbb_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1203 {
1204 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_RESET3,
1205 	    UMASS_T_BBB_DATA_READ, error);
1206 }
1207 
1208 static void
1209 umass_t_bbb_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1210 {
1211 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_COMMAND,
1212 	    UMASS_T_BBB_DATA_WRITE, error);
1213 }
1214 
1215 static void
1216 umass_t_bbb_data_clear_stall_callback(struct usb_xfer *xfer,
1217     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1218 {
1219 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1220 
1221 	switch (USB_GET_STATE(xfer)) {
1222 	case USB_ST_TRANSFERRED:
1223 tr_transferred:
1224 		umass_transfer_start(sc, next_xfer);
1225 		return;
1226 
1227 	case USB_ST_SETUP:
1228 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1229 			goto tr_transferred;
1230 		}
1231 		return;
1232 
1233 	default:			/* Error */
1234 		umass_tr_error(xfer, error);
1235 		return;
1236 	}
1237 }
1238 
1239 static void
1240 umass_t_bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
1241 {
1242 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1243 	union ccb *ccb = sc->sc_transfer.ccb;
1244 	struct usb_page_cache *pc;
1245 	uint32_t tag;
1246 
1247 	switch (USB_GET_STATE(xfer)) {
1248 	case USB_ST_TRANSFERRED:
1249 		umass_transfer_start
1250 		    (sc, ((sc->sc_transfer.dir == DIR_IN) ? UMASS_T_BBB_DATA_READ :
1251 		    (sc->sc_transfer.dir == DIR_OUT) ? UMASS_T_BBB_DATA_WRITE :
1252 		    UMASS_T_BBB_STATUS));
1253 		return;
1254 
1255 	case USB_ST_SETUP:
1256 
1257 		sc->sc_status_try = 0;
1258 
1259 		if (ccb) {
1260 
1261 			/*
1262 		         * the initial value is not important,
1263 		         * as long as the values are unique:
1264 		         */
1265 			tag = UGETDW(sc->cbw.dCBWTag) + 1;
1266 
1267 			USETDW(sc->cbw.dCBWSignature, CBWSIGNATURE);
1268 			USETDW(sc->cbw.dCBWTag, tag);
1269 
1270 			/*
1271 		         * dCBWDataTransferLength:
1272 		         *   This field indicates the number of bytes of data that the host
1273 		         *   intends to transfer on the IN or OUT Bulk endpoint(as indicated by
1274 		         *   the Direction bit) during the execution of this command. If this
1275 		         *   field is set to 0, the device will expect that no data will be
1276 		         *   transferred IN or OUT during this command, regardless of the value
1277 		         *   of the Direction bit defined in dCBWFlags.
1278 		         */
1279 			USETDW(sc->cbw.dCBWDataTransferLength, sc->sc_transfer.data_len);
1280 
1281 			/*
1282 		         * dCBWFlags:
1283 		         *   The bits of the Flags field are defined as follows:
1284 		         *     Bits 0-6  reserved
1285 		         *     Bit  7    Direction - this bit shall be ignored if the
1286 		         *                           dCBWDataTransferLength field is zero.
1287 		         *               0 = data Out from host to device
1288 		         *               1 = data In from device to host
1289 		         */
1290 			sc->cbw.bCBWFlags = ((sc->sc_transfer.dir == DIR_IN) ?
1291 			    CBWFLAGS_IN : CBWFLAGS_OUT);
1292 			sc->cbw.bCBWLUN = sc->sc_transfer.lun;
1293 
1294 			if (sc->sc_transfer.cmd_len > sizeof(sc->cbw.CBWCDB)) {
1295 				sc->sc_transfer.cmd_len = sizeof(sc->cbw.CBWCDB);
1296 				DPRINTF(sc, UDMASS_BBB, "Truncating long command!\n");
1297 			}
1298 			sc->cbw.bCDBLength = sc->sc_transfer.cmd_len;
1299 
1300 			memcpy(sc->cbw.CBWCDB, sc->sc_transfer.cmd_data,
1301 			    sc->sc_transfer.cmd_len);
1302 
1303 			memset(sc->sc_transfer.cmd_data +
1304 			    sc->sc_transfer.cmd_len, 0,
1305 			    sizeof(sc->cbw.CBWCDB) -
1306 			    sc->sc_transfer.cmd_len);
1307 
1308 			DIF(UDMASS_BBB, umass_bbb_dump_cbw(sc, &sc->cbw));
1309 
1310 			pc = usbd_xfer_get_frame(xfer, 0);
1311 			usbd_copy_in(pc, 0, &sc->cbw, sizeof(sc->cbw));
1312 			usbd_xfer_set_frame_len(xfer, 0, sizeof(sc->cbw));
1313 
1314 			usbd_transfer_submit(xfer);
1315 		}
1316 		return;
1317 
1318 	default:			/* Error */
1319 		umass_tr_error(xfer, error);
1320 		return;
1321 	}
1322 }
1323 
1324 static void
1325 umass_t_bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1326 {
1327 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1328 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1329 	int actlen, sumlen;
1330 
1331 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1332 
1333 	switch (USB_GET_STATE(xfer)) {
1334 	case USB_ST_TRANSFERRED:
1335 		sc->sc_transfer.data_rem -= actlen;
1336 		sc->sc_transfer.data_ptr += actlen;
1337 		sc->sc_transfer.actlen += actlen;
1338 
1339 		if (actlen < sumlen) {
1340 			/* short transfer */
1341 			sc->sc_transfer.data_rem = 0;
1342 		}
1343 	case USB_ST_SETUP:
1344 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1345 		    max_bulk, sc->sc_transfer.data_rem);
1346 
1347 		if (sc->sc_transfer.data_rem == 0) {
1348 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1349 			return;
1350 		}
1351 		if (max_bulk > sc->sc_transfer.data_rem) {
1352 			max_bulk = sc->sc_transfer.data_rem;
1353 		}
1354 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1355 
1356 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1357 		    max_bulk);
1358 
1359 		usbd_transfer_submit(xfer);
1360 		return;
1361 
1362 	default:			/* Error */
1363 		if (error == USB_ERR_CANCELLED) {
1364 			umass_tr_error(xfer, error);
1365 		} else {
1366 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1367 		}
1368 		return;
1369 	}
1370 }
1371 
1372 static void
1373 umass_t_bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1374 {
1375 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1376 	    UMASS_T_BBB_DATA_READ, error);
1377 }
1378 
1379 static void
1380 umass_t_bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1381 {
1382 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1383 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1384 	int actlen, sumlen;
1385 
1386 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1387 
1388 	switch (USB_GET_STATE(xfer)) {
1389 	case USB_ST_TRANSFERRED:
1390 		sc->sc_transfer.data_rem -= actlen;
1391 		sc->sc_transfer.data_ptr += actlen;
1392 		sc->sc_transfer.actlen += actlen;
1393 
1394 		if (actlen < sumlen) {
1395 			/* short transfer */
1396 			sc->sc_transfer.data_rem = 0;
1397 		}
1398 	case USB_ST_SETUP:
1399 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1400 		    max_bulk, sc->sc_transfer.data_rem);
1401 
1402 		if (sc->sc_transfer.data_rem == 0) {
1403 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1404 			return;
1405 		}
1406 		if (max_bulk > sc->sc_transfer.data_rem) {
1407 			max_bulk = sc->sc_transfer.data_rem;
1408 		}
1409 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1410 
1411 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1412 		    max_bulk);
1413 
1414 		usbd_transfer_submit(xfer);
1415 		return;
1416 
1417 	default:			/* Error */
1418 		if (error == USB_ERR_CANCELLED) {
1419 			umass_tr_error(xfer, error);
1420 		} else {
1421 			umass_transfer_start(sc, UMASS_T_BBB_DATA_WR_CS);
1422 		}
1423 		return;
1424 	}
1425 }
1426 
1427 static void
1428 umass_t_bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1429 {
1430 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1431 	    UMASS_T_BBB_DATA_WRITE, error);
1432 }
1433 
1434 static void
1435 umass_t_bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
1436 {
1437 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1438 	union ccb *ccb = sc->sc_transfer.ccb;
1439 	struct usb_page_cache *pc;
1440 	uint32_t residue;
1441 	int actlen;
1442 
1443 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1444 
1445 	switch (USB_GET_STATE(xfer)) {
1446 	case USB_ST_TRANSFERRED:
1447 
1448 		/*
1449 		 * Do a full reset if there is something wrong with the CSW:
1450 		 */
1451 		sc->sc_status_try = 1;
1452 
1453 		/* Zero missing parts of the CSW: */
1454 
1455 		if (actlen < (int)sizeof(sc->csw))
1456 			memset(&sc->csw, 0, sizeof(sc->csw));
1457 
1458 		pc = usbd_xfer_get_frame(xfer, 0);
1459 		usbd_copy_out(pc, 0, &sc->csw, actlen);
1460 
1461 		DIF(UDMASS_BBB, umass_bbb_dump_csw(sc, &sc->csw));
1462 
1463 		residue = UGETDW(sc->csw.dCSWDataResidue);
1464 
1465 		if ((!residue) || (sc->sc_quirks & IGNORE_RESIDUE)) {
1466 			residue = (sc->sc_transfer.data_len -
1467 			    sc->sc_transfer.actlen);
1468 		}
1469 		if (residue > sc->sc_transfer.data_len) {
1470 			DPRINTF(sc, UDMASS_BBB, "truncating residue from %d "
1471 			    "to %d bytes\n", residue, sc->sc_transfer.data_len);
1472 			residue = sc->sc_transfer.data_len;
1473 		}
1474 		/* translate weird command-status signatures: */
1475 		if (sc->sc_quirks & WRONG_CSWSIG) {
1476 
1477 			uint32_t temp = UGETDW(sc->csw.dCSWSignature);
1478 
1479 			if ((temp == CSWSIGNATURE_OLYMPUS_C1) ||
1480 			    (temp == CSWSIGNATURE_IMAGINATION_DBX1)) {
1481 				USETDW(sc->csw.dCSWSignature, CSWSIGNATURE);
1482 			}
1483 		}
1484 		/* check CSW and handle eventual error */
1485 		if (UGETDW(sc->csw.dCSWSignature) != CSWSIGNATURE) {
1486 			DPRINTF(sc, UDMASS_BBB, "bad CSW signature 0x%08x != 0x%08x\n",
1487 			    UGETDW(sc->csw.dCSWSignature), CSWSIGNATURE);
1488 			/*
1489 			 * Invalid CSW: Wrong signature or wrong tag might
1490 			 * indicate that we lost synchronization. Reset the
1491 			 * device.
1492 			 */
1493 			goto tr_error;
1494 		} else if (UGETDW(sc->csw.dCSWTag) != UGETDW(sc->cbw.dCBWTag)) {
1495 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: tag 0x%08x should be "
1496 			    "0x%08x\n", UGETDW(sc->csw.dCSWTag),
1497 			    UGETDW(sc->cbw.dCBWTag));
1498 			goto tr_error;
1499 		} else if (sc->csw.bCSWStatus > CSWSTATUS_PHASE) {
1500 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: status %d > %d\n",
1501 			    sc->csw.bCSWStatus, CSWSTATUS_PHASE);
1502 			goto tr_error;
1503 		} else if (sc->csw.bCSWStatus == CSWSTATUS_PHASE) {
1504 			DPRINTF(sc, UDMASS_BBB, "Phase error, residue = "
1505 			    "%d\n", residue);
1506 			goto tr_error;
1507 		} else if (sc->sc_transfer.actlen > sc->sc_transfer.data_len) {
1508 			DPRINTF(sc, UDMASS_BBB, "Buffer overrun %d > %d\n",
1509 			    sc->sc_transfer.actlen, sc->sc_transfer.data_len);
1510 			goto tr_error;
1511 		} else if (sc->csw.bCSWStatus == CSWSTATUS_FAILED) {
1512 			DPRINTF(sc, UDMASS_BBB, "Command failed, residue = "
1513 			    "%d\n", residue);
1514 
1515 			sc->sc_transfer.ccb = NULL;
1516 
1517 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1518 
1519 			(sc->sc_transfer.callback)
1520 			    (sc, ccb, residue, STATUS_CMD_FAILED);
1521 		} else {
1522 			sc->sc_transfer.ccb = NULL;
1523 
1524 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1525 
1526 			(sc->sc_transfer.callback)
1527 			    (sc, ccb, residue, STATUS_CMD_OK);
1528 		}
1529 		return;
1530 
1531 	case USB_ST_SETUP:
1532 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1533 		usbd_transfer_submit(xfer);
1534 		return;
1535 
1536 	default:
1537 tr_error:
1538 		DPRINTF(sc, UDMASS_BBB, "Failed to read CSW: %s, try %d\n",
1539 		    usbd_errstr(error), sc->sc_status_try);
1540 
1541 		if ((error == USB_ERR_CANCELLED) ||
1542 		    (sc->sc_status_try)) {
1543 			umass_tr_error(xfer, error);
1544 		} else {
1545 			sc->sc_status_try = 1;
1546 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1547 		}
1548 		return;
1549 	}
1550 }
1551 
1552 static void
1553 umass_command_start(struct umass_softc *sc, uint8_t dir,
1554     void *data_ptr, uint32_t data_len,
1555     uint32_t data_timeout, umass_callback_t *callback,
1556     union ccb *ccb)
1557 {
1558 	sc->sc_transfer.lun = ccb->ccb_h.target_lun;
1559 
1560 	/*
1561 	 * NOTE: assumes that "sc->sc_transfer.cmd_data" and
1562 	 * "sc->sc_transfer.cmd_len" has been properly
1563 	 * initialized.
1564 	 */
1565 
1566 	sc->sc_transfer.dir = data_len ? dir : DIR_NONE;
1567 	sc->sc_transfer.data_ptr = data_ptr;
1568 	sc->sc_transfer.data_len = data_len;
1569 	sc->sc_transfer.data_rem = data_len;
1570 	sc->sc_transfer.data_timeout = (data_timeout + UMASS_TIMEOUT);
1571 
1572 	sc->sc_transfer.actlen = 0;
1573 	sc->sc_transfer.callback = callback;
1574 	sc->sc_transfer.ccb = ccb;
1575 
1576 	if (sc->sc_xfer[sc->sc_last_xfer_index]) {
1577 		usbd_transfer_start(sc->sc_xfer[sc->sc_last_xfer_index]);
1578 	} else {
1579 		umass_cancel_ccb(sc);
1580 	}
1581 }
1582 
1583 static uint8_t
1584 umass_bbb_get_max_lun(struct umass_softc *sc)
1585 {
1586 	struct usb_device_request req;
1587 	usb_error_t err;
1588 	uint8_t buf = 0;
1589 
1590 	/* The Get Max Lun command is a class-specific request. */
1591 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
1592 	req.bRequest = UR_BBB_GET_MAX_LUN;
1593 	USETW(req.wValue, 0);
1594 	req.wIndex[0] = sc->sc_iface_no;
1595 	req.wIndex[1] = 0;
1596 	USETW(req.wLength, 1);
1597 
1598 	err = usbd_do_request(sc->sc_udev, NULL, &req, &buf);
1599 	if (err) {
1600 		buf = 0;
1601 
1602 		/* Device doesn't support Get Max Lun request. */
1603 		printf("%s: Get Max Lun not supported (%s)\n",
1604 		    sc->sc_name, usbd_errstr(err));
1605 	}
1606 	return (buf);
1607 }
1608 
1609 /*
1610  * Command/Bulk/Interrupt (CBI) specific functions
1611  */
1612 
1613 static void
1614 umass_cbi_start_status(struct umass_softc *sc)
1615 {
1616 	if (sc->sc_xfer[UMASS_T_CBI_STATUS]) {
1617 		umass_transfer_start(sc, UMASS_T_CBI_STATUS);
1618 	} else {
1619 		union ccb *ccb = sc->sc_transfer.ccb;
1620 
1621 		sc->sc_transfer.ccb = NULL;
1622 
1623 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1624 
1625 		(sc->sc_transfer.callback)
1626 		    (sc, ccb, (sc->sc_transfer.data_len -
1627 		    sc->sc_transfer.actlen), STATUS_CMD_UNKNOWN);
1628 	}
1629 }
1630 
1631 static void
1632 umass_t_cbi_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1633 {
1634 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1635 	struct usb_device_request req;
1636 	struct usb_page_cache *pc;
1637 	uint8_t buf[UMASS_CBI_DIAGNOSTIC_CMDLEN];
1638 
1639 	uint8_t i;
1640 
1641 	switch (USB_GET_STATE(xfer)) {
1642 	case USB_ST_TRANSFERRED:
1643 		umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1644 		break;
1645 
1646 	case USB_ST_SETUP:
1647 		/*
1648 		 * Command Block Reset Protocol
1649 		 *
1650 		 * First send a reset request to the device. Then clear
1651 		 * any possibly stalled bulk endpoints.
1652 		 *
1653 		 * This is done in 3 steps, using 3 transfers:
1654 		 * UMASS_T_CBI_RESET1
1655 		 * UMASS_T_CBI_RESET2
1656 		 * UMASS_T_CBI_RESET3
1657 		 * UMASS_T_CBI_RESET4 (only if there is an interrupt endpoint)
1658 		 */
1659 
1660 		DPRINTF(sc, UDMASS_CBI, "CBI reset!\n");
1661 
1662 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1663 		req.bRequest = UR_CBI_ADSC;
1664 		USETW(req.wValue, 0);
1665 		req.wIndex[0] = sc->sc_iface_no;
1666 		req.wIndex[1] = 0;
1667 		USETW(req.wLength, UMASS_CBI_DIAGNOSTIC_CMDLEN);
1668 
1669 		/*
1670 		 * The 0x1d code is the SEND DIAGNOSTIC command. To
1671 		 * distinguish between the two, the last 10 bytes of the CBL
1672 		 * is filled with 0xff (section 2.2 of the CBI
1673 		 * specification)
1674 		 */
1675 		buf[0] = 0x1d;		/* Command Block Reset */
1676 		buf[1] = 0x04;
1677 
1678 		for (i = 2; i < UMASS_CBI_DIAGNOSTIC_CMDLEN; i++) {
1679 			buf[i] = 0xff;
1680 		}
1681 
1682 		pc = usbd_xfer_get_frame(xfer, 0);
1683 		usbd_copy_in(pc, 0, &req, sizeof(req));
1684 		pc = usbd_xfer_get_frame(xfer, 1);
1685 		usbd_copy_in(pc, 0, buf, sizeof(buf));
1686 
1687 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1688 		usbd_xfer_set_frame_len(xfer, 1, sizeof(buf));
1689 		usbd_xfer_set_frames(xfer, 2);
1690 		usbd_transfer_submit(xfer);
1691 		break;
1692 
1693 	default:			/* Error */
1694 		if (error == USB_ERR_CANCELLED)
1695 			umass_tr_error(xfer, error);
1696 		else
1697 			umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1698 		break;
1699 	}
1700 }
1701 
1702 static void
1703 umass_t_cbi_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1704 {
1705 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_RESET3,
1706 	    UMASS_T_CBI_DATA_READ, error);
1707 }
1708 
1709 static void
1710 umass_t_cbi_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1711 {
1712 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1713 
1714 	umass_t_cbi_data_clear_stall_callback
1715 	    (xfer, (sc->sc_xfer[UMASS_T_CBI_RESET4] &&
1716 	    sc->sc_xfer[UMASS_T_CBI_STATUS]) ?
1717 	    UMASS_T_CBI_RESET4 : UMASS_T_CBI_COMMAND,
1718 	    UMASS_T_CBI_DATA_WRITE, error);
1719 }
1720 
1721 static void
1722 umass_t_cbi_reset4_callback(struct usb_xfer *xfer, usb_error_t error)
1723 {
1724 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_COMMAND,
1725 	    UMASS_T_CBI_STATUS, error);
1726 }
1727 
1728 static void
1729 umass_t_cbi_data_clear_stall_callback(struct usb_xfer *xfer,
1730     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1731 {
1732 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1733 
1734 	switch (USB_GET_STATE(xfer)) {
1735 	case USB_ST_TRANSFERRED:
1736 tr_transferred:
1737 		if (next_xfer == UMASS_T_CBI_STATUS) {
1738 			umass_cbi_start_status(sc);
1739 		} else {
1740 			umass_transfer_start(sc, next_xfer);
1741 		}
1742 		break;
1743 
1744 	case USB_ST_SETUP:
1745 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1746 			goto tr_transferred;	/* should not happen */
1747 		}
1748 		break;
1749 
1750 	default:			/* Error */
1751 		umass_tr_error(xfer, error);
1752 		break;
1753 	}
1754 }
1755 
1756 static void
1757 umass_t_cbi_command_callback(struct usb_xfer *xfer, usb_error_t error)
1758 {
1759 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1760 	union ccb *ccb = sc->sc_transfer.ccb;
1761 	struct usb_device_request req;
1762 	struct usb_page_cache *pc;
1763 
1764 	switch (USB_GET_STATE(xfer)) {
1765 	case USB_ST_TRANSFERRED:
1766 
1767 		if (sc->sc_transfer.dir == DIR_NONE) {
1768 			umass_cbi_start_status(sc);
1769 		} else {
1770 			umass_transfer_start
1771 			    (sc, (sc->sc_transfer.dir == DIR_IN) ?
1772 			    UMASS_T_CBI_DATA_READ : UMASS_T_CBI_DATA_WRITE);
1773 		}
1774 		break;
1775 
1776 	case USB_ST_SETUP:
1777 
1778 		if (ccb) {
1779 
1780 			/*
1781 		         * do a CBI transfer with cmd_len bytes from
1782 		         * cmd_data, possibly a data phase of data_len
1783 		         * bytes from/to the device and finally a status
1784 		         * read phase.
1785 		         */
1786 
1787 			req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1788 			req.bRequest = UR_CBI_ADSC;
1789 			USETW(req.wValue, 0);
1790 			req.wIndex[0] = sc->sc_iface_no;
1791 			req.wIndex[1] = 0;
1792 			req.wLength[0] = sc->sc_transfer.cmd_len;
1793 			req.wLength[1] = 0;
1794 
1795 			pc = usbd_xfer_get_frame(xfer, 0);
1796 			usbd_copy_in(pc, 0, &req, sizeof(req));
1797 			pc = usbd_xfer_get_frame(xfer, 1);
1798 			usbd_copy_in(pc, 0, sc->sc_transfer.cmd_data,
1799 			    sc->sc_transfer.cmd_len);
1800 
1801 			usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1802 			usbd_xfer_set_frame_len(xfer, 1, sc->sc_transfer.cmd_len);
1803 			usbd_xfer_set_frames(xfer,
1804 			    sc->sc_transfer.cmd_len ? 2 : 1);
1805 
1806 			DIF(UDMASS_CBI,
1807 			    umass_cbi_dump_cmd(sc,
1808 			    sc->sc_transfer.cmd_data,
1809 			    sc->sc_transfer.cmd_len));
1810 
1811 			usbd_transfer_submit(xfer);
1812 		}
1813 		break;
1814 
1815 	default:			/* Error */
1816 		/*
1817 		 * STALL on the control pipe can be result of the command error.
1818 		 * Attempt to clear this STALL same as for bulk pipe also
1819 		 * results in command completion interrupt, but ASC/ASCQ there
1820 		 * look like not always valid, so don't bother about it.
1821 		 */
1822 		if ((error == USB_ERR_STALLED) ||
1823 		    (sc->sc_transfer.callback == &umass_cam_cb)) {
1824 			sc->sc_transfer.ccb = NULL;
1825 			(sc->sc_transfer.callback)
1826 			    (sc, ccb, sc->sc_transfer.data_len,
1827 			    STATUS_CMD_UNKNOWN);
1828 		} else {
1829 			umass_tr_error(xfer, error);
1830 			/* skip reset */
1831 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1832 		}
1833 		break;
1834 	}
1835 }
1836 
1837 static void
1838 umass_t_cbi_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1839 {
1840 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1841 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1842 	int actlen, sumlen;
1843 
1844 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1845 
1846 	switch (USB_GET_STATE(xfer)) {
1847 	case USB_ST_TRANSFERRED:
1848 		sc->sc_transfer.data_rem -= actlen;
1849 		sc->sc_transfer.data_ptr += actlen;
1850 		sc->sc_transfer.actlen += actlen;
1851 
1852 		if (actlen < sumlen) {
1853 			/* short transfer */
1854 			sc->sc_transfer.data_rem = 0;
1855 		}
1856 	case USB_ST_SETUP:
1857 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1858 		    max_bulk, sc->sc_transfer.data_rem);
1859 
1860 		if (sc->sc_transfer.data_rem == 0) {
1861 			umass_cbi_start_status(sc);
1862 			break;
1863 		}
1864 		if (max_bulk > sc->sc_transfer.data_rem) {
1865 			max_bulk = sc->sc_transfer.data_rem;
1866 		}
1867 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1868 
1869 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1870 		    max_bulk);
1871 
1872 		usbd_transfer_submit(xfer);
1873 		break;
1874 
1875 	default:			/* Error */
1876 		if ((error == USB_ERR_CANCELLED) ||
1877 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1878 			umass_tr_error(xfer, error);
1879 		} else {
1880 			umass_transfer_start(sc, UMASS_T_CBI_DATA_RD_CS);
1881 		}
1882 		break;
1883 	}
1884 }
1885 
1886 static void
1887 umass_t_cbi_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1888 {
1889 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1890 	    UMASS_T_CBI_DATA_READ, error);
1891 }
1892 
1893 static void
1894 umass_t_cbi_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1895 {
1896 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1897 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1898 	int actlen, sumlen;
1899 
1900 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1901 
1902 	switch (USB_GET_STATE(xfer)) {
1903 	case USB_ST_TRANSFERRED:
1904 		sc->sc_transfer.data_rem -= actlen;
1905 		sc->sc_transfer.data_ptr += actlen;
1906 		sc->sc_transfer.actlen += actlen;
1907 
1908 		if (actlen < sumlen) {
1909 			/* short transfer */
1910 			sc->sc_transfer.data_rem = 0;
1911 		}
1912 	case USB_ST_SETUP:
1913 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1914 		    max_bulk, sc->sc_transfer.data_rem);
1915 
1916 		if (sc->sc_transfer.data_rem == 0) {
1917 			umass_cbi_start_status(sc);
1918 			break;
1919 		}
1920 		if (max_bulk > sc->sc_transfer.data_rem) {
1921 			max_bulk = sc->sc_transfer.data_rem;
1922 		}
1923 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1924 
1925 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1926 		    max_bulk);
1927 
1928 		usbd_transfer_submit(xfer);
1929 		break;
1930 
1931 	default:			/* Error */
1932 		if ((error == USB_ERR_CANCELLED) ||
1933 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1934 			umass_tr_error(xfer, error);
1935 		} else {
1936 			umass_transfer_start(sc, UMASS_T_CBI_DATA_WR_CS);
1937 		}
1938 		break;
1939 	}
1940 }
1941 
1942 static void
1943 umass_t_cbi_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1944 {
1945 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1946 	    UMASS_T_CBI_DATA_WRITE, error);
1947 }
1948 
1949 static void
1950 umass_t_cbi_status_callback(struct usb_xfer *xfer, usb_error_t error)
1951 {
1952 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1953 	union ccb *ccb = sc->sc_transfer.ccb;
1954 	struct usb_page_cache *pc;
1955 	uint32_t residue;
1956 	uint8_t status;
1957 	int actlen;
1958 
1959 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1960 
1961 	switch (USB_GET_STATE(xfer)) {
1962 	case USB_ST_TRANSFERRED:
1963 
1964 		if (actlen < (int)sizeof(sc->sbl)) {
1965 			goto tr_setup;
1966 		}
1967 		pc = usbd_xfer_get_frame(xfer, 0);
1968 		usbd_copy_out(pc, 0, &sc->sbl, sizeof(sc->sbl));
1969 
1970 		residue = (sc->sc_transfer.data_len -
1971 		    sc->sc_transfer.actlen);
1972 
1973 		/* dissect the information in the buffer */
1974 
1975 		if (sc->sc_proto & UMASS_PROTO_UFI) {
1976 
1977 			/*
1978 			 * Section 3.4.3.1.3 specifies that the UFI command
1979 			 * protocol returns an ASC and ASCQ in the interrupt
1980 			 * data block.
1981 			 */
1982 
1983 			DPRINTF(sc, UDMASS_CBI, "UFI CCI, ASC = 0x%02x, "
1984 			    "ASCQ = 0x%02x\n", sc->sbl.ufi.asc,
1985 			    sc->sbl.ufi.ascq);
1986 
1987 			status = (((sc->sbl.ufi.asc == 0) &&
1988 			    (sc->sbl.ufi.ascq == 0)) ?
1989 			    STATUS_CMD_OK : STATUS_CMD_FAILED);
1990 
1991 			sc->sc_transfer.ccb = NULL;
1992 
1993 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1994 
1995 			(sc->sc_transfer.callback)
1996 			    (sc, ccb, residue, status);
1997 
1998 			break;
1999 
2000 		} else {
2001 
2002 			/* Command Interrupt Data Block */
2003 
2004 			DPRINTF(sc, UDMASS_CBI, "type=0x%02x, value=0x%02x\n",
2005 			    sc->sbl.common.type, sc->sbl.common.value);
2006 
2007 			if (sc->sbl.common.type == IDB_TYPE_CCI) {
2008 
2009 				status = (sc->sbl.common.value & IDB_VALUE_STATUS_MASK);
2010 
2011 				status = ((status == IDB_VALUE_PASS) ? STATUS_CMD_OK :
2012 				    (status == IDB_VALUE_FAIL) ? STATUS_CMD_FAILED :
2013 				    (status == IDB_VALUE_PERSISTENT) ? STATUS_CMD_FAILED :
2014 				    STATUS_WIRE_FAILED);
2015 
2016 				sc->sc_transfer.ccb = NULL;
2017 
2018 				sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2019 
2020 				(sc->sc_transfer.callback)
2021 				    (sc, ccb, residue, status);
2022 
2023 				break;
2024 			}
2025 		}
2026 
2027 		/* fallthrough */
2028 
2029 	case USB_ST_SETUP:
2030 tr_setup:
2031 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2032 		usbd_transfer_submit(xfer);
2033 		break;
2034 
2035 	default:			/* Error */
2036 		DPRINTF(sc, UDMASS_CBI, "Failed to read CSW: %s\n",
2037 		    usbd_errstr(error));
2038 		umass_tr_error(xfer, error);
2039 		break;
2040 	}
2041 }
2042 
2043 /*
2044  * CAM specific functions (used by SCSI, UFI, 8070i (ATAPI))
2045  */
2046 
2047 static int
2048 umass_cam_attach_sim(struct umass_softc *sc)
2049 {
2050 	struct cam_devq *devq;		/* Per device Queue */
2051 
2052 	/*
2053 	 * A HBA is attached to the CAM layer.
2054 	 *
2055 	 * The CAM layer will then after a while start probing for devices on
2056 	 * the bus. The number of SIMs is limited to one.
2057 	 */
2058 
2059 	devq = cam_simq_alloc(1 /* maximum openings */ );
2060 	if (devq == NULL) {
2061 		return (ENOMEM);
2062 	}
2063 	sc->sc_sim = cam_sim_alloc
2064 	    (&umass_cam_action, &umass_cam_poll,
2065 	    DEVNAME_SIM,
2066 	    sc /* priv */ ,
2067 	    sc->sc_unit /* unit number */ ,
2068 	    &sc->sc_mtx /* mutex */ ,
2069 	    1 /* maximum device openings */ ,
2070 	    0 /* maximum tagged device openings */ ,
2071 	    devq);
2072 
2073 	if (sc->sc_sim == NULL) {
2074 		cam_simq_free(devq);
2075 		return (ENOMEM);
2076 	}
2077 
2078 	mtx_lock(&sc->sc_mtx);
2079 
2080 	if (xpt_bus_register(sc->sc_sim, sc->sc_dev,
2081 	    sc->sc_unit) != CAM_SUCCESS) {
2082 		mtx_unlock(&sc->sc_mtx);
2083 		return (ENOMEM);
2084 	}
2085 	mtx_unlock(&sc->sc_mtx);
2086 
2087 	return (0);
2088 }
2089 
2090 static void
2091 umass_cam_attach(struct umass_softc *sc)
2092 {
2093 #ifndef USB_DEBUG
2094 	if (bootverbose)
2095 #endif
2096 		printf("%s:%d:%d:%d: Attached to scbus%d\n",
2097 		    sc->sc_name, cam_sim_path(sc->sc_sim),
2098 		    sc->sc_unit, CAM_LUN_WILDCARD,
2099 		    cam_sim_path(sc->sc_sim));
2100 }
2101 
2102 /* umass_cam_detach
2103  *	detach from the CAM layer
2104  */
2105 
2106 static void
2107 umass_cam_detach_sim(struct umass_softc *sc)
2108 {
2109 	if (sc->sc_sim != NULL) {
2110 		if (xpt_bus_deregister(cam_sim_path(sc->sc_sim))) {
2111 			/* accessing the softc is not possible after this */
2112 			sc->sc_sim->softc = UMASS_GONE;
2113 			cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2114 		} else {
2115 			panic("%s: CAM layer is busy\n",
2116 			    sc->sc_name);
2117 		}
2118 		sc->sc_sim = NULL;
2119 	}
2120 }
2121 
2122 /* umass_cam_action
2123  * 	CAM requests for action come through here
2124  */
2125 
2126 static void
2127 umass_cam_action(struct cam_sim *sim, union ccb *ccb)
2128 {
2129 	struct umass_softc *sc = (struct umass_softc *)sim->softc;
2130 
2131 	if (sc == UMASS_GONE ||
2132 	    (sc != NULL && !usbd_device_attached(sc->sc_udev))) {
2133 		ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2134 		xpt_done(ccb);
2135 		return;
2136 	}
2137 	/*
2138 	 * Verify, depending on the operation to perform, that we either got
2139 	 * a valid sc, because an existing target was referenced, or
2140 	 * otherwise the SIM is addressed.
2141 	 *
2142 	 * This avoids bombing out at a printf and does give the CAM layer some
2143 	 * sensible feedback on errors.
2144 	 */
2145 	switch (ccb->ccb_h.func_code) {
2146 	case XPT_SCSI_IO:
2147 	case XPT_RESET_DEV:
2148 	case XPT_GET_TRAN_SETTINGS:
2149 	case XPT_SET_TRAN_SETTINGS:
2150 	case XPT_CALC_GEOMETRY:
2151 		/* the opcodes requiring a target. These should never occur. */
2152 		if (sc == NULL) {
2153 			DPRINTF(sc, UDMASS_GEN, "%s:%d:%d:%d:func_code 0x%04x: "
2154 			    "Invalid target (target needed)\n",
2155 			    DEVNAME_SIM, cam_sim_path(sc->sc_sim),
2156 			    ccb->ccb_h.target_id, ccb->ccb_h.target_lun,
2157 			    ccb->ccb_h.func_code);
2158 
2159 			ccb->ccb_h.status = CAM_TID_INVALID;
2160 			xpt_done(ccb);
2161 			goto done;
2162 		}
2163 		break;
2164 	case XPT_PATH_INQ:
2165 	case XPT_NOOP:
2166 		/*
2167 		 * The opcodes sometimes aimed at a target (sc is valid),
2168 		 * sometimes aimed at the SIM (sc is invalid and target is
2169 		 * CAM_TARGET_WILDCARD)
2170 		 */
2171 		if ((sc == NULL) &&
2172 		    (ccb->ccb_h.target_id != CAM_TARGET_WILDCARD)) {
2173 			DPRINTF(sc, UDMASS_SCSI, "%s:%d:%d:%d:func_code 0x%04x: "
2174 			    "Invalid target (no wildcard)\n",
2175 			    DEVNAME_SIM, cam_sim_path(sc->sc_sim),
2176 			    ccb->ccb_h.target_id, ccb->ccb_h.target_lun,
2177 			    ccb->ccb_h.func_code);
2178 
2179 			ccb->ccb_h.status = CAM_TID_INVALID;
2180 			xpt_done(ccb);
2181 			goto done;
2182 		}
2183 		break;
2184 	default:
2185 		/* XXX Hm, we should check the input parameters */
2186 		break;
2187 	}
2188 
2189 	/* Perform the requested action */
2190 	switch (ccb->ccb_h.func_code) {
2191 	case XPT_SCSI_IO:
2192 		{
2193 			uint8_t *cmd;
2194 			uint8_t dir;
2195 
2196 			if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2197 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2198 			} else {
2199 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2200 			}
2201 
2202 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2203 			    "cmd: 0x%02x, flags: 0x%02x, "
2204 			    "%db cmd/%db data/%db sense\n",
2205 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2206 			    ccb->ccb_h.target_lun, cmd[0],
2207 			    ccb->ccb_h.flags & CAM_DIR_MASK, ccb->csio.cdb_len,
2208 			    ccb->csio.dxfer_len, ccb->csio.sense_len);
2209 
2210 			if (sc->sc_transfer.ccb) {
2211 				DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2212 				    "I/O in progress, deferring\n",
2213 				    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2214 				    ccb->ccb_h.target_lun);
2215 				ccb->ccb_h.status = CAM_SCSI_BUSY;
2216 				xpt_done(ccb);
2217 				goto done;
2218 			}
2219 			switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
2220 			case CAM_DIR_IN:
2221 				dir = DIR_IN;
2222 				break;
2223 			case CAM_DIR_OUT:
2224 				dir = DIR_OUT;
2225 				DIF(UDMASS_SCSI,
2226 				    umass_dump_buffer(sc, ccb->csio.data_ptr,
2227 				    ccb->csio.dxfer_len, 48));
2228 				break;
2229 			default:
2230 				dir = DIR_NONE;
2231 			}
2232 
2233 			ccb->ccb_h.status = CAM_REQ_INPROG | CAM_SIM_QUEUED;
2234 
2235 			/*
2236 			 * sc->sc_transform will convert the command to the
2237 			 * command format needed by the specific command set
2238 			 * and return the converted command in
2239 			 * "sc->sc_transfer.cmd_data"
2240 			 */
2241 			if (umass_std_transform(sc, ccb, cmd, ccb->csio.cdb_len)) {
2242 
2243 				if (sc->sc_transfer.cmd_data[0] == INQUIRY) {
2244 					const char *pserial;
2245 
2246 					pserial = usb_get_serial(sc->sc_udev);
2247 
2248 					/*
2249 					 * Umass devices don't generally report their serial numbers
2250 					 * in the usual SCSI way.  Emulate it here.
2251 					 */
2252 					if ((sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2253 					    (sc->sc_transfer.cmd_data[2] == SVPD_UNIT_SERIAL_NUMBER) &&
2254 					    (pserial[0] != '\0')) {
2255 						struct scsi_vpd_unit_serial_number *vpd_serial;
2256 
2257 						vpd_serial = (struct scsi_vpd_unit_serial_number *)ccb->csio.data_ptr;
2258 						vpd_serial->length = strlen(pserial);
2259 						if (vpd_serial->length > sizeof(vpd_serial->serial_num))
2260 							vpd_serial->length = sizeof(vpd_serial->serial_num);
2261 						memcpy(vpd_serial->serial_num, pserial, vpd_serial->length);
2262 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2263 						ccb->ccb_h.status = CAM_REQ_CMP;
2264 						xpt_done(ccb);
2265 						goto done;
2266 					}
2267 
2268 					/*
2269 					 * Handle EVPD inquiry for broken devices first
2270 					 * NO_INQUIRY also implies NO_INQUIRY_EVPD
2271 					 */
2272 					if ((sc->sc_quirks & (NO_INQUIRY_EVPD | NO_INQUIRY)) &&
2273 					    (sc->sc_transfer.cmd_data[1] & SI_EVPD)) {
2274 
2275 						scsi_set_sense_data(&ccb->csio.sense_data,
2276 							/*sense_format*/ SSD_TYPE_NONE,
2277 							/*current_error*/ 1,
2278 							/*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2279 							/*asc*/ 0x24,
2280 							/*ascq*/ 0x00,
2281 							/*extra args*/ SSD_ELEM_NONE);
2282 						ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2283 						ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR |
2284 						    CAM_AUTOSNS_VALID;
2285 						xpt_done(ccb);
2286 						goto done;
2287 					}
2288 					/*
2289 					 * Return fake inquiry data for
2290 					 * broken devices
2291 					 */
2292 					if (sc->sc_quirks & NO_INQUIRY) {
2293 						memcpy(ccb->csio.data_ptr, &fake_inq_data,
2294 						    sizeof(fake_inq_data));
2295 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2296 						ccb->ccb_h.status = CAM_REQ_CMP;
2297 						xpt_done(ccb);
2298 						goto done;
2299 					}
2300 					if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2301 						ccb->csio.dxfer_len = SHORT_INQUIRY_LENGTH;
2302 					}
2303 				} else if (sc->sc_transfer.cmd_data[0] == SYNCHRONIZE_CACHE) {
2304 					if (sc->sc_quirks & NO_SYNCHRONIZE_CACHE) {
2305 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2306 						ccb->ccb_h.status = CAM_REQ_CMP;
2307 						xpt_done(ccb);
2308 						goto done;
2309 					}
2310 				}
2311 				umass_command_start(sc, dir, ccb->csio.data_ptr,
2312 				    ccb->csio.dxfer_len,
2313 				    ccb->ccb_h.timeout,
2314 				    &umass_cam_cb, ccb);
2315 			}
2316 			break;
2317 		}
2318 	case XPT_PATH_INQ:
2319 		{
2320 			struct ccb_pathinq *cpi = &ccb->cpi;
2321 
2322 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_PATH_INQ:.\n",
2323 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2324 			    ccb->ccb_h.target_lun);
2325 
2326 			/* host specific information */
2327 			cpi->version_num = 1;
2328 			cpi->hba_inquiry = 0;
2329 			cpi->target_sprt = 0;
2330 			cpi->hba_misc = PIM_NO_6_BYTE;
2331 			cpi->hba_eng_cnt = 0;
2332 			cpi->max_target = UMASS_SCSIID_MAX;	/* one target */
2333 			cpi->initiator_id = UMASS_SCSIID_HOST;
2334 			strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2335 			strlcpy(cpi->hba_vid, "USB SCSI", HBA_IDLEN);
2336 			strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2337 			cpi->unit_number = cam_sim_unit(sim);
2338 			cpi->bus_id = sc->sc_unit;
2339 			cpi->protocol = PROTO_SCSI;
2340 			cpi->protocol_version = SCSI_REV_2;
2341 			cpi->transport = XPORT_USB;
2342 			cpi->transport_version = 0;
2343 
2344 			if (sc == NULL) {
2345 				cpi->base_transfer_speed = 0;
2346 				cpi->max_lun = 0;
2347 			} else {
2348 				if (sc->sc_quirks & FLOPPY_SPEED) {
2349 					cpi->base_transfer_speed =
2350 					    UMASS_FLOPPY_TRANSFER_SPEED;
2351 				} else {
2352 					switch (usbd_get_speed(sc->sc_udev)) {
2353 					case USB_SPEED_SUPER:
2354 						cpi->base_transfer_speed =
2355 						    UMASS_SUPER_TRANSFER_SPEED;
2356 						cpi->maxio = MAXPHYS;
2357 						break;
2358 					case USB_SPEED_HIGH:
2359 						cpi->base_transfer_speed =
2360 						    UMASS_HIGH_TRANSFER_SPEED;
2361 						break;
2362 					default:
2363 						cpi->base_transfer_speed =
2364 						    UMASS_FULL_TRANSFER_SPEED;
2365 						break;
2366 					}
2367 				}
2368 				cpi->max_lun = sc->sc_maxlun;
2369 			}
2370 
2371 			cpi->ccb_h.status = CAM_REQ_CMP;
2372 			xpt_done(ccb);
2373 			break;
2374 		}
2375 	case XPT_RESET_DEV:
2376 		{
2377 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_RESET_DEV:.\n",
2378 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2379 			    ccb->ccb_h.target_lun);
2380 
2381 			umass_reset(sc);
2382 
2383 			ccb->ccb_h.status = CAM_REQ_CMP;
2384 			xpt_done(ccb);
2385 			break;
2386 		}
2387 	case XPT_GET_TRAN_SETTINGS:
2388 		{
2389 			struct ccb_trans_settings *cts = &ccb->cts;
2390 
2391 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_GET_TRAN_SETTINGS:.\n",
2392 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2393 			    ccb->ccb_h.target_lun);
2394 
2395 			cts->protocol = PROTO_SCSI;
2396 			cts->protocol_version = SCSI_REV_2;
2397 			cts->transport = XPORT_USB;
2398 			cts->transport_version = 0;
2399 			cts->xport_specific.valid = 0;
2400 
2401 			ccb->ccb_h.status = CAM_REQ_CMP;
2402 			xpt_done(ccb);
2403 			break;
2404 		}
2405 	case XPT_SET_TRAN_SETTINGS:
2406 		{
2407 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SET_TRAN_SETTINGS:.\n",
2408 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2409 			    ccb->ccb_h.target_lun);
2410 
2411 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2412 			xpt_done(ccb);
2413 			break;
2414 		}
2415 	case XPT_CALC_GEOMETRY:
2416 		{
2417 			cam_calc_geometry(&ccb->ccg, /* extended */ 1);
2418 			xpt_done(ccb);
2419 			break;
2420 		}
2421 	case XPT_NOOP:
2422 		{
2423 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_NOOP:.\n",
2424 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2425 			    ccb->ccb_h.target_lun);
2426 
2427 			ccb->ccb_h.status = CAM_REQ_CMP;
2428 			xpt_done(ccb);
2429 			break;
2430 		}
2431 	default:
2432 		DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:func_code 0x%04x: "
2433 		    "Not implemented\n",
2434 		    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2435 		    ccb->ccb_h.target_lun, ccb->ccb_h.func_code);
2436 
2437 		ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2438 		xpt_done(ccb);
2439 		break;
2440 	}
2441 
2442 done:
2443 	return;
2444 }
2445 
2446 static void
2447 umass_cam_poll(struct cam_sim *sim)
2448 {
2449 	struct umass_softc *sc = (struct umass_softc *)sim->softc;
2450 
2451 	if (sc == UMASS_GONE)
2452 		return;
2453 
2454 	DPRINTF(sc, UDMASS_SCSI, "CAM poll\n");
2455 
2456 	usbd_transfer_poll(sc->sc_xfer, UMASS_T_MAX);
2457 }
2458 
2459 
2460 /* umass_cam_cb
2461  *	finalise a completed CAM command
2462  */
2463 
2464 static void
2465 umass_cam_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2466     uint8_t status)
2467 {
2468 	ccb->csio.resid = residue;
2469 
2470 	switch (status) {
2471 	case STATUS_CMD_OK:
2472 		ccb->ccb_h.status = CAM_REQ_CMP;
2473 		if ((sc->sc_quirks & READ_CAPACITY_OFFBY1) &&
2474 		    (ccb->ccb_h.func_code == XPT_SCSI_IO) &&
2475 		    (ccb->csio.cdb_io.cdb_bytes[0] == READ_CAPACITY)) {
2476 			struct scsi_read_capacity_data *rcap;
2477 			uint32_t maxsector;
2478 
2479 			rcap = (void *)(ccb->csio.data_ptr);
2480 			maxsector = scsi_4btoul(rcap->addr) - 1;
2481 			scsi_ulto4b(maxsector, rcap->addr);
2482 		}
2483 		/*
2484 		 * We have to add SVPD_UNIT_SERIAL_NUMBER to the list
2485 		 * of pages supported by the device - otherwise, CAM
2486 		 * will never ask us for the serial number if the
2487 		 * device cannot handle that by itself.
2488 		 */
2489 		if (ccb->ccb_h.func_code == XPT_SCSI_IO &&
2490 		    sc->sc_transfer.cmd_data[0] == INQUIRY &&
2491 		    (sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2492 		    sc->sc_transfer.cmd_data[2] == SVPD_SUPPORTED_PAGE_LIST &&
2493 		    (usb_get_serial(sc->sc_udev)[0] != '\0')) {
2494 			struct ccb_scsiio *csio;
2495 			struct scsi_vpd_supported_page_list *page_list;
2496 
2497 			csio = &ccb->csio;
2498 			page_list = (struct scsi_vpd_supported_page_list *)csio->data_ptr;
2499 			if (page_list->length + 1 < SVPD_SUPPORTED_PAGES_SIZE) {
2500 				page_list->list[page_list->length] = SVPD_UNIT_SERIAL_NUMBER;
2501 				page_list->length++;
2502 			}
2503 		}
2504 		xpt_done(ccb);
2505 		break;
2506 
2507 	case STATUS_CMD_UNKNOWN:
2508 	case STATUS_CMD_FAILED:
2509 
2510 		/* fetch sense data */
2511 
2512 		/* the rest of the command was filled in at attach */
2513 		sc->cam_scsi_sense.length = ccb->csio.sense_len;
2514 
2515 		DPRINTF(sc, UDMASS_SCSI, "Fetching %d bytes of "
2516 		    "sense data\n", ccb->csio.sense_len);
2517 
2518 		if (umass_std_transform(sc, ccb, &sc->cam_scsi_sense.opcode,
2519 		    sizeof(sc->cam_scsi_sense))) {
2520 
2521 			if ((sc->sc_quirks & FORCE_SHORT_INQUIRY) &&
2522 			    (sc->sc_transfer.cmd_data[0] == INQUIRY)) {
2523 				ccb->csio.sense_len = SHORT_INQUIRY_LENGTH;
2524 			}
2525 			umass_command_start(sc, DIR_IN, &ccb->csio.sense_data.error_code,
2526 			    ccb->csio.sense_len, ccb->ccb_h.timeout,
2527 			    &umass_cam_sense_cb, ccb);
2528 		}
2529 		break;
2530 
2531 	default:
2532 		/*
2533 		 * The wire protocol failed and will hopefully have
2534 		 * recovered. We return an error to CAM and let CAM
2535 		 * retry the command if necessary.
2536 		 */
2537 		ccb->ccb_h.status = CAM_REQ_CMP_ERR;
2538 		xpt_done(ccb);
2539 		break;
2540 	}
2541 }
2542 
2543 /*
2544  * Finalise a completed autosense operation
2545  */
2546 static void
2547 umass_cam_sense_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2548     uint8_t status)
2549 {
2550 	uint8_t *cmd;
2551 
2552 	switch (status) {
2553 	case STATUS_CMD_OK:
2554 	case STATUS_CMD_UNKNOWN:
2555 	case STATUS_CMD_FAILED: {
2556 		int key, sense_len;
2557 
2558 		ccb->csio.sense_resid = residue;
2559 		sense_len = ccb->csio.sense_len - ccb->csio.sense_resid;
2560 		key = scsi_get_sense_key(&ccb->csio.sense_data, sense_len,
2561 					 /*show_errors*/ 1);
2562 
2563 		if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2564 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2565 		} else {
2566 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2567 		}
2568 
2569 		/*
2570 		 * Getting sense data always succeeds (apart from wire
2571 		 * failures):
2572 		 */
2573 		if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2574 		    (cmd[0] == INQUIRY) &&
2575 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2576 			/*
2577 			 * Ignore unit attention errors in the case where
2578 			 * the Unit Attention state is not cleared on
2579 			 * REQUEST SENSE. They will appear again at the next
2580 			 * command.
2581 			 */
2582 			ccb->ccb_h.status = CAM_REQ_CMP;
2583 		} else if (key == SSD_KEY_NO_SENSE) {
2584 			/*
2585 			 * No problem after all (in the case of CBI without
2586 			 * CCI)
2587 			 */
2588 			ccb->ccb_h.status = CAM_REQ_CMP;
2589 		} else if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2590 			    (cmd[0] == READ_CAPACITY) &&
2591 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2592 			/*
2593 			 * Some devices do not clear the unit attention error
2594 			 * on request sense. We insert a test unit ready
2595 			 * command to make sure we clear the unit attention
2596 			 * condition, then allow the retry to proceed as
2597 			 * usual.
2598 			 */
2599 
2600 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2601 			    | CAM_AUTOSNS_VALID;
2602 			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2603 
2604 #if 0
2605 			DELAY(300000);
2606 #endif
2607 			DPRINTF(sc, UDMASS_SCSI, "Doing a sneaky"
2608 			    "TEST_UNIT_READY\n");
2609 
2610 			/* the rest of the command was filled in at attach */
2611 
2612 			if (umass_std_transform(sc, ccb,
2613 			    &sc->cam_scsi_test_unit_ready.opcode,
2614 			    sizeof(sc->cam_scsi_test_unit_ready))) {
2615 				umass_command_start(sc, DIR_NONE, NULL, 0,
2616 				    ccb->ccb_h.timeout,
2617 				    &umass_cam_quirk_cb, ccb);
2618 			}
2619 			break;
2620 		} else {
2621 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2622 			    | CAM_AUTOSNS_VALID;
2623 			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2624 		}
2625 		xpt_done(ccb);
2626 		break;
2627 	}
2628 	default:
2629 		DPRINTF(sc, UDMASS_SCSI, "Autosense failed, "
2630 		    "status %d\n", status);
2631 		ccb->ccb_h.status = CAM_AUTOSENSE_FAIL;
2632 		xpt_done(ccb);
2633 	}
2634 }
2635 
2636 /*
2637  * This completion code just handles the fact that we sent a test-unit-ready
2638  * after having previously failed a READ CAPACITY with CHECK_COND.  Even
2639  * though this command succeeded, we have to tell CAM to retry.
2640  */
2641 static void
2642 umass_cam_quirk_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2643     uint8_t status)
2644 {
2645 	DPRINTF(sc, UDMASS_SCSI, "Test unit ready "
2646 	    "returned status %d\n", status);
2647 
2648 	ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2649 	    | CAM_AUTOSNS_VALID;
2650 	ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2651 	xpt_done(ccb);
2652 }
2653 
2654 /*
2655  * SCSI specific functions
2656  */
2657 
2658 static uint8_t
2659 umass_scsi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2660     uint8_t cmd_len)
2661 {
2662 	if ((cmd_len == 0) ||
2663 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2664 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2665 		    "length: %d bytes\n", cmd_len);
2666 		return (0);		/* failure */
2667 	}
2668 	sc->sc_transfer.cmd_len = cmd_len;
2669 
2670 	switch (cmd_ptr[0]) {
2671 	case TEST_UNIT_READY:
2672 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2673 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2674 			    "to START_UNIT\n");
2675 			memset(sc->sc_transfer.cmd_data, 0, cmd_len);
2676 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2677 			sc->sc_transfer.cmd_data[4] = SSS_START;
2678 			return (1);
2679 		}
2680 		break;
2681 
2682 	case INQUIRY:
2683 		/*
2684 		 * some drives wedge when asked for full inquiry
2685 		 * information.
2686 		 */
2687 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2688 			memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2689 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2690 			return (1);
2691 		}
2692 		break;
2693 	}
2694 
2695 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2696 	return (1);
2697 }
2698 
2699 static uint8_t
2700 umass_rbc_transform(struct umass_softc *sc, uint8_t *cmd_ptr, uint8_t cmd_len)
2701 {
2702 	if ((cmd_len == 0) ||
2703 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2704 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2705 		    "length: %d bytes\n", cmd_len);
2706 		return (0);		/* failure */
2707 	}
2708 	switch (cmd_ptr[0]) {
2709 		/* these commands are defined in RBC: */
2710 	case READ_10:
2711 	case READ_CAPACITY:
2712 	case START_STOP_UNIT:
2713 	case SYNCHRONIZE_CACHE:
2714 	case WRITE_10:
2715 	case 0x2f:			/* VERIFY_10 is absent from
2716 					 * scsi_all.h??? */
2717 	case INQUIRY:
2718 	case MODE_SELECT_10:
2719 	case MODE_SENSE_10:
2720 	case TEST_UNIT_READY:
2721 	case WRITE_BUFFER:
2722 		/*
2723 		 * The following commands are not listed in my copy of the
2724 		 * RBC specs. CAM however seems to want those, and at least
2725 		 * the Sony DSC device appears to support those as well
2726 		 */
2727 	case REQUEST_SENSE:
2728 	case PREVENT_ALLOW:
2729 
2730 		memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2731 
2732 		if ((sc->sc_quirks & RBC_PAD_TO_12) && (cmd_len < 12)) {
2733 			memset(sc->sc_transfer.cmd_data + cmd_len,
2734 			    0, 12 - cmd_len);
2735 			cmd_len = 12;
2736 		}
2737 		sc->sc_transfer.cmd_len = cmd_len;
2738 		return (1);		/* sucess */
2739 
2740 		/* All other commands are not legal in RBC */
2741 	default:
2742 		DPRINTF(sc, UDMASS_SCSI, "Unsupported RBC "
2743 		    "command 0x%02x\n", cmd_ptr[0]);
2744 		return (0);		/* failure */
2745 	}
2746 }
2747 
2748 static uint8_t
2749 umass_ufi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2750     uint8_t cmd_len)
2751 {
2752 	if ((cmd_len == 0) ||
2753 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2754 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2755 		    "length: %d bytes\n", cmd_len);
2756 		return (0);		/* failure */
2757 	}
2758 	/* An UFI command is always 12 bytes in length */
2759 	sc->sc_transfer.cmd_len = UFI_COMMAND_LENGTH;
2760 
2761 	/* Zero the command data */
2762 	memset(sc->sc_transfer.cmd_data, 0, UFI_COMMAND_LENGTH);
2763 
2764 	switch (cmd_ptr[0]) {
2765 		/*
2766 		 * Commands of which the format has been verified. They
2767 		 * should work. Copy the command into the (zeroed out)
2768 		 * destination buffer.
2769 		 */
2770 	case TEST_UNIT_READY:
2771 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2772 			/*
2773 			 * Some devices do not support this command. Start
2774 			 * Stop Unit should give the same results
2775 			 */
2776 			DPRINTF(sc, UDMASS_UFI, "Converted TEST_UNIT_READY "
2777 			    "to START_UNIT\n");
2778 
2779 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2780 			sc->sc_transfer.cmd_data[4] = SSS_START;
2781 			return (1);
2782 		}
2783 		break;
2784 
2785 	case REZERO_UNIT:
2786 	case REQUEST_SENSE:
2787 	case FORMAT_UNIT:
2788 	case INQUIRY:
2789 	case START_STOP_UNIT:
2790 	case SEND_DIAGNOSTIC:
2791 	case PREVENT_ALLOW:
2792 	case READ_CAPACITY:
2793 	case READ_10:
2794 	case WRITE_10:
2795 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2796 	case WRITE_AND_VERIFY:
2797 	case VERIFY:
2798 	case MODE_SELECT_10:
2799 	case MODE_SENSE_10:
2800 	case READ_12:
2801 	case WRITE_12:
2802 	case READ_FORMAT_CAPACITIES:
2803 		break;
2804 
2805 		/*
2806 		 * SYNCHRONIZE_CACHE isn't supported by UFI, nor should it be
2807 		 * required for UFI devices, so it is appropriate to fake
2808 		 * success.
2809 		 */
2810 	case SYNCHRONIZE_CACHE:
2811 		return (2);
2812 
2813 	default:
2814 		DPRINTF(sc, UDMASS_SCSI, "Unsupported UFI "
2815 		    "command 0x%02x\n", cmd_ptr[0]);
2816 		return (0);		/* failure */
2817 	}
2818 
2819 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2820 	return (1);			/* success */
2821 }
2822 
2823 /*
2824  * 8070i (ATAPI) specific functions
2825  */
2826 static uint8_t
2827 umass_atapi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2828     uint8_t cmd_len)
2829 {
2830 	if ((cmd_len == 0) ||
2831 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2832 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2833 		    "length: %d bytes\n", cmd_len);
2834 		return (0);		/* failure */
2835 	}
2836 	/* An ATAPI command is always 12 bytes in length. */
2837 	sc->sc_transfer.cmd_len = ATAPI_COMMAND_LENGTH;
2838 
2839 	/* Zero the command data */
2840 	memset(sc->sc_transfer.cmd_data, 0, ATAPI_COMMAND_LENGTH);
2841 
2842 	switch (cmd_ptr[0]) {
2843 		/*
2844 		 * Commands of which the format has been verified. They
2845 		 * should work. Copy the command into the destination
2846 		 * buffer.
2847 		 */
2848 	case INQUIRY:
2849 		/*
2850 		 * some drives wedge when asked for full inquiry
2851 		 * information.
2852 		 */
2853 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2854 			memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2855 
2856 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2857 			return (1);
2858 		}
2859 		break;
2860 
2861 	case TEST_UNIT_READY:
2862 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2863 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2864 			    "to START_UNIT\n");
2865 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2866 			sc->sc_transfer.cmd_data[4] = SSS_START;
2867 			return (1);
2868 		}
2869 		break;
2870 
2871 	case REZERO_UNIT:
2872 	case REQUEST_SENSE:
2873 	case START_STOP_UNIT:
2874 	case SEND_DIAGNOSTIC:
2875 	case PREVENT_ALLOW:
2876 	case READ_CAPACITY:
2877 	case READ_10:
2878 	case WRITE_10:
2879 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2880 	case SYNCHRONIZE_CACHE:
2881 	case MODE_SELECT_10:
2882 	case MODE_SENSE_10:
2883 	case READ_BUFFER:
2884 	case 0x42:			/* READ_SUBCHANNEL */
2885 	case 0x43:			/* READ_TOC */
2886 	case 0x44:			/* READ_HEADER */
2887 	case 0x47:			/* PLAY_MSF (Play Minute/Second/Frame) */
2888 	case 0x48:			/* PLAY_TRACK */
2889 	case 0x49:			/* PLAY_TRACK_REL */
2890 	case 0x4b:			/* PAUSE */
2891 	case 0x51:			/* READ_DISK_INFO */
2892 	case 0x52:			/* READ_TRACK_INFO */
2893 	case 0x54:			/* SEND_OPC */
2894 	case 0x59:			/* READ_MASTER_CUE */
2895 	case 0x5b:			/* CLOSE_TR_SESSION */
2896 	case 0x5c:			/* READ_BUFFER_CAP */
2897 	case 0x5d:			/* SEND_CUE_SHEET */
2898 	case 0xa1:			/* BLANK */
2899 	case 0xa5:			/* PLAY_12 */
2900 	case 0xa6:			/* EXCHANGE_MEDIUM */
2901 	case 0xad:			/* READ_DVD_STRUCTURE */
2902 	case 0xbb:			/* SET_CD_SPEED */
2903 	case 0xe5:			/* READ_TRACK_INFO_PHILIPS */
2904 		break;
2905 
2906 	case READ_12:
2907 	case WRITE_12:
2908 	default:
2909 		DPRINTF(sc, UDMASS_SCSI, "Unsupported ATAPI "
2910 		    "command 0x%02x - trying anyway\n",
2911 		    cmd_ptr[0]);
2912 		break;
2913 	}
2914 
2915 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2916 	return (1);			/* success */
2917 }
2918 
2919 static uint8_t
2920 umass_no_transform(struct umass_softc *sc, uint8_t *cmd,
2921     uint8_t cmdlen)
2922 {
2923 	return (0);			/* failure */
2924 }
2925 
2926 static uint8_t
2927 umass_std_transform(struct umass_softc *sc, union ccb *ccb,
2928     uint8_t *cmd, uint8_t cmdlen)
2929 {
2930 	uint8_t retval;
2931 
2932 	retval = (sc->sc_transform) (sc, cmd, cmdlen);
2933 
2934 	if (retval == 2) {
2935 		ccb->ccb_h.status = CAM_REQ_CMP;
2936 		xpt_done(ccb);
2937 		return (0);
2938 	} else if (retval == 0) {
2939 		ccb->ccb_h.status = CAM_REQ_INVALID;
2940 		xpt_done(ccb);
2941 		return (0);
2942 	}
2943 	/* Command should be executed */
2944 	return (1);
2945 }
2946 
2947 #ifdef USB_DEBUG
2948 static void
2949 umass_bbb_dump_cbw(struct umass_softc *sc, umass_bbb_cbw_t *cbw)
2950 {
2951 	uint8_t *c = cbw->CBWCDB;
2952 
2953 	uint32_t dlen = UGETDW(cbw->dCBWDataTransferLength);
2954 	uint32_t tag = UGETDW(cbw->dCBWTag);
2955 
2956 	uint8_t clen = cbw->bCDBLength;
2957 	uint8_t flags = cbw->bCBWFlags;
2958 	uint8_t lun = cbw->bCBWLUN;
2959 
2960 	DPRINTF(sc, UDMASS_BBB, "CBW %d: cmd = %db "
2961 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
2962 	    "data = %db, lun = %d, dir = %s\n",
2963 	    tag, clen,
2964 	    c[0], c[1], c[2], c[3], c[4], c[5], (clen > 6 ? "..." : ""),
2965 	    dlen, lun, (flags == CBWFLAGS_IN ? "in" :
2966 	    (flags == CBWFLAGS_OUT ? "out" : "<invalid>")));
2967 }
2968 
2969 static void
2970 umass_bbb_dump_csw(struct umass_softc *sc, umass_bbb_csw_t *csw)
2971 {
2972 	uint32_t sig = UGETDW(csw->dCSWSignature);
2973 	uint32_t tag = UGETDW(csw->dCSWTag);
2974 	uint32_t res = UGETDW(csw->dCSWDataResidue);
2975 	uint8_t status = csw->bCSWStatus;
2976 
2977 	DPRINTF(sc, UDMASS_BBB, "CSW %d: sig = 0x%08x (%s), tag = 0x%08x, "
2978 	    "res = %d, status = 0x%02x (%s)\n",
2979 	    tag, sig, (sig == CSWSIGNATURE ? "valid" : "invalid"),
2980 	    tag, res,
2981 	    status, (status == CSWSTATUS_GOOD ? "good" :
2982 	    (status == CSWSTATUS_FAILED ? "failed" :
2983 	    (status == CSWSTATUS_PHASE ? "phase" : "<invalid>"))));
2984 }
2985 
2986 static void
2987 umass_cbi_dump_cmd(struct umass_softc *sc, void *cmd, uint8_t cmdlen)
2988 {
2989 	uint8_t *c = cmd;
2990 	uint8_t dir = sc->sc_transfer.dir;
2991 
2992 	DPRINTF(sc, UDMASS_BBB, "cmd = %db "
2993 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
2994 	    "data = %db, dir = %s\n",
2995 	    cmdlen,
2996 	    c[0], c[1], c[2], c[3], c[4], c[5], (cmdlen > 6 ? "..." : ""),
2997 	    sc->sc_transfer.data_len,
2998 	    (dir == DIR_IN ? "in" :
2999 	    (dir == DIR_OUT ? "out" :
3000 	    (dir == DIR_NONE ? "no data phase" : "<invalid>"))));
3001 }
3002 
3003 static void
3004 umass_dump_buffer(struct umass_softc *sc, uint8_t *buffer, uint32_t buflen,
3005     uint32_t printlen)
3006 {
3007 	uint32_t i, j;
3008 	char s1[40];
3009 	char s2[40];
3010 	char s3[5];
3011 
3012 	s1[0] = '\0';
3013 	s3[0] = '\0';
3014 
3015 	sprintf(s2, " buffer=%p, buflen=%d", buffer, buflen);
3016 	for (i = 0; (i < buflen) && (i < printlen); i++) {
3017 		j = i % 16;
3018 		if (j == 0 && i != 0) {
3019 			DPRINTF(sc, UDMASS_GEN, "0x %s%s\n",
3020 			    s1, s2);
3021 			s2[0] = '\0';
3022 		}
3023 		sprintf(&s1[j * 2], "%02x", buffer[i] & 0xff);
3024 	}
3025 	if (buflen > printlen)
3026 		sprintf(s3, " ...");
3027 	DPRINTF(sc, UDMASS_GEN, "0x %s%s%s\n",
3028 	    s1, s2, s3);
3029 }
3030 
3031 #endif
3032