xref: /freebsd-12.1/sys/dev/usb/storage/umass.c (revision dfd2f2d4)
1 #include <sys/cdefs.h>
2 __FBSDID("$FreeBSD$");
3 
4 /*-
5  * Copyright (c) 1999 MAEKAWA Masahide <[email protected]>,
6  *		      Nick Hibma <[email protected]>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  *	$FreeBSD$
31  *	$NetBSD: umass.c,v 1.28 2000/04/02 23:46:53 augustss Exp $
32  */
33 
34 /* Also already merged from NetBSD:
35  *	$NetBSD: umass.c,v 1.67 2001/11/25 19:05:22 augustss Exp $
36  *	$NetBSD: umass.c,v 1.90 2002/11/04 19:17:33 pooka Exp $
37  *	$NetBSD: umass.c,v 1.108 2003/11/07 17:03:25 wiz Exp $
38  *	$NetBSD: umass.c,v 1.109 2003/12/04 13:57:31 keihan Exp $
39  */
40 
41 /*
42  * Universal Serial Bus Mass Storage Class specs:
43  * http://www.usb.org/developers/devclass_docs/usb_msc_overview_1.2.pdf
44  * http://www.usb.org/developers/devclass_docs/usbmassbulk_10.pdf
45  * http://www.usb.org/developers/devclass_docs/usb_msc_cbi_1.1.pdf
46  * http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf
47  */
48 
49 /*
50  * Ported to NetBSD by Lennart Augustsson <[email protected]>.
51  * Parts of the code written by Jason R. Thorpe <[email protected]>.
52  */
53 
54 /*
55  * The driver handles 3 Wire Protocols
56  * - Command/Bulk/Interrupt (CBI)
57  * - Command/Bulk/Interrupt with Command Completion Interrupt (CBI with CCI)
58  * - Mass Storage Bulk-Only (BBB)
59  *   (BBB refers Bulk/Bulk/Bulk for Command/Data/Status phases)
60  *
61  * Over these wire protocols it handles the following command protocols
62  * - SCSI
63  * - UFI (floppy command set)
64  * - 8070i (ATAPI)
65  *
66  * UFI and 8070i (ATAPI) are transformed versions of the SCSI command set. The
67  * sc->sc_transform method is used to convert the commands into the appropriate
68  * format (if at all necessary). For example, UFI requires all commands to be
69  * 12 bytes in length amongst other things.
70  *
71  * The source code below is marked and can be split into a number of pieces
72  * (in this order):
73  *
74  * - probe/attach/detach
75  * - generic transfer routines
76  * - BBB
77  * - CBI
78  * - CBI_I (in addition to functions from CBI)
79  * - CAM (Common Access Method)
80  * - SCSI
81  * - UFI
82  * - 8070i (ATAPI)
83  *
84  * The protocols are implemented using a state machine, for the transfers as
85  * well as for the resets. The state machine is contained in umass_t_*_callback.
86  * The state machine is started through either umass_command_start() or
87  * umass_reset().
88  *
89  * The reason for doing this is a) CAM performs a lot better this way and b) it
90  * avoids using tsleep from interrupt context (for example after a failed
91  * transfer).
92  */
93 
94 /*
95  * The SCSI related part of this driver has been derived from the
96  * dev/ppbus/vpo.c driver, by Nicolas Souchu ([email protected]).
97  *
98  * The CAM layer uses so called actions which are messages sent to the host
99  * adapter for completion. The actions come in through umass_cam_action. The
100  * appropriate block of routines is called depending on the transport protocol
101  * in use. When the transfer has finished, these routines call
102  * umass_cam_cb again to complete the CAM command.
103  */
104 
105 #include <sys/stdint.h>
106 #include <sys/stddef.h>
107 #include <sys/param.h>
108 #include <sys/queue.h>
109 #include <sys/types.h>
110 #include <sys/systm.h>
111 #include <sys/kernel.h>
112 #include <sys/bus.h>
113 #include <sys/linker_set.h>
114 #include <sys/module.h>
115 #include <sys/lock.h>
116 #include <sys/mutex.h>
117 #include <sys/condvar.h>
118 #include <sys/sysctl.h>
119 #include <sys/sx.h>
120 #include <sys/unistd.h>
121 #include <sys/callout.h>
122 #include <sys/malloc.h>
123 #include <sys/priv.h>
124 
125 #include <dev/usb/usb.h>
126 #include <dev/usb/usbdi.h>
127 #include <dev/usb/usbdi_util.h>
128 #include "usbdevs.h"
129 
130 #include <dev/usb/quirk/usb_quirk.h>
131 
132 #include <cam/cam.h>
133 #include <cam/cam_ccb.h>
134 #include <cam/cam_sim.h>
135 #include <cam/cam_xpt_sim.h>
136 #include <cam/scsi/scsi_all.h>
137 #include <cam/scsi/scsi_da.h>
138 
139 #include <cam/cam_periph.h>
140 
141 #define UMASS_EXT_BUFFER
142 #ifdef UMASS_EXT_BUFFER
143 /* this enables loading of virtual buffers into DMA */
144 #define	UMASS_USB_FLAGS .ext_buffer=1,
145 #else
146 #define	UMASS_USB_FLAGS
147 #endif
148 
149 #ifdef USB_DEBUG
150 #define	DIF(m, x)				\
151   do {						\
152     if (umass_debug & (m)) { x ; }		\
153   } while (0)
154 
155 #define	DPRINTF(sc, m, fmt, ...)			\
156   do {							\
157     if (umass_debug & (m)) {				\
158         printf("%s:%s: " fmt,				\
159 	       (sc) ? (const char *)(sc)->sc_name :	\
160 	       (const char *)"umassX",			\
161 		__FUNCTION__ ,## __VA_ARGS__);		\
162     }							\
163   } while (0)
164 
165 #define	UDMASS_GEN	0x00010000	/* general */
166 #define	UDMASS_SCSI	0x00020000	/* scsi */
167 #define	UDMASS_UFI	0x00040000	/* ufi command set */
168 #define	UDMASS_ATAPI	0x00080000	/* 8070i command set */
169 #define	UDMASS_CMD	(UDMASS_SCSI|UDMASS_UFI|UDMASS_ATAPI)
170 #define	UDMASS_USB	0x00100000	/* USB general */
171 #define	UDMASS_BBB	0x00200000	/* Bulk-Only transfers */
172 #define	UDMASS_CBI	0x00400000	/* CBI transfers */
173 #define	UDMASS_WIRE	(UDMASS_BBB|UDMASS_CBI)
174 #define	UDMASS_ALL	0xffff0000	/* all of the above */
175 static int umass_debug = 0;
176 
177 SYSCTL_NODE(_hw_usb, OID_AUTO, umass, CTLFLAG_RW, 0, "USB umass");
178 SYSCTL_INT(_hw_usb_umass, OID_AUTO, debug, CTLFLAG_RW,
179     &umass_debug, 0, "umass debug level");
180 
181 TUNABLE_INT("hw.usb.umass.debug", &umass_debug);
182 #else
183 #define	DIF(...) do { } while (0)
184 #define	DPRINTF(...) do { } while (0)
185 #endif
186 
187 #define	UMASS_GONE ((struct umass_softc *)1)
188 
189 #define	UMASS_BULK_SIZE (1 << 17)
190 #define	UMASS_CBI_DIAGNOSTIC_CMDLEN 12	/* bytes */
191 #define	UMASS_MAX_CMDLEN MAX(12, CAM_MAX_CDBLEN)	/* bytes */
192 
193 /* USB transfer definitions */
194 
195 #define	UMASS_T_BBB_RESET1      0	/* Bulk-Only */
196 #define	UMASS_T_BBB_RESET2      1
197 #define	UMASS_T_BBB_RESET3      2
198 #define	UMASS_T_BBB_COMMAND     3
199 #define	UMASS_T_BBB_DATA_READ   4
200 #define	UMASS_T_BBB_DATA_RD_CS  5
201 #define	UMASS_T_BBB_DATA_WRITE  6
202 #define	UMASS_T_BBB_DATA_WR_CS  7
203 #define	UMASS_T_BBB_STATUS      8
204 #define	UMASS_T_BBB_MAX         9
205 
206 #define	UMASS_T_CBI_RESET1      0	/* CBI */
207 #define	UMASS_T_CBI_RESET2      1
208 #define	UMASS_T_CBI_RESET3      2
209 #define	UMASS_T_CBI_COMMAND     3
210 #define	UMASS_T_CBI_DATA_READ   4
211 #define	UMASS_T_CBI_DATA_RD_CS  5
212 #define	UMASS_T_CBI_DATA_WRITE  6
213 #define	UMASS_T_CBI_DATA_WR_CS  7
214 #define	UMASS_T_CBI_STATUS      8
215 #define	UMASS_T_CBI_RESET4      9
216 #define	UMASS_T_CBI_MAX        10
217 
218 #define	UMASS_T_MAX MAX(UMASS_T_CBI_MAX, UMASS_T_BBB_MAX)
219 
220 /* Generic definitions */
221 
222 /* Direction for transfer */
223 #define	DIR_NONE	0
224 #define	DIR_IN		1
225 #define	DIR_OUT		2
226 
227 /* device name */
228 #define	DEVNAME		"umass"
229 #define	DEVNAME_SIM	"umass-sim"
230 
231 /* Approximate maximum transfer speeds (assumes 33% overhead). */
232 #define	UMASS_FULL_TRANSFER_SPEED	1000
233 #define	UMASS_HIGH_TRANSFER_SPEED	40000
234 #define	UMASS_SUPER_TRANSFER_SPEED	400000
235 #define	UMASS_FLOPPY_TRANSFER_SPEED	20
236 
237 #define	UMASS_TIMEOUT			5000	/* ms */
238 
239 /* CAM specific definitions */
240 
241 #define	UMASS_SCSIID_MAX	1	/* maximum number of drives expected */
242 #define	UMASS_SCSIID_HOST	UMASS_SCSIID_MAX
243 
244 /* Bulk-Only features */
245 
246 #define	UR_BBB_RESET		0xff	/* Bulk-Only reset */
247 #define	UR_BBB_GET_MAX_LUN	0xfe	/* Get maximum lun */
248 
249 /* Command Block Wrapper */
250 typedef struct {
251 	uDWord	dCBWSignature;
252 #define	CBWSIGNATURE	0x43425355
253 	uDWord	dCBWTag;
254 	uDWord	dCBWDataTransferLength;
255 	uByte	bCBWFlags;
256 #define	CBWFLAGS_OUT	0x00
257 #define	CBWFLAGS_IN	0x80
258 	uByte	bCBWLUN;
259 	uByte	bCDBLength;
260 #define	CBWCDBLENGTH	16
261 	uByte	CBWCDB[CBWCDBLENGTH];
262 } __packed umass_bbb_cbw_t;
263 
264 #define	UMASS_BBB_CBW_SIZE	31
265 
266 /* Command Status Wrapper */
267 typedef struct {
268 	uDWord	dCSWSignature;
269 #define	CSWSIGNATURE	0x53425355
270 #define	CSWSIGNATURE_IMAGINATION_DBX1	0x43425355
271 #define	CSWSIGNATURE_OLYMPUS_C1	0x55425355
272 	uDWord	dCSWTag;
273 	uDWord	dCSWDataResidue;
274 	uByte	bCSWStatus;
275 #define	CSWSTATUS_GOOD	0x0
276 #define	CSWSTATUS_FAILED	0x1
277 #define	CSWSTATUS_PHASE	0x2
278 } __packed umass_bbb_csw_t;
279 
280 #define	UMASS_BBB_CSW_SIZE	13
281 
282 /* CBI features */
283 
284 #define	UR_CBI_ADSC	0x00
285 
286 typedef union {
287 	struct {
288 		uint8_t	type;
289 #define	IDB_TYPE_CCI		0x00
290 		uint8_t	value;
291 #define	IDB_VALUE_PASS		0x00
292 #define	IDB_VALUE_FAIL		0x01
293 #define	IDB_VALUE_PHASE		0x02
294 #define	IDB_VALUE_PERSISTENT	0x03
295 #define	IDB_VALUE_STATUS_MASK	0x03
296 	} __packed common;
297 
298 	struct {
299 		uint8_t	asc;
300 		uint8_t	ascq;
301 	} __packed ufi;
302 } __packed umass_cbi_sbl_t;
303 
304 struct umass_softc;			/* see below */
305 
306 typedef void (umass_callback_t)(struct umass_softc *sc, union ccb *ccb,
307     	uint32_t residue, uint8_t status);
308 
309 #define	STATUS_CMD_OK		0	/* everything ok */
310 #define	STATUS_CMD_UNKNOWN	1	/* will have to fetch sense */
311 #define	STATUS_CMD_FAILED	2	/* transfer was ok, command failed */
312 #define	STATUS_WIRE_FAILED	3	/* couldn't even get command across */
313 
314 typedef uint8_t (umass_transform_t)(struct umass_softc *sc, uint8_t *cmd_ptr,
315     	uint8_t cmd_len);
316 
317 /* Wire and command protocol */
318 #define	UMASS_PROTO_BBB		0x0001	/* USB wire protocol */
319 #define	UMASS_PROTO_CBI		0x0002
320 #define	UMASS_PROTO_CBI_I	0x0004
321 #define	UMASS_PROTO_WIRE	0x00ff	/* USB wire protocol mask */
322 #define	UMASS_PROTO_SCSI	0x0100	/* command protocol */
323 #define	UMASS_PROTO_ATAPI	0x0200
324 #define	UMASS_PROTO_UFI		0x0400
325 #define	UMASS_PROTO_RBC		0x0800
326 #define	UMASS_PROTO_COMMAND	0xff00	/* command protocol mask */
327 
328 /* Device specific quirks */
329 #define	NO_QUIRKS		0x0000
330 	/*
331 	 * The drive does not support Test Unit Ready. Convert to Start Unit
332 	 */
333 #define	NO_TEST_UNIT_READY	0x0001
334 	/*
335 	 * The drive does not reset the Unit Attention state after REQUEST
336 	 * SENSE has been sent. The INQUIRY command does not reset the UA
337 	 * either, and so CAM runs in circles trying to retrieve the initial
338 	 * INQUIRY data.
339 	 */
340 #define	RS_NO_CLEAR_UA		0x0002
341 	/* The drive does not support START STOP.  */
342 #define	NO_START_STOP		0x0004
343 	/* Don't ask for full inquiry data (255b).  */
344 #define	FORCE_SHORT_INQUIRY	0x0008
345 	/* Needs to be initialised the Shuttle way */
346 #define	SHUTTLE_INIT		0x0010
347 	/* Drive needs to be switched to alternate iface 1 */
348 #define	ALT_IFACE_1		0x0020
349 	/* Drive does not do 1Mb/s, but just floppy speeds (20kb/s) */
350 #define	FLOPPY_SPEED		0x0040
351 	/* The device can't count and gets the residue of transfers wrong */
352 #define	IGNORE_RESIDUE		0x0080
353 	/* No GetMaxLun call */
354 #define	NO_GETMAXLUN		0x0100
355 	/* The device uses a weird CSWSIGNATURE. */
356 #define	WRONG_CSWSIG		0x0200
357 	/* Device cannot handle INQUIRY so fake a generic response */
358 #define	NO_INQUIRY		0x0400
359 	/* Device cannot handle INQUIRY EVPD, return CHECK CONDITION */
360 #define	NO_INQUIRY_EVPD		0x0800
361 	/* Pad all RBC requests to 12 bytes. */
362 #define	RBC_PAD_TO_12		0x1000
363 	/*
364 	 * Device reports number of sectors from READ_CAPACITY, not max
365 	 * sector number.
366 	 */
367 #define	READ_CAPACITY_OFFBY1	0x2000
368 	/*
369 	 * Device cannot handle a SCSI synchronize cache command.  Normally
370 	 * this quirk would be handled in the cam layer, but for IDE bridges
371 	 * we need to associate the quirk with the bridge and not the
372 	 * underlying disk device.  This is handled by faking a success
373 	 * result.
374 	 */
375 #define	NO_SYNCHRONIZE_CACHE	0x4000
376 
377 struct umass_softc {
378 
379 	struct scsi_sense cam_scsi_sense;
380 	struct scsi_test_unit_ready cam_scsi_test_unit_ready;
381 	struct mtx sc_mtx;
382 	struct {
383 		uint8_t *data_ptr;
384 		union ccb *ccb;
385 		umass_callback_t *callback;
386 
387 		uint32_t data_len;	/* bytes */
388 		uint32_t data_rem;	/* bytes */
389 		uint32_t data_timeout;	/* ms */
390 		uint32_t actlen;	/* bytes */
391 
392 		uint8_t	cmd_data[UMASS_MAX_CMDLEN];
393 		uint8_t	cmd_len;	/* bytes */
394 		uint8_t	dir;
395 		uint8_t	lun;
396 	}	sc_transfer;
397 
398 	/* Bulk specific variables for transfers in progress */
399 	umass_bbb_cbw_t cbw;		/* command block wrapper */
400 	umass_bbb_csw_t csw;		/* command status wrapper */
401 
402 	/* CBI specific variables for transfers in progress */
403 	umass_cbi_sbl_t sbl;		/* status block */
404 
405 	device_t sc_dev;
406 	struct usb_device *sc_udev;
407 	struct cam_sim *sc_sim;		/* SCSI Interface Module */
408 	struct usb_xfer *sc_xfer[UMASS_T_MAX];
409 
410 	/*
411 	 * The command transform function is used to convert the SCSI
412 	 * commands into their derivatives, like UFI, ATAPI, and friends.
413 	 */
414 	umass_transform_t *sc_transform;
415 
416 	uint32_t sc_unit;
417 	uint32_t sc_quirks;		/* they got it almost right */
418 	uint32_t sc_proto;		/* wire and cmd protocol */
419 
420 	uint8_t	sc_name[16];
421 	uint8_t	sc_iface_no;		/* interface number */
422 	uint8_t	sc_maxlun;		/* maximum LUN number, inclusive */
423 	uint8_t	sc_last_xfer_index;
424 	uint8_t	sc_status_try;
425 };
426 
427 struct umass_probe_proto {
428 	uint32_t quirks;
429 	uint32_t proto;
430 
431 	int	error;
432 };
433 
434 /* prototypes */
435 
436 static device_probe_t umass_probe;
437 static device_attach_t umass_attach;
438 static device_detach_t umass_detach;
439 
440 static usb_callback_t umass_tr_error;
441 static usb_callback_t umass_t_bbb_reset1_callback;
442 static usb_callback_t umass_t_bbb_reset2_callback;
443 static usb_callback_t umass_t_bbb_reset3_callback;
444 static usb_callback_t umass_t_bbb_command_callback;
445 static usb_callback_t umass_t_bbb_data_read_callback;
446 static usb_callback_t umass_t_bbb_data_rd_cs_callback;
447 static usb_callback_t umass_t_bbb_data_write_callback;
448 static usb_callback_t umass_t_bbb_data_wr_cs_callback;
449 static usb_callback_t umass_t_bbb_status_callback;
450 static usb_callback_t umass_t_cbi_reset1_callback;
451 static usb_callback_t umass_t_cbi_reset2_callback;
452 static usb_callback_t umass_t_cbi_reset3_callback;
453 static usb_callback_t umass_t_cbi_reset4_callback;
454 static usb_callback_t umass_t_cbi_command_callback;
455 static usb_callback_t umass_t_cbi_data_read_callback;
456 static usb_callback_t umass_t_cbi_data_rd_cs_callback;
457 static usb_callback_t umass_t_cbi_data_write_callback;
458 static usb_callback_t umass_t_cbi_data_wr_cs_callback;
459 static usb_callback_t umass_t_cbi_status_callback;
460 
461 static void	umass_cancel_ccb(struct umass_softc *);
462 static void	umass_init_shuttle(struct umass_softc *);
463 static void	umass_reset(struct umass_softc *);
464 static void	umass_t_bbb_data_clear_stall_callback(struct usb_xfer *,
465 		    uint8_t, uint8_t, usb_error_t);
466 static void	umass_command_start(struct umass_softc *, uint8_t, void *,
467 		    uint32_t, uint32_t, umass_callback_t *, union ccb *);
468 static uint8_t	umass_bbb_get_max_lun(struct umass_softc *);
469 static void	umass_cbi_start_status(struct umass_softc *);
470 static void	umass_t_cbi_data_clear_stall_callback(struct usb_xfer *,
471 		    uint8_t, uint8_t, usb_error_t);
472 static int	umass_cam_attach_sim(struct umass_softc *);
473 static void	umass_cam_attach(struct umass_softc *);
474 static void	umass_cam_detach_sim(struct umass_softc *);
475 static void	umass_cam_action(struct cam_sim *, union ccb *);
476 static void	umass_cam_poll(struct cam_sim *);
477 static void	umass_cam_cb(struct umass_softc *, union ccb *, uint32_t,
478 		    uint8_t);
479 static void	umass_cam_sense_cb(struct umass_softc *, union ccb *, uint32_t,
480 		    uint8_t);
481 static void	umass_cam_quirk_cb(struct umass_softc *, union ccb *, uint32_t,
482 		    uint8_t);
483 static uint8_t	umass_scsi_transform(struct umass_softc *, uint8_t *, uint8_t);
484 static uint8_t	umass_rbc_transform(struct umass_softc *, uint8_t *, uint8_t);
485 static uint8_t	umass_ufi_transform(struct umass_softc *, uint8_t *, uint8_t);
486 static uint8_t	umass_atapi_transform(struct umass_softc *, uint8_t *,
487 		    uint8_t);
488 static uint8_t	umass_no_transform(struct umass_softc *, uint8_t *, uint8_t);
489 static uint8_t	umass_std_transform(struct umass_softc *, union ccb *, uint8_t
490 		    *, uint8_t);
491 
492 #ifdef USB_DEBUG
493 static void	umass_bbb_dump_cbw(struct umass_softc *, umass_bbb_cbw_t *);
494 static void	umass_bbb_dump_csw(struct umass_softc *, umass_bbb_csw_t *);
495 static void	umass_cbi_dump_cmd(struct umass_softc *, void *, uint8_t);
496 static void	umass_dump_buffer(struct umass_softc *, uint8_t *, uint32_t,
497 		    uint32_t);
498 #endif
499 
500 static struct usb_config umass_bbb_config[UMASS_T_BBB_MAX] = {
501 
502 	[UMASS_T_BBB_RESET1] = {
503 		.type = UE_CONTROL,
504 		.endpoint = 0x00,	/* Control pipe */
505 		.direction = UE_DIR_ANY,
506 		.bufsize = sizeof(struct usb_device_request),
507 		.callback = &umass_t_bbb_reset1_callback,
508 		.timeout = 5000,	/* 5 seconds */
509 		.interval = 500,	/* 500 milliseconds */
510 	},
511 
512 	[UMASS_T_BBB_RESET2] = {
513 		.type = UE_CONTROL,
514 		.endpoint = 0x00,	/* Control pipe */
515 		.direction = UE_DIR_ANY,
516 		.bufsize = sizeof(struct usb_device_request),
517 		.callback = &umass_t_bbb_reset2_callback,
518 		.timeout = 5000,	/* 5 seconds */
519 		.interval = 50,	/* 50 milliseconds */
520 	},
521 
522 	[UMASS_T_BBB_RESET3] = {
523 		.type = UE_CONTROL,
524 		.endpoint = 0x00,	/* Control pipe */
525 		.direction = UE_DIR_ANY,
526 		.bufsize = sizeof(struct usb_device_request),
527 		.callback = &umass_t_bbb_reset3_callback,
528 		.timeout = 5000,	/* 5 seconds */
529 		.interval = 50,	/* 50 milliseconds */
530 	},
531 
532 	[UMASS_T_BBB_COMMAND] = {
533 		.type = UE_BULK,
534 		.endpoint = UE_ADDR_ANY,
535 		.direction = UE_DIR_OUT,
536 		.bufsize = sizeof(umass_bbb_cbw_t),
537 		.callback = &umass_t_bbb_command_callback,
538 		.timeout = 5000,	/* 5 seconds */
539 	},
540 
541 	[UMASS_T_BBB_DATA_READ] = {
542 		.type = UE_BULK,
543 		.endpoint = UE_ADDR_ANY,
544 		.direction = UE_DIR_IN,
545 		.bufsize = UMASS_BULK_SIZE,
546 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
547 		.callback = &umass_t_bbb_data_read_callback,
548 		.timeout = 0,	/* overwritten later */
549 	},
550 
551 	[UMASS_T_BBB_DATA_RD_CS] = {
552 		.type = UE_CONTROL,
553 		.endpoint = 0x00,	/* Control pipe */
554 		.direction = UE_DIR_ANY,
555 		.bufsize = sizeof(struct usb_device_request),
556 		.callback = &umass_t_bbb_data_rd_cs_callback,
557 		.timeout = 5000,	/* 5 seconds */
558 	},
559 
560 	[UMASS_T_BBB_DATA_WRITE] = {
561 		.type = UE_BULK,
562 		.endpoint = UE_ADDR_ANY,
563 		.direction = UE_DIR_OUT,
564 		.bufsize = UMASS_BULK_SIZE,
565 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
566 		.callback = &umass_t_bbb_data_write_callback,
567 		.timeout = 0,	/* overwritten later */
568 	},
569 
570 	[UMASS_T_BBB_DATA_WR_CS] = {
571 		.type = UE_CONTROL,
572 		.endpoint = 0x00,	/* Control pipe */
573 		.direction = UE_DIR_ANY,
574 		.bufsize = sizeof(struct usb_device_request),
575 		.callback = &umass_t_bbb_data_wr_cs_callback,
576 		.timeout = 5000,	/* 5 seconds */
577 	},
578 
579 	[UMASS_T_BBB_STATUS] = {
580 		.type = UE_BULK,
581 		.endpoint = UE_ADDR_ANY,
582 		.direction = UE_DIR_IN,
583 		.bufsize = sizeof(umass_bbb_csw_t),
584 		.flags = {.short_xfer_ok = 1,},
585 		.callback = &umass_t_bbb_status_callback,
586 		.timeout = 5000,	/* ms */
587 	},
588 };
589 
590 static struct usb_config umass_cbi_config[UMASS_T_CBI_MAX] = {
591 
592 	[UMASS_T_CBI_RESET1] = {
593 		.type = UE_CONTROL,
594 		.endpoint = 0x00,	/* Control pipe */
595 		.direction = UE_DIR_ANY,
596 		.bufsize = (sizeof(struct usb_device_request) +
597 		    UMASS_CBI_DIAGNOSTIC_CMDLEN),
598 		.callback = &umass_t_cbi_reset1_callback,
599 		.timeout = 5000,	/* 5 seconds */
600 		.interval = 500,	/* 500 milliseconds */
601 	},
602 
603 	[UMASS_T_CBI_RESET2] = {
604 		.type = UE_CONTROL,
605 		.endpoint = 0x00,	/* Control pipe */
606 		.direction = UE_DIR_ANY,
607 		.bufsize = sizeof(struct usb_device_request),
608 		.callback = &umass_t_cbi_reset2_callback,
609 		.timeout = 5000,	/* 5 seconds */
610 		.interval = 50,	/* 50 milliseconds */
611 	},
612 
613 	[UMASS_T_CBI_RESET3] = {
614 		.type = UE_CONTROL,
615 		.endpoint = 0x00,	/* Control pipe */
616 		.direction = UE_DIR_ANY,
617 		.bufsize = sizeof(struct usb_device_request),
618 		.callback = &umass_t_cbi_reset3_callback,
619 		.timeout = 5000,	/* 5 seconds */
620 		.interval = 50,	/* 50 milliseconds */
621 	},
622 
623 	[UMASS_T_CBI_COMMAND] = {
624 		.type = UE_CONTROL,
625 		.endpoint = 0x00,	/* Control pipe */
626 		.direction = UE_DIR_ANY,
627 		.bufsize = (sizeof(struct usb_device_request) +
628 		    UMASS_MAX_CMDLEN),
629 		.callback = &umass_t_cbi_command_callback,
630 		.timeout = 5000,	/* 5 seconds */
631 	},
632 
633 	[UMASS_T_CBI_DATA_READ] = {
634 		.type = UE_BULK,
635 		.endpoint = UE_ADDR_ANY,
636 		.direction = UE_DIR_IN,
637 		.bufsize = UMASS_BULK_SIZE,
638 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
639 		.callback = &umass_t_cbi_data_read_callback,
640 		.timeout = 0,	/* overwritten later */
641 	},
642 
643 	[UMASS_T_CBI_DATA_RD_CS] = {
644 		.type = UE_CONTROL,
645 		.endpoint = 0x00,	/* Control pipe */
646 		.direction = UE_DIR_ANY,
647 		.bufsize = sizeof(struct usb_device_request),
648 		.callback = &umass_t_cbi_data_rd_cs_callback,
649 		.timeout = 5000,	/* 5 seconds */
650 	},
651 
652 	[UMASS_T_CBI_DATA_WRITE] = {
653 		.type = UE_BULK,
654 		.endpoint = UE_ADDR_ANY,
655 		.direction = UE_DIR_OUT,
656 		.bufsize = UMASS_BULK_SIZE,
657 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
658 		.callback = &umass_t_cbi_data_write_callback,
659 		.timeout = 0,	/* overwritten later */
660 	},
661 
662 	[UMASS_T_CBI_DATA_WR_CS] = {
663 		.type = UE_CONTROL,
664 		.endpoint = 0x00,	/* Control pipe */
665 		.direction = UE_DIR_ANY,
666 		.bufsize = sizeof(struct usb_device_request),
667 		.callback = &umass_t_cbi_data_wr_cs_callback,
668 		.timeout = 5000,	/* 5 seconds */
669 	},
670 
671 	[UMASS_T_CBI_STATUS] = {
672 		.type = UE_INTERRUPT,
673 		.endpoint = UE_ADDR_ANY,
674 		.direction = UE_DIR_IN,
675 		.flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
676 		.bufsize = sizeof(umass_cbi_sbl_t),
677 		.callback = &umass_t_cbi_status_callback,
678 		.timeout = 5000,	/* ms */
679 	},
680 
681 	[UMASS_T_CBI_RESET4] = {
682 		.type = UE_CONTROL,
683 		.endpoint = 0x00,	/* Control pipe */
684 		.direction = UE_DIR_ANY,
685 		.bufsize = sizeof(struct usb_device_request),
686 		.callback = &umass_t_cbi_reset4_callback,
687 		.timeout = 5000,	/* ms */
688 	},
689 };
690 
691 /* If device cannot return valid inquiry data, fake it */
692 static const uint8_t fake_inq_data[SHORT_INQUIRY_LENGTH] = {
693 	0, /* removable */ 0x80, SCSI_REV_2, SCSI_REV_2,
694 	 /* additional_length */ 31, 0, 0, 0
695 };
696 
697 #define	UFI_COMMAND_LENGTH	12	/* UFI commands are always 12 bytes */
698 #define	ATAPI_COMMAND_LENGTH	12	/* ATAPI commands are always 12 bytes */
699 
700 static devclass_t umass_devclass;
701 
702 static device_method_t umass_methods[] = {
703 	/* Device interface */
704 	DEVMETHOD(device_probe, umass_probe),
705 	DEVMETHOD(device_attach, umass_attach),
706 	DEVMETHOD(device_detach, umass_detach),
707 	{0, 0}
708 };
709 
710 static driver_t umass_driver = {
711 	.name = "umass",
712 	.methods = umass_methods,
713 	.size = sizeof(struct umass_softc),
714 };
715 
716 DRIVER_MODULE(umass, uhub, umass_driver, umass_devclass, NULL, 0);
717 MODULE_DEPEND(umass, usb, 1, 1, 1);
718 MODULE_DEPEND(umass, cam, 1, 1, 1);
719 MODULE_VERSION(umass, 1);
720 
721 /*
722  * USB device probe/attach/detach
723  */
724 
725 static uint16_t
726 umass_get_proto(struct usb_interface *iface)
727 {
728 	struct usb_interface_descriptor *id;
729 	uint16_t retval;
730 
731 	retval = 0;
732 
733 	/* Check for a standards compliant device */
734 	id = usbd_get_interface_descriptor(iface);
735 	if ((id == NULL) ||
736 	    (id->bInterfaceClass != UICLASS_MASS)) {
737 		goto done;
738 	}
739 	switch (id->bInterfaceSubClass) {
740 	case UISUBCLASS_SCSI:
741 		retval |= UMASS_PROTO_SCSI;
742 		break;
743 	case UISUBCLASS_UFI:
744 		retval |= UMASS_PROTO_UFI;
745 		break;
746 	case UISUBCLASS_RBC:
747 		retval |= UMASS_PROTO_RBC;
748 		break;
749 	case UISUBCLASS_SFF8020I:
750 	case UISUBCLASS_SFF8070I:
751 		retval |= UMASS_PROTO_ATAPI;
752 		break;
753 	default:
754 		goto done;
755 	}
756 
757 	switch (id->bInterfaceProtocol) {
758 	case UIPROTO_MASS_CBI:
759 		retval |= UMASS_PROTO_CBI;
760 		break;
761 	case UIPROTO_MASS_CBI_I:
762 		retval |= UMASS_PROTO_CBI_I;
763 		break;
764 	case UIPROTO_MASS_BBB_OLD:
765 	case UIPROTO_MASS_BBB:
766 		retval |= UMASS_PROTO_BBB;
767 		break;
768 	default:
769 		goto done;
770 	}
771 done:
772 	return (retval);
773 }
774 
775 /*
776  * Match the device we are seeing with the devices supported.
777  */
778 static struct umass_probe_proto
779 umass_probe_proto(device_t dev, struct usb_attach_arg *uaa)
780 {
781 	struct umass_probe_proto ret;
782 	uint32_t quirks = NO_QUIRKS;
783 	uint32_t proto = umass_get_proto(uaa->iface);
784 
785 	memset(&ret, 0, sizeof(ret));
786 
787 	/* Search for protocol enforcement */
788 
789 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_BBB)) {
790 		proto &= ~UMASS_PROTO_WIRE;
791 		proto |= UMASS_PROTO_BBB;
792 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI)) {
793 		proto &= ~UMASS_PROTO_WIRE;
794 		proto |= UMASS_PROTO_CBI;
795 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI_I)) {
796 		proto &= ~UMASS_PROTO_WIRE;
797 		proto |= UMASS_PROTO_CBI_I;
798 	}
799 
800 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_SCSI)) {
801 		proto &= ~UMASS_PROTO_COMMAND;
802 		proto |= UMASS_PROTO_SCSI;
803 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_ATAPI)) {
804 		proto &= ~UMASS_PROTO_COMMAND;
805 		proto |= UMASS_PROTO_ATAPI;
806 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_UFI)) {
807 		proto &= ~UMASS_PROTO_COMMAND;
808 		proto |= UMASS_PROTO_UFI;
809 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_RBC)) {
810 		proto &= ~UMASS_PROTO_COMMAND;
811 		proto |= UMASS_PROTO_RBC;
812 	}
813 
814 	/* Check if the protocol is invalid */
815 
816 	if ((proto & UMASS_PROTO_COMMAND) == 0) {
817 		ret.error = ENXIO;
818 		goto done;
819 	}
820 
821 	if ((proto & UMASS_PROTO_WIRE) == 0) {
822 		ret.error = ENXIO;
823 		goto done;
824 	}
825 
826 	/* Search for quirks */
827 
828 	if (usb_test_quirk(uaa, UQ_MSC_NO_TEST_UNIT_READY))
829 		quirks |= NO_TEST_UNIT_READY;
830 	if (usb_test_quirk(uaa, UQ_MSC_NO_RS_CLEAR_UA))
831 		quirks |= RS_NO_CLEAR_UA;
832 	if (usb_test_quirk(uaa, UQ_MSC_NO_START_STOP))
833 		quirks |= NO_START_STOP;
834 	if (usb_test_quirk(uaa, UQ_MSC_NO_GETMAXLUN))
835 		quirks |= NO_GETMAXLUN;
836 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY))
837 		quirks |= NO_INQUIRY;
838 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY_EVPD))
839 		quirks |= NO_INQUIRY_EVPD;
840 	if (usb_test_quirk(uaa, UQ_MSC_NO_SYNC_CACHE))
841 		quirks |= NO_SYNCHRONIZE_CACHE;
842 	if (usb_test_quirk(uaa, UQ_MSC_SHUTTLE_INIT))
843 		quirks |= SHUTTLE_INIT;
844 	if (usb_test_quirk(uaa, UQ_MSC_ALT_IFACE_1))
845 		quirks |= ALT_IFACE_1;
846 	if (usb_test_quirk(uaa, UQ_MSC_FLOPPY_SPEED))
847 		quirks |= FLOPPY_SPEED;
848 	if (usb_test_quirk(uaa, UQ_MSC_IGNORE_RESIDUE))
849 		quirks |= IGNORE_RESIDUE;
850 	if (usb_test_quirk(uaa, UQ_MSC_WRONG_CSWSIG))
851 		quirks |= WRONG_CSWSIG;
852 	if (usb_test_quirk(uaa, UQ_MSC_RBC_PAD_TO_12))
853 		quirks |= RBC_PAD_TO_12;
854 	if (usb_test_quirk(uaa, UQ_MSC_READ_CAP_OFFBY1))
855 		quirks |= READ_CAPACITY_OFFBY1;
856 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_SHORT_INQ))
857 		quirks |= FORCE_SHORT_INQUIRY;
858 
859 done:
860 	ret.quirks = quirks;
861 	ret.proto = proto;
862 	return (ret);
863 }
864 
865 static int
866 umass_probe(device_t dev)
867 {
868 	struct usb_attach_arg *uaa = device_get_ivars(dev);
869 	struct umass_probe_proto temp;
870 
871 	if (uaa->usb_mode != USB_MODE_HOST) {
872 		return (ENXIO);
873 	}
874 	if (uaa->use_generic == 0) {
875 		/* give other drivers a try first */
876 		return (ENXIO);
877 	}
878 	temp = umass_probe_proto(dev, uaa);
879 
880 	return (temp.error);
881 }
882 
883 static int
884 umass_attach(device_t dev)
885 {
886 	struct umass_softc *sc = device_get_softc(dev);
887 	struct usb_attach_arg *uaa = device_get_ivars(dev);
888 	struct umass_probe_proto temp = umass_probe_proto(dev, uaa);
889 	struct usb_interface_descriptor *id;
890 	int32_t err;
891 
892 	/*
893 	 * NOTE: the softc struct is bzero-ed in device_set_driver.
894 	 * We can safely call umass_detach without specifically
895 	 * initializing the struct.
896 	 */
897 
898 	sc->sc_dev = dev;
899 	sc->sc_udev = uaa->device;
900 	sc->sc_proto = temp.proto;
901 	sc->sc_quirks = temp.quirks;
902 	sc->sc_unit = device_get_unit(dev);
903 
904 	snprintf(sc->sc_name, sizeof(sc->sc_name),
905 	    "%s", device_get_nameunit(dev));
906 
907 	device_set_usb_desc(dev);
908 
909         mtx_init(&sc->sc_mtx, device_get_nameunit(dev),
910 	    NULL, MTX_DEF | MTX_RECURSE);
911 
912 	/* get interface index */
913 
914 	id = usbd_get_interface_descriptor(uaa->iface);
915 	if (id == NULL) {
916 		device_printf(dev, "failed to get "
917 		    "interface number\n");
918 		goto detach;
919 	}
920 	sc->sc_iface_no = id->bInterfaceNumber;
921 
922 #ifdef USB_DEBUG
923 	device_printf(dev, " ");
924 
925 	switch (sc->sc_proto & UMASS_PROTO_COMMAND) {
926 	case UMASS_PROTO_SCSI:
927 		printf("SCSI");
928 		break;
929 	case UMASS_PROTO_ATAPI:
930 		printf("8070i (ATAPI)");
931 		break;
932 	case UMASS_PROTO_UFI:
933 		printf("UFI");
934 		break;
935 	case UMASS_PROTO_RBC:
936 		printf("RBC");
937 		break;
938 	default:
939 		printf("(unknown 0x%02x)",
940 		    sc->sc_proto & UMASS_PROTO_COMMAND);
941 		break;
942 	}
943 
944 	printf(" over ");
945 
946 	switch (sc->sc_proto & UMASS_PROTO_WIRE) {
947 	case UMASS_PROTO_BBB:
948 		printf("Bulk-Only");
949 		break;
950 	case UMASS_PROTO_CBI:		/* uses Comand/Bulk pipes */
951 		printf("CBI");
952 		break;
953 	case UMASS_PROTO_CBI_I:	/* uses Comand/Bulk/Interrupt pipes */
954 		printf("CBI with CCI");
955 		break;
956 	default:
957 		printf("(unknown 0x%02x)",
958 		    sc->sc_proto & UMASS_PROTO_WIRE);
959 	}
960 
961 	printf("; quirks = 0x%04x\n", sc->sc_quirks);
962 #endif
963 
964 	if (sc->sc_quirks & ALT_IFACE_1) {
965 		err = usbd_set_alt_interface_index
966 		    (uaa->device, uaa->info.bIfaceIndex, 1);
967 
968 		if (err) {
969 			DPRINTF(sc, UDMASS_USB, "could not switch to "
970 			    "Alt Interface 1\n");
971 			goto detach;
972 		}
973 	}
974 	/* allocate all required USB transfers */
975 
976 	if (sc->sc_proto & UMASS_PROTO_BBB) {
977 
978 		err = usbd_transfer_setup(uaa->device,
979 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_bbb_config,
980 		    UMASS_T_BBB_MAX, sc, &sc->sc_mtx);
981 
982 		/* skip reset first time */
983 		sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
984 
985 	} else if (sc->sc_proto & (UMASS_PROTO_CBI | UMASS_PROTO_CBI_I)) {
986 
987 		err = usbd_transfer_setup(uaa->device,
988 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_cbi_config,
989 		    UMASS_T_CBI_MAX, sc, &sc->sc_mtx);
990 
991 		/* skip reset first time */
992 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
993 
994 	} else {
995 		err = USB_ERR_INVAL;
996 	}
997 
998 	if (err) {
999 		device_printf(dev, "could not setup required "
1000 		    "transfers, %s\n", usbd_errstr(err));
1001 		goto detach;
1002 	}
1003 	sc->sc_transform =
1004 	    (sc->sc_proto & UMASS_PROTO_SCSI) ? &umass_scsi_transform :
1005 	    (sc->sc_proto & UMASS_PROTO_UFI) ? &umass_ufi_transform :
1006 	    (sc->sc_proto & UMASS_PROTO_ATAPI) ? &umass_atapi_transform :
1007 	    (sc->sc_proto & UMASS_PROTO_RBC) ? &umass_rbc_transform :
1008 	    &umass_no_transform;
1009 
1010 	/* from here onwards the device can be used. */
1011 
1012 	if (sc->sc_quirks & SHUTTLE_INIT) {
1013 		umass_init_shuttle(sc);
1014 	}
1015 	/* get the maximum LUN supported by the device */
1016 
1017 	if (((sc->sc_proto & UMASS_PROTO_WIRE) == UMASS_PROTO_BBB) &&
1018 	    !(sc->sc_quirks & NO_GETMAXLUN))
1019 		sc->sc_maxlun = umass_bbb_get_max_lun(sc);
1020 	else
1021 		sc->sc_maxlun = 0;
1022 
1023 	/* Prepare the SCSI command block */
1024 	sc->cam_scsi_sense.opcode = REQUEST_SENSE;
1025 	sc->cam_scsi_test_unit_ready.opcode = TEST_UNIT_READY;
1026 
1027 	/*
1028 	 * some devices need a delay after that the configuration value is
1029 	 * set to function properly:
1030 	 */
1031 	usb_pause_mtx(NULL, hz);
1032 
1033 	/* register the SIM */
1034 	err = umass_cam_attach_sim(sc);
1035 	if (err) {
1036 		goto detach;
1037 	}
1038 	/* scan the SIM */
1039 	umass_cam_attach(sc);
1040 
1041 	DPRINTF(sc, UDMASS_GEN, "Attach finished\n");
1042 
1043 	return (0);			/* success */
1044 
1045 detach:
1046 	umass_detach(dev);
1047 	return (ENXIO);			/* failure */
1048 }
1049 
1050 static int
1051 umass_detach(device_t dev)
1052 {
1053 	struct umass_softc *sc = device_get_softc(dev);
1054 
1055 	DPRINTF(sc, UDMASS_USB, "\n");
1056 
1057 	/* teardown our statemachine */
1058 
1059 	usbd_transfer_unsetup(sc->sc_xfer, UMASS_T_MAX);
1060 
1061 #if (__FreeBSD_version >= 700037)
1062 	mtx_lock(&sc->sc_mtx);
1063 #endif
1064 	umass_cam_detach_sim(sc);
1065 
1066 #if (__FreeBSD_version >= 700037)
1067 	mtx_unlock(&sc->sc_mtx);
1068 #endif
1069 	mtx_destroy(&sc->sc_mtx);
1070 
1071 	return (0);			/* success */
1072 }
1073 
1074 static void
1075 umass_init_shuttle(struct umass_softc *sc)
1076 {
1077 	struct usb_device_request req;
1078 	usb_error_t err;
1079 	uint8_t status[2] = {0, 0};
1080 
1081 	/*
1082 	 * The Linux driver does this, but no one can tell us what the
1083 	 * command does.
1084 	 */
1085 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1086 	req.bRequest = 1;		/* XXX unknown command */
1087 	USETW(req.wValue, 0);
1088 	req.wIndex[0] = sc->sc_iface_no;
1089 	req.wIndex[1] = 0;
1090 	USETW(req.wLength, sizeof(status));
1091 	err = usbd_do_request(sc->sc_udev, NULL, &req, &status);
1092 
1093 	DPRINTF(sc, UDMASS_GEN, "Shuttle init returned 0x%02x%02x\n",
1094 	    status[0], status[1]);
1095 }
1096 
1097 /*
1098  * Generic functions to handle transfers
1099  */
1100 
1101 static void
1102 umass_transfer_start(struct umass_softc *sc, uint8_t xfer_index)
1103 {
1104 	DPRINTF(sc, UDMASS_GEN, "transfer index = "
1105 	    "%d\n", xfer_index);
1106 
1107 	if (sc->sc_xfer[xfer_index]) {
1108 		sc->sc_last_xfer_index = xfer_index;
1109 		usbd_transfer_start(sc->sc_xfer[xfer_index]);
1110 	} else {
1111 		umass_cancel_ccb(sc);
1112 	}
1113 }
1114 
1115 static void
1116 umass_reset(struct umass_softc *sc)
1117 {
1118 	DPRINTF(sc, UDMASS_GEN, "resetting device\n");
1119 
1120 	/*
1121 	 * stop the last transfer, if not already stopped:
1122 	 */
1123 	usbd_transfer_stop(sc->sc_xfer[sc->sc_last_xfer_index]);
1124 	umass_transfer_start(sc, 0);
1125 }
1126 
1127 static void
1128 umass_cancel_ccb(struct umass_softc *sc)
1129 {
1130 	union ccb *ccb;
1131 
1132 	mtx_assert(&sc->sc_mtx, MA_OWNED);
1133 
1134 	ccb = sc->sc_transfer.ccb;
1135 	sc->sc_transfer.ccb = NULL;
1136 	sc->sc_last_xfer_index = 0;
1137 
1138 	if (ccb) {
1139 		(sc->sc_transfer.callback)
1140 		    (sc, ccb, (sc->sc_transfer.data_len -
1141 		    sc->sc_transfer.actlen), STATUS_WIRE_FAILED);
1142 	}
1143 }
1144 
1145 static void
1146 umass_tr_error(struct usb_xfer *xfer, usb_error_t error)
1147 {
1148 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1149 
1150 	if (error != USB_ERR_CANCELLED) {
1151 
1152 		DPRINTF(sc, UDMASS_GEN, "transfer error, %s -> "
1153 		    "reset\n", usbd_errstr(error));
1154 	}
1155 	umass_cancel_ccb(sc);
1156 }
1157 
1158 /*
1159  * BBB protocol specific functions
1160  */
1161 
1162 static void
1163 umass_t_bbb_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1164 {
1165 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1166 	struct usb_device_request req;
1167 	struct usb_page_cache *pc;
1168 
1169 	switch (USB_GET_STATE(xfer)) {
1170 	case USB_ST_TRANSFERRED:
1171 		umass_transfer_start(sc, UMASS_T_BBB_RESET2);
1172 		return;
1173 
1174 	case USB_ST_SETUP:
1175 		/*
1176 		 * Reset recovery (5.3.4 in Universal Serial Bus Mass Storage Class)
1177 		 *
1178 		 * For Reset Recovery the host shall issue in the following order:
1179 		 * a) a Bulk-Only Mass Storage Reset
1180 		 * b) a Clear Feature HALT to the Bulk-In endpoint
1181 		 * c) a Clear Feature HALT to the Bulk-Out endpoint
1182 		 *
1183 		 * This is done in 3 steps, using 3 transfers:
1184 		 * UMASS_T_BBB_RESET1
1185 		 * UMASS_T_BBB_RESET2
1186 		 * UMASS_T_BBB_RESET3
1187 		 */
1188 
1189 		DPRINTF(sc, UDMASS_BBB, "BBB reset!\n");
1190 
1191 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1192 		req.bRequest = UR_BBB_RESET;	/* bulk only reset */
1193 		USETW(req.wValue, 0);
1194 		req.wIndex[0] = sc->sc_iface_no;
1195 		req.wIndex[1] = 0;
1196 		USETW(req.wLength, 0);
1197 
1198 		pc = usbd_xfer_get_frame(xfer, 0);
1199 		usbd_copy_in(pc, 0, &req, sizeof(req));
1200 
1201 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1202 		usbd_xfer_set_frames(xfer, 1);
1203 		usbd_transfer_submit(xfer);
1204 		return;
1205 
1206 	default:			/* Error */
1207 		umass_tr_error(xfer, error);
1208 		return;
1209 
1210 	}
1211 }
1212 
1213 static void
1214 umass_t_bbb_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1215 {
1216 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_RESET3,
1217 	    UMASS_T_BBB_DATA_READ, error);
1218 }
1219 
1220 static void
1221 umass_t_bbb_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1222 {
1223 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_COMMAND,
1224 	    UMASS_T_BBB_DATA_WRITE, error);
1225 }
1226 
1227 static void
1228 umass_t_bbb_data_clear_stall_callback(struct usb_xfer *xfer,
1229     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1230 {
1231 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1232 
1233 	switch (USB_GET_STATE(xfer)) {
1234 	case USB_ST_TRANSFERRED:
1235 tr_transferred:
1236 		umass_transfer_start(sc, next_xfer);
1237 		return;
1238 
1239 	case USB_ST_SETUP:
1240 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1241 			goto tr_transferred;
1242 		}
1243 		return;
1244 
1245 	default:			/* Error */
1246 		umass_tr_error(xfer, error);
1247 		return;
1248 
1249 	}
1250 }
1251 
1252 static void
1253 umass_t_bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
1254 {
1255 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1256 	union ccb *ccb = sc->sc_transfer.ccb;
1257 	struct usb_page_cache *pc;
1258 	uint32_t tag;
1259 
1260 	switch (USB_GET_STATE(xfer)) {
1261 	case USB_ST_TRANSFERRED:
1262 		umass_transfer_start
1263 		    (sc, ((sc->sc_transfer.dir == DIR_IN) ? UMASS_T_BBB_DATA_READ :
1264 		    (sc->sc_transfer.dir == DIR_OUT) ? UMASS_T_BBB_DATA_WRITE :
1265 		    UMASS_T_BBB_STATUS));
1266 		return;
1267 
1268 	case USB_ST_SETUP:
1269 
1270 		sc->sc_status_try = 0;
1271 
1272 		if (ccb) {
1273 
1274 			/*
1275 		         * the initial value is not important,
1276 		         * as long as the values are unique:
1277 		         */
1278 			tag = UGETDW(sc->cbw.dCBWTag) + 1;
1279 
1280 			USETDW(sc->cbw.dCBWSignature, CBWSIGNATURE);
1281 			USETDW(sc->cbw.dCBWTag, tag);
1282 
1283 			/*
1284 		         * dCBWDataTransferLength:
1285 		         *   This field indicates the number of bytes of data that the host
1286 		         *   intends to transfer on the IN or OUT Bulk endpoint(as indicated by
1287 		         *   the Direction bit) during the execution of this command. If this
1288 		         *   field is set to 0, the device will expect that no data will be
1289 		         *   transferred IN or OUT during this command, regardless of the value
1290 		         *   of the Direction bit defined in dCBWFlags.
1291 		         */
1292 			USETDW(sc->cbw.dCBWDataTransferLength, sc->sc_transfer.data_len);
1293 
1294 			/*
1295 		         * dCBWFlags:
1296 		         *   The bits of the Flags field are defined as follows:
1297 		         *     Bits 0-6  reserved
1298 		         *     Bit  7    Direction - this bit shall be ignored if the
1299 		         *                           dCBWDataTransferLength field is zero.
1300 		         *               0 = data Out from host to device
1301 		         *               1 = data In from device to host
1302 		         */
1303 			sc->cbw.bCBWFlags = ((sc->sc_transfer.dir == DIR_IN) ?
1304 			    CBWFLAGS_IN : CBWFLAGS_OUT);
1305 			sc->cbw.bCBWLUN = sc->sc_transfer.lun;
1306 
1307 			if (sc->sc_transfer.cmd_len > sizeof(sc->cbw.CBWCDB)) {
1308 				sc->sc_transfer.cmd_len = sizeof(sc->cbw.CBWCDB);
1309 				DPRINTF(sc, UDMASS_BBB, "Truncating long command!\n");
1310 			}
1311 			sc->cbw.bCDBLength = sc->sc_transfer.cmd_len;
1312 
1313 			bcopy(sc->sc_transfer.cmd_data, sc->cbw.CBWCDB,
1314 			    sc->sc_transfer.cmd_len);
1315 
1316 			bzero(sc->sc_transfer.cmd_data + sc->sc_transfer.cmd_len,
1317 			    sizeof(sc->cbw.CBWCDB) - sc->sc_transfer.cmd_len);
1318 
1319 			DIF(UDMASS_BBB, umass_bbb_dump_cbw(sc, &sc->cbw));
1320 
1321 			pc = usbd_xfer_get_frame(xfer, 0);
1322 			usbd_copy_in(pc, 0, &sc->cbw, sizeof(sc->cbw));
1323 			usbd_xfer_set_frame_len(xfer, 0, sizeof(sc->cbw));
1324 
1325 			usbd_transfer_submit(xfer);
1326 		}
1327 		return;
1328 
1329 	default:			/* Error */
1330 		umass_tr_error(xfer, error);
1331 		return;
1332 
1333 	}
1334 }
1335 
1336 static void
1337 umass_t_bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1338 {
1339 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1340 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1341 #ifndef UMASS_EXT_BUFFER
1342 	struct usb_page_cache *pc;
1343 #endif
1344 	int actlen, sumlen;
1345 
1346 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1347 
1348 	switch (USB_GET_STATE(xfer)) {
1349 	case USB_ST_TRANSFERRED:
1350 #ifndef UMASS_EXT_BUFFER
1351 		pc = usbd_xfer_get_frame(xfer, 0);
1352 		usbd_copy_out(pc, 0, sc->sc_transfer.data_ptr, actlen);
1353 #endif
1354 		sc->sc_transfer.data_rem -= actlen;
1355 		sc->sc_transfer.data_ptr += actlen;
1356 		sc->sc_transfer.actlen += actlen;
1357 
1358 		if (actlen < sumlen) {
1359 			/* short transfer */
1360 			sc->sc_transfer.data_rem = 0;
1361 		}
1362 	case USB_ST_SETUP:
1363 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1364 		    max_bulk, sc->sc_transfer.data_rem);
1365 
1366 		if (sc->sc_transfer.data_rem == 0) {
1367 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1368 			return;
1369 		}
1370 		if (max_bulk > sc->sc_transfer.data_rem) {
1371 			max_bulk = sc->sc_transfer.data_rem;
1372 		}
1373 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1374 
1375 #ifdef UMASS_EXT_BUFFER
1376 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1377 		    max_bulk);
1378 #else
1379 		usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1380 #endif
1381 		usbd_transfer_submit(xfer);
1382 		return;
1383 
1384 	default:			/* Error */
1385 		if (error == USB_ERR_CANCELLED) {
1386 			umass_tr_error(xfer, error);
1387 		} else {
1388 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1389 		}
1390 		return;
1391 
1392 	}
1393 }
1394 
1395 static void
1396 umass_t_bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1397 {
1398 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1399 	    UMASS_T_BBB_DATA_READ, error);
1400 }
1401 
1402 static void
1403 umass_t_bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1404 {
1405 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1406 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1407 #ifndef UMASS_EXT_BUFFER
1408 	struct usb_page_cache *pc;
1409 #endif
1410 	int actlen, sumlen;
1411 
1412 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1413 
1414 	switch (USB_GET_STATE(xfer)) {
1415 	case USB_ST_TRANSFERRED:
1416 		sc->sc_transfer.data_rem -= actlen;
1417 		sc->sc_transfer.data_ptr += actlen;
1418 		sc->sc_transfer.actlen += actlen;
1419 
1420 		if (actlen < sumlen) {
1421 			/* short transfer */
1422 			sc->sc_transfer.data_rem = 0;
1423 		}
1424 	case USB_ST_SETUP:
1425 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1426 		    max_bulk, sc->sc_transfer.data_rem);
1427 
1428 		if (sc->sc_transfer.data_rem == 0) {
1429 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1430 			return;
1431 		}
1432 		if (max_bulk > sc->sc_transfer.data_rem) {
1433 			max_bulk = sc->sc_transfer.data_rem;
1434 		}
1435 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1436 
1437 #ifdef UMASS_EXT_BUFFER
1438 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1439 		    max_bulk);
1440 #else
1441 		pc = usbd_xfer_get_frame(xfer, 0);
1442 		usbd_copy_in(pc, 0, sc->sc_transfer.data_ptr, max_bulk);
1443 		usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1444 #endif
1445 
1446 		usbd_transfer_submit(xfer);
1447 		return;
1448 
1449 	default:			/* Error */
1450 		if (error == USB_ERR_CANCELLED) {
1451 			umass_tr_error(xfer, error);
1452 		} else {
1453 			umass_transfer_start(sc, UMASS_T_BBB_DATA_WR_CS);
1454 		}
1455 		return;
1456 
1457 	}
1458 }
1459 
1460 static void
1461 umass_t_bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1462 {
1463 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1464 	    UMASS_T_BBB_DATA_WRITE, error);
1465 }
1466 
1467 static void
1468 umass_t_bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
1469 {
1470 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1471 	union ccb *ccb = sc->sc_transfer.ccb;
1472 	struct usb_page_cache *pc;
1473 	uint32_t residue;
1474 	int actlen;
1475 
1476 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1477 
1478 	switch (USB_GET_STATE(xfer)) {
1479 	case USB_ST_TRANSFERRED:
1480 
1481 		/*
1482 		 * Do a full reset if there is something wrong with the CSW:
1483 		 */
1484 		sc->sc_status_try = 1;
1485 
1486 		/* Zero missing parts of the CSW: */
1487 
1488 		if (actlen < sizeof(sc->csw)) {
1489 			bzero(&sc->csw, sizeof(sc->csw));
1490 		}
1491 		pc = usbd_xfer_get_frame(xfer, 0);
1492 		usbd_copy_out(pc, 0, &sc->csw, actlen);
1493 
1494 		DIF(UDMASS_BBB, umass_bbb_dump_csw(sc, &sc->csw));
1495 
1496 		residue = UGETDW(sc->csw.dCSWDataResidue);
1497 
1498 		if ((!residue) || (sc->sc_quirks & IGNORE_RESIDUE)) {
1499 			residue = (sc->sc_transfer.data_len -
1500 			    sc->sc_transfer.actlen);
1501 		}
1502 		if (residue > sc->sc_transfer.data_len) {
1503 			DPRINTF(sc, UDMASS_BBB, "truncating residue from %d "
1504 			    "to %d bytes\n", residue, sc->sc_transfer.data_len);
1505 			residue = sc->sc_transfer.data_len;
1506 		}
1507 		/* translate weird command-status signatures: */
1508 		if (sc->sc_quirks & WRONG_CSWSIG) {
1509 
1510 			uint32_t temp = UGETDW(sc->csw.dCSWSignature);
1511 
1512 			if ((temp == CSWSIGNATURE_OLYMPUS_C1) ||
1513 			    (temp == CSWSIGNATURE_IMAGINATION_DBX1)) {
1514 				USETDW(sc->csw.dCSWSignature, CSWSIGNATURE);
1515 			}
1516 		}
1517 		/* check CSW and handle eventual error */
1518 		if (UGETDW(sc->csw.dCSWSignature) != CSWSIGNATURE) {
1519 			DPRINTF(sc, UDMASS_BBB, "bad CSW signature 0x%08x != 0x%08x\n",
1520 			    UGETDW(sc->csw.dCSWSignature), CSWSIGNATURE);
1521 			/*
1522 			 * Invalid CSW: Wrong signature or wrong tag might
1523 			 * indicate that we lost synchronization. Reset the
1524 			 * device.
1525 			 */
1526 			goto tr_error;
1527 		} else if (UGETDW(sc->csw.dCSWTag) != UGETDW(sc->cbw.dCBWTag)) {
1528 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: tag 0x%08x should be "
1529 			    "0x%08x\n", UGETDW(sc->csw.dCSWTag),
1530 			    UGETDW(sc->cbw.dCBWTag));
1531 			goto tr_error;
1532 		} else if (sc->csw.bCSWStatus > CSWSTATUS_PHASE) {
1533 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: status %d > %d\n",
1534 			    sc->csw.bCSWStatus, CSWSTATUS_PHASE);
1535 			goto tr_error;
1536 		} else if (sc->csw.bCSWStatus == CSWSTATUS_PHASE) {
1537 			DPRINTF(sc, UDMASS_BBB, "Phase error, residue = "
1538 			    "%d\n", residue);
1539 			goto tr_error;
1540 		} else if (sc->sc_transfer.actlen > sc->sc_transfer.data_len) {
1541 			DPRINTF(sc, UDMASS_BBB, "Buffer overrun %d > %d\n",
1542 			    sc->sc_transfer.actlen, sc->sc_transfer.data_len);
1543 			goto tr_error;
1544 		} else if (sc->csw.bCSWStatus == CSWSTATUS_FAILED) {
1545 			DPRINTF(sc, UDMASS_BBB, "Command failed, residue = "
1546 			    "%d\n", residue);
1547 
1548 			sc->sc_transfer.ccb = NULL;
1549 
1550 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1551 
1552 			(sc->sc_transfer.callback)
1553 			    (sc, ccb, residue, STATUS_CMD_FAILED);
1554 		} else {
1555 			sc->sc_transfer.ccb = NULL;
1556 
1557 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1558 
1559 			(sc->sc_transfer.callback)
1560 			    (sc, ccb, residue, STATUS_CMD_OK);
1561 		}
1562 		return;
1563 
1564 	case USB_ST_SETUP:
1565 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1566 		usbd_transfer_submit(xfer);
1567 		return;
1568 
1569 	default:
1570 tr_error:
1571 		DPRINTF(sc, UDMASS_BBB, "Failed to read CSW: %s, try %d\n",
1572 		    usbd_errstr(error), sc->sc_status_try);
1573 
1574 		if ((error == USB_ERR_CANCELLED) ||
1575 		    (sc->sc_status_try)) {
1576 			umass_tr_error(xfer, error);
1577 		} else {
1578 			sc->sc_status_try = 1;
1579 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1580 		}
1581 		return;
1582 
1583 	}
1584 }
1585 
1586 static void
1587 umass_command_start(struct umass_softc *sc, uint8_t dir,
1588     void *data_ptr, uint32_t data_len,
1589     uint32_t data_timeout, umass_callback_t *callback,
1590     union ccb *ccb)
1591 {
1592 	sc->sc_transfer.lun = ccb->ccb_h.target_lun;
1593 
1594 	/*
1595 	 * NOTE: assumes that "sc->sc_transfer.cmd_data" and
1596 	 * "sc->sc_transfer.cmd_len" has been properly
1597 	 * initialized.
1598 	 */
1599 
1600 	sc->sc_transfer.dir = data_len ? dir : DIR_NONE;
1601 	sc->sc_transfer.data_ptr = data_ptr;
1602 	sc->sc_transfer.data_len = data_len;
1603 	sc->sc_transfer.data_rem = data_len;
1604 	sc->sc_transfer.data_timeout = (data_timeout + UMASS_TIMEOUT);
1605 
1606 	sc->sc_transfer.actlen = 0;
1607 	sc->sc_transfer.callback = callback;
1608 	sc->sc_transfer.ccb = ccb;
1609 
1610 	if (sc->sc_xfer[sc->sc_last_xfer_index]) {
1611 		usbd_transfer_start(sc->sc_xfer[sc->sc_last_xfer_index]);
1612 	} else {
1613 		ccb->ccb_h.status = CAM_TID_INVALID;
1614 		xpt_done(ccb);
1615 	}
1616 }
1617 
1618 static uint8_t
1619 umass_bbb_get_max_lun(struct umass_softc *sc)
1620 {
1621 	struct usb_device_request req;
1622 	usb_error_t err;
1623 	uint8_t buf = 0;
1624 
1625 	/* The Get Max Lun command is a class-specific request. */
1626 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
1627 	req.bRequest = UR_BBB_GET_MAX_LUN;
1628 	USETW(req.wValue, 0);
1629 	req.wIndex[0] = sc->sc_iface_no;
1630 	req.wIndex[1] = 0;
1631 	USETW(req.wLength, 1);
1632 
1633 	err = usbd_do_request(sc->sc_udev, NULL, &req, &buf);
1634 	if (err) {
1635 		buf = 0;
1636 
1637 		/* Device doesn't support Get Max Lun request. */
1638 		printf("%s: Get Max Lun not supported (%s)\n",
1639 		    sc->sc_name, usbd_errstr(err));
1640 	}
1641 	return (buf);
1642 }
1643 
1644 /*
1645  * Command/Bulk/Interrupt (CBI) specific functions
1646  */
1647 
1648 static void
1649 umass_cbi_start_status(struct umass_softc *sc)
1650 {
1651 	if (sc->sc_xfer[UMASS_T_CBI_STATUS]) {
1652 		umass_transfer_start(sc, UMASS_T_CBI_STATUS);
1653 	} else {
1654 		union ccb *ccb = sc->sc_transfer.ccb;
1655 
1656 		sc->sc_transfer.ccb = NULL;
1657 
1658 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1659 
1660 		(sc->sc_transfer.callback)
1661 		    (sc, ccb, (sc->sc_transfer.data_len -
1662 		    sc->sc_transfer.actlen), STATUS_CMD_UNKNOWN);
1663 	}
1664 }
1665 
1666 static void
1667 umass_t_cbi_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1668 {
1669 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1670 	struct usb_device_request req;
1671 	struct usb_page_cache *pc;
1672 	uint8_t buf[UMASS_CBI_DIAGNOSTIC_CMDLEN];
1673 
1674 	uint8_t i;
1675 
1676 	switch (USB_GET_STATE(xfer)) {
1677 	case USB_ST_TRANSFERRED:
1678 		umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1679 		break;
1680 
1681 	case USB_ST_SETUP:
1682 		/*
1683 		 * Command Block Reset Protocol
1684 		 *
1685 		 * First send a reset request to the device. Then clear
1686 		 * any possibly stalled bulk endpoints.
1687 		 *
1688 		 * This is done in 3 steps, using 3 transfers:
1689 		 * UMASS_T_CBI_RESET1
1690 		 * UMASS_T_CBI_RESET2
1691 		 * UMASS_T_CBI_RESET3
1692 		 * UMASS_T_CBI_RESET4 (only if there is an interrupt endpoint)
1693 		 */
1694 
1695 		DPRINTF(sc, UDMASS_CBI, "CBI reset!\n");
1696 
1697 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1698 		req.bRequest = UR_CBI_ADSC;
1699 		USETW(req.wValue, 0);
1700 		req.wIndex[0] = sc->sc_iface_no;
1701 		req.wIndex[1] = 0;
1702 		USETW(req.wLength, UMASS_CBI_DIAGNOSTIC_CMDLEN);
1703 
1704 		/*
1705 		 * The 0x1d code is the SEND DIAGNOSTIC command. To
1706 		 * distinguish between the two, the last 10 bytes of the CBL
1707 		 * is filled with 0xff (section 2.2 of the CBI
1708 		 * specification)
1709 		 */
1710 		buf[0] = 0x1d;		/* Command Block Reset */
1711 		buf[1] = 0x04;
1712 
1713 		for (i = 2; i < UMASS_CBI_DIAGNOSTIC_CMDLEN; i++) {
1714 			buf[i] = 0xff;
1715 		}
1716 
1717 		pc = usbd_xfer_get_frame(xfer, 0);
1718 		usbd_copy_in(pc, 0, &req, sizeof(req));
1719 		pc = usbd_xfer_get_frame(xfer, 1);
1720 		usbd_copy_in(pc, 0, buf, sizeof(buf));
1721 
1722 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1723 		usbd_xfer_set_frame_len(xfer, 1, sizeof(buf));
1724 		usbd_xfer_set_frames(xfer, 2);
1725 		usbd_transfer_submit(xfer);
1726 		break;
1727 
1728 	default:			/* Error */
1729 		if (error == USB_ERR_CANCELLED)
1730 			umass_tr_error(xfer, error);
1731 		else
1732 			umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1733 		break;
1734 
1735 	}
1736 }
1737 
1738 static void
1739 umass_t_cbi_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1740 {
1741 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_RESET3,
1742 	    UMASS_T_CBI_DATA_READ, error);
1743 }
1744 
1745 static void
1746 umass_t_cbi_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1747 {
1748 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1749 
1750 	umass_t_cbi_data_clear_stall_callback
1751 	    (xfer, (sc->sc_xfer[UMASS_T_CBI_RESET4] &&
1752 	    sc->sc_xfer[UMASS_T_CBI_STATUS]) ?
1753 	    UMASS_T_CBI_RESET4 : UMASS_T_CBI_COMMAND,
1754 	    UMASS_T_CBI_DATA_WRITE, error);
1755 }
1756 
1757 static void
1758 umass_t_cbi_reset4_callback(struct usb_xfer *xfer, usb_error_t error)
1759 {
1760 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_COMMAND,
1761 	    UMASS_T_CBI_STATUS, error);
1762 }
1763 
1764 static void
1765 umass_t_cbi_data_clear_stall_callback(struct usb_xfer *xfer,
1766     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1767 {
1768 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1769 
1770 	switch (USB_GET_STATE(xfer)) {
1771 	case USB_ST_TRANSFERRED:
1772 tr_transferred:
1773 		if (next_xfer == UMASS_T_CBI_STATUS) {
1774 			umass_cbi_start_status(sc);
1775 		} else {
1776 			umass_transfer_start(sc, next_xfer);
1777 		}
1778 		break;
1779 
1780 	case USB_ST_SETUP:
1781 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1782 			goto tr_transferred;	/* should not happen */
1783 		}
1784 		break;
1785 
1786 	default:			/* Error */
1787 		umass_tr_error(xfer, error);
1788 		break;
1789 
1790 	}
1791 }
1792 
1793 static void
1794 umass_t_cbi_command_callback(struct usb_xfer *xfer, usb_error_t error)
1795 {
1796 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1797 	union ccb *ccb = sc->sc_transfer.ccb;
1798 	struct usb_device_request req;
1799 	struct usb_page_cache *pc;
1800 
1801 	switch (USB_GET_STATE(xfer)) {
1802 	case USB_ST_TRANSFERRED:
1803 
1804 		if (sc->sc_transfer.dir == DIR_NONE) {
1805 			umass_cbi_start_status(sc);
1806 		} else {
1807 			umass_transfer_start
1808 			    (sc, (sc->sc_transfer.dir == DIR_IN) ?
1809 			    UMASS_T_CBI_DATA_READ : UMASS_T_CBI_DATA_WRITE);
1810 		}
1811 		break;
1812 
1813 	case USB_ST_SETUP:
1814 
1815 		if (ccb) {
1816 
1817 			/*
1818 		         * do a CBI transfer with cmd_len bytes from
1819 		         * cmd_data, possibly a data phase of data_len
1820 		         * bytes from/to the device and finally a status
1821 		         * read phase.
1822 		         */
1823 
1824 			req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1825 			req.bRequest = UR_CBI_ADSC;
1826 			USETW(req.wValue, 0);
1827 			req.wIndex[0] = sc->sc_iface_no;
1828 			req.wIndex[1] = 0;
1829 			req.wLength[0] = sc->sc_transfer.cmd_len;
1830 			req.wLength[1] = 0;
1831 
1832 			pc = usbd_xfer_get_frame(xfer, 0);
1833 			usbd_copy_in(pc, 0, &req, sizeof(req));
1834 			pc = usbd_xfer_get_frame(xfer, 1);
1835 			usbd_copy_in(pc, 0, sc->sc_transfer.cmd_data,
1836 			    sc->sc_transfer.cmd_len);
1837 
1838 			usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1839 			usbd_xfer_set_frame_len(xfer, 1, sc->sc_transfer.cmd_len);
1840 			usbd_xfer_set_frames(xfer,
1841 			    sc->sc_transfer.cmd_len ? 2 : 1);
1842 
1843 			DIF(UDMASS_CBI,
1844 			    umass_cbi_dump_cmd(sc,
1845 			    sc->sc_transfer.cmd_data,
1846 			    sc->sc_transfer.cmd_len));
1847 
1848 			usbd_transfer_submit(xfer);
1849 		}
1850 		break;
1851 
1852 	default:			/* Error */
1853 		umass_tr_error(xfer, error);
1854 		/* skip reset */
1855 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1856 		break;
1857 	}
1858 }
1859 
1860 static void
1861 umass_t_cbi_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1862 {
1863 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1864 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1865 #ifndef UMASS_EXT_BUFFER
1866 	struct usb_page_cache *pc;
1867 #endif
1868 	int actlen, sumlen;
1869 
1870 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1871 
1872 	switch (USB_GET_STATE(xfer)) {
1873 	case USB_ST_TRANSFERRED:
1874 #ifndef UMASS_EXT_BUFFER
1875 		pc = usbd_xfer_get_frame(xfer, 0);
1876 		usbd_copy_out(pc, 0, sc->sc_transfer.data_ptr, actlen);
1877 #endif
1878 		sc->sc_transfer.data_rem -= actlen;
1879 		sc->sc_transfer.data_ptr += actlen;
1880 		sc->sc_transfer.actlen += actlen;
1881 
1882 		if (actlen < sumlen) {
1883 			/* short transfer */
1884 			sc->sc_transfer.data_rem = 0;
1885 		}
1886 	case USB_ST_SETUP:
1887 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1888 		    max_bulk, sc->sc_transfer.data_rem);
1889 
1890 		if (sc->sc_transfer.data_rem == 0) {
1891 			umass_cbi_start_status(sc);
1892 			break;
1893 		}
1894 		if (max_bulk > sc->sc_transfer.data_rem) {
1895 			max_bulk = sc->sc_transfer.data_rem;
1896 		}
1897 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1898 
1899 #ifdef UMASS_EXT_BUFFER
1900 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1901 		    max_bulk);
1902 #else
1903 		usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1904 #endif
1905 		usbd_transfer_submit(xfer);
1906 		break;
1907 
1908 	default:			/* Error */
1909 		if ((error == USB_ERR_CANCELLED) ||
1910 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1911 			umass_tr_error(xfer, error);
1912 		} else {
1913 			umass_transfer_start(sc, UMASS_T_CBI_DATA_RD_CS);
1914 		}
1915 		break;
1916 
1917 	}
1918 }
1919 
1920 static void
1921 umass_t_cbi_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1922 {
1923 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1924 	    UMASS_T_CBI_DATA_READ, error);
1925 }
1926 
1927 static void
1928 umass_t_cbi_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1929 {
1930 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1931 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1932 #ifndef UMASS_EXT_BUFFER
1933 	struct usb_page_cache *pc;
1934 #endif
1935 	int actlen, sumlen;
1936 
1937 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1938 
1939 	switch (USB_GET_STATE(xfer)) {
1940 	case USB_ST_TRANSFERRED:
1941 		sc->sc_transfer.data_rem -= actlen;
1942 		sc->sc_transfer.data_ptr += actlen;
1943 		sc->sc_transfer.actlen += actlen;
1944 
1945 		if (actlen < sumlen) {
1946 			/* short transfer */
1947 			sc->sc_transfer.data_rem = 0;
1948 		}
1949 	case USB_ST_SETUP:
1950 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1951 		    max_bulk, sc->sc_transfer.data_rem);
1952 
1953 		if (sc->sc_transfer.data_rem == 0) {
1954 			umass_cbi_start_status(sc);
1955 			break;
1956 		}
1957 		if (max_bulk > sc->sc_transfer.data_rem) {
1958 			max_bulk = sc->sc_transfer.data_rem;
1959 		}
1960 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1961 
1962 #ifdef UMASS_EXT_BUFFER
1963 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1964 		    max_bulk);
1965 #else
1966 		pc = usbd_xfer_get_frame(xfer, 0);
1967 		usbd_copy_in(pc, 0, sc->sc_transfer.data_ptr, max_bulk);
1968 		usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1969 #endif
1970 
1971 		usbd_transfer_submit(xfer);
1972 		break;
1973 
1974 	default:			/* Error */
1975 		if ((error == USB_ERR_CANCELLED) ||
1976 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1977 			umass_tr_error(xfer, error);
1978 		} else {
1979 			umass_transfer_start(sc, UMASS_T_CBI_DATA_WR_CS);
1980 		}
1981 		break;
1982 
1983 	}
1984 }
1985 
1986 static void
1987 umass_t_cbi_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1988 {
1989 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1990 	    UMASS_T_CBI_DATA_WRITE, error);
1991 }
1992 
1993 static void
1994 umass_t_cbi_status_callback(struct usb_xfer *xfer, usb_error_t error)
1995 {
1996 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1997 	union ccb *ccb = sc->sc_transfer.ccb;
1998 	struct usb_page_cache *pc;
1999 	uint32_t residue;
2000 	uint8_t status;
2001 	int actlen;
2002 
2003 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
2004 
2005 	switch (USB_GET_STATE(xfer)) {
2006 	case USB_ST_TRANSFERRED:
2007 
2008 		if (actlen < sizeof(sc->sbl)) {
2009 			goto tr_setup;
2010 		}
2011 		pc = usbd_xfer_get_frame(xfer, 0);
2012 		usbd_copy_out(pc, 0, &sc->sbl, sizeof(sc->sbl));
2013 
2014 		residue = (sc->sc_transfer.data_len -
2015 		    sc->sc_transfer.actlen);
2016 
2017 		/* dissect the information in the buffer */
2018 
2019 		if (sc->sc_proto & UMASS_PROTO_UFI) {
2020 
2021 			/*
2022 			 * Section 3.4.3.1.3 specifies that the UFI command
2023 			 * protocol returns an ASC and ASCQ in the interrupt
2024 			 * data block.
2025 			 */
2026 
2027 			DPRINTF(sc, UDMASS_CBI, "UFI CCI, ASC = 0x%02x, "
2028 			    "ASCQ = 0x%02x\n", sc->sbl.ufi.asc,
2029 			    sc->sbl.ufi.ascq);
2030 
2031 			status = (((sc->sbl.ufi.asc == 0) &&
2032 			    (sc->sbl.ufi.ascq == 0)) ?
2033 			    STATUS_CMD_OK : STATUS_CMD_FAILED);
2034 
2035 			sc->sc_transfer.ccb = NULL;
2036 
2037 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2038 
2039 			(sc->sc_transfer.callback)
2040 			    (sc, ccb, residue, status);
2041 
2042 			break;
2043 
2044 		} else {
2045 
2046 			/* Command Interrupt Data Block */
2047 
2048 			DPRINTF(sc, UDMASS_CBI, "type=0x%02x, value=0x%02x\n",
2049 			    sc->sbl.common.type, sc->sbl.common.value);
2050 
2051 			if (sc->sbl.common.type == IDB_TYPE_CCI) {
2052 
2053 				status = (sc->sbl.common.value & IDB_VALUE_STATUS_MASK);
2054 
2055 				status = ((status == IDB_VALUE_PASS) ? STATUS_CMD_OK :
2056 				    (status == IDB_VALUE_FAIL) ? STATUS_CMD_FAILED :
2057 				    (status == IDB_VALUE_PERSISTENT) ? STATUS_CMD_FAILED :
2058 				    STATUS_WIRE_FAILED);
2059 
2060 				sc->sc_transfer.ccb = NULL;
2061 
2062 				sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2063 
2064 				(sc->sc_transfer.callback)
2065 				    (sc, ccb, residue, status);
2066 
2067 				break;
2068 			}
2069 		}
2070 
2071 		/* fallthrough */
2072 
2073 	case USB_ST_SETUP:
2074 tr_setup:
2075 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2076 		usbd_transfer_submit(xfer);
2077 		break;
2078 
2079 	default:			/* Error */
2080 		DPRINTF(sc, UDMASS_CBI, "Failed to read CSW: %s\n",
2081 		    usbd_errstr(error));
2082 		umass_tr_error(xfer, error);
2083 		break;
2084 
2085 	}
2086 }
2087 
2088 /*
2089  * CAM specific functions (used by SCSI, UFI, 8070i (ATAPI))
2090  */
2091 
2092 static int
2093 umass_cam_attach_sim(struct umass_softc *sc)
2094 {
2095 	struct cam_devq *devq;		/* Per device Queue */
2096 
2097 	/*
2098 	 * A HBA is attached to the CAM layer.
2099 	 *
2100 	 * The CAM layer will then after a while start probing for devices on
2101 	 * the bus. The number of SIMs is limited to one.
2102 	 */
2103 
2104 	devq = cam_simq_alloc(1 /* maximum openings */ );
2105 	if (devq == NULL) {
2106 		return (ENOMEM);
2107 	}
2108 	sc->sc_sim = cam_sim_alloc
2109 	    (&umass_cam_action, &umass_cam_poll,
2110 	    DEVNAME_SIM,
2111 	    sc /* priv */ ,
2112 	    sc->sc_unit /* unit number */ ,
2113 #if (__FreeBSD_version >= 700037)
2114 	    &sc->sc_mtx /* mutex */ ,
2115 #endif
2116 	    1 /* maximum device openings */ ,
2117 	    0 /* maximum tagged device openings */ ,
2118 	    devq);
2119 
2120 	if (sc->sc_sim == NULL) {
2121 		cam_simq_free(devq);
2122 		return (ENOMEM);
2123 	}
2124 
2125 #if (__FreeBSD_version >= 700037)
2126 	mtx_lock(&sc->sc_mtx);
2127 #endif
2128 
2129 #if (__FreeBSD_version >= 700048)
2130 	if (xpt_bus_register(sc->sc_sim, sc->sc_dev, sc->sc_unit) != CAM_SUCCESS) {
2131 		mtx_unlock(&sc->sc_mtx);
2132 		return (ENOMEM);
2133 	}
2134 #else
2135 	if (xpt_bus_register(sc->sc_sim, sc->sc_unit) != CAM_SUCCESS) {
2136 #if (__FreeBSD_version >= 700037)
2137 		mtx_unlock(&sc->sc_mtx);
2138 #endif
2139 		return (ENOMEM);
2140 	}
2141 #endif
2142 
2143 #if (__FreeBSD_version >= 700037)
2144 	mtx_unlock(&sc->sc_mtx);
2145 #endif
2146 	return (0);
2147 }
2148 
2149 static void
2150 umass_cam_attach(struct umass_softc *sc)
2151 {
2152 #ifndef USB_DEBUG
2153 	if (bootverbose)
2154 #endif
2155 		printf("%s:%d:%d:%d: Attached to scbus%d\n",
2156 		    sc->sc_name, cam_sim_path(sc->sc_sim),
2157 		    sc->sc_unit, CAM_LUN_WILDCARD,
2158 		    cam_sim_path(sc->sc_sim));
2159 }
2160 
2161 /* umass_cam_detach
2162  *	detach from the CAM layer
2163  */
2164 
2165 static void
2166 umass_cam_detach_sim(struct umass_softc *sc)
2167 {
2168 	if (sc->sc_sim != NULL) {
2169 		if (xpt_bus_deregister(cam_sim_path(sc->sc_sim))) {
2170 			/* accessing the softc is not possible after this */
2171 			sc->sc_sim->softc = UMASS_GONE;
2172 			cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2173 		} else {
2174 			panic("%s: CAM layer is busy\n",
2175 			    sc->sc_name);
2176 		}
2177 		sc->sc_sim = NULL;
2178 	}
2179 }
2180 
2181 /* umass_cam_action
2182  * 	CAM requests for action come through here
2183  */
2184 
2185 static void
2186 umass_cam_action(struct cam_sim *sim, union ccb *ccb)
2187 {
2188 	struct umass_softc *sc = (struct umass_softc *)sim->softc;
2189 
2190 	if (sc == UMASS_GONE ||
2191 	    (sc != NULL && !usbd_device_attached(sc->sc_udev))) {
2192 		ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2193 		xpt_done(ccb);
2194 		return;
2195 	}
2196 	if (sc) {
2197 #if (__FreeBSD_version < 700037)
2198 		mtx_lock(&sc->sc_mtx);
2199 #endif
2200 	}
2201 	/*
2202 	 * Verify, depending on the operation to perform, that we either got
2203 	 * a valid sc, because an existing target was referenced, or
2204 	 * otherwise the SIM is addressed.
2205 	 *
2206 	 * This avoids bombing out at a printf and does give the CAM layer some
2207 	 * sensible feedback on errors.
2208 	 */
2209 	switch (ccb->ccb_h.func_code) {
2210 	case XPT_SCSI_IO:
2211 	case XPT_RESET_DEV:
2212 	case XPT_GET_TRAN_SETTINGS:
2213 	case XPT_SET_TRAN_SETTINGS:
2214 	case XPT_CALC_GEOMETRY:
2215 		/* the opcodes requiring a target. These should never occur. */
2216 		if (sc == NULL) {
2217 			DPRINTF(sc, UDMASS_GEN, "%s:%d:%d:%d:func_code 0x%04x: "
2218 			    "Invalid target (target needed)\n",
2219 			    DEVNAME_SIM, cam_sim_path(sc->sc_sim),
2220 			    ccb->ccb_h.target_id, ccb->ccb_h.target_lun,
2221 			    ccb->ccb_h.func_code);
2222 
2223 			ccb->ccb_h.status = CAM_TID_INVALID;
2224 			xpt_done(ccb);
2225 			goto done;
2226 		}
2227 		break;
2228 	case XPT_PATH_INQ:
2229 	case XPT_NOOP:
2230 		/*
2231 		 * The opcodes sometimes aimed at a target (sc is valid),
2232 		 * sometimes aimed at the SIM (sc is invalid and target is
2233 		 * CAM_TARGET_WILDCARD)
2234 		 */
2235 		if ((sc == NULL) &&
2236 		    (ccb->ccb_h.target_id != CAM_TARGET_WILDCARD)) {
2237 			DPRINTF(sc, UDMASS_SCSI, "%s:%d:%d:%d:func_code 0x%04x: "
2238 			    "Invalid target (no wildcard)\n",
2239 			    DEVNAME_SIM, cam_sim_path(sc->sc_sim),
2240 			    ccb->ccb_h.target_id, ccb->ccb_h.target_lun,
2241 			    ccb->ccb_h.func_code);
2242 
2243 			ccb->ccb_h.status = CAM_TID_INVALID;
2244 			xpt_done(ccb);
2245 			goto done;
2246 		}
2247 		break;
2248 	default:
2249 		/* XXX Hm, we should check the input parameters */
2250 		break;
2251 	}
2252 
2253 	/* Perform the requested action */
2254 	switch (ccb->ccb_h.func_code) {
2255 	case XPT_SCSI_IO:
2256 		{
2257 			uint8_t *cmd;
2258 			uint8_t dir;
2259 
2260 			if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2261 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2262 			} else {
2263 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2264 			}
2265 
2266 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2267 			    "cmd: 0x%02x, flags: 0x%02x, "
2268 			    "%db cmd/%db data/%db sense\n",
2269 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2270 			    ccb->ccb_h.target_lun, cmd[0],
2271 			    ccb->ccb_h.flags & CAM_DIR_MASK, ccb->csio.cdb_len,
2272 			    ccb->csio.dxfer_len, ccb->csio.sense_len);
2273 
2274 			if (sc->sc_transfer.ccb) {
2275 				DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2276 				    "I/O in progress, deferring\n",
2277 				    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2278 				    ccb->ccb_h.target_lun);
2279 				ccb->ccb_h.status = CAM_SCSI_BUSY;
2280 				xpt_done(ccb);
2281 				goto done;
2282 			}
2283 			switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
2284 			case CAM_DIR_IN:
2285 				dir = DIR_IN;
2286 				break;
2287 			case CAM_DIR_OUT:
2288 				dir = DIR_OUT;
2289 				DIF(UDMASS_SCSI,
2290 				    umass_dump_buffer(sc, ccb->csio.data_ptr,
2291 				    ccb->csio.dxfer_len, 48));
2292 				break;
2293 			default:
2294 				dir = DIR_NONE;
2295 			}
2296 
2297 			ccb->ccb_h.status = CAM_REQ_INPROG | CAM_SIM_QUEUED;
2298 
2299 			/*
2300 			 * sc->sc_transform will convert the command to the
2301 			 * command format needed by the specific command set
2302 			 * and return the converted command in
2303 			 * "sc->sc_transfer.cmd_data"
2304 			 */
2305 			if (umass_std_transform(sc, ccb, cmd, ccb->csio.cdb_len)) {
2306 
2307 				if (sc->sc_transfer.cmd_data[0] == INQUIRY) {
2308 					const char *pserial;
2309 
2310 					pserial = usb_get_serial(sc->sc_udev);
2311 
2312 					/*
2313 					 * Umass devices don't generally report their serial numbers
2314 					 * in the usual SCSI way.  Emulate it here.
2315 					 */
2316 					if ((sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2317 					    (sc->sc_transfer.cmd_data[2] == SVPD_UNIT_SERIAL_NUMBER) &&
2318 					    (pserial[0] != '\0')) {
2319 						struct scsi_vpd_unit_serial_number *vpd_serial;
2320 
2321 						vpd_serial = (struct scsi_vpd_unit_serial_number *)ccb->csio.data_ptr;
2322 						vpd_serial->length = strlen(pserial);
2323 						if (vpd_serial->length > sizeof(vpd_serial->serial_num))
2324 							vpd_serial->length = sizeof(vpd_serial->serial_num);
2325 						memcpy(vpd_serial->serial_num, pserial, vpd_serial->length);
2326 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2327 						ccb->ccb_h.status = CAM_REQ_CMP;
2328 						xpt_done(ccb);
2329 						goto done;
2330 					}
2331 
2332 					/*
2333 					 * Handle EVPD inquiry for broken devices first
2334 					 * NO_INQUIRY also implies NO_INQUIRY_EVPD
2335 					 */
2336 					if ((sc->sc_quirks & (NO_INQUIRY_EVPD | NO_INQUIRY)) &&
2337 					    (sc->sc_transfer.cmd_data[1] & SI_EVPD)) {
2338 						struct scsi_sense_data *sense;
2339 
2340 						sense = &ccb->csio.sense_data;
2341 						bzero(sense, sizeof(*sense));
2342 						sense->error_code = SSD_CURRENT_ERROR;
2343 						sense->flags = SSD_KEY_ILLEGAL_REQUEST;
2344 						sense->add_sense_code = 0x24;
2345 						sense->extra_len = 10;
2346 						ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2347 						ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR |
2348 						    CAM_AUTOSNS_VALID;
2349 						xpt_done(ccb);
2350 						goto done;
2351 					}
2352 					/*
2353 					 * Return fake inquiry data for
2354 					 * broken devices
2355 					 */
2356 					if (sc->sc_quirks & NO_INQUIRY) {
2357 						memcpy(ccb->csio.data_ptr, &fake_inq_data,
2358 						    sizeof(fake_inq_data));
2359 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2360 						ccb->ccb_h.status = CAM_REQ_CMP;
2361 						xpt_done(ccb);
2362 						goto done;
2363 					}
2364 					if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2365 						ccb->csio.dxfer_len = SHORT_INQUIRY_LENGTH;
2366 					}
2367 				} else if (sc->sc_transfer.cmd_data[0] == SYNCHRONIZE_CACHE) {
2368 					if (sc->sc_quirks & NO_SYNCHRONIZE_CACHE) {
2369 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2370 						ccb->ccb_h.status = CAM_REQ_CMP;
2371 						xpt_done(ccb);
2372 						goto done;
2373 					}
2374 				}
2375 				umass_command_start(sc, dir, ccb->csio.data_ptr,
2376 				    ccb->csio.dxfer_len,
2377 				    ccb->ccb_h.timeout,
2378 				    &umass_cam_cb, ccb);
2379 			}
2380 			break;
2381 		}
2382 	case XPT_PATH_INQ:
2383 		{
2384 			struct ccb_pathinq *cpi = &ccb->cpi;
2385 
2386 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_PATH_INQ:.\n",
2387 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2388 			    ccb->ccb_h.target_lun);
2389 
2390 			/* host specific information */
2391 			cpi->version_num = 1;
2392 			cpi->hba_inquiry = 0;
2393 			cpi->target_sprt = 0;
2394 			cpi->hba_misc = PIM_NO_6_BYTE;
2395 			cpi->hba_eng_cnt = 0;
2396 			cpi->max_target = UMASS_SCSIID_MAX;	/* one target */
2397 			cpi->initiator_id = UMASS_SCSIID_HOST;
2398 			strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2399 			strlcpy(cpi->hba_vid, "USB SCSI", HBA_IDLEN);
2400 			strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2401 			cpi->unit_number = cam_sim_unit(sim);
2402 			cpi->bus_id = sc->sc_unit;
2403 #if (__FreeBSD_version >= 700025)
2404 			cpi->protocol = PROTO_SCSI;
2405 			cpi->protocol_version = SCSI_REV_2;
2406 			cpi->transport = XPORT_USB;
2407 			cpi->transport_version = 0;
2408 #endif
2409 			if (sc == NULL) {
2410 				cpi->base_transfer_speed = 0;
2411 				cpi->max_lun = 0;
2412 			} else {
2413 				if (sc->sc_quirks & FLOPPY_SPEED) {
2414 					cpi->base_transfer_speed =
2415 					    UMASS_FLOPPY_TRANSFER_SPEED;
2416 				} else {
2417 					switch (usbd_get_speed(sc->sc_udev)) {
2418 					case USB_SPEED_SUPER:
2419 						cpi->base_transfer_speed =
2420 						    UMASS_SUPER_TRANSFER_SPEED;
2421 						cpi->maxio = MAXPHYS;
2422 						break;
2423 					case USB_SPEED_HIGH:
2424 						cpi->base_transfer_speed =
2425 						    UMASS_HIGH_TRANSFER_SPEED;
2426 						break;
2427 					default:
2428 						cpi->base_transfer_speed =
2429 						    UMASS_FULL_TRANSFER_SPEED;
2430 						break;
2431 					}
2432 				}
2433 				cpi->max_lun = sc->sc_maxlun;
2434 			}
2435 
2436 			cpi->ccb_h.status = CAM_REQ_CMP;
2437 			xpt_done(ccb);
2438 			break;
2439 		}
2440 	case XPT_RESET_DEV:
2441 		{
2442 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_RESET_DEV:.\n",
2443 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2444 			    ccb->ccb_h.target_lun);
2445 
2446 			umass_reset(sc);
2447 
2448 			ccb->ccb_h.status = CAM_REQ_CMP;
2449 			xpt_done(ccb);
2450 			break;
2451 		}
2452 	case XPT_GET_TRAN_SETTINGS:
2453 		{
2454 			struct ccb_trans_settings *cts = &ccb->cts;
2455 
2456 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_GET_TRAN_SETTINGS:.\n",
2457 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2458 			    ccb->ccb_h.target_lun);
2459 
2460 #if (__FreeBSD_version >= 700025)
2461 			cts->protocol = PROTO_SCSI;
2462 			cts->protocol_version = SCSI_REV_2;
2463 			cts->transport = XPORT_USB;
2464 			cts->transport_version = 0;
2465 			cts->xport_specific.valid = 0;
2466 #else
2467 			cts->valid = 0;
2468 			cts->flags = 0;	/* no disconnection, tagging */
2469 #endif
2470 			ccb->ccb_h.status = CAM_REQ_CMP;
2471 			xpt_done(ccb);
2472 			break;
2473 		}
2474 	case XPT_SET_TRAN_SETTINGS:
2475 		{
2476 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SET_TRAN_SETTINGS:.\n",
2477 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2478 			    ccb->ccb_h.target_lun);
2479 
2480 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2481 			xpt_done(ccb);
2482 			break;
2483 		}
2484 	case XPT_CALC_GEOMETRY:
2485 		{
2486 			cam_calc_geometry(&ccb->ccg, /* extended */ 1);
2487 			xpt_done(ccb);
2488 			break;
2489 		}
2490 	case XPT_NOOP:
2491 		{
2492 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_NOOP:.\n",
2493 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2494 			    ccb->ccb_h.target_lun);
2495 
2496 			ccb->ccb_h.status = CAM_REQ_CMP;
2497 			xpt_done(ccb);
2498 			break;
2499 		}
2500 	default:
2501 		DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:func_code 0x%04x: "
2502 		    "Not implemented\n",
2503 		    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2504 		    ccb->ccb_h.target_lun, ccb->ccb_h.func_code);
2505 
2506 		ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2507 		xpt_done(ccb);
2508 		break;
2509 	}
2510 
2511 done:
2512 #if (__FreeBSD_version < 700037)
2513 	if (sc) {
2514 		mtx_unlock(&sc->sc_mtx);
2515 	}
2516 #endif
2517 	return;
2518 }
2519 
2520 static void
2521 umass_cam_poll(struct cam_sim *sim)
2522 {
2523 	struct umass_softc *sc = (struct umass_softc *)sim->softc;
2524 
2525 	if (sc == UMASS_GONE)
2526 		return;
2527 
2528 	DPRINTF(sc, UDMASS_SCSI, "CAM poll\n");
2529 
2530 	usbd_transfer_poll(sc->sc_xfer, UMASS_T_MAX);
2531 }
2532 
2533 
2534 /* umass_cam_cb
2535  *	finalise a completed CAM command
2536  */
2537 
2538 static void
2539 umass_cam_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2540     uint8_t status)
2541 {
2542 	ccb->csio.resid = residue;
2543 
2544 	switch (status) {
2545 	case STATUS_CMD_OK:
2546 		ccb->ccb_h.status = CAM_REQ_CMP;
2547 		if ((sc->sc_quirks & READ_CAPACITY_OFFBY1) &&
2548 		    (ccb->ccb_h.func_code == XPT_SCSI_IO) &&
2549 		    (ccb->csio.cdb_io.cdb_bytes[0] == READ_CAPACITY)) {
2550 			struct scsi_read_capacity_data *rcap;
2551 			uint32_t maxsector;
2552 
2553 			rcap = (void *)(ccb->csio.data_ptr);
2554 			maxsector = scsi_4btoul(rcap->addr) - 1;
2555 			scsi_ulto4b(maxsector, rcap->addr);
2556 		}
2557 		/*
2558 		 * We have to add SVPD_UNIT_SERIAL_NUMBER to the list
2559 		 * of pages supported by the device - otherwise, CAM
2560 		 * will never ask us for the serial number if the
2561 		 * device cannot handle that by itself.
2562 		 */
2563 		if (ccb->ccb_h.func_code == XPT_SCSI_IO &&
2564 		    sc->sc_transfer.cmd_data[0] == INQUIRY &&
2565 		    (sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2566 		    sc->sc_transfer.cmd_data[2] == SVPD_SUPPORTED_PAGE_LIST &&
2567 		    (usb_get_serial(sc->sc_udev)[0] != '\0')) {
2568 			struct ccb_scsiio *csio;
2569 			struct scsi_vpd_supported_page_list *page_list;
2570 
2571 			csio = &ccb->csio;
2572 			page_list = (struct scsi_vpd_supported_page_list *)csio->data_ptr;
2573 			if (page_list->length + 1 < SVPD_SUPPORTED_PAGES_SIZE) {
2574 				page_list->list[page_list->length] = SVPD_UNIT_SERIAL_NUMBER;
2575 				page_list->length++;
2576 			}
2577 		}
2578 		xpt_done(ccb);
2579 		break;
2580 
2581 	case STATUS_CMD_UNKNOWN:
2582 	case STATUS_CMD_FAILED:
2583 
2584 		/* fetch sense data */
2585 
2586 		/* the rest of the command was filled in at attach */
2587 		sc->cam_scsi_sense.length = ccb->csio.sense_len;
2588 
2589 		DPRINTF(sc, UDMASS_SCSI, "Fetching %d bytes of "
2590 		    "sense data\n", ccb->csio.sense_len);
2591 
2592 		if (umass_std_transform(sc, ccb, &sc->cam_scsi_sense.opcode,
2593 		    sizeof(sc->cam_scsi_sense))) {
2594 
2595 			if ((sc->sc_quirks & FORCE_SHORT_INQUIRY) &&
2596 			    (sc->sc_transfer.cmd_data[0] == INQUIRY)) {
2597 				ccb->csio.sense_len = SHORT_INQUIRY_LENGTH;
2598 			}
2599 			umass_command_start(sc, DIR_IN, &ccb->csio.sense_data.error_code,
2600 			    ccb->csio.sense_len, ccb->ccb_h.timeout,
2601 			    &umass_cam_sense_cb, ccb);
2602 		}
2603 		break;
2604 
2605 	default:
2606 		/*
2607 		 * The wire protocol failed and will hopefully have
2608 		 * recovered. We return an error to CAM and let CAM
2609 		 * retry the command if necessary. In case of SCSI IO
2610 		 * commands we ask the CAM layer to check the
2611 		 * condition first. This is a quick hack to make
2612 		 * certain devices work.
2613 		 */
2614 		if (ccb->ccb_h.func_code == XPT_SCSI_IO) {
2615 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR;
2616 			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2617 		} else {
2618 			ccb->ccb_h.status = CAM_REQ_CMP_ERR;
2619 		}
2620 		xpt_done(ccb);
2621 		break;
2622 	}
2623 }
2624 
2625 /*
2626  * Finalise a completed autosense operation
2627  */
2628 static void
2629 umass_cam_sense_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2630     uint8_t status)
2631 {
2632 	uint8_t *cmd;
2633 	uint8_t key;
2634 
2635 	switch (status) {
2636 	case STATUS_CMD_OK:
2637 	case STATUS_CMD_UNKNOWN:
2638 	case STATUS_CMD_FAILED:
2639 
2640 		if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2641 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2642 		} else {
2643 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2644 		}
2645 
2646 		key = (ccb->csio.sense_data.flags & SSD_KEY);
2647 
2648 		/*
2649 		 * Getting sense data always succeeds (apart from wire
2650 		 * failures):
2651 		 */
2652 		if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2653 		    (cmd[0] == INQUIRY) &&
2654 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2655 			/*
2656 			 * Ignore unit attention errors in the case where
2657 			 * the Unit Attention state is not cleared on
2658 			 * REQUEST SENSE. They will appear again at the next
2659 			 * command.
2660 			 */
2661 			ccb->ccb_h.status = CAM_REQ_CMP;
2662 		} else if (key == SSD_KEY_NO_SENSE) {
2663 			/*
2664 			 * No problem after all (in the case of CBI without
2665 			 * CCI)
2666 			 */
2667 			ccb->ccb_h.status = CAM_REQ_CMP;
2668 		} else if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2669 			    (cmd[0] == READ_CAPACITY) &&
2670 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2671 			/*
2672 			 * Some devices do not clear the unit attention error
2673 			 * on request sense. We insert a test unit ready
2674 			 * command to make sure we clear the unit attention
2675 			 * condition, then allow the retry to proceed as
2676 			 * usual.
2677 			 */
2678 
2679 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2680 			    | CAM_AUTOSNS_VALID;
2681 			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2682 
2683 #if 0
2684 			DELAY(300000);
2685 #endif
2686 			DPRINTF(sc, UDMASS_SCSI, "Doing a sneaky"
2687 			    "TEST_UNIT_READY\n");
2688 
2689 			/* the rest of the command was filled in at attach */
2690 
2691 			if (umass_std_transform(sc, ccb,
2692 			    &sc->cam_scsi_test_unit_ready.opcode,
2693 			    sizeof(sc->cam_scsi_test_unit_ready))) {
2694 				umass_command_start(sc, DIR_NONE, NULL, 0,
2695 				    ccb->ccb_h.timeout,
2696 				    &umass_cam_quirk_cb, ccb);
2697 			}
2698 			break;
2699 		} else {
2700 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2701 			    | CAM_AUTOSNS_VALID;
2702 			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2703 		}
2704 		xpt_done(ccb);
2705 		break;
2706 
2707 	default:
2708 		DPRINTF(sc, UDMASS_SCSI, "Autosense failed, "
2709 		    "status %d\n", status);
2710 		ccb->ccb_h.status = CAM_AUTOSENSE_FAIL;
2711 		xpt_done(ccb);
2712 	}
2713 }
2714 
2715 /*
2716  * This completion code just handles the fact that we sent a test-unit-ready
2717  * after having previously failed a READ CAPACITY with CHECK_COND.  Even
2718  * though this command succeeded, we have to tell CAM to retry.
2719  */
2720 static void
2721 umass_cam_quirk_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2722     uint8_t status)
2723 {
2724 	DPRINTF(sc, UDMASS_SCSI, "Test unit ready "
2725 	    "returned status %d\n", status);
2726 
2727 	ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2728 	    | CAM_AUTOSNS_VALID;
2729 	ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2730 	xpt_done(ccb);
2731 }
2732 
2733 /*
2734  * SCSI specific functions
2735  */
2736 
2737 static uint8_t
2738 umass_scsi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2739     uint8_t cmd_len)
2740 {
2741 	if ((cmd_len == 0) ||
2742 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2743 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2744 		    "length: %d bytes\n", cmd_len);
2745 		return (0);		/* failure */
2746 	}
2747 	sc->sc_transfer.cmd_len = cmd_len;
2748 
2749 	switch (cmd_ptr[0]) {
2750 	case TEST_UNIT_READY:
2751 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2752 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2753 			    "to START_UNIT\n");
2754 			bzero(sc->sc_transfer.cmd_data, cmd_len);
2755 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2756 			sc->sc_transfer.cmd_data[4] = SSS_START;
2757 			return (1);
2758 		}
2759 		break;
2760 
2761 	case INQUIRY:
2762 		/*
2763 		 * some drives wedge when asked for full inquiry
2764 		 * information.
2765 		 */
2766 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2767 			bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2768 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2769 			return (1);
2770 		}
2771 		break;
2772 	}
2773 
2774 	bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2775 	return (1);
2776 }
2777 
2778 static uint8_t
2779 umass_rbc_transform(struct umass_softc *sc, uint8_t *cmd_ptr, uint8_t cmd_len)
2780 {
2781 	if ((cmd_len == 0) ||
2782 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2783 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2784 		    "length: %d bytes\n", cmd_len);
2785 		return (0);		/* failure */
2786 	}
2787 	switch (cmd_ptr[0]) {
2788 		/* these commands are defined in RBC: */
2789 	case READ_10:
2790 	case READ_CAPACITY:
2791 	case START_STOP_UNIT:
2792 	case SYNCHRONIZE_CACHE:
2793 	case WRITE_10:
2794 	case 0x2f:			/* VERIFY_10 is absent from
2795 					 * scsi_all.h??? */
2796 	case INQUIRY:
2797 	case MODE_SELECT_10:
2798 	case MODE_SENSE_10:
2799 	case TEST_UNIT_READY:
2800 	case WRITE_BUFFER:
2801 		/*
2802 		 * The following commands are not listed in my copy of the
2803 		 * RBC specs. CAM however seems to want those, and at least
2804 		 * the Sony DSC device appears to support those as well
2805 		 */
2806 	case REQUEST_SENSE:
2807 	case PREVENT_ALLOW:
2808 
2809 		bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2810 
2811 		if ((sc->sc_quirks & RBC_PAD_TO_12) && (cmd_len < 12)) {
2812 			bzero(sc->sc_transfer.cmd_data + cmd_len, 12 - cmd_len);
2813 			cmd_len = 12;
2814 		}
2815 		sc->sc_transfer.cmd_len = cmd_len;
2816 		return (1);		/* sucess */
2817 
2818 		/* All other commands are not legal in RBC */
2819 	default:
2820 		DPRINTF(sc, UDMASS_SCSI, "Unsupported RBC "
2821 		    "command 0x%02x\n", cmd_ptr[0]);
2822 		return (0);		/* failure */
2823 	}
2824 }
2825 
2826 static uint8_t
2827 umass_ufi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2828     uint8_t cmd_len)
2829 {
2830 	if ((cmd_len == 0) ||
2831 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2832 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2833 		    "length: %d bytes\n", cmd_len);
2834 		return (0);		/* failure */
2835 	}
2836 	/* An UFI command is always 12 bytes in length */
2837 	sc->sc_transfer.cmd_len = UFI_COMMAND_LENGTH;
2838 
2839 	/* Zero the command data */
2840 	bzero(sc->sc_transfer.cmd_data, UFI_COMMAND_LENGTH);
2841 
2842 	switch (cmd_ptr[0]) {
2843 		/*
2844 		 * Commands of which the format has been verified. They
2845 		 * should work. Copy the command into the (zeroed out)
2846 		 * destination buffer.
2847 		 */
2848 	case TEST_UNIT_READY:
2849 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2850 			/*
2851 			 * Some devices do not support this command. Start
2852 			 * Stop Unit should give the same results
2853 			 */
2854 			DPRINTF(sc, UDMASS_UFI, "Converted TEST_UNIT_READY "
2855 			    "to START_UNIT\n");
2856 
2857 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2858 			sc->sc_transfer.cmd_data[4] = SSS_START;
2859 			return (1);
2860 		}
2861 		break;
2862 
2863 	case REZERO_UNIT:
2864 	case REQUEST_SENSE:
2865 	case FORMAT_UNIT:
2866 	case INQUIRY:
2867 	case START_STOP_UNIT:
2868 	case SEND_DIAGNOSTIC:
2869 	case PREVENT_ALLOW:
2870 	case READ_CAPACITY:
2871 	case READ_10:
2872 	case WRITE_10:
2873 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2874 	case WRITE_AND_VERIFY:
2875 	case VERIFY:
2876 	case MODE_SELECT_10:
2877 	case MODE_SENSE_10:
2878 	case READ_12:
2879 	case WRITE_12:
2880 	case READ_FORMAT_CAPACITIES:
2881 		break;
2882 
2883 		/*
2884 		 * SYNCHRONIZE_CACHE isn't supported by UFI, nor should it be
2885 		 * required for UFI devices, so it is appropriate to fake
2886 		 * success.
2887 		 */
2888 	case SYNCHRONIZE_CACHE:
2889 		return (2);
2890 
2891 	default:
2892 		DPRINTF(sc, UDMASS_SCSI, "Unsupported UFI "
2893 		    "command 0x%02x\n", cmd_ptr[0]);
2894 		return (0);		/* failure */
2895 	}
2896 
2897 	bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2898 	return (1);			/* success */
2899 }
2900 
2901 /*
2902  * 8070i (ATAPI) specific functions
2903  */
2904 static uint8_t
2905 umass_atapi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2906     uint8_t cmd_len)
2907 {
2908 	if ((cmd_len == 0) ||
2909 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2910 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2911 		    "length: %d bytes\n", cmd_len);
2912 		return (0);		/* failure */
2913 	}
2914 	/* An ATAPI command is always 12 bytes in length. */
2915 	sc->sc_transfer.cmd_len = ATAPI_COMMAND_LENGTH;
2916 
2917 	/* Zero the command data */
2918 	bzero(sc->sc_transfer.cmd_data, ATAPI_COMMAND_LENGTH);
2919 
2920 	switch (cmd_ptr[0]) {
2921 		/*
2922 		 * Commands of which the format has been verified. They
2923 		 * should work. Copy the command into the destination
2924 		 * buffer.
2925 		 */
2926 	case INQUIRY:
2927 		/*
2928 		 * some drives wedge when asked for full inquiry
2929 		 * information.
2930 		 */
2931 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2932 			bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2933 
2934 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2935 			return (1);
2936 		}
2937 		break;
2938 
2939 	case TEST_UNIT_READY:
2940 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2941 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2942 			    "to START_UNIT\n");
2943 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2944 			sc->sc_transfer.cmd_data[4] = SSS_START;
2945 			return (1);
2946 		}
2947 		break;
2948 
2949 	case REZERO_UNIT:
2950 	case REQUEST_SENSE:
2951 	case START_STOP_UNIT:
2952 	case SEND_DIAGNOSTIC:
2953 	case PREVENT_ALLOW:
2954 	case READ_CAPACITY:
2955 	case READ_10:
2956 	case WRITE_10:
2957 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2958 	case SYNCHRONIZE_CACHE:
2959 	case MODE_SELECT_10:
2960 	case MODE_SENSE_10:
2961 	case READ_BUFFER:
2962 	case 0x42:			/* READ_SUBCHANNEL */
2963 	case 0x43:			/* READ_TOC */
2964 	case 0x44:			/* READ_HEADER */
2965 	case 0x47:			/* PLAY_MSF (Play Minute/Second/Frame) */
2966 	case 0x48:			/* PLAY_TRACK */
2967 	case 0x49:			/* PLAY_TRACK_REL */
2968 	case 0x4b:			/* PAUSE */
2969 	case 0x51:			/* READ_DISK_INFO */
2970 	case 0x52:			/* READ_TRACK_INFO */
2971 	case 0x54:			/* SEND_OPC */
2972 	case 0x59:			/* READ_MASTER_CUE */
2973 	case 0x5b:			/* CLOSE_TR_SESSION */
2974 	case 0x5c:			/* READ_BUFFER_CAP */
2975 	case 0x5d:			/* SEND_CUE_SHEET */
2976 	case 0xa1:			/* BLANK */
2977 	case 0xa5:			/* PLAY_12 */
2978 	case 0xa6:			/* EXCHANGE_MEDIUM */
2979 	case 0xad:			/* READ_DVD_STRUCTURE */
2980 	case 0xbb:			/* SET_CD_SPEED */
2981 	case 0xe5:			/* READ_TRACK_INFO_PHILIPS */
2982 		break;
2983 
2984 	case READ_12:
2985 	case WRITE_12:
2986 	default:
2987 		DPRINTF(sc, UDMASS_SCSI, "Unsupported ATAPI "
2988 		    "command 0x%02x - trying anyway\n",
2989 		    cmd_ptr[0]);
2990 		break;
2991 	}
2992 
2993 	bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2994 	return (1);			/* success */
2995 }
2996 
2997 static uint8_t
2998 umass_no_transform(struct umass_softc *sc, uint8_t *cmd,
2999     uint8_t cmdlen)
3000 {
3001 	return (0);			/* failure */
3002 }
3003 
3004 static uint8_t
3005 umass_std_transform(struct umass_softc *sc, union ccb *ccb,
3006     uint8_t *cmd, uint8_t cmdlen)
3007 {
3008 	uint8_t retval;
3009 
3010 	retval = (sc->sc_transform) (sc, cmd, cmdlen);
3011 
3012 	if (retval == 2) {
3013 		ccb->ccb_h.status = CAM_REQ_CMP;
3014 		xpt_done(ccb);
3015 		return (0);
3016 	} else if (retval == 0) {
3017 		ccb->ccb_h.status = CAM_REQ_INVALID;
3018 		xpt_done(ccb);
3019 		return (0);
3020 	}
3021 	/* Command should be executed */
3022 	return (1);
3023 }
3024 
3025 #ifdef USB_DEBUG
3026 static void
3027 umass_bbb_dump_cbw(struct umass_softc *sc, umass_bbb_cbw_t *cbw)
3028 {
3029 	uint8_t *c = cbw->CBWCDB;
3030 
3031 	uint32_t dlen = UGETDW(cbw->dCBWDataTransferLength);
3032 	uint32_t tag = UGETDW(cbw->dCBWTag);
3033 
3034 	uint8_t clen = cbw->bCDBLength;
3035 	uint8_t flags = cbw->bCBWFlags;
3036 	uint8_t lun = cbw->bCBWLUN;
3037 
3038 	DPRINTF(sc, UDMASS_BBB, "CBW %d: cmd = %db "
3039 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
3040 	    "data = %db, lun = %d, dir = %s\n",
3041 	    tag, clen,
3042 	    c[0], c[1], c[2], c[3], c[4], c[5], (clen > 6 ? "..." : ""),
3043 	    dlen, lun, (flags == CBWFLAGS_IN ? "in" :
3044 	    (flags == CBWFLAGS_OUT ? "out" : "<invalid>")));
3045 }
3046 
3047 static void
3048 umass_bbb_dump_csw(struct umass_softc *sc, umass_bbb_csw_t *csw)
3049 {
3050 	uint32_t sig = UGETDW(csw->dCSWSignature);
3051 	uint32_t tag = UGETDW(csw->dCSWTag);
3052 	uint32_t res = UGETDW(csw->dCSWDataResidue);
3053 	uint8_t status = csw->bCSWStatus;
3054 
3055 	DPRINTF(sc, UDMASS_BBB, "CSW %d: sig = 0x%08x (%s), tag = 0x%08x, "
3056 	    "res = %d, status = 0x%02x (%s)\n",
3057 	    tag, sig, (sig == CSWSIGNATURE ? "valid" : "invalid"),
3058 	    tag, res,
3059 	    status, (status == CSWSTATUS_GOOD ? "good" :
3060 	    (status == CSWSTATUS_FAILED ? "failed" :
3061 	    (status == CSWSTATUS_PHASE ? "phase" : "<invalid>"))));
3062 }
3063 
3064 static void
3065 umass_cbi_dump_cmd(struct umass_softc *sc, void *cmd, uint8_t cmdlen)
3066 {
3067 	uint8_t *c = cmd;
3068 	uint8_t dir = sc->sc_transfer.dir;
3069 
3070 	DPRINTF(sc, UDMASS_BBB, "cmd = %db "
3071 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
3072 	    "data = %db, dir = %s\n",
3073 	    cmdlen,
3074 	    c[0], c[1], c[2], c[3], c[4], c[5], (cmdlen > 6 ? "..." : ""),
3075 	    sc->sc_transfer.data_len,
3076 	    (dir == DIR_IN ? "in" :
3077 	    (dir == DIR_OUT ? "out" :
3078 	    (dir == DIR_NONE ? "no data phase" : "<invalid>"))));
3079 }
3080 
3081 static void
3082 umass_dump_buffer(struct umass_softc *sc, uint8_t *buffer, uint32_t buflen,
3083     uint32_t printlen)
3084 {
3085 	uint32_t i, j;
3086 	char s1[40];
3087 	char s2[40];
3088 	char s3[5];
3089 
3090 	s1[0] = '\0';
3091 	s3[0] = '\0';
3092 
3093 	sprintf(s2, " buffer=%p, buflen=%d", buffer, buflen);
3094 	for (i = 0; (i < buflen) && (i < printlen); i++) {
3095 		j = i % 16;
3096 		if (j == 0 && i != 0) {
3097 			DPRINTF(sc, UDMASS_GEN, "0x %s%s\n",
3098 			    s1, s2);
3099 			s2[0] = '\0';
3100 		}
3101 		sprintf(&s1[j * 2], "%02x", buffer[i] & 0xff);
3102 	}
3103 	if (buflen > printlen)
3104 		sprintf(s3, " ...");
3105 	DPRINTF(sc, UDMASS_GEN, "0x %s%s%s\n",
3106 	    s1, s2, s3);
3107 }
3108 
3109 #endif
3110