xref: /freebsd/sys/dev/usb/storage/umass.c (revision b3e7694832e81d7a904a10f525f8797b753bf0d3)
1 #include <sys/cdefs.h>
2 __FBSDID("$FreeBSD$");
3 
4 /*-
5  * SPDX-License-Identifier: BSD-2-Clause
6  *
7  * Copyright (c) 1999 MAEKAWA Masahide <bishop@rr.iij4u.or.jp>,
8  *		      Nick Hibma <n_hibma@FreeBSD.org>
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *	$NetBSD: umass.c,v 1.28 2000/04/02 23:46:53 augustss Exp $
32  */
33 
34 /* Also already merged from NetBSD:
35  *	$NetBSD: umass.c,v 1.67 2001/11/25 19:05:22 augustss Exp $
36  *	$NetBSD: umass.c,v 1.90 2002/11/04 19:17:33 pooka Exp $
37  *	$NetBSD: umass.c,v 1.108 2003/11/07 17:03:25 wiz Exp $
38  *	$NetBSD: umass.c,v 1.109 2003/12/04 13:57:31 keihan Exp $
39  */
40 
41 /*
42  * Universal Serial Bus Mass Storage Class specs:
43  * http://www.usb.org/developers/devclass_docs/usb_msc_overview_1.2.pdf
44  * http://www.usb.org/developers/devclass_docs/usbmassbulk_10.pdf
45  * http://www.usb.org/developers/devclass_docs/usb_msc_cbi_1.1.pdf
46  * http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf
47  */
48 
49 /*
50  * Ported to NetBSD by Lennart Augustsson <augustss@NetBSD.org>.
51  * Parts of the code written by Jason R. Thorpe <thorpej@shagadelic.org>.
52  */
53 
54 /*
55  * The driver handles 3 Wire Protocols
56  * - Command/Bulk/Interrupt (CBI)
57  * - Command/Bulk/Interrupt with Command Completion Interrupt (CBI with CCI)
58  * - Mass Storage Bulk-Only (BBB)
59  *   (BBB refers Bulk/Bulk/Bulk for Command/Data/Status phases)
60  *
61  * Over these wire protocols it handles the following command protocols
62  * - SCSI
63  * - UFI (floppy command set)
64  * - 8070i (ATAPI)
65  *
66  * UFI and 8070i (ATAPI) are transformed versions of the SCSI command set. The
67  * sc->sc_transform method is used to convert the commands into the appropriate
68  * format (if at all necessary). For example, UFI requires all commands to be
69  * 12 bytes in length amongst other things.
70  *
71  * The source code below is marked and can be split into a number of pieces
72  * (in this order):
73  *
74  * - probe/attach/detach
75  * - generic transfer routines
76  * - BBB
77  * - CBI
78  * - CBI_I (in addition to functions from CBI)
79  * - CAM (Common Access Method)
80  * - SCSI
81  * - UFI
82  * - 8070i (ATAPI)
83  *
84  * The protocols are implemented using a state machine, for the transfers as
85  * well as for the resets. The state machine is contained in umass_t_*_callback.
86  * The state machine is started through either umass_command_start() or
87  * umass_reset().
88  *
89  * The reason for doing this is a) CAM performs a lot better this way and b) it
90  * avoids using tsleep from interrupt context (for example after a failed
91  * transfer).
92  */
93 
94 /*
95  * The SCSI related part of this driver has been derived from the
96  * dev/ppbus/vpo.c driver, by Nicolas Souchu (nsouch@FreeBSD.org).
97  *
98  * The CAM layer uses so called actions which are messages sent to the host
99  * adapter for completion. The actions come in through umass_cam_action. The
100  * appropriate block of routines is called depending on the transport protocol
101  * in use. When the transfer has finished, these routines call
102  * umass_cam_cb again to complete the CAM command.
103  */
104 
105 #include <sys/stdint.h>
106 #include <sys/stddef.h>
107 #include <sys/param.h>
108 #include <sys/queue.h>
109 #include <sys/types.h>
110 #include <sys/systm.h>
111 #include <sys/kernel.h>
112 #include <sys/bus.h>
113 #include <sys/module.h>
114 #include <sys/lock.h>
115 #include <sys/mutex.h>
116 #include <sys/condvar.h>
117 #include <sys/sysctl.h>
118 #include <sys/sx.h>
119 #include <sys/unistd.h>
120 #include <sys/callout.h>
121 #include <sys/malloc.h>
122 #include <sys/priv.h>
123 
124 #include <dev/usb/usb.h>
125 #include <dev/usb/usbdi.h>
126 #include <dev/usb/usbdi_util.h>
127 #include "usbdevs.h"
128 
129 #include <dev/usb/quirk/usb_quirk.h>
130 
131 #include <cam/cam.h>
132 #include <cam/cam_ccb.h>
133 #include <cam/cam_sim.h>
134 #include <cam/cam_xpt_sim.h>
135 #include <cam/scsi/scsi_all.h>
136 #include <cam/scsi/scsi_da.h>
137 
138 #include <cam/cam_periph.h>
139 
140 #ifdef USB_DEBUG
141 #define	DIF(m, x)				\
142   do {						\
143     if (umass_debug & (m)) { x ; }		\
144   } while (0)
145 
146 #define	DPRINTF(sc, m, fmt, ...)			\
147   do {							\
148     if (umass_debug & (m)) {				\
149         printf("%s:%s: " fmt,				\
150 	       (sc) ? (const char *)(sc)->sc_name :	\
151 	       (const char *)"umassX",			\
152 		__FUNCTION__ ,## __VA_ARGS__);		\
153     }							\
154   } while (0)
155 
156 #define	UDMASS_GEN	0x00010000	/* general */
157 #define	UDMASS_SCSI	0x00020000	/* scsi */
158 #define	UDMASS_UFI	0x00040000	/* ufi command set */
159 #define	UDMASS_ATAPI	0x00080000	/* 8070i command set */
160 #define	UDMASS_CMD	(UDMASS_SCSI|UDMASS_UFI|UDMASS_ATAPI)
161 #define	UDMASS_USB	0x00100000	/* USB general */
162 #define	UDMASS_BBB	0x00200000	/* Bulk-Only transfers */
163 #define	UDMASS_CBI	0x00400000	/* CBI transfers */
164 #define	UDMASS_WIRE	(UDMASS_BBB|UDMASS_CBI)
165 #define	UDMASS_ALL	0xffff0000	/* all of the above */
166 static int umass_debug;
167 static int umass_throttle;
168 
169 static SYSCTL_NODE(_hw_usb, OID_AUTO, umass, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
170     "USB umass");
171 SYSCTL_INT(_hw_usb_umass, OID_AUTO, debug, CTLFLAG_RWTUN,
172     &umass_debug, 0, "umass debug level");
173 SYSCTL_INT(_hw_usb_umass, OID_AUTO, throttle, CTLFLAG_RWTUN,
174     &umass_throttle, 0, "Forced delay between commands in milliseconds");
175 #else
176 #define	DIF(...) do { } while (0)
177 #define	DPRINTF(...) do { } while (0)
178 #endif
179 
180 #define	UMASS_BULK_SIZE (1 << 17)
181 #define	UMASS_CBI_DIAGNOSTIC_CMDLEN 12	/* bytes */
182 #define	UMASS_MAX_CMDLEN MAX(12, CAM_MAX_CDBLEN)	/* bytes */
183 
184 /* USB transfer definitions */
185 
186 #define	UMASS_T_BBB_RESET1      0	/* Bulk-Only */
187 #define	UMASS_T_BBB_RESET2      1
188 #define	UMASS_T_BBB_RESET3      2
189 #define	UMASS_T_BBB_COMMAND     3
190 #define	UMASS_T_BBB_DATA_READ   4
191 #define	UMASS_T_BBB_DATA_RD_CS  5
192 #define	UMASS_T_BBB_DATA_WRITE  6
193 #define	UMASS_T_BBB_DATA_WR_CS  7
194 #define	UMASS_T_BBB_STATUS      8
195 #define	UMASS_T_BBB_MAX         9
196 
197 #define	UMASS_T_CBI_RESET1      0	/* CBI */
198 #define	UMASS_T_CBI_RESET2      1
199 #define	UMASS_T_CBI_RESET3      2
200 #define	UMASS_T_CBI_COMMAND     3
201 #define	UMASS_T_CBI_DATA_READ   4
202 #define	UMASS_T_CBI_DATA_RD_CS  5
203 #define	UMASS_T_CBI_DATA_WRITE  6
204 #define	UMASS_T_CBI_DATA_WR_CS  7
205 #define	UMASS_T_CBI_STATUS      8
206 #define	UMASS_T_CBI_RESET4      9
207 #define	UMASS_T_CBI_MAX        10
208 
209 #define	UMASS_T_MAX MAX(UMASS_T_CBI_MAX, UMASS_T_BBB_MAX)
210 
211 /* Generic definitions */
212 
213 /* Direction for transfer */
214 #define	DIR_NONE	0
215 #define	DIR_IN		1
216 #define	DIR_OUT		2
217 
218 /* device name */
219 #define	DEVNAME		"umass"
220 #define	DEVNAME_SIM	"umass-sim"
221 
222 /* Approximate maximum transfer speeds (assumes 33% overhead). */
223 #define	UMASS_FULL_TRANSFER_SPEED	1000
224 #define	UMASS_HIGH_TRANSFER_SPEED	40000
225 #define	UMASS_SUPER_TRANSFER_SPEED	400000
226 #define	UMASS_FLOPPY_TRANSFER_SPEED	20
227 
228 #define	UMASS_TIMEOUT			5000	/* ms */
229 
230 /* CAM specific definitions */
231 
232 #define	UMASS_SCSIID_MAX	1	/* maximum number of drives expected */
233 #define	UMASS_SCSIID_HOST	UMASS_SCSIID_MAX
234 
235 /* Bulk-Only features */
236 
237 #define	UR_BBB_RESET		0xff	/* Bulk-Only reset */
238 #define	UR_BBB_GET_MAX_LUN	0xfe	/* Get maximum lun */
239 
240 /* Command Block Wrapper */
241 typedef struct {
242 	uDWord	dCBWSignature;
243 #define	CBWSIGNATURE	0x43425355
244 	uDWord	dCBWTag;
245 	uDWord	dCBWDataTransferLength;
246 	uByte	bCBWFlags;
247 #define	CBWFLAGS_OUT	0x00
248 #define	CBWFLAGS_IN	0x80
249 	uByte	bCBWLUN;
250 	uByte	bCDBLength;
251 #define	CBWCDBLENGTH	16
252 	uByte	CBWCDB[CBWCDBLENGTH];
253 } __packed umass_bbb_cbw_t;
254 
255 #define	UMASS_BBB_CBW_SIZE	31
256 
257 /* Command Status Wrapper */
258 typedef struct {
259 	uDWord	dCSWSignature;
260 #define	CSWSIGNATURE	0x53425355
261 #define	CSWSIGNATURE_IMAGINATION_DBX1	0x43425355
262 #define	CSWSIGNATURE_OLYMPUS_C1	0x55425355
263 	uDWord	dCSWTag;
264 	uDWord	dCSWDataResidue;
265 	uByte	bCSWStatus;
266 #define	CSWSTATUS_GOOD	0x0
267 #define	CSWSTATUS_FAILED	0x1
268 #define	CSWSTATUS_PHASE	0x2
269 } __packed umass_bbb_csw_t;
270 
271 #define	UMASS_BBB_CSW_SIZE	13
272 
273 /* CBI features */
274 
275 #define	UR_CBI_ADSC	0x00
276 
277 typedef union {
278 	struct {
279 		uint8_t	type;
280 #define	IDB_TYPE_CCI		0x00
281 		uint8_t	value;
282 #define	IDB_VALUE_PASS		0x00
283 #define	IDB_VALUE_FAIL		0x01
284 #define	IDB_VALUE_PHASE		0x02
285 #define	IDB_VALUE_PERSISTENT	0x03
286 #define	IDB_VALUE_STATUS_MASK	0x03
287 	} __packed common;
288 
289 	struct {
290 		uint8_t	asc;
291 		uint8_t	ascq;
292 	} __packed ufi;
293 } __packed umass_cbi_sbl_t;
294 
295 struct umass_softc;			/* see below */
296 
297 typedef void (umass_callback_t)(struct umass_softc *sc, union ccb *ccb,
298     	uint32_t residue, uint8_t status);
299 
300 #define	STATUS_CMD_OK		0	/* everything ok */
301 #define	STATUS_CMD_UNKNOWN	1	/* will have to fetch sense */
302 #define	STATUS_CMD_FAILED	2	/* transfer was ok, command failed */
303 #define	STATUS_WIRE_FAILED	3	/* couldn't even get command across */
304 
305 typedef uint8_t (umass_transform_t)(struct umass_softc *sc, uint8_t *cmd_ptr,
306     	uint8_t cmd_len);
307 
308 /* Wire and command protocol */
309 #define	UMASS_PROTO_BBB		0x0001	/* USB wire protocol */
310 #define	UMASS_PROTO_CBI		0x0002
311 #define	UMASS_PROTO_CBI_I	0x0004
312 #define	UMASS_PROTO_WIRE	0x00ff	/* USB wire protocol mask */
313 #define	UMASS_PROTO_SCSI	0x0100	/* command protocol */
314 #define	UMASS_PROTO_ATAPI	0x0200
315 #define	UMASS_PROTO_UFI		0x0400
316 #define	UMASS_PROTO_RBC		0x0800
317 #define	UMASS_PROTO_COMMAND	0xff00	/* command protocol mask */
318 
319 /* Device specific quirks */
320 #define	NO_QUIRKS		0x0000
321 	/*
322 	 * The drive does not support Test Unit Ready. Convert to Start Unit
323 	 */
324 #define	NO_TEST_UNIT_READY	0x0001
325 	/*
326 	 * The drive does not reset the Unit Attention state after REQUEST
327 	 * SENSE has been sent. The INQUIRY command does not reset the UA
328 	 * either, and so CAM runs in circles trying to retrieve the initial
329 	 * INQUIRY data.
330 	 */
331 #define	RS_NO_CLEAR_UA		0x0002
332 	/* The drive does not support START STOP.  */
333 #define	NO_START_STOP		0x0004
334 	/* Don't ask for full inquiry data (255b).  */
335 #define	FORCE_SHORT_INQUIRY	0x0008
336 	/* Needs to be initialised the Shuttle way */
337 #define	SHUTTLE_INIT		0x0010
338 	/* Drive needs to be switched to alternate iface 1 */
339 #define	ALT_IFACE_1		0x0020
340 	/* Drive does not do 1Mb/s, but just floppy speeds (20kb/s) */
341 #define	FLOPPY_SPEED		0x0040
342 	/* The device can't count and gets the residue of transfers wrong */
343 #define	IGNORE_RESIDUE		0x0080
344 	/* No GetMaxLun call */
345 #define	NO_GETMAXLUN		0x0100
346 	/* The device uses a weird CSWSIGNATURE. */
347 #define	WRONG_CSWSIG		0x0200
348 	/* Device cannot handle INQUIRY so fake a generic response */
349 #define	NO_INQUIRY		0x0400
350 	/* Device cannot handle INQUIRY EVPD, return CHECK CONDITION */
351 #define	NO_INQUIRY_EVPD		0x0800
352 	/* Pad all RBC requests to 12 bytes. */
353 #define	RBC_PAD_TO_12		0x1000
354 	/*
355 	 * Device reports number of sectors from READ_CAPACITY, not max
356 	 * sector number.
357 	 */
358 #define	READ_CAPACITY_OFFBY1	0x2000
359 	/*
360 	 * Device cannot handle a SCSI synchronize cache command.  Normally
361 	 * this quirk would be handled in the cam layer, but for IDE bridges
362 	 * we need to associate the quirk with the bridge and not the
363 	 * underlying disk device.  This is handled by faking a success
364 	 * result.
365 	 */
366 #define	NO_SYNCHRONIZE_CACHE	0x4000
367 	/* Device does not support 'PREVENT/ALLOW MEDIUM REMOVAL'. */
368 #define	NO_PREVENT_ALLOW	0x8000
369 
370 struct umass_softc {
371 	struct scsi_sense cam_scsi_sense;
372 	struct scsi_test_unit_ready cam_scsi_test_unit_ready;
373 	struct mtx sc_mtx;
374 	struct {
375 		uint8_t *data_ptr;
376 		union ccb *ccb;
377 		umass_callback_t *callback;
378 
379 		uint32_t data_len;	/* bytes */
380 		uint32_t data_rem;	/* bytes */
381 		uint32_t data_timeout;	/* ms */
382 		uint32_t actlen;	/* bytes */
383 
384 		uint8_t	cmd_data[UMASS_MAX_CMDLEN];
385 		uint8_t	cmd_len;	/* bytes */
386 		uint8_t	dir;
387 		uint8_t	lun;
388 	}	sc_transfer;
389 
390 	/* Bulk specific variables for transfers in progress */
391 	umass_bbb_cbw_t cbw;		/* command block wrapper */
392 	umass_bbb_csw_t csw;		/* command status wrapper */
393 
394 	/* CBI specific variables for transfers in progress */
395 	umass_cbi_sbl_t sbl;		/* status block */
396 
397 	device_t sc_dev;
398 	struct usb_device *sc_udev;
399 	struct cam_sim *sc_sim;		/* SCSI Interface Module */
400 	struct usb_xfer *sc_xfer[UMASS_T_MAX];
401 
402 	/*
403 	 * The command transform function is used to convert the SCSI
404 	 * commands into their derivatives, like UFI, ATAPI, and friends.
405 	 */
406 	umass_transform_t *sc_transform;
407 
408 	uint32_t sc_unit;
409 	uint32_t sc_quirks;		/* they got it almost right */
410 	uint32_t sc_proto;		/* wire and cmd protocol */
411 
412 	uint8_t	sc_name[16];
413 	uint8_t	sc_iface_no;		/* interface number */
414 	uint8_t	sc_maxlun;		/* maximum LUN number, inclusive */
415 	uint8_t	sc_last_xfer_index;
416 	uint8_t	sc_status_try;
417 };
418 
419 struct umass_probe_proto {
420 	uint32_t quirks;
421 	uint32_t proto;
422 
423 	int	error;
424 };
425 
426 /* prototypes */
427 
428 static device_probe_t umass_probe;
429 static device_attach_t umass_attach;
430 static device_detach_t umass_detach;
431 
432 static usb_callback_t umass_tr_error;
433 static usb_callback_t umass_t_bbb_reset1_callback;
434 static usb_callback_t umass_t_bbb_reset2_callback;
435 static usb_callback_t umass_t_bbb_reset3_callback;
436 static usb_callback_t umass_t_bbb_command_callback;
437 static usb_callback_t umass_t_bbb_data_read_callback;
438 static usb_callback_t umass_t_bbb_data_rd_cs_callback;
439 static usb_callback_t umass_t_bbb_data_write_callback;
440 static usb_callback_t umass_t_bbb_data_wr_cs_callback;
441 static usb_callback_t umass_t_bbb_status_callback;
442 static usb_callback_t umass_t_cbi_reset1_callback;
443 static usb_callback_t umass_t_cbi_reset2_callback;
444 static usb_callback_t umass_t_cbi_reset3_callback;
445 static usb_callback_t umass_t_cbi_reset4_callback;
446 static usb_callback_t umass_t_cbi_command_callback;
447 static usb_callback_t umass_t_cbi_data_read_callback;
448 static usb_callback_t umass_t_cbi_data_rd_cs_callback;
449 static usb_callback_t umass_t_cbi_data_write_callback;
450 static usb_callback_t umass_t_cbi_data_wr_cs_callback;
451 static usb_callback_t umass_t_cbi_status_callback;
452 
453 static void	umass_cancel_ccb(struct umass_softc *);
454 static void	umass_init_shuttle(struct umass_softc *);
455 static void	umass_reset(struct umass_softc *);
456 static void	umass_t_bbb_data_clear_stall_callback(struct usb_xfer *,
457 		    uint8_t, uint8_t, usb_error_t);
458 static void	umass_command_start(struct umass_softc *, uint8_t, void *,
459 		    uint32_t, uint32_t, umass_callback_t *, union ccb *);
460 static uint8_t	umass_bbb_get_max_lun(struct umass_softc *);
461 static void	umass_cbi_start_status(struct umass_softc *);
462 static void	umass_t_cbi_data_clear_stall_callback(struct usb_xfer *,
463 		    uint8_t, uint8_t, usb_error_t);
464 static int	umass_cam_attach_sim(struct umass_softc *);
465 static void	umass_cam_attach(struct umass_softc *);
466 static void	umass_cam_detach_sim(struct umass_softc *);
467 static void	umass_cam_action(struct cam_sim *, union ccb *);
468 static void	umass_cam_poll(struct cam_sim *);
469 static void	umass_cam_cb(struct umass_softc *, union ccb *, uint32_t,
470 		    uint8_t);
471 static void	umass_cam_sense_cb(struct umass_softc *, union ccb *, uint32_t,
472 		    uint8_t);
473 static void	umass_cam_quirk_cb(struct umass_softc *, union ccb *, uint32_t,
474 		    uint8_t);
475 static uint8_t	umass_scsi_transform(struct umass_softc *, uint8_t *, uint8_t);
476 static uint8_t	umass_rbc_transform(struct umass_softc *, uint8_t *, uint8_t);
477 static uint8_t	umass_ufi_transform(struct umass_softc *, uint8_t *, uint8_t);
478 static uint8_t	umass_atapi_transform(struct umass_softc *, uint8_t *,
479 		    uint8_t);
480 static uint8_t	umass_no_transform(struct umass_softc *, uint8_t *, uint8_t);
481 static uint8_t	umass_std_transform(struct umass_softc *, union ccb *, uint8_t
482 		    *, uint8_t);
483 
484 #ifdef USB_DEBUG
485 static void	umass_bbb_dump_cbw(struct umass_softc *, umass_bbb_cbw_t *);
486 static void	umass_bbb_dump_csw(struct umass_softc *, umass_bbb_csw_t *);
487 static void	umass_cbi_dump_cmd(struct umass_softc *, void *, uint8_t);
488 static void	umass_dump_buffer(struct umass_softc *, uint8_t *, uint32_t,
489 		    uint32_t);
490 #endif
491 
492 static struct usb_config umass_bbb_config[UMASS_T_BBB_MAX] = {
493 	[UMASS_T_BBB_RESET1] = {
494 		.type = UE_CONTROL,
495 		.endpoint = 0x00,	/* Control pipe */
496 		.direction = UE_DIR_ANY,
497 		.bufsize = sizeof(struct usb_device_request),
498 		.callback = &umass_t_bbb_reset1_callback,
499 		.timeout = 5000,	/* 5 seconds */
500 		.interval = 500,	/* 500 milliseconds */
501 	},
502 
503 	[UMASS_T_BBB_RESET2] = {
504 		.type = UE_CONTROL,
505 		.endpoint = 0x00,	/* Control pipe */
506 		.direction = UE_DIR_ANY,
507 		.bufsize = sizeof(struct usb_device_request),
508 		.callback = &umass_t_bbb_reset2_callback,
509 		.timeout = 5000,	/* 5 seconds */
510 		.interval = 50,	/* 50 milliseconds */
511 	},
512 
513 	[UMASS_T_BBB_RESET3] = {
514 		.type = UE_CONTROL,
515 		.endpoint = 0x00,	/* Control pipe */
516 		.direction = UE_DIR_ANY,
517 		.bufsize = sizeof(struct usb_device_request),
518 		.callback = &umass_t_bbb_reset3_callback,
519 		.timeout = 5000,	/* 5 seconds */
520 		.interval = 50,	/* 50 milliseconds */
521 	},
522 
523 	[UMASS_T_BBB_COMMAND] = {
524 		.type = UE_BULK,
525 		.endpoint = UE_ADDR_ANY,
526 		.direction = UE_DIR_OUT,
527 		.bufsize = sizeof(umass_bbb_cbw_t),
528 		.callback = &umass_t_bbb_command_callback,
529 		.timeout = 5000,	/* 5 seconds */
530 	},
531 
532 	[UMASS_T_BBB_DATA_READ] = {
533 		.type = UE_BULK,
534 		.endpoint = UE_ADDR_ANY,
535 		.direction = UE_DIR_IN,
536 		.bufsize = UMASS_BULK_SIZE,
537 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
538 		.callback = &umass_t_bbb_data_read_callback,
539 		.timeout = 0,	/* overwritten later */
540 	},
541 
542 	[UMASS_T_BBB_DATA_RD_CS] = {
543 		.type = UE_CONTROL,
544 		.endpoint = 0x00,	/* Control pipe */
545 		.direction = UE_DIR_ANY,
546 		.bufsize = sizeof(struct usb_device_request),
547 		.callback = &umass_t_bbb_data_rd_cs_callback,
548 		.timeout = 5000,	/* 5 seconds */
549 	},
550 
551 	[UMASS_T_BBB_DATA_WRITE] = {
552 		.type = UE_BULK,
553 		.endpoint = UE_ADDR_ANY,
554 		.direction = UE_DIR_OUT,
555 		.bufsize = UMASS_BULK_SIZE,
556 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
557 		.callback = &umass_t_bbb_data_write_callback,
558 		.timeout = 0,	/* overwritten later */
559 	},
560 
561 	[UMASS_T_BBB_DATA_WR_CS] = {
562 		.type = UE_CONTROL,
563 		.endpoint = 0x00,	/* Control pipe */
564 		.direction = UE_DIR_ANY,
565 		.bufsize = sizeof(struct usb_device_request),
566 		.callback = &umass_t_bbb_data_wr_cs_callback,
567 		.timeout = 5000,	/* 5 seconds */
568 	},
569 
570 	[UMASS_T_BBB_STATUS] = {
571 		.type = UE_BULK,
572 		.endpoint = UE_ADDR_ANY,
573 		.direction = UE_DIR_IN,
574 		.bufsize = sizeof(umass_bbb_csw_t),
575 		.flags = {.short_xfer_ok = 1,},
576 		.callback = &umass_t_bbb_status_callback,
577 		.timeout = 5000,	/* ms */
578 	},
579 };
580 
581 static struct usb_config umass_cbi_config[UMASS_T_CBI_MAX] = {
582 	[UMASS_T_CBI_RESET1] = {
583 		.type = UE_CONTROL,
584 		.endpoint = 0x00,	/* Control pipe */
585 		.direction = UE_DIR_ANY,
586 		.bufsize = (sizeof(struct usb_device_request) +
587 		    UMASS_CBI_DIAGNOSTIC_CMDLEN),
588 		.callback = &umass_t_cbi_reset1_callback,
589 		.timeout = 5000,	/* 5 seconds */
590 		.interval = 500,	/* 500 milliseconds */
591 	},
592 
593 	[UMASS_T_CBI_RESET2] = {
594 		.type = UE_CONTROL,
595 		.endpoint = 0x00,	/* Control pipe */
596 		.direction = UE_DIR_ANY,
597 		.bufsize = sizeof(struct usb_device_request),
598 		.callback = &umass_t_cbi_reset2_callback,
599 		.timeout = 5000,	/* 5 seconds */
600 		.interval = 50,	/* 50 milliseconds */
601 	},
602 
603 	[UMASS_T_CBI_RESET3] = {
604 		.type = UE_CONTROL,
605 		.endpoint = 0x00,	/* Control pipe */
606 		.direction = UE_DIR_ANY,
607 		.bufsize = sizeof(struct usb_device_request),
608 		.callback = &umass_t_cbi_reset3_callback,
609 		.timeout = 5000,	/* 5 seconds */
610 		.interval = 50,	/* 50 milliseconds */
611 	},
612 
613 	[UMASS_T_CBI_COMMAND] = {
614 		.type = UE_CONTROL,
615 		.endpoint = 0x00,	/* Control pipe */
616 		.direction = UE_DIR_ANY,
617 		.bufsize = (sizeof(struct usb_device_request) +
618 		    UMASS_MAX_CMDLEN),
619 		.callback = &umass_t_cbi_command_callback,
620 		.timeout = 5000,	/* 5 seconds */
621 	},
622 
623 	[UMASS_T_CBI_DATA_READ] = {
624 		.type = UE_BULK,
625 		.endpoint = UE_ADDR_ANY,
626 		.direction = UE_DIR_IN,
627 		.bufsize = UMASS_BULK_SIZE,
628 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
629 		.callback = &umass_t_cbi_data_read_callback,
630 		.timeout = 0,	/* overwritten later */
631 	},
632 
633 	[UMASS_T_CBI_DATA_RD_CS] = {
634 		.type = UE_CONTROL,
635 		.endpoint = 0x00,	/* Control pipe */
636 		.direction = UE_DIR_ANY,
637 		.bufsize = sizeof(struct usb_device_request),
638 		.callback = &umass_t_cbi_data_rd_cs_callback,
639 		.timeout = 5000,	/* 5 seconds */
640 	},
641 
642 	[UMASS_T_CBI_DATA_WRITE] = {
643 		.type = UE_BULK,
644 		.endpoint = UE_ADDR_ANY,
645 		.direction = UE_DIR_OUT,
646 		.bufsize = UMASS_BULK_SIZE,
647 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
648 		.callback = &umass_t_cbi_data_write_callback,
649 		.timeout = 0,	/* overwritten later */
650 	},
651 
652 	[UMASS_T_CBI_DATA_WR_CS] = {
653 		.type = UE_CONTROL,
654 		.endpoint = 0x00,	/* Control pipe */
655 		.direction = UE_DIR_ANY,
656 		.bufsize = sizeof(struct usb_device_request),
657 		.callback = &umass_t_cbi_data_wr_cs_callback,
658 		.timeout = 5000,	/* 5 seconds */
659 	},
660 
661 	[UMASS_T_CBI_STATUS] = {
662 		.type = UE_INTERRUPT,
663 		.endpoint = UE_ADDR_ANY,
664 		.direction = UE_DIR_IN,
665 		.flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
666 		.bufsize = sizeof(umass_cbi_sbl_t),
667 		.callback = &umass_t_cbi_status_callback,
668 		.timeout = 5000,	/* ms */
669 	},
670 
671 	[UMASS_T_CBI_RESET4] = {
672 		.type = UE_CONTROL,
673 		.endpoint = 0x00,	/* Control pipe */
674 		.direction = UE_DIR_ANY,
675 		.bufsize = sizeof(struct usb_device_request),
676 		.callback = &umass_t_cbi_reset4_callback,
677 		.timeout = 5000,	/* ms */
678 	},
679 };
680 
681 /* If device cannot return valid inquiry data, fake it */
682 static const uint8_t fake_inq_data[SHORT_INQUIRY_LENGTH] = {
683 	0, /* removable */ 0x80, SCSI_REV_2, SCSI_REV_2,
684 	 /* additional_length */ 31, 0, 0, 0
685 };
686 
687 #define	UFI_COMMAND_LENGTH	12	/* UFI commands are always 12 bytes */
688 #define	ATAPI_COMMAND_LENGTH	12	/* ATAPI commands are always 12 bytes */
689 
690 static device_method_t umass_methods[] = {
691 	/* Device interface */
692 	DEVMETHOD(device_probe, umass_probe),
693 	DEVMETHOD(device_attach, umass_attach),
694 	DEVMETHOD(device_detach, umass_detach),
695 
696 	DEVMETHOD_END
697 };
698 
699 static driver_t umass_driver = {
700 	.name = "umass",
701 	.methods = umass_methods,
702 	.size = sizeof(struct umass_softc),
703 };
704 
705 static const STRUCT_USB_HOST_ID __used umass_devs[] = {
706 	/* generic mass storage class */
707 	{USB_IFACE_CLASS(UICLASS_MASS),},
708 };
709 
710 DRIVER_MODULE(umass, uhub, umass_driver, NULL, NULL);
711 MODULE_DEPEND(umass, usb, 1, 1, 1);
712 MODULE_DEPEND(umass, cam, 1, 1, 1);
713 MODULE_VERSION(umass, 1);
714 USB_PNP_HOST_INFO(umass_devs);
715 
716 /*
717  * USB device probe/attach/detach
718  */
719 
720 static uint16_t
721 umass_get_proto(struct usb_interface *iface)
722 {
723 	struct usb_interface_descriptor *id;
724 	uint16_t retval;
725 
726 	retval = 0;
727 
728 	/* Check for a standards compliant device */
729 	id = usbd_get_interface_descriptor(iface);
730 	if ((id == NULL) ||
731 	    (id->bInterfaceClass != UICLASS_MASS)) {
732 		goto done;
733 	}
734 	switch (id->bInterfaceSubClass) {
735 	case UISUBCLASS_SCSI:
736 		retval |= UMASS_PROTO_SCSI;
737 		break;
738 	case UISUBCLASS_UFI:
739 		retval |= UMASS_PROTO_UFI;
740 		break;
741 	case UISUBCLASS_RBC:
742 		retval |= UMASS_PROTO_RBC;
743 		break;
744 	case UISUBCLASS_SFF8020I:
745 	case UISUBCLASS_SFF8070I:
746 		retval |= UMASS_PROTO_ATAPI;
747 		break;
748 	default:
749 		goto done;
750 	}
751 
752 	switch (id->bInterfaceProtocol) {
753 	case UIPROTO_MASS_CBI:
754 		retval |= UMASS_PROTO_CBI;
755 		break;
756 	case UIPROTO_MASS_CBI_I:
757 		retval |= UMASS_PROTO_CBI_I;
758 		break;
759 	case UIPROTO_MASS_BBB_OLD:
760 	case UIPROTO_MASS_BBB:
761 		retval |= UMASS_PROTO_BBB;
762 		break;
763 	default:
764 		goto done;
765 	}
766 done:
767 	return (retval);
768 }
769 
770 /*
771  * Match the device we are seeing with the devices supported.
772  */
773 static struct umass_probe_proto
774 umass_probe_proto(device_t dev, struct usb_attach_arg *uaa)
775 {
776 	struct umass_probe_proto ret;
777 	uint32_t quirks = NO_QUIRKS;
778 	uint32_t proto = umass_get_proto(uaa->iface);
779 
780 	memset(&ret, 0, sizeof(ret));
781 	ret.error = BUS_PROBE_GENERIC;
782 
783 	/* Check if we should deny probing. */
784 	if (usb_test_quirk(uaa, UQ_MSC_IGNORE)) {
785 		ret.error = ENXIO;
786 		goto done;
787 	}
788 
789 	/* Search for protocol enforcement */
790 
791 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_BBB)) {
792 		proto &= ~UMASS_PROTO_WIRE;
793 		proto |= UMASS_PROTO_BBB;
794 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI)) {
795 		proto &= ~UMASS_PROTO_WIRE;
796 		proto |= UMASS_PROTO_CBI;
797 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI_I)) {
798 		proto &= ~UMASS_PROTO_WIRE;
799 		proto |= UMASS_PROTO_CBI_I;
800 	}
801 
802 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_SCSI)) {
803 		proto &= ~UMASS_PROTO_COMMAND;
804 		proto |= UMASS_PROTO_SCSI;
805 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_ATAPI)) {
806 		proto &= ~UMASS_PROTO_COMMAND;
807 		proto |= UMASS_PROTO_ATAPI;
808 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_UFI)) {
809 		proto &= ~UMASS_PROTO_COMMAND;
810 		proto |= UMASS_PROTO_UFI;
811 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_RBC)) {
812 		proto &= ~UMASS_PROTO_COMMAND;
813 		proto |= UMASS_PROTO_RBC;
814 	}
815 
816 	/* Check if the protocol is invalid */
817 
818 	if ((proto & UMASS_PROTO_COMMAND) == 0) {
819 		ret.error = ENXIO;
820 		goto done;
821 	}
822 
823 	if ((proto & UMASS_PROTO_WIRE) == 0) {
824 		ret.error = ENXIO;
825 		goto done;
826 	}
827 
828 	/* Search for quirks */
829 
830 	if (usb_test_quirk(uaa, UQ_MSC_NO_TEST_UNIT_READY))
831 		quirks |= NO_TEST_UNIT_READY;
832 	if (usb_test_quirk(uaa, UQ_MSC_NO_RS_CLEAR_UA))
833 		quirks |= RS_NO_CLEAR_UA;
834 	if (usb_test_quirk(uaa, UQ_MSC_NO_START_STOP))
835 		quirks |= NO_START_STOP;
836 	if (usb_test_quirk(uaa, UQ_MSC_NO_GETMAXLUN))
837 		quirks |= NO_GETMAXLUN;
838 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY))
839 		quirks |= NO_INQUIRY;
840 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY_EVPD))
841 		quirks |= NO_INQUIRY_EVPD;
842 	if (usb_test_quirk(uaa, UQ_MSC_NO_PREVENT_ALLOW))
843 		quirks |= NO_PREVENT_ALLOW;
844 	if (usb_test_quirk(uaa, UQ_MSC_NO_SYNC_CACHE))
845 		quirks |= NO_SYNCHRONIZE_CACHE;
846 	if (usb_test_quirk(uaa, UQ_MSC_SHUTTLE_INIT))
847 		quirks |= SHUTTLE_INIT;
848 	if (usb_test_quirk(uaa, UQ_MSC_ALT_IFACE_1))
849 		quirks |= ALT_IFACE_1;
850 	if (usb_test_quirk(uaa, UQ_MSC_FLOPPY_SPEED))
851 		quirks |= FLOPPY_SPEED;
852 	if (usb_test_quirk(uaa, UQ_MSC_IGNORE_RESIDUE))
853 		quirks |= IGNORE_RESIDUE;
854 	if (usb_test_quirk(uaa, UQ_MSC_WRONG_CSWSIG))
855 		quirks |= WRONG_CSWSIG;
856 	if (usb_test_quirk(uaa, UQ_MSC_RBC_PAD_TO_12))
857 		quirks |= RBC_PAD_TO_12;
858 	if (usb_test_quirk(uaa, UQ_MSC_READ_CAP_OFFBY1))
859 		quirks |= READ_CAPACITY_OFFBY1;
860 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_SHORT_INQ))
861 		quirks |= FORCE_SHORT_INQUIRY;
862 
863 done:
864 	ret.quirks = quirks;
865 	ret.proto = proto;
866 	return (ret);
867 }
868 
869 static int
870 umass_probe(device_t dev)
871 {
872 	struct usb_attach_arg *uaa = device_get_ivars(dev);
873 	struct umass_probe_proto temp;
874 
875 	if (uaa->usb_mode != USB_MODE_HOST) {
876 		return (ENXIO);
877 	}
878 	temp = umass_probe_proto(dev, uaa);
879 
880 	return (temp.error);
881 }
882 
883 static int
884 umass_attach(device_t dev)
885 {
886 	struct umass_softc *sc = device_get_softc(dev);
887 	struct usb_attach_arg *uaa = device_get_ivars(dev);
888 	struct umass_probe_proto temp = umass_probe_proto(dev, uaa);
889 	struct usb_interface_descriptor *id;
890 	int err;
891 
892 	/*
893 	 * NOTE: the softc struct is cleared in device_set_driver.
894 	 * We can safely call umass_detach without specifically
895 	 * initializing the struct.
896 	 */
897 
898 	sc->sc_dev = dev;
899 	sc->sc_udev = uaa->device;
900 	sc->sc_proto = temp.proto;
901 	sc->sc_quirks = temp.quirks;
902 	sc->sc_unit = device_get_unit(dev);
903 
904 	snprintf(sc->sc_name, sizeof(sc->sc_name),
905 	    "%s", device_get_nameunit(dev));
906 
907 	device_set_usb_desc(dev);
908 
909         mtx_init(&sc->sc_mtx, device_get_nameunit(dev),
910 	    NULL, MTX_DEF | MTX_RECURSE);
911 
912 	/* get interface index */
913 
914 	id = usbd_get_interface_descriptor(uaa->iface);
915 	if (id == NULL) {
916 		device_printf(dev, "failed to get "
917 		    "interface number\n");
918 		goto detach;
919 	}
920 	sc->sc_iface_no = id->bInterfaceNumber;
921 
922 #ifdef USB_DEBUG
923 	device_printf(dev, " ");
924 
925 	switch (sc->sc_proto & UMASS_PROTO_COMMAND) {
926 	case UMASS_PROTO_SCSI:
927 		printf("SCSI");
928 		break;
929 	case UMASS_PROTO_ATAPI:
930 		printf("8070i (ATAPI)");
931 		break;
932 	case UMASS_PROTO_UFI:
933 		printf("UFI");
934 		break;
935 	case UMASS_PROTO_RBC:
936 		printf("RBC");
937 		break;
938 	default:
939 		printf("(unknown 0x%02x)",
940 		    sc->sc_proto & UMASS_PROTO_COMMAND);
941 		break;
942 	}
943 
944 	printf(" over ");
945 
946 	switch (sc->sc_proto & UMASS_PROTO_WIRE) {
947 	case UMASS_PROTO_BBB:
948 		printf("Bulk-Only");
949 		break;
950 	case UMASS_PROTO_CBI:		/* uses Comand/Bulk pipes */
951 		printf("CBI");
952 		break;
953 	case UMASS_PROTO_CBI_I:	/* uses Comand/Bulk/Interrupt pipes */
954 		printf("CBI with CCI");
955 		break;
956 	default:
957 		printf("(unknown 0x%02x)",
958 		    sc->sc_proto & UMASS_PROTO_WIRE);
959 	}
960 
961 	printf("; quirks = 0x%04x\n", sc->sc_quirks);
962 #endif
963 
964 	if (sc->sc_quirks & ALT_IFACE_1) {
965 		err = usbd_set_alt_interface_index
966 		    (uaa->device, uaa->info.bIfaceIndex, 1);
967 
968 		if (err) {
969 			DPRINTF(sc, UDMASS_USB, "could not switch to "
970 			    "Alt Interface 1\n");
971 			goto detach;
972 		}
973 	}
974 	/* allocate all required USB transfers */
975 
976 	if (sc->sc_proto & UMASS_PROTO_BBB) {
977 		err = usbd_transfer_setup(uaa->device,
978 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_bbb_config,
979 		    UMASS_T_BBB_MAX, sc, &sc->sc_mtx);
980 
981 		/* skip reset first time */
982 		sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
983 
984 	} else if (sc->sc_proto & (UMASS_PROTO_CBI | UMASS_PROTO_CBI_I)) {
985 		err = usbd_transfer_setup(uaa->device,
986 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_cbi_config,
987 		    UMASS_T_CBI_MAX, sc, &sc->sc_mtx);
988 
989 		/* skip reset first time */
990 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
991 
992 	} else {
993 		err = USB_ERR_INVAL;
994 	}
995 
996 	if (err) {
997 		device_printf(dev, "could not setup required "
998 		    "transfers, %s\n", usbd_errstr(err));
999 		goto detach;
1000 	}
1001 #ifdef USB_DEBUG
1002 	if (umass_throttle > 0) {
1003 		uint8_t x;
1004 		int iv;
1005 
1006 		iv = umass_throttle;
1007 
1008 		if (iv < 1)
1009 			iv = 1;
1010 		else if (iv > 8000)
1011 			iv = 8000;
1012 
1013 		for (x = 0; x != UMASS_T_MAX; x++) {
1014 			if (sc->sc_xfer[x] != NULL)
1015 				usbd_xfer_set_interval(sc->sc_xfer[x], iv);
1016 		}
1017 	}
1018 #endif
1019 	sc->sc_transform =
1020 	    (sc->sc_proto & UMASS_PROTO_SCSI) ? &umass_scsi_transform :
1021 	    (sc->sc_proto & UMASS_PROTO_UFI) ? &umass_ufi_transform :
1022 	    (sc->sc_proto & UMASS_PROTO_ATAPI) ? &umass_atapi_transform :
1023 	    (sc->sc_proto & UMASS_PROTO_RBC) ? &umass_rbc_transform :
1024 	    &umass_no_transform;
1025 
1026 	/* from here onwards the device can be used. */
1027 
1028 	if (sc->sc_quirks & SHUTTLE_INIT) {
1029 		umass_init_shuttle(sc);
1030 	}
1031 	/* get the maximum LUN supported by the device */
1032 
1033 	if (((sc->sc_proto & UMASS_PROTO_WIRE) == UMASS_PROTO_BBB) &&
1034 	    !(sc->sc_quirks & NO_GETMAXLUN))
1035 		sc->sc_maxlun = umass_bbb_get_max_lun(sc);
1036 	else
1037 		sc->sc_maxlun = 0;
1038 
1039 	/* Prepare the SCSI command block */
1040 	sc->cam_scsi_sense.opcode = REQUEST_SENSE;
1041 	sc->cam_scsi_test_unit_ready.opcode = TEST_UNIT_READY;
1042 
1043 	/* register the SIM */
1044 	err = umass_cam_attach_sim(sc);
1045 	if (err) {
1046 		goto detach;
1047 	}
1048 	/* scan the SIM */
1049 	umass_cam_attach(sc);
1050 
1051 	DPRINTF(sc, UDMASS_GEN, "Attach finished\n");
1052 
1053 	return (0);			/* success */
1054 
1055 detach:
1056 	umass_detach(dev);
1057 	return (ENXIO);			/* failure */
1058 }
1059 
1060 static int
1061 umass_detach(device_t dev)
1062 {
1063 	struct umass_softc *sc = device_get_softc(dev);
1064 
1065 	DPRINTF(sc, UDMASS_USB, "\n");
1066 
1067 	/* teardown our statemachine */
1068 
1069 	usbd_transfer_unsetup(sc->sc_xfer, UMASS_T_MAX);
1070 
1071 	mtx_lock(&sc->sc_mtx);
1072 
1073 	/* cancel any leftover CCB's */
1074 
1075 	umass_cancel_ccb(sc);
1076 
1077 	umass_cam_detach_sim(sc);
1078 
1079 	mtx_unlock(&sc->sc_mtx);
1080 
1081 	mtx_destroy(&sc->sc_mtx);
1082 
1083 	return (0);			/* success */
1084 }
1085 
1086 static void
1087 umass_init_shuttle(struct umass_softc *sc)
1088 {
1089 	struct usb_device_request req;
1090 	uint8_t status[2] = {0, 0};
1091 
1092 	/*
1093 	 * The Linux driver does this, but no one can tell us what the
1094 	 * command does.
1095 	 */
1096 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1097 	req.bRequest = 1;		/* XXX unknown command */
1098 	USETW(req.wValue, 0);
1099 	req.wIndex[0] = sc->sc_iface_no;
1100 	req.wIndex[1] = 0;
1101 	USETW(req.wLength, sizeof(status));
1102 	usbd_do_request(sc->sc_udev, NULL, &req, &status);
1103 
1104 	DPRINTF(sc, UDMASS_GEN, "Shuttle init returned 0x%02x%02x\n",
1105 	    status[0], status[1]);
1106 }
1107 
1108 /*
1109  * Generic functions to handle transfers
1110  */
1111 
1112 static void
1113 umass_transfer_start(struct umass_softc *sc, uint8_t xfer_index)
1114 {
1115 	DPRINTF(sc, UDMASS_GEN, "transfer index = "
1116 	    "%d\n", xfer_index);
1117 
1118 	if (sc->sc_xfer[xfer_index]) {
1119 		sc->sc_last_xfer_index = xfer_index;
1120 		usbd_transfer_start(sc->sc_xfer[xfer_index]);
1121 	} else {
1122 		umass_cancel_ccb(sc);
1123 	}
1124 }
1125 
1126 static void
1127 umass_reset(struct umass_softc *sc)
1128 {
1129 	DPRINTF(sc, UDMASS_GEN, "resetting device\n");
1130 
1131 	/*
1132 	 * stop the last transfer, if not already stopped:
1133 	 */
1134 	usbd_transfer_stop(sc->sc_xfer[sc->sc_last_xfer_index]);
1135 	umass_transfer_start(sc, 0);
1136 }
1137 
1138 static void
1139 umass_cancel_ccb(struct umass_softc *sc)
1140 {
1141 	union ccb *ccb;
1142 
1143 	USB_MTX_ASSERT(&sc->sc_mtx, MA_OWNED);
1144 
1145 	ccb = sc->sc_transfer.ccb;
1146 	sc->sc_transfer.ccb = NULL;
1147 	sc->sc_last_xfer_index = 0;
1148 
1149 	if (ccb) {
1150 		(sc->sc_transfer.callback)
1151 		    (sc, ccb, (sc->sc_transfer.data_len -
1152 		    sc->sc_transfer.actlen), STATUS_WIRE_FAILED);
1153 	}
1154 }
1155 
1156 static void
1157 umass_tr_error(struct usb_xfer *xfer, usb_error_t error)
1158 {
1159 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1160 
1161 	if (error != USB_ERR_CANCELLED) {
1162 		DPRINTF(sc, UDMASS_GEN, "transfer error, %s -> "
1163 		    "reset\n", usbd_errstr(error));
1164 	}
1165 	umass_cancel_ccb(sc);
1166 }
1167 
1168 /*
1169  * BBB protocol specific functions
1170  */
1171 
1172 static void
1173 umass_t_bbb_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1174 {
1175 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1176 	struct usb_device_request req;
1177 	struct usb_page_cache *pc;
1178 
1179 	switch (USB_GET_STATE(xfer)) {
1180 	case USB_ST_TRANSFERRED:
1181 		umass_transfer_start(sc, UMASS_T_BBB_RESET2);
1182 		return;
1183 
1184 	case USB_ST_SETUP:
1185 		/*
1186 		 * Reset recovery (5.3.4 in Universal Serial Bus Mass Storage Class)
1187 		 *
1188 		 * For Reset Recovery the host shall issue in the following order:
1189 		 * a) a Bulk-Only Mass Storage Reset
1190 		 * b) a Clear Feature HALT to the Bulk-In endpoint
1191 		 * c) a Clear Feature HALT to the Bulk-Out endpoint
1192 		 *
1193 		 * This is done in 3 steps, using 3 transfers:
1194 		 * UMASS_T_BBB_RESET1
1195 		 * UMASS_T_BBB_RESET2
1196 		 * UMASS_T_BBB_RESET3
1197 		 */
1198 
1199 		DPRINTF(sc, UDMASS_BBB, "BBB reset!\n");
1200 
1201 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1202 		req.bRequest = UR_BBB_RESET;	/* bulk only reset */
1203 		USETW(req.wValue, 0);
1204 		req.wIndex[0] = sc->sc_iface_no;
1205 		req.wIndex[1] = 0;
1206 		USETW(req.wLength, 0);
1207 
1208 		pc = usbd_xfer_get_frame(xfer, 0);
1209 		usbd_copy_in(pc, 0, &req, sizeof(req));
1210 
1211 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1212 		usbd_xfer_set_frames(xfer, 1);
1213 		usbd_transfer_submit(xfer);
1214 		return;
1215 
1216 	default:			/* Error */
1217 		umass_tr_error(xfer, error);
1218 		return;
1219 	}
1220 }
1221 
1222 static void
1223 umass_t_bbb_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1224 {
1225 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_RESET3,
1226 	    UMASS_T_BBB_DATA_READ, error);
1227 }
1228 
1229 static void
1230 umass_t_bbb_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1231 {
1232 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_COMMAND,
1233 	    UMASS_T_BBB_DATA_WRITE, error);
1234 }
1235 
1236 static void
1237 umass_t_bbb_data_clear_stall_callback(struct usb_xfer *xfer,
1238     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1239 {
1240 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1241 
1242 	switch (USB_GET_STATE(xfer)) {
1243 	case USB_ST_TRANSFERRED:
1244 tr_transferred:
1245 		umass_transfer_start(sc, next_xfer);
1246 		return;
1247 
1248 	case USB_ST_SETUP:
1249 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1250 			goto tr_transferred;
1251 		}
1252 		return;
1253 
1254 	default:			/* Error */
1255 		umass_tr_error(xfer, error);
1256 		return;
1257 	}
1258 }
1259 
1260 static void
1261 umass_t_bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
1262 {
1263 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1264 	union ccb *ccb = sc->sc_transfer.ccb;
1265 	struct usb_page_cache *pc;
1266 	uint32_t tag;
1267 
1268 	switch (USB_GET_STATE(xfer)) {
1269 	case USB_ST_TRANSFERRED:
1270 		umass_transfer_start
1271 		    (sc, ((sc->sc_transfer.dir == DIR_IN) ? UMASS_T_BBB_DATA_READ :
1272 		    (sc->sc_transfer.dir == DIR_OUT) ? UMASS_T_BBB_DATA_WRITE :
1273 		    UMASS_T_BBB_STATUS));
1274 		return;
1275 
1276 	case USB_ST_SETUP:
1277 
1278 		sc->sc_status_try = 0;
1279 
1280 		if (ccb) {
1281 			/*
1282 		         * the initial value is not important,
1283 		         * as long as the values are unique:
1284 		         */
1285 			tag = UGETDW(sc->cbw.dCBWTag) + 1;
1286 
1287 			USETDW(sc->cbw.dCBWSignature, CBWSIGNATURE);
1288 			USETDW(sc->cbw.dCBWTag, tag);
1289 
1290 			/*
1291 		         * dCBWDataTransferLength:
1292 		         *   This field indicates the number of bytes of data that the host
1293 		         *   intends to transfer on the IN or OUT Bulk endpoint(as indicated by
1294 		         *   the Direction bit) during the execution of this command. If this
1295 		         *   field is set to 0, the device will expect that no data will be
1296 		         *   transferred IN or OUT during this command, regardless of the value
1297 		         *   of the Direction bit defined in dCBWFlags.
1298 		         */
1299 			USETDW(sc->cbw.dCBWDataTransferLength, sc->sc_transfer.data_len);
1300 
1301 			/*
1302 		         * dCBWFlags:
1303 		         *   The bits of the Flags field are defined as follows:
1304 		         *     Bits 0-6  reserved
1305 		         *     Bit  7    Direction - this bit shall be ignored if the
1306 		         *                           dCBWDataTransferLength field is zero.
1307 		         *               0 = data Out from host to device
1308 		         *               1 = data In from device to host
1309 		         */
1310 			sc->cbw.bCBWFlags = ((sc->sc_transfer.dir == DIR_IN) ?
1311 			    CBWFLAGS_IN : CBWFLAGS_OUT);
1312 			sc->cbw.bCBWLUN = sc->sc_transfer.lun;
1313 
1314 			if (sc->sc_transfer.cmd_len > sizeof(sc->cbw.CBWCDB)) {
1315 				sc->sc_transfer.cmd_len = sizeof(sc->cbw.CBWCDB);
1316 				DPRINTF(sc, UDMASS_BBB, "Truncating long command!\n");
1317 			}
1318 			sc->cbw.bCDBLength = sc->sc_transfer.cmd_len;
1319 
1320 			/* copy SCSI command data */
1321 			memcpy(sc->cbw.CBWCDB, sc->sc_transfer.cmd_data,
1322 			    sc->sc_transfer.cmd_len);
1323 
1324 			/* clear remaining command area */
1325 			memset(sc->cbw.CBWCDB +
1326 			    sc->sc_transfer.cmd_len, 0,
1327 			    sizeof(sc->cbw.CBWCDB) -
1328 			    sc->sc_transfer.cmd_len);
1329 
1330 			DIF(UDMASS_BBB, umass_bbb_dump_cbw(sc, &sc->cbw));
1331 
1332 			pc = usbd_xfer_get_frame(xfer, 0);
1333 			usbd_copy_in(pc, 0, &sc->cbw, sizeof(sc->cbw));
1334 			usbd_xfer_set_frame_len(xfer, 0, sizeof(sc->cbw));
1335 
1336 			usbd_transfer_submit(xfer);
1337 		}
1338 		return;
1339 
1340 	default:			/* Error */
1341 		umass_tr_error(xfer, error);
1342 		return;
1343 	}
1344 }
1345 
1346 static void
1347 umass_t_bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1348 {
1349 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1350 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1351 	int actlen, sumlen;
1352 
1353 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1354 
1355 	switch (USB_GET_STATE(xfer)) {
1356 	case USB_ST_TRANSFERRED:
1357 		sc->sc_transfer.data_rem -= actlen;
1358 		sc->sc_transfer.data_ptr += actlen;
1359 		sc->sc_transfer.actlen += actlen;
1360 
1361 		if (actlen < sumlen) {
1362 			/* short transfer */
1363 			sc->sc_transfer.data_rem = 0;
1364 		}
1365 	case USB_ST_SETUP:
1366 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1367 		    max_bulk, sc->sc_transfer.data_rem);
1368 
1369 		if (sc->sc_transfer.data_rem == 0) {
1370 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1371 			return;
1372 		}
1373 		if (max_bulk > sc->sc_transfer.data_rem) {
1374 			max_bulk = sc->sc_transfer.data_rem;
1375 		}
1376 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1377 
1378 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1379 		    max_bulk);
1380 
1381 		usbd_transfer_submit(xfer);
1382 		return;
1383 
1384 	default:			/* Error */
1385 		if (error == USB_ERR_CANCELLED) {
1386 			umass_tr_error(xfer, error);
1387 		} else {
1388 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1389 		}
1390 		return;
1391 	}
1392 }
1393 
1394 static void
1395 umass_t_bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1396 {
1397 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1398 	    UMASS_T_BBB_DATA_READ, error);
1399 }
1400 
1401 static void
1402 umass_t_bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1403 {
1404 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1405 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1406 	int actlen, sumlen;
1407 
1408 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1409 
1410 	switch (USB_GET_STATE(xfer)) {
1411 	case USB_ST_TRANSFERRED:
1412 		sc->sc_transfer.data_rem -= actlen;
1413 		sc->sc_transfer.data_ptr += actlen;
1414 		sc->sc_transfer.actlen += actlen;
1415 
1416 		if (actlen < sumlen) {
1417 			/* short transfer */
1418 			sc->sc_transfer.data_rem = 0;
1419 		}
1420 	case USB_ST_SETUP:
1421 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1422 		    max_bulk, sc->sc_transfer.data_rem);
1423 
1424 		if (sc->sc_transfer.data_rem == 0) {
1425 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1426 			return;
1427 		}
1428 		if (max_bulk > sc->sc_transfer.data_rem) {
1429 			max_bulk = sc->sc_transfer.data_rem;
1430 		}
1431 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1432 
1433 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1434 		    max_bulk);
1435 
1436 		usbd_transfer_submit(xfer);
1437 		return;
1438 
1439 	default:			/* Error */
1440 		if (error == USB_ERR_CANCELLED) {
1441 			umass_tr_error(xfer, error);
1442 		} else {
1443 			umass_transfer_start(sc, UMASS_T_BBB_DATA_WR_CS);
1444 		}
1445 		return;
1446 	}
1447 }
1448 
1449 static void
1450 umass_t_bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1451 {
1452 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1453 	    UMASS_T_BBB_DATA_WRITE, error);
1454 }
1455 
1456 static void
1457 umass_t_bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
1458 {
1459 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1460 	union ccb *ccb = sc->sc_transfer.ccb;
1461 	struct usb_page_cache *pc;
1462 	uint32_t residue;
1463 	int actlen;
1464 
1465 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1466 
1467 	switch (USB_GET_STATE(xfer)) {
1468 	case USB_ST_TRANSFERRED:
1469 
1470 		/*
1471 		 * Do a full reset if there is something wrong with the CSW:
1472 		 */
1473 		sc->sc_status_try = 1;
1474 
1475 		/* Zero missing parts of the CSW: */
1476 
1477 		if (actlen < (int)sizeof(sc->csw))
1478 			memset(&sc->csw, 0, sizeof(sc->csw));
1479 
1480 		pc = usbd_xfer_get_frame(xfer, 0);
1481 		usbd_copy_out(pc, 0, &sc->csw, actlen);
1482 
1483 		DIF(UDMASS_BBB, umass_bbb_dump_csw(sc, &sc->csw));
1484 
1485 		residue = UGETDW(sc->csw.dCSWDataResidue);
1486 
1487 		if ((!residue) || (sc->sc_quirks & IGNORE_RESIDUE)) {
1488 			residue = (sc->sc_transfer.data_len -
1489 			    sc->sc_transfer.actlen);
1490 		}
1491 		if (residue > sc->sc_transfer.data_len) {
1492 			DPRINTF(sc, UDMASS_BBB, "truncating residue from %d "
1493 			    "to %d bytes\n", residue, sc->sc_transfer.data_len);
1494 			residue = sc->sc_transfer.data_len;
1495 		}
1496 		/* translate weird command-status signatures: */
1497 		if (sc->sc_quirks & WRONG_CSWSIG) {
1498 			uint32_t temp = UGETDW(sc->csw.dCSWSignature);
1499 
1500 			if ((temp == CSWSIGNATURE_OLYMPUS_C1) ||
1501 			    (temp == CSWSIGNATURE_IMAGINATION_DBX1)) {
1502 				USETDW(sc->csw.dCSWSignature, CSWSIGNATURE);
1503 			}
1504 		}
1505 		/* check CSW and handle eventual error */
1506 		if (UGETDW(sc->csw.dCSWSignature) != CSWSIGNATURE) {
1507 			DPRINTF(sc, UDMASS_BBB, "bad CSW signature 0x%08x != 0x%08x\n",
1508 			    UGETDW(sc->csw.dCSWSignature), CSWSIGNATURE);
1509 			/*
1510 			 * Invalid CSW: Wrong signature or wrong tag might
1511 			 * indicate that we lost synchronization. Reset the
1512 			 * device.
1513 			 */
1514 			goto tr_error;
1515 		} else if (UGETDW(sc->csw.dCSWTag) != UGETDW(sc->cbw.dCBWTag)) {
1516 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: tag 0x%08x should be "
1517 			    "0x%08x\n", UGETDW(sc->csw.dCSWTag),
1518 			    UGETDW(sc->cbw.dCBWTag));
1519 			goto tr_error;
1520 		} else if (sc->csw.bCSWStatus > CSWSTATUS_PHASE) {
1521 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: status %d > %d\n",
1522 			    sc->csw.bCSWStatus, CSWSTATUS_PHASE);
1523 			goto tr_error;
1524 		} else if (sc->csw.bCSWStatus == CSWSTATUS_PHASE) {
1525 			DPRINTF(sc, UDMASS_BBB, "Phase error, residue = "
1526 			    "%d\n", residue);
1527 			goto tr_error;
1528 		} else if (sc->sc_transfer.actlen > sc->sc_transfer.data_len) {
1529 			DPRINTF(sc, UDMASS_BBB, "Buffer overrun %d > %d\n",
1530 			    sc->sc_transfer.actlen, sc->sc_transfer.data_len);
1531 			goto tr_error;
1532 		} else if (sc->csw.bCSWStatus == CSWSTATUS_FAILED) {
1533 			DPRINTF(sc, UDMASS_BBB, "Command failed, residue = "
1534 			    "%d\n", residue);
1535 
1536 			sc->sc_transfer.ccb = NULL;
1537 
1538 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1539 
1540 			(sc->sc_transfer.callback)
1541 			    (sc, ccb, residue, STATUS_CMD_FAILED);
1542 		} else {
1543 			sc->sc_transfer.ccb = NULL;
1544 
1545 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1546 
1547 			(sc->sc_transfer.callback)
1548 			    (sc, ccb, residue, STATUS_CMD_OK);
1549 		}
1550 		return;
1551 
1552 	case USB_ST_SETUP:
1553 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1554 		usbd_transfer_submit(xfer);
1555 		return;
1556 
1557 	default:
1558 tr_error:
1559 		DPRINTF(sc, UDMASS_BBB, "Failed to read CSW: %s, try %d\n",
1560 		    usbd_errstr(error), sc->sc_status_try);
1561 
1562 		if ((error == USB_ERR_CANCELLED) ||
1563 		    (sc->sc_status_try)) {
1564 			umass_tr_error(xfer, error);
1565 		} else {
1566 			sc->sc_status_try = 1;
1567 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1568 		}
1569 		return;
1570 	}
1571 }
1572 
1573 static void
1574 umass_command_start(struct umass_softc *sc, uint8_t dir,
1575     void *data_ptr, uint32_t data_len,
1576     uint32_t data_timeout, umass_callback_t *callback,
1577     union ccb *ccb)
1578 {
1579 	sc->sc_transfer.lun = ccb->ccb_h.target_lun;
1580 
1581 	/*
1582 	 * NOTE: assumes that "sc->sc_transfer.cmd_data" and
1583 	 * "sc->sc_transfer.cmd_len" has been properly
1584 	 * initialized.
1585 	 */
1586 
1587 	sc->sc_transfer.dir = data_len ? dir : DIR_NONE;
1588 	sc->sc_transfer.data_ptr = data_ptr;
1589 	sc->sc_transfer.data_len = data_len;
1590 	sc->sc_transfer.data_rem = data_len;
1591 	sc->sc_transfer.data_timeout = (data_timeout + UMASS_TIMEOUT);
1592 
1593 	sc->sc_transfer.actlen = 0;
1594 	sc->sc_transfer.callback = callback;
1595 	sc->sc_transfer.ccb = ccb;
1596 
1597 	if (sc->sc_xfer[sc->sc_last_xfer_index]) {
1598 		usbd_transfer_start(sc->sc_xfer[sc->sc_last_xfer_index]);
1599 	} else {
1600 		umass_cancel_ccb(sc);
1601 	}
1602 }
1603 
1604 static uint8_t
1605 umass_bbb_get_max_lun(struct umass_softc *sc)
1606 {
1607 	struct usb_device_request req;
1608 	usb_error_t err;
1609 	uint8_t buf = 0;
1610 
1611 	/* The Get Max Lun command is a class-specific request. */
1612 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
1613 	req.bRequest = UR_BBB_GET_MAX_LUN;
1614 	USETW(req.wValue, 0);
1615 	req.wIndex[0] = sc->sc_iface_no;
1616 	req.wIndex[1] = 0;
1617 	USETW(req.wLength, 1);
1618 
1619 	err = usbd_do_request(sc->sc_udev, NULL, &req, &buf);
1620 	if (err) {
1621 		buf = 0;
1622 
1623 		/* Device doesn't support Get Max Lun request. */
1624 		printf("%s: Get Max Lun not supported (%s)\n",
1625 		    sc->sc_name, usbd_errstr(err));
1626 	}
1627 	return (buf);
1628 }
1629 
1630 /*
1631  * Command/Bulk/Interrupt (CBI) specific functions
1632  */
1633 
1634 static void
1635 umass_cbi_start_status(struct umass_softc *sc)
1636 {
1637 	if (sc->sc_xfer[UMASS_T_CBI_STATUS]) {
1638 		umass_transfer_start(sc, UMASS_T_CBI_STATUS);
1639 	} else {
1640 		union ccb *ccb = sc->sc_transfer.ccb;
1641 
1642 		sc->sc_transfer.ccb = NULL;
1643 
1644 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1645 
1646 		(sc->sc_transfer.callback)
1647 		    (sc, ccb, (sc->sc_transfer.data_len -
1648 		    sc->sc_transfer.actlen), STATUS_CMD_UNKNOWN);
1649 	}
1650 }
1651 
1652 static void
1653 umass_t_cbi_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1654 {
1655 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1656 	struct usb_device_request req;
1657 	struct usb_page_cache *pc;
1658 	uint8_t buf[UMASS_CBI_DIAGNOSTIC_CMDLEN];
1659 
1660 	uint8_t i;
1661 
1662 	switch (USB_GET_STATE(xfer)) {
1663 	case USB_ST_TRANSFERRED:
1664 		umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1665 		break;
1666 
1667 	case USB_ST_SETUP:
1668 		/*
1669 		 * Command Block Reset Protocol
1670 		 *
1671 		 * First send a reset request to the device. Then clear
1672 		 * any possibly stalled bulk endpoints.
1673 		 *
1674 		 * This is done in 3 steps, using 3 transfers:
1675 		 * UMASS_T_CBI_RESET1
1676 		 * UMASS_T_CBI_RESET2
1677 		 * UMASS_T_CBI_RESET3
1678 		 * UMASS_T_CBI_RESET4 (only if there is an interrupt endpoint)
1679 		 */
1680 
1681 		DPRINTF(sc, UDMASS_CBI, "CBI reset!\n");
1682 
1683 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1684 		req.bRequest = UR_CBI_ADSC;
1685 		USETW(req.wValue, 0);
1686 		req.wIndex[0] = sc->sc_iface_no;
1687 		req.wIndex[1] = 0;
1688 		USETW(req.wLength, UMASS_CBI_DIAGNOSTIC_CMDLEN);
1689 
1690 		/*
1691 		 * The 0x1d code is the SEND DIAGNOSTIC command. To
1692 		 * distinguish between the two, the last 10 bytes of the CBL
1693 		 * is filled with 0xff (section 2.2 of the CBI
1694 		 * specification)
1695 		 */
1696 		buf[0] = 0x1d;		/* Command Block Reset */
1697 		buf[1] = 0x04;
1698 
1699 		for (i = 2; i < UMASS_CBI_DIAGNOSTIC_CMDLEN; i++) {
1700 			buf[i] = 0xff;
1701 		}
1702 
1703 		pc = usbd_xfer_get_frame(xfer, 0);
1704 		usbd_copy_in(pc, 0, &req, sizeof(req));
1705 		pc = usbd_xfer_get_frame(xfer, 1);
1706 		usbd_copy_in(pc, 0, buf, sizeof(buf));
1707 
1708 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1709 		usbd_xfer_set_frame_len(xfer, 1, sizeof(buf));
1710 		usbd_xfer_set_frames(xfer, 2);
1711 		usbd_transfer_submit(xfer);
1712 		break;
1713 
1714 	default:			/* Error */
1715 		if (error == USB_ERR_CANCELLED)
1716 			umass_tr_error(xfer, error);
1717 		else
1718 			umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1719 		break;
1720 	}
1721 }
1722 
1723 static void
1724 umass_t_cbi_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1725 {
1726 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_RESET3,
1727 	    UMASS_T_CBI_DATA_READ, error);
1728 }
1729 
1730 static void
1731 umass_t_cbi_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1732 {
1733 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1734 
1735 	umass_t_cbi_data_clear_stall_callback
1736 	    (xfer, (sc->sc_xfer[UMASS_T_CBI_RESET4] &&
1737 	    sc->sc_xfer[UMASS_T_CBI_STATUS]) ?
1738 	    UMASS_T_CBI_RESET4 : UMASS_T_CBI_COMMAND,
1739 	    UMASS_T_CBI_DATA_WRITE, error);
1740 }
1741 
1742 static void
1743 umass_t_cbi_reset4_callback(struct usb_xfer *xfer, usb_error_t error)
1744 {
1745 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_COMMAND,
1746 	    UMASS_T_CBI_STATUS, error);
1747 }
1748 
1749 static void
1750 umass_t_cbi_data_clear_stall_callback(struct usb_xfer *xfer,
1751     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1752 {
1753 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1754 
1755 	switch (USB_GET_STATE(xfer)) {
1756 	case USB_ST_TRANSFERRED:
1757 tr_transferred:
1758 		if (next_xfer == UMASS_T_CBI_STATUS) {
1759 			umass_cbi_start_status(sc);
1760 		} else {
1761 			umass_transfer_start(sc, next_xfer);
1762 		}
1763 		break;
1764 
1765 	case USB_ST_SETUP:
1766 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1767 			goto tr_transferred;	/* should not happen */
1768 		}
1769 		break;
1770 
1771 	default:			/* Error */
1772 		umass_tr_error(xfer, error);
1773 		break;
1774 	}
1775 }
1776 
1777 static void
1778 umass_t_cbi_command_callback(struct usb_xfer *xfer, usb_error_t error)
1779 {
1780 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1781 	union ccb *ccb = sc->sc_transfer.ccb;
1782 	struct usb_device_request req;
1783 	struct usb_page_cache *pc;
1784 
1785 	switch (USB_GET_STATE(xfer)) {
1786 	case USB_ST_TRANSFERRED:
1787 
1788 		if (sc->sc_transfer.dir == DIR_NONE) {
1789 			umass_cbi_start_status(sc);
1790 		} else {
1791 			umass_transfer_start
1792 			    (sc, (sc->sc_transfer.dir == DIR_IN) ?
1793 			    UMASS_T_CBI_DATA_READ : UMASS_T_CBI_DATA_WRITE);
1794 		}
1795 		break;
1796 
1797 	case USB_ST_SETUP:
1798 
1799 		if (ccb) {
1800 			/*
1801 		         * do a CBI transfer with cmd_len bytes from
1802 		         * cmd_data, possibly a data phase of data_len
1803 		         * bytes from/to the device and finally a status
1804 		         * read phase.
1805 		         */
1806 
1807 			req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1808 			req.bRequest = UR_CBI_ADSC;
1809 			USETW(req.wValue, 0);
1810 			req.wIndex[0] = sc->sc_iface_no;
1811 			req.wIndex[1] = 0;
1812 			req.wLength[0] = sc->sc_transfer.cmd_len;
1813 			req.wLength[1] = 0;
1814 
1815 			pc = usbd_xfer_get_frame(xfer, 0);
1816 			usbd_copy_in(pc, 0, &req, sizeof(req));
1817 			pc = usbd_xfer_get_frame(xfer, 1);
1818 			usbd_copy_in(pc, 0, sc->sc_transfer.cmd_data,
1819 			    sc->sc_transfer.cmd_len);
1820 
1821 			usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1822 			usbd_xfer_set_frame_len(xfer, 1, sc->sc_transfer.cmd_len);
1823 			usbd_xfer_set_frames(xfer,
1824 			    sc->sc_transfer.cmd_len ? 2 : 1);
1825 
1826 			DIF(UDMASS_CBI,
1827 			    umass_cbi_dump_cmd(sc,
1828 			    sc->sc_transfer.cmd_data,
1829 			    sc->sc_transfer.cmd_len));
1830 
1831 			usbd_transfer_submit(xfer);
1832 		}
1833 		break;
1834 
1835 	default:			/* Error */
1836 		/*
1837 		 * STALL on the control pipe can be result of the command error.
1838 		 * Attempt to clear this STALL same as for bulk pipe also
1839 		 * results in command completion interrupt, but ASC/ASCQ there
1840 		 * look like not always valid, so don't bother about it.
1841 		 */
1842 		if ((error == USB_ERR_STALLED) ||
1843 		    (sc->sc_transfer.callback == &umass_cam_cb)) {
1844 			sc->sc_transfer.ccb = NULL;
1845 			(sc->sc_transfer.callback)
1846 			    (sc, ccb, sc->sc_transfer.data_len,
1847 			    STATUS_CMD_UNKNOWN);
1848 		} else {
1849 			umass_tr_error(xfer, error);
1850 			/* skip reset */
1851 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1852 		}
1853 		break;
1854 	}
1855 }
1856 
1857 static void
1858 umass_t_cbi_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1859 {
1860 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1861 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1862 	int actlen, sumlen;
1863 
1864 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1865 
1866 	switch (USB_GET_STATE(xfer)) {
1867 	case USB_ST_TRANSFERRED:
1868 		sc->sc_transfer.data_rem -= actlen;
1869 		sc->sc_transfer.data_ptr += actlen;
1870 		sc->sc_transfer.actlen += actlen;
1871 
1872 		if (actlen < sumlen) {
1873 			/* short transfer */
1874 			sc->sc_transfer.data_rem = 0;
1875 		}
1876 	case USB_ST_SETUP:
1877 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1878 		    max_bulk, sc->sc_transfer.data_rem);
1879 
1880 		if (sc->sc_transfer.data_rem == 0) {
1881 			umass_cbi_start_status(sc);
1882 			break;
1883 		}
1884 		if (max_bulk > sc->sc_transfer.data_rem) {
1885 			max_bulk = sc->sc_transfer.data_rem;
1886 		}
1887 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1888 
1889 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1890 		    max_bulk);
1891 
1892 		usbd_transfer_submit(xfer);
1893 		break;
1894 
1895 	default:			/* Error */
1896 		if ((error == USB_ERR_CANCELLED) ||
1897 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1898 			umass_tr_error(xfer, error);
1899 		} else {
1900 			umass_transfer_start(sc, UMASS_T_CBI_DATA_RD_CS);
1901 		}
1902 		break;
1903 	}
1904 }
1905 
1906 static void
1907 umass_t_cbi_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1908 {
1909 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1910 	    UMASS_T_CBI_DATA_READ, error);
1911 }
1912 
1913 static void
1914 umass_t_cbi_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1915 {
1916 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1917 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1918 	int actlen, sumlen;
1919 
1920 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1921 
1922 	switch (USB_GET_STATE(xfer)) {
1923 	case USB_ST_TRANSFERRED:
1924 		sc->sc_transfer.data_rem -= actlen;
1925 		sc->sc_transfer.data_ptr += actlen;
1926 		sc->sc_transfer.actlen += actlen;
1927 
1928 		if (actlen < sumlen) {
1929 			/* short transfer */
1930 			sc->sc_transfer.data_rem = 0;
1931 		}
1932 	case USB_ST_SETUP:
1933 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1934 		    max_bulk, sc->sc_transfer.data_rem);
1935 
1936 		if (sc->sc_transfer.data_rem == 0) {
1937 			umass_cbi_start_status(sc);
1938 			break;
1939 		}
1940 		if (max_bulk > sc->sc_transfer.data_rem) {
1941 			max_bulk = sc->sc_transfer.data_rem;
1942 		}
1943 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1944 
1945 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1946 		    max_bulk);
1947 
1948 		usbd_transfer_submit(xfer);
1949 		break;
1950 
1951 	default:			/* Error */
1952 		if ((error == USB_ERR_CANCELLED) ||
1953 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1954 			umass_tr_error(xfer, error);
1955 		} else {
1956 			umass_transfer_start(sc, UMASS_T_CBI_DATA_WR_CS);
1957 		}
1958 		break;
1959 	}
1960 }
1961 
1962 static void
1963 umass_t_cbi_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1964 {
1965 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1966 	    UMASS_T_CBI_DATA_WRITE, error);
1967 }
1968 
1969 static void
1970 umass_t_cbi_status_callback(struct usb_xfer *xfer, usb_error_t error)
1971 {
1972 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1973 	union ccb *ccb = sc->sc_transfer.ccb;
1974 	struct usb_page_cache *pc;
1975 	uint32_t residue;
1976 	uint8_t status;
1977 	int actlen;
1978 
1979 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1980 
1981 	switch (USB_GET_STATE(xfer)) {
1982 	case USB_ST_TRANSFERRED:
1983 
1984 		if (actlen < (int)sizeof(sc->sbl)) {
1985 			goto tr_setup;
1986 		}
1987 		pc = usbd_xfer_get_frame(xfer, 0);
1988 		usbd_copy_out(pc, 0, &sc->sbl, sizeof(sc->sbl));
1989 
1990 		residue = (sc->sc_transfer.data_len -
1991 		    sc->sc_transfer.actlen);
1992 
1993 		/* dissect the information in the buffer */
1994 
1995 		if (sc->sc_proto & UMASS_PROTO_UFI) {
1996 			/*
1997 			 * Section 3.4.3.1.3 specifies that the UFI command
1998 			 * protocol returns an ASC and ASCQ in the interrupt
1999 			 * data block.
2000 			 */
2001 
2002 			DPRINTF(sc, UDMASS_CBI, "UFI CCI, ASC = 0x%02x, "
2003 			    "ASCQ = 0x%02x\n", sc->sbl.ufi.asc,
2004 			    sc->sbl.ufi.ascq);
2005 
2006 			status = (((sc->sbl.ufi.asc == 0) &&
2007 			    (sc->sbl.ufi.ascq == 0)) ?
2008 			    STATUS_CMD_OK : STATUS_CMD_FAILED);
2009 
2010 			sc->sc_transfer.ccb = NULL;
2011 
2012 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2013 
2014 			(sc->sc_transfer.callback)
2015 			    (sc, ccb, residue, status);
2016 
2017 			break;
2018 
2019 		} else {
2020 			/* Command Interrupt Data Block */
2021 
2022 			DPRINTF(sc, UDMASS_CBI, "type=0x%02x, value=0x%02x\n",
2023 			    sc->sbl.common.type, sc->sbl.common.value);
2024 
2025 			if (sc->sbl.common.type == IDB_TYPE_CCI) {
2026 				status = (sc->sbl.common.value & IDB_VALUE_STATUS_MASK);
2027 
2028 				status = ((status == IDB_VALUE_PASS) ? STATUS_CMD_OK :
2029 				    (status == IDB_VALUE_FAIL) ? STATUS_CMD_FAILED :
2030 				    (status == IDB_VALUE_PERSISTENT) ? STATUS_CMD_FAILED :
2031 				    STATUS_WIRE_FAILED);
2032 
2033 				sc->sc_transfer.ccb = NULL;
2034 
2035 				sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2036 
2037 				(sc->sc_transfer.callback)
2038 				    (sc, ccb, residue, status);
2039 
2040 				break;
2041 			}
2042 		}
2043 
2044 		/* fallthrough */
2045 
2046 	case USB_ST_SETUP:
2047 tr_setup:
2048 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2049 		usbd_transfer_submit(xfer);
2050 		break;
2051 
2052 	default:			/* Error */
2053 		DPRINTF(sc, UDMASS_CBI, "Failed to read CSW: %s\n",
2054 		    usbd_errstr(error));
2055 		umass_tr_error(xfer, error);
2056 		break;
2057 	}
2058 }
2059 
2060 /*
2061  * CAM specific functions (used by SCSI, UFI, 8070i (ATAPI))
2062  */
2063 
2064 static int
2065 umass_cam_attach_sim(struct umass_softc *sc)
2066 {
2067 	struct cam_devq *devq;		/* Per device Queue */
2068 	cam_status status;
2069 
2070 	/*
2071 	 * A HBA is attached to the CAM layer.
2072 	 *
2073 	 * The CAM layer will then after a while start probing for devices on
2074 	 * the bus. The number of SIMs is limited to one.
2075 	 */
2076 
2077 	devq = cam_simq_alloc(1 /* maximum openings */ );
2078 	if (devq == NULL) {
2079 		return (ENOMEM);
2080 	}
2081 	sc->sc_sim = cam_sim_alloc
2082 	    (&umass_cam_action, &umass_cam_poll,
2083 	    DEVNAME_SIM,
2084 	    sc /* priv */ ,
2085 	    sc->sc_unit /* unit number */ ,
2086 	    &sc->sc_mtx /* mutex */ ,
2087 	    1 /* maximum device openings */ ,
2088 	    0 /* maximum tagged device openings */ ,
2089 	    devq);
2090 
2091 	if (sc->sc_sim == NULL) {
2092 		cam_simq_free(devq);
2093 		return (ENOMEM);
2094 	}
2095 
2096 	mtx_lock(&sc->sc_mtx);
2097 	status = xpt_bus_register(sc->sc_sim, sc->sc_dev, sc->sc_unit);
2098 	if (status != CAM_SUCCESS) {
2099 		cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2100 		mtx_unlock(&sc->sc_mtx);
2101 		printf("%s: xpt_bus_register failed with status %#x\n",
2102 		    __func__, status);
2103 		return (ENOMEM);
2104 	}
2105 	mtx_unlock(&sc->sc_mtx);
2106 
2107 	return (0);
2108 }
2109 
2110 static void
2111 umass_cam_attach(struct umass_softc *sc)
2112 {
2113 #ifndef USB_DEBUG
2114 	if (bootverbose)
2115 #endif
2116 		printf("%s:%d:%d: Attached to scbus%d\n",
2117 		    sc->sc_name, cam_sim_path(sc->sc_sim),
2118 		    sc->sc_unit, cam_sim_path(sc->sc_sim));
2119 }
2120 
2121 /* umass_cam_detach
2122  *	detach from the CAM layer
2123  */
2124 
2125 static void
2126 umass_cam_detach_sim(struct umass_softc *sc)
2127 {
2128 	int error;
2129 
2130 	if (sc->sc_sim != NULL) {
2131 		error = xpt_bus_deregister(cam_sim_path(sc->sc_sim));
2132 		if (error == 0) {
2133 			/* accessing the softc is not possible after this */
2134 			sc->sc_sim->softc = NULL;
2135 			DPRINTF(sc, UDMASS_SCSI, "%s: %s:%d:%d caling "
2136 			    "cam_sim_free sim %p refc %u mtx %p\n",
2137 			    __func__, sc->sc_name, cam_sim_path(sc->sc_sim),
2138 			    sc->sc_unit, sc->sc_sim,
2139 			    sc->sc_sim->refcount, sc->sc_sim->mtx);
2140 			cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2141 		} else {
2142 			panic("%s: %s: CAM layer is busy: errno %d\n",
2143 			    __func__, sc->sc_name, error);
2144 		}
2145 		sc->sc_sim = NULL;
2146 	}
2147 }
2148 
2149 /* umass_cam_action
2150  * 	CAM requests for action come through here
2151  */
2152 
2153 static void
2154 umass_cam_action(struct cam_sim *sim, union ccb *ccb)
2155 {
2156 	struct umass_softc *sc = cam_sim_softc(sim);
2157 
2158 	if (sc == NULL) {
2159 		ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2160 		xpt_done(ccb);
2161 		return;
2162 	}
2163 
2164 	/* Perform the requested action */
2165 	switch (ccb->ccb_h.func_code) {
2166 	case XPT_SCSI_IO:
2167 		{
2168 			uint8_t *cmd;
2169 			uint8_t dir;
2170 
2171 			if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2172 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2173 			} else {
2174 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2175 			}
2176 
2177 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_SCSI_IO: "
2178 			    "cmd: 0x%02x, flags: 0x%02x, "
2179 			    "%db cmd/%db data/%db sense\n",
2180 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2181 			    (uintmax_t)ccb->ccb_h.target_lun, cmd[0],
2182 			    ccb->ccb_h.flags & CAM_DIR_MASK, ccb->csio.cdb_len,
2183 			    ccb->csio.dxfer_len, ccb->csio.sense_len);
2184 
2185 			if (sc->sc_transfer.ccb) {
2186 				DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_SCSI_IO: "
2187 				    "I/O in progress, deferring\n",
2188 				    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2189 				    (uintmax_t)ccb->ccb_h.target_lun);
2190 				ccb->ccb_h.status = CAM_SCSI_BUSY;
2191 				xpt_done(ccb);
2192 				goto done;
2193 			}
2194 			switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
2195 			case CAM_DIR_IN:
2196 				dir = DIR_IN;
2197 				break;
2198 			case CAM_DIR_OUT:
2199 				dir = DIR_OUT;
2200 				DIF(UDMASS_SCSI,
2201 				    umass_dump_buffer(sc, ccb->csio.data_ptr,
2202 				    ccb->csio.dxfer_len, 48));
2203 				break;
2204 			default:
2205 				dir = DIR_NONE;
2206 			}
2207 
2208 			ccb->ccb_h.status = CAM_REQ_INPROG | CAM_SIM_QUEUED;
2209 
2210 			/*
2211 			 * sc->sc_transform will convert the command to the
2212 			 * command format needed by the specific command set
2213 			 * and return the converted command in
2214 			 * "sc->sc_transfer.cmd_data"
2215 			 */
2216 			if (umass_std_transform(sc, ccb, cmd, ccb->csio.cdb_len)) {
2217 				if (sc->sc_transfer.cmd_data[0] == INQUIRY) {
2218 					const char *pserial;
2219 
2220 					pserial = usb_get_serial(sc->sc_udev);
2221 
2222 					/*
2223 					 * Umass devices don't generally report their serial numbers
2224 					 * in the usual SCSI way.  Emulate it here.
2225 					 */
2226 					if ((sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2227 					    (sc->sc_transfer.cmd_data[2] == SVPD_UNIT_SERIAL_NUMBER) &&
2228 					    (pserial[0] != '\0')) {
2229 						struct scsi_vpd_unit_serial_number *vpd_serial;
2230 
2231 						vpd_serial = (struct scsi_vpd_unit_serial_number *)ccb->csio.data_ptr;
2232 						vpd_serial->length = strlen(pserial);
2233 						if (vpd_serial->length > sizeof(vpd_serial->serial_num))
2234 							vpd_serial->length = sizeof(vpd_serial->serial_num);
2235 						memcpy(vpd_serial->serial_num, pserial, vpd_serial->length);
2236 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2237 						ccb->ccb_h.status = CAM_REQ_CMP;
2238 						xpt_done(ccb);
2239 						goto done;
2240 					}
2241 
2242 					/*
2243 					 * Handle EVPD inquiry for broken devices first
2244 					 * NO_INQUIRY also implies NO_INQUIRY_EVPD
2245 					 */
2246 					if ((sc->sc_quirks & (NO_INQUIRY_EVPD | NO_INQUIRY)) &&
2247 					    (sc->sc_transfer.cmd_data[1] & SI_EVPD)) {
2248 						scsi_set_sense_data(&ccb->csio.sense_data,
2249 							/*sense_format*/ SSD_TYPE_NONE,
2250 							/*current_error*/ 1,
2251 							/*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2252 							/*asc*/ 0x24,
2253 							/*ascq*/ 0x00,
2254 							/*extra args*/ SSD_ELEM_NONE);
2255 						ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2256 						ccb->ccb_h.status =
2257 						    CAM_SCSI_STATUS_ERROR |
2258 						    CAM_AUTOSNS_VALID |
2259 						    CAM_DEV_QFRZN;
2260 						xpt_freeze_devq(ccb->ccb_h.path, 1);
2261 						xpt_done(ccb);
2262 						goto done;
2263 					}
2264 					/*
2265 					 * Return fake inquiry data for
2266 					 * broken devices
2267 					 */
2268 					if (sc->sc_quirks & NO_INQUIRY) {
2269 						memcpy(ccb->csio.data_ptr, &fake_inq_data,
2270 						    sizeof(fake_inq_data));
2271 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2272 						ccb->ccb_h.status = CAM_REQ_CMP;
2273 						xpt_done(ccb);
2274 						goto done;
2275 					}
2276 					if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2277 						ccb->csio.dxfer_len = SHORT_INQUIRY_LENGTH;
2278 					}
2279 				} else if (sc->sc_transfer.cmd_data[0] == PREVENT_ALLOW) {
2280 					if (sc->sc_quirks & NO_PREVENT_ALLOW) {
2281 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2282 						ccb->ccb_h.status = CAM_REQ_CMP;
2283 						xpt_done(ccb);
2284 						goto done;
2285 					}
2286 				} else if (sc->sc_transfer.cmd_data[0] == SYNCHRONIZE_CACHE) {
2287 					if (sc->sc_quirks & NO_SYNCHRONIZE_CACHE) {
2288 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2289 						ccb->ccb_h.status = CAM_REQ_CMP;
2290 						xpt_done(ccb);
2291 						goto done;
2292 					}
2293 				} else if (sc->sc_transfer.cmd_data[0] == START_STOP_UNIT) {
2294 					if (sc->sc_quirks & NO_START_STOP) {
2295 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2296 						ccb->ccb_h.status = CAM_REQ_CMP;
2297 						xpt_done(ccb);
2298 						goto done;
2299 					}
2300 				}
2301 				umass_command_start(sc, dir, ccb->csio.data_ptr,
2302 				    ccb->csio.dxfer_len,
2303 				    ccb->ccb_h.timeout,
2304 				    &umass_cam_cb, ccb);
2305 			}
2306 			break;
2307 		}
2308 	case XPT_PATH_INQ:
2309 		{
2310 			struct ccb_pathinq *cpi = &ccb->cpi;
2311 
2312 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_PATH_INQ:.\n",
2313 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2314 			    (uintmax_t)ccb->ccb_h.target_lun);
2315 
2316 			/* host specific information */
2317 			cpi->version_num = 1;
2318 			cpi->hba_inquiry = 0;
2319 			cpi->target_sprt = 0;
2320 			cpi->hba_misc = PIM_NO_6_BYTE;
2321 			cpi->hba_eng_cnt = 0;
2322 			cpi->max_target = UMASS_SCSIID_MAX;	/* one target */
2323 			cpi->initiator_id = UMASS_SCSIID_HOST;
2324 			strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2325 			strlcpy(cpi->hba_vid, "USB SCSI", HBA_IDLEN);
2326 			strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2327 			cpi->unit_number = cam_sim_unit(sim);
2328 			cpi->bus_id = sc->sc_unit;
2329 			cpi->protocol = PROTO_SCSI;
2330 			cpi->protocol_version = SCSI_REV_2;
2331 			cpi->transport = XPORT_USB;
2332 			cpi->transport_version = 0;
2333 
2334 			if (sc == NULL) {
2335 				cpi->base_transfer_speed = 0;
2336 				cpi->max_lun = 0;
2337 			} else {
2338 				if (sc->sc_quirks & FLOPPY_SPEED) {
2339 					cpi->base_transfer_speed =
2340 					    UMASS_FLOPPY_TRANSFER_SPEED;
2341 				} else {
2342 					switch (usbd_get_speed(sc->sc_udev)) {
2343 					case USB_SPEED_SUPER:
2344 						cpi->base_transfer_speed =
2345 						    UMASS_SUPER_TRANSFER_SPEED;
2346 						cpi->maxio = maxphys;
2347 						break;
2348 					case USB_SPEED_HIGH:
2349 						cpi->base_transfer_speed =
2350 						    UMASS_HIGH_TRANSFER_SPEED;
2351 						break;
2352 					default:
2353 						cpi->base_transfer_speed =
2354 						    UMASS_FULL_TRANSFER_SPEED;
2355 						break;
2356 					}
2357 				}
2358 				cpi->max_lun = sc->sc_maxlun;
2359 			}
2360 
2361 			cpi->ccb_h.status = CAM_REQ_CMP;
2362 			xpt_done(ccb);
2363 			break;
2364 		}
2365 	case XPT_RESET_DEV:
2366 		{
2367 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_RESET_DEV:.\n",
2368 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2369 			    (uintmax_t)ccb->ccb_h.target_lun);
2370 
2371 			umass_reset(sc);
2372 
2373 			ccb->ccb_h.status = CAM_REQ_CMP;
2374 			xpt_done(ccb);
2375 			break;
2376 		}
2377 	case XPT_GET_TRAN_SETTINGS:
2378 		{
2379 			struct ccb_trans_settings *cts = &ccb->cts;
2380 
2381 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_GET_TRAN_SETTINGS:.\n",
2382 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2383 			    (uintmax_t)ccb->ccb_h.target_lun);
2384 
2385 			cts->protocol = PROTO_SCSI;
2386 			cts->protocol_version = SCSI_REV_2;
2387 			cts->transport = XPORT_USB;
2388 			cts->transport_version = 0;
2389 			cts->xport_specific.valid = 0;
2390 
2391 			ccb->ccb_h.status = CAM_REQ_CMP;
2392 			xpt_done(ccb);
2393 			break;
2394 		}
2395 	case XPT_SET_TRAN_SETTINGS:
2396 		{
2397 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_SET_TRAN_SETTINGS:.\n",
2398 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2399 			    (uintmax_t)ccb->ccb_h.target_lun);
2400 
2401 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2402 			xpt_done(ccb);
2403 			break;
2404 		}
2405 	case XPT_CALC_GEOMETRY:
2406 		{
2407 			cam_calc_geometry(&ccb->ccg, /* extended */ 1);
2408 			xpt_done(ccb);
2409 			break;
2410 		}
2411 	case XPT_NOOP:
2412 		{
2413 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_NOOP:.\n",
2414 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2415 			    (uintmax_t)ccb->ccb_h.target_lun);
2416 
2417 			ccb->ccb_h.status = CAM_REQ_CMP;
2418 			xpt_done(ccb);
2419 			break;
2420 		}
2421 	default:
2422 		DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:func_code 0x%04x: "
2423 		    "Not implemented\n",
2424 		    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2425 		    (uintmax_t)ccb->ccb_h.target_lun, ccb->ccb_h.func_code);
2426 
2427 		ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2428 		xpt_done(ccb);
2429 		break;
2430 	}
2431 
2432 done:
2433 	return;
2434 }
2435 
2436 static void
2437 umass_cam_poll(struct cam_sim *sim)
2438 {
2439 	struct umass_softc *sc = cam_sim_softc(sim);
2440 
2441 	if (sc == NULL)
2442 		return;
2443 
2444 	DPRINTF(sc, UDMASS_SCSI, "CAM poll\n");
2445 
2446 	usbd_transfer_poll(sc->sc_xfer, UMASS_T_MAX);
2447 }
2448 
2449 /* umass_cam_cb
2450  *	finalise a completed CAM command
2451  */
2452 
2453 static void
2454 umass_cam_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2455     uint8_t status)
2456 {
2457 	ccb->csio.resid = residue;
2458 
2459 	switch (status) {
2460 	case STATUS_CMD_OK:
2461 		ccb->ccb_h.status = CAM_REQ_CMP;
2462 		if ((sc->sc_quirks & READ_CAPACITY_OFFBY1) &&
2463 		    (ccb->ccb_h.func_code == XPT_SCSI_IO) &&
2464 		    (ccb->csio.cdb_io.cdb_bytes[0] == READ_CAPACITY)) {
2465 			struct scsi_read_capacity_data *rcap;
2466 			uint32_t maxsector;
2467 
2468 			rcap = (void *)(ccb->csio.data_ptr);
2469 			maxsector = scsi_4btoul(rcap->addr) - 1;
2470 			scsi_ulto4b(maxsector, rcap->addr);
2471 		}
2472 		/*
2473 		 * We have to add SVPD_UNIT_SERIAL_NUMBER to the list
2474 		 * of pages supported by the device - otherwise, CAM
2475 		 * will never ask us for the serial number if the
2476 		 * device cannot handle that by itself.
2477 		 */
2478 		if (ccb->ccb_h.func_code == XPT_SCSI_IO &&
2479 		    sc->sc_transfer.cmd_data[0] == INQUIRY &&
2480 		    (sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2481 		    sc->sc_transfer.cmd_data[2] == SVPD_SUPPORTED_PAGE_LIST &&
2482 		    (usb_get_serial(sc->sc_udev)[0] != '\0')) {
2483 			struct ccb_scsiio *csio;
2484 			struct scsi_vpd_supported_page_list *page_list;
2485 
2486 			csio = &ccb->csio;
2487 			page_list = (struct scsi_vpd_supported_page_list *)csio->data_ptr;
2488 			if (page_list->length + 1 < SVPD_SUPPORTED_PAGES_SIZE) {
2489 				page_list->list[page_list->length] = SVPD_UNIT_SERIAL_NUMBER;
2490 				page_list->length++;
2491 			}
2492 		}
2493 		xpt_done(ccb);
2494 		break;
2495 
2496 	case STATUS_CMD_UNKNOWN:
2497 	case STATUS_CMD_FAILED:
2498 
2499 		/* fetch sense data */
2500 
2501 		/* the rest of the command was filled in at attach */
2502 		sc->cam_scsi_sense.length = ccb->csio.sense_len;
2503 
2504 		DPRINTF(sc, UDMASS_SCSI, "Fetching %d bytes of "
2505 		    "sense data\n", ccb->csio.sense_len);
2506 
2507 		if (umass_std_transform(sc, ccb, &sc->cam_scsi_sense.opcode,
2508 		    sizeof(sc->cam_scsi_sense))) {
2509 			if ((sc->sc_quirks & FORCE_SHORT_INQUIRY) &&
2510 			    (sc->sc_transfer.cmd_data[0] == INQUIRY)) {
2511 				ccb->csio.sense_len = SHORT_INQUIRY_LENGTH;
2512 			}
2513 			umass_command_start(sc, DIR_IN, &ccb->csio.sense_data.error_code,
2514 			    ccb->csio.sense_len, ccb->ccb_h.timeout,
2515 			    &umass_cam_sense_cb, ccb);
2516 		}
2517 		break;
2518 
2519 	default:
2520 		/*
2521 		 * The wire protocol failed and will hopefully have
2522 		 * recovered. We return an error to CAM and let CAM
2523 		 * retry the command if necessary.
2524 		 */
2525 		xpt_freeze_devq(ccb->ccb_h.path, 1);
2526 		ccb->ccb_h.status = CAM_REQ_CMP_ERR | CAM_DEV_QFRZN;
2527 		xpt_done(ccb);
2528 		break;
2529 	}
2530 }
2531 
2532 /*
2533  * Finalise a completed autosense operation
2534  */
2535 static void
2536 umass_cam_sense_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2537     uint8_t status)
2538 {
2539 	uint8_t *cmd;
2540 
2541 	switch (status) {
2542 	case STATUS_CMD_OK:
2543 	case STATUS_CMD_UNKNOWN:
2544 	case STATUS_CMD_FAILED: {
2545 		int key, sense_len;
2546 
2547 		ccb->csio.sense_resid = residue;
2548 		sense_len = ccb->csio.sense_len - ccb->csio.sense_resid;
2549 		key = scsi_get_sense_key(&ccb->csio.sense_data, sense_len,
2550 					 /*show_errors*/ 1);
2551 
2552 		if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2553 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2554 		} else {
2555 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2556 		}
2557 
2558 		/*
2559 		 * Getting sense data always succeeds (apart from wire
2560 		 * failures):
2561 		 */
2562 		if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2563 		    (cmd[0] == INQUIRY) &&
2564 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2565 			/*
2566 			 * Ignore unit attention errors in the case where
2567 			 * the Unit Attention state is not cleared on
2568 			 * REQUEST SENSE. They will appear again at the next
2569 			 * command.
2570 			 */
2571 			ccb->ccb_h.status = CAM_REQ_CMP;
2572 		} else if (key == SSD_KEY_NO_SENSE) {
2573 			/*
2574 			 * No problem after all (in the case of CBI without
2575 			 * CCI)
2576 			 */
2577 			ccb->ccb_h.status = CAM_REQ_CMP;
2578 		} else if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2579 			    (cmd[0] == READ_CAPACITY) &&
2580 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2581 			/*
2582 			 * Some devices do not clear the unit attention error
2583 			 * on request sense. We insert a test unit ready
2584 			 * command to make sure we clear the unit attention
2585 			 * condition, then allow the retry to proceed as
2586 			 * usual.
2587 			 */
2588 
2589 			xpt_freeze_devq(ccb->ccb_h.path, 1);
2590 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2591 			    | CAM_AUTOSNS_VALID | CAM_DEV_QFRZN;
2592 			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2593 
2594 #if 0
2595 			DELAY(300000);
2596 #endif
2597 			DPRINTF(sc, UDMASS_SCSI, "Doing a sneaky"
2598 			    "TEST_UNIT_READY\n");
2599 
2600 			/* the rest of the command was filled in at attach */
2601 
2602 			if ((sc->sc_transform)(sc,
2603 			    &sc->cam_scsi_test_unit_ready.opcode,
2604 			    sizeof(sc->cam_scsi_test_unit_ready)) == 1) {
2605 				umass_command_start(sc, DIR_NONE, NULL, 0,
2606 				    ccb->ccb_h.timeout,
2607 				    &umass_cam_quirk_cb, ccb);
2608 				break;
2609 			}
2610 		} else {
2611 			xpt_freeze_devq(ccb->ccb_h.path, 1);
2612 			if (key >= 0) {
2613 				ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2614 				    | CAM_AUTOSNS_VALID | CAM_DEV_QFRZN;
2615 				ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2616 			} else
2617 				ccb->ccb_h.status = CAM_AUTOSENSE_FAIL
2618 				    | CAM_DEV_QFRZN;
2619 		}
2620 		xpt_done(ccb);
2621 		break;
2622 	}
2623 	default:
2624 		DPRINTF(sc, UDMASS_SCSI, "Autosense failed, "
2625 		    "status %d\n", status);
2626 		xpt_freeze_devq(ccb->ccb_h.path, 1);
2627 		ccb->ccb_h.status = CAM_AUTOSENSE_FAIL | CAM_DEV_QFRZN;
2628 		xpt_done(ccb);
2629 	}
2630 }
2631 
2632 /*
2633  * This completion code just handles the fact that we sent a test-unit-ready
2634  * after having previously failed a READ CAPACITY with CHECK_COND.  The CCB
2635  * status for CAM is already set earlier.
2636  */
2637 static void
2638 umass_cam_quirk_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2639     uint8_t status)
2640 {
2641 	DPRINTF(sc, UDMASS_SCSI, "Test unit ready "
2642 	    "returned status %d\n", status);
2643 
2644 	xpt_done(ccb);
2645 }
2646 
2647 /*
2648  * SCSI specific functions
2649  */
2650 
2651 static uint8_t
2652 umass_scsi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2653     uint8_t cmd_len)
2654 {
2655 	if ((cmd_len == 0) ||
2656 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2657 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2658 		    "length: %d bytes\n", cmd_len);
2659 		return (0);		/* failure */
2660 	}
2661 	sc->sc_transfer.cmd_len = cmd_len;
2662 
2663 	switch (cmd_ptr[0]) {
2664 	case TEST_UNIT_READY:
2665 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2666 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2667 			    "to START_UNIT\n");
2668 			memset(sc->sc_transfer.cmd_data, 0, cmd_len);
2669 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2670 			sc->sc_transfer.cmd_data[4] = SSS_START;
2671 			return (1);
2672 		}
2673 		break;
2674 
2675 	case INQUIRY:
2676 		/*
2677 		 * some drives wedge when asked for full inquiry
2678 		 * information.
2679 		 */
2680 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2681 			memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2682 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2683 			return (1);
2684 		}
2685 		break;
2686 	}
2687 
2688 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2689 	return (1);
2690 }
2691 
2692 static uint8_t
2693 umass_rbc_transform(struct umass_softc *sc, uint8_t *cmd_ptr, uint8_t cmd_len)
2694 {
2695 	if ((cmd_len == 0) ||
2696 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2697 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2698 		    "length: %d bytes\n", cmd_len);
2699 		return (0);		/* failure */
2700 	}
2701 	switch (cmd_ptr[0]) {
2702 		/* these commands are defined in RBC: */
2703 	case READ_10:
2704 	case READ_CAPACITY:
2705 	case START_STOP_UNIT:
2706 	case SYNCHRONIZE_CACHE:
2707 	case WRITE_10:
2708 	case VERIFY_10:
2709 	case INQUIRY:
2710 	case MODE_SELECT_10:
2711 	case MODE_SENSE_10:
2712 	case TEST_UNIT_READY:
2713 	case WRITE_BUFFER:
2714 		/*
2715 		 * The following commands are not listed in my copy of the
2716 		 * RBC specs. CAM however seems to want those, and at least
2717 		 * the Sony DSC device appears to support those as well
2718 		 */
2719 	case REQUEST_SENSE:
2720 	case PREVENT_ALLOW:
2721 
2722 		memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2723 
2724 		if ((sc->sc_quirks & RBC_PAD_TO_12) && (cmd_len < 12)) {
2725 			memset(sc->sc_transfer.cmd_data + cmd_len,
2726 			    0, 12 - cmd_len);
2727 			cmd_len = 12;
2728 		}
2729 		sc->sc_transfer.cmd_len = cmd_len;
2730 		return (1);		/* success */
2731 
2732 		/* All other commands are not legal in RBC */
2733 	default:
2734 		DPRINTF(sc, UDMASS_SCSI, "Unsupported RBC "
2735 		    "command 0x%02x\n", cmd_ptr[0]);
2736 		return (0);		/* failure */
2737 	}
2738 }
2739 
2740 static uint8_t
2741 umass_ufi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2742     uint8_t cmd_len)
2743 {
2744 	if ((cmd_len == 0) ||
2745 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2746 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2747 		    "length: %d bytes\n", cmd_len);
2748 		return (0);		/* failure */
2749 	}
2750 	/* An UFI command is always 12 bytes in length */
2751 	sc->sc_transfer.cmd_len = UFI_COMMAND_LENGTH;
2752 
2753 	/* Zero the command data */
2754 	memset(sc->sc_transfer.cmd_data, 0, UFI_COMMAND_LENGTH);
2755 
2756 	switch (cmd_ptr[0]) {
2757 		/*
2758 		 * Commands of which the format has been verified. They
2759 		 * should work. Copy the command into the (zeroed out)
2760 		 * destination buffer.
2761 		 */
2762 	case TEST_UNIT_READY:
2763 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2764 			/*
2765 			 * Some devices do not support this command. Start
2766 			 * Stop Unit should give the same results
2767 			 */
2768 			DPRINTF(sc, UDMASS_UFI, "Converted TEST_UNIT_READY "
2769 			    "to START_UNIT\n");
2770 
2771 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2772 			sc->sc_transfer.cmd_data[4] = SSS_START;
2773 			return (1);
2774 		}
2775 		break;
2776 
2777 	case REZERO_UNIT:
2778 	case REQUEST_SENSE:
2779 	case FORMAT_UNIT:
2780 	case INQUIRY:
2781 	case START_STOP_UNIT:
2782 	case SEND_DIAGNOSTIC:
2783 	case PREVENT_ALLOW:
2784 	case READ_CAPACITY:
2785 	case READ_10:
2786 	case WRITE_10:
2787 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2788 	case WRITE_AND_VERIFY:
2789 	case VERIFY:
2790 	case MODE_SELECT_10:
2791 	case MODE_SENSE_10:
2792 	case READ_12:
2793 	case WRITE_12:
2794 	case READ_FORMAT_CAPACITIES:
2795 		break;
2796 
2797 		/*
2798 		 * SYNCHRONIZE_CACHE isn't supported by UFI, nor should it be
2799 		 * required for UFI devices, so it is appropriate to fake
2800 		 * success.
2801 		 */
2802 	case SYNCHRONIZE_CACHE:
2803 		return (2);
2804 
2805 	default:
2806 		DPRINTF(sc, UDMASS_SCSI, "Unsupported UFI "
2807 		    "command 0x%02x\n", cmd_ptr[0]);
2808 		return (0);		/* failure */
2809 	}
2810 
2811 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2812 	return (1);			/* success */
2813 }
2814 
2815 /*
2816  * 8070i (ATAPI) specific functions
2817  */
2818 static uint8_t
2819 umass_atapi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2820     uint8_t cmd_len)
2821 {
2822 	if ((cmd_len == 0) ||
2823 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2824 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2825 		    "length: %d bytes\n", cmd_len);
2826 		return (0);		/* failure */
2827 	}
2828 	/* An ATAPI command is always 12 bytes in length. */
2829 	sc->sc_transfer.cmd_len = ATAPI_COMMAND_LENGTH;
2830 
2831 	/* Zero the command data */
2832 	memset(sc->sc_transfer.cmd_data, 0, ATAPI_COMMAND_LENGTH);
2833 
2834 	switch (cmd_ptr[0]) {
2835 		/*
2836 		 * Commands of which the format has been verified. They
2837 		 * should work. Copy the command into the destination
2838 		 * buffer.
2839 		 */
2840 	case INQUIRY:
2841 		/*
2842 		 * some drives wedge when asked for full inquiry
2843 		 * information.
2844 		 */
2845 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2846 			memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2847 
2848 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2849 			return (1);
2850 		}
2851 		break;
2852 
2853 	case TEST_UNIT_READY:
2854 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2855 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2856 			    "to START_UNIT\n");
2857 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2858 			sc->sc_transfer.cmd_data[4] = SSS_START;
2859 			return (1);
2860 		}
2861 		break;
2862 
2863 	case REZERO_UNIT:
2864 	case REQUEST_SENSE:
2865 	case START_STOP_UNIT:
2866 	case SEND_DIAGNOSTIC:
2867 	case PREVENT_ALLOW:
2868 	case READ_CAPACITY:
2869 	case READ_10:
2870 	case WRITE_10:
2871 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2872 	case SYNCHRONIZE_CACHE:
2873 	case MODE_SELECT_10:
2874 	case MODE_SENSE_10:
2875 	case READ_BUFFER:
2876 	case 0x42:			/* READ_SUBCHANNEL */
2877 	case 0x43:			/* READ_TOC */
2878 	case 0x44:			/* READ_HEADER */
2879 	case 0x47:			/* PLAY_MSF (Play Minute/Second/Frame) */
2880 	case 0x48:			/* PLAY_TRACK */
2881 	case 0x49:			/* PLAY_TRACK_REL */
2882 	case 0x4b:			/* PAUSE */
2883 	case 0x51:			/* READ_DISK_INFO */
2884 	case 0x52:			/* READ_TRACK_INFO */
2885 	case 0x54:			/* SEND_OPC */
2886 	case 0x59:			/* READ_MASTER_CUE */
2887 	case 0x5b:			/* CLOSE_TR_SESSION */
2888 	case 0x5c:			/* READ_BUFFER_CAP */
2889 	case 0x5d:			/* SEND_CUE_SHEET */
2890 	case 0xa1:			/* BLANK */
2891 	case 0xa5:			/* PLAY_12 */
2892 	case 0xa6:			/* EXCHANGE_MEDIUM */
2893 	case 0xad:			/* READ_DVD_STRUCTURE */
2894 	case 0xbb:			/* SET_CD_SPEED */
2895 	case 0xe5:			/* READ_TRACK_INFO_PHILIPS */
2896 		break;
2897 
2898 	case READ_12:
2899 	case WRITE_12:
2900 	default:
2901 		DPRINTF(sc, UDMASS_SCSI, "Unsupported ATAPI "
2902 		    "command 0x%02x - trying anyway\n",
2903 		    cmd_ptr[0]);
2904 		break;
2905 	}
2906 
2907 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2908 	return (1);			/* success */
2909 }
2910 
2911 static uint8_t
2912 umass_no_transform(struct umass_softc *sc, uint8_t *cmd,
2913     uint8_t cmdlen)
2914 {
2915 	return (0);			/* failure */
2916 }
2917 
2918 static uint8_t
2919 umass_std_transform(struct umass_softc *sc, union ccb *ccb,
2920     uint8_t *cmd, uint8_t cmdlen)
2921 {
2922 	uint8_t retval;
2923 
2924 	retval = (sc->sc_transform) (sc, cmd, cmdlen);
2925 
2926 	if (retval == 2) {
2927 		ccb->ccb_h.status = CAM_REQ_CMP;
2928 		xpt_done(ccb);
2929 		return (0);
2930 	} else if (retval == 0) {
2931 		xpt_freeze_devq(ccb->ccb_h.path, 1);
2932 		ccb->ccb_h.status = CAM_REQ_INVALID | CAM_DEV_QFRZN;
2933 		xpt_done(ccb);
2934 		return (0);
2935 	}
2936 	/* Command should be executed */
2937 	return (1);
2938 }
2939 
2940 #ifdef USB_DEBUG
2941 static void
2942 umass_bbb_dump_cbw(struct umass_softc *sc, umass_bbb_cbw_t *cbw)
2943 {
2944 	uint8_t *c = cbw->CBWCDB;
2945 
2946 	uint32_t dlen = UGETDW(cbw->dCBWDataTransferLength);
2947 	uint32_t tag = UGETDW(cbw->dCBWTag);
2948 
2949 	uint8_t clen = cbw->bCDBLength;
2950 	uint8_t flags = cbw->bCBWFlags;
2951 	uint8_t lun = cbw->bCBWLUN;
2952 
2953 	DPRINTF(sc, UDMASS_BBB, "CBW %d: cmd = %db "
2954 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
2955 	    "data = %db, lun = %d, dir = %s\n",
2956 	    tag, clen,
2957 	    c[0], c[1], c[2], c[3], c[4], c[5], (clen > 6 ? "..." : ""),
2958 	    dlen, lun, (flags == CBWFLAGS_IN ? "in" :
2959 	    (flags == CBWFLAGS_OUT ? "out" : "<invalid>")));
2960 }
2961 
2962 static void
2963 umass_bbb_dump_csw(struct umass_softc *sc, umass_bbb_csw_t *csw)
2964 {
2965 	uint32_t sig = UGETDW(csw->dCSWSignature);
2966 	uint32_t tag = UGETDW(csw->dCSWTag);
2967 	uint32_t res = UGETDW(csw->dCSWDataResidue);
2968 	uint8_t status = csw->bCSWStatus;
2969 
2970 	DPRINTF(sc, UDMASS_BBB, "CSW %d: sig = 0x%08x (%s), tag = 0x%08x, "
2971 	    "res = %d, status = 0x%02x (%s)\n",
2972 	    tag, sig, (sig == CSWSIGNATURE ? "valid" : "invalid"),
2973 	    tag, res,
2974 	    status, (status == CSWSTATUS_GOOD ? "good" :
2975 	    (status == CSWSTATUS_FAILED ? "failed" :
2976 	    (status == CSWSTATUS_PHASE ? "phase" : "<invalid>"))));
2977 }
2978 
2979 static void
2980 umass_cbi_dump_cmd(struct umass_softc *sc, void *cmd, uint8_t cmdlen)
2981 {
2982 	uint8_t *c = cmd;
2983 	uint8_t dir = sc->sc_transfer.dir;
2984 
2985 	DPRINTF(sc, UDMASS_BBB, "cmd = %db "
2986 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
2987 	    "data = %db, dir = %s\n",
2988 	    cmdlen,
2989 	    c[0], c[1], c[2], c[3], c[4], c[5], (cmdlen > 6 ? "..." : ""),
2990 	    sc->sc_transfer.data_len,
2991 	    (dir == DIR_IN ? "in" :
2992 	    (dir == DIR_OUT ? "out" :
2993 	    (dir == DIR_NONE ? "no data phase" : "<invalid>"))));
2994 }
2995 
2996 static void
2997 umass_dump_buffer(struct umass_softc *sc, uint8_t *buffer, uint32_t buflen,
2998     uint32_t printlen)
2999 {
3000 	uint32_t i, j;
3001 	char s1[40];
3002 	char s2[40];
3003 	char s3[5];
3004 
3005 	s1[0] = '\0';
3006 	s3[0] = '\0';
3007 
3008 	sprintf(s2, " buffer=%p, buflen=%d", buffer, buflen);
3009 	for (i = 0; (i < buflen) && (i < printlen); i++) {
3010 		j = i % 16;
3011 		if (j == 0 && i != 0) {
3012 			DPRINTF(sc, UDMASS_GEN, "0x %s%s\n",
3013 			    s1, s2);
3014 			s2[0] = '\0';
3015 		}
3016 		sprintf(&s1[j * 2], "%02x", buffer[i] & 0xff);
3017 	}
3018 	if (buflen > printlen)
3019 		sprintf(s3, " ...");
3020 	DPRINTF(sc, UDMASS_GEN, "0x %s%s%s\n",
3021 	    s1, s2, s3);
3022 }
3023 
3024 #endif
3025