xref: /dragonfly/sys/bus/u4b/storage/ustorage_fs.c (revision 82730a9c)
1 /* $FreeBSD$ */
2 /*-
3  * Copyright (C) 2003-2005 Alan Stern
4  * Copyright (C) 2008 Hans Petter Selasky
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions, and the following disclaimer,
12  *    without modification.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. The names of the above-listed copyright holders may not be used
17  *    to endorse or promote products derived from this software without
18  *    specific prior written permission.
19  *
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
22  * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
23  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
25  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
26  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
27  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
28  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
29  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
30  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
31  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 /*
35  * NOTE: Much of the SCSI statemachine handling code derives from the
36  * Linux USB gadget stack.
37  */
38 
39 #include <sys/stdint.h>
40 #include <sys/param.h>
41 #include <sys/queue.h>
42 #include <sys/types.h>
43 #include <sys/systm.h>
44 #include <sys/kernel.h>
45 #include <sys/bus.h>
46 #include <sys/module.h>
47 #include <sys/lock.h>
48 #include <sys/mutex.h>
49 #include <sys/condvar.h>
50 #include <sys/sysctl.h>
51 #include <sys/unistd.h>
52 #include <sys/callout.h>
53 #include <sys/malloc.h>
54 #include <sys/priv.h>
55 
56 #include <bus/u4b/usb.h>
57 #include <bus/u4b/usbdi.h>
58 #include "usbdevs.h"
59 #include "usb_if.h"
60 
61 #define	USB_DEBUG_VAR ustorage_fs_debug
62 #include <bus/u4b/usb_debug.h>
63 
64 #ifdef USB_DEBUG
65 static int ustorage_fs_debug = 0;
66 
67 SYSCTL_NODE(_hw_usb, OID_AUTO, ustorage_fs, CTLFLAG_RW, 0, "USB ustorage_fs");
68 SYSCTL_INT(_hw_usb_ustorage_fs, OID_AUTO, debug, CTLFLAG_RW,
69     &ustorage_fs_debug, 0, "ustorage_fs debug level");
70 #endif
71 
72 /* Define some limits */
73 
74 #ifndef USTORAGE_FS_BULK_SIZE
75 #define	USTORAGE_FS_BULK_SIZE (1UL << 17)	/* bytes */
76 #endif
77 
78 #ifndef	USTORAGE_FS_MAX_LUN
79 #define	USTORAGE_FS_MAX_LUN	8	/* units */
80 #endif
81 
82 #ifndef USTORAGE_QDATA_MAX
83 #define	USTORAGE_QDATA_MAX	40	/* bytes */
84 #endif
85 
86 #define sc_cmd_data sc_cbw.CBWCDB
87 
88 /*
89  * The SCSI ID string must be exactly 28 characters long
90  * exluding the terminating zero.
91  */
92 #ifndef USTORAGE_FS_ID_STRING
93 #define	USTORAGE_FS_ID_STRING \
94 	"FreeBSD " /* 8 */ \
95 	"File-Stor Gadget" /* 16 */ \
96 	"0101" /* 4 */
97 #endif
98 
99 /*
100  * The following macro defines the number of
101  * sectors to be allocated for the RAM disk:
102  */
103 #ifndef USTORAGE_FS_RAM_SECT
104 #define	USTORAGE_FS_RAM_SECT (1UL << 13)
105 #endif
106 
107 static uint8_t *ustorage_fs_ramdisk;
108 
109 /* USB transfer definitions */
110 
111 #define	USTORAGE_FS_T_BBB_COMMAND     0
112 #define	USTORAGE_FS_T_BBB_DATA_DUMP   1
113 #define	USTORAGE_FS_T_BBB_DATA_READ   2
114 #define	USTORAGE_FS_T_BBB_DATA_WRITE  3
115 #define	USTORAGE_FS_T_BBB_STATUS      4
116 #define	USTORAGE_FS_T_BBB_MAX         5
117 
118 /* USB data stage direction */
119 
120 #define	DIR_NONE	0
121 #define	DIR_READ	1
122 #define	DIR_WRITE	2
123 
124 /* USB interface specific control request */
125 
126 #define	UR_BBB_RESET		0xff	/* Bulk-Only reset */
127 #define	UR_BBB_GET_MAX_LUN	0xfe	/* Get maximum lun */
128 
129 /* Command Block Wrapper */
130 typedef struct {
131 	uDWord	dCBWSignature;
132 #define	CBWSIGNATURE	0x43425355
133 	uDWord	dCBWTag;
134 	uDWord	dCBWDataTransferLength;
135 	uByte	bCBWFlags;
136 #define	CBWFLAGS_OUT	0x00
137 #define	CBWFLAGS_IN	0x80
138 	uByte	bCBWLUN;
139 	uByte	bCDBLength;
140 #define	CBWCDBLENGTH	16
141 	uByte	CBWCDB[CBWCDBLENGTH];
142 } __packed ustorage_fs_bbb_cbw_t;
143 
144 #define	USTORAGE_FS_BBB_CBW_SIZE	31
145 
146 /* Command Status Wrapper */
147 typedef struct {
148 	uDWord	dCSWSignature;
149 #define	CSWSIGNATURE	0x53425355
150 	uDWord	dCSWTag;
151 	uDWord	dCSWDataResidue;
152 	uByte	bCSWStatus;
153 #define	CSWSTATUS_GOOD	0x0
154 #define	CSWSTATUS_FAILED	0x1
155 #define	CSWSTATUS_PHASE	0x2
156 } __packed ustorage_fs_bbb_csw_t;
157 
158 #define	USTORAGE_FS_BBB_CSW_SIZE	13
159 
160 struct ustorage_fs_lun {
161 
162 	uint8_t	*memory_image;
163 
164 	uint32_t num_sectors;
165 	uint32_t sense_data;
166 	uint32_t sense_data_info;
167 	uint32_t unit_attention_data;
168 
169 	uint8_t	read_only:1;
170 	uint8_t	prevent_medium_removal:1;
171 	uint8_t	info_valid:1;
172 	uint8_t	removable:1;
173 };
174 
175 struct ustorage_fs_softc {
176 
177 	ustorage_fs_bbb_cbw_t *sc_cbw;	/* Command Wrapper Block */
178 	ustorage_fs_bbb_csw_t *sc_csw;	/* Command Status Block */
179 	void *sc_dma_ptr;		/* Main data buffer */
180 
181 	struct lock sc_lock;
182 
183 	struct ustorage_fs_lun sc_lun[USTORAGE_FS_MAX_LUN];
184 
185 	struct {
186 		uint8_t *data_ptr;
187 		struct ustorage_fs_lun *currlun;
188 
189 		uint32_t data_rem;	/* bytes, as reported by the command
190 					 * block wrapper */
191 		uint32_t offset;	/* bytes */
192 
193 		uint8_t	cbw_dir;
194 		uint8_t	cmd_dir;
195 		uint8_t	lun;
196 		uint8_t	cmd_len;
197 		uint8_t	data_short:1;
198 		uint8_t	data_error:1;
199 	}	sc_transfer;
200 
201 	device_t sc_dev;
202 	struct usb_device *sc_udev;
203 	struct usb_xfer *sc_xfer[USTORAGE_FS_T_BBB_MAX];
204 
205 	uint8_t	sc_iface_no;		/* interface number */
206 	uint8_t	sc_last_lun;
207 	uint8_t	sc_last_xfer_index;
208 	uint8_t	sc_qdata[USTORAGE_QDATA_MAX];
209 };
210 
211 /* prototypes */
212 
213 static device_probe_t ustorage_fs_probe;
214 static device_attach_t ustorage_fs_attach;
215 static device_detach_t ustorage_fs_detach;
216 static device_suspend_t ustorage_fs_suspend;
217 static device_resume_t ustorage_fs_resume;
218 static usb_handle_request_t ustorage_fs_handle_request;
219 
220 static usb_callback_t ustorage_fs_t_bbb_command_callback;
221 static usb_callback_t ustorage_fs_t_bbb_data_dump_callback;
222 static usb_callback_t ustorage_fs_t_bbb_data_read_callback;
223 static usb_callback_t ustorage_fs_t_bbb_data_write_callback;
224 static usb_callback_t ustorage_fs_t_bbb_status_callback;
225 
226 static void ustorage_fs_transfer_start(struct ustorage_fs_softc *sc, uint8_t xfer_index);
227 static void ustorage_fs_transfer_stop(struct ustorage_fs_softc *sc);
228 
229 static uint8_t ustorage_fs_verify(struct ustorage_fs_softc *sc);
230 static uint8_t ustorage_fs_inquiry(struct ustorage_fs_softc *sc);
231 static uint8_t ustorage_fs_request_sense(struct ustorage_fs_softc *sc);
232 static uint8_t ustorage_fs_read_capacity(struct ustorage_fs_softc *sc);
233 static uint8_t ustorage_fs_mode_sense(struct ustorage_fs_softc *sc);
234 static uint8_t ustorage_fs_start_stop(struct ustorage_fs_softc *sc);
235 static uint8_t ustorage_fs_prevent_allow(struct ustorage_fs_softc *sc);
236 static uint8_t ustorage_fs_read_format_capacities(struct ustorage_fs_softc *sc);
237 static uint8_t ustorage_fs_mode_select(struct ustorage_fs_softc *sc);
238 static uint8_t ustorage_fs_min_len(struct ustorage_fs_softc *sc, uint32_t len, uint32_t mask);
239 static uint8_t ustorage_fs_read(struct ustorage_fs_softc *sc);
240 static uint8_t ustorage_fs_write(struct ustorage_fs_softc *sc);
241 static uint8_t ustorage_fs_check_cmd(struct ustorage_fs_softc *sc, uint8_t cmd_size, uint16_t mask, uint8_t needs_medium);
242 static uint8_t ustorage_fs_do_cmd(struct ustorage_fs_softc *sc);
243 
244 static device_method_t ustorage_fs_methods[] = {
245 	/* USB interface */
246 	DEVMETHOD(usb_handle_request, ustorage_fs_handle_request),
247 
248 	/* Device interface */
249 	DEVMETHOD(device_probe, ustorage_fs_probe),
250 	DEVMETHOD(device_attach, ustorage_fs_attach),
251 	DEVMETHOD(device_detach, ustorage_fs_detach),
252 	DEVMETHOD(device_suspend, ustorage_fs_suspend),
253 	DEVMETHOD(device_resume, ustorage_fs_resume),
254 
255 	DEVMETHOD_END
256 };
257 
258 static driver_t ustorage_fs_driver = {
259 	.name = "ustorage_fs",
260 	.methods = ustorage_fs_methods,
261 	.size = sizeof(struct ustorage_fs_softc),
262 };
263 
264 static devclass_t ustorage_fs_devclass;
265 
266 DRIVER_MODULE(ustorage_fs, uhub, ustorage_fs_driver, ustorage_fs_devclass, NULL, NULL);
267 MODULE_VERSION(ustorage_fs, 0);
268 MODULE_DEPEND(ustorage_fs, usb, 1, 1, 1);
269 
270 static struct usb_config ustorage_fs_bbb_config[USTORAGE_FS_T_BBB_MAX] = {
271 
272 	[USTORAGE_FS_T_BBB_COMMAND] = {
273 		.type = UE_BULK,
274 		.endpoint = UE_ADDR_ANY,
275 		.direction = UE_DIR_OUT,
276 		.bufsize = sizeof(ustorage_fs_bbb_cbw_t),
277 		.callback = &ustorage_fs_t_bbb_command_callback,
278 		.usb_mode = USB_MODE_DEVICE,
279 	},
280 
281 	[USTORAGE_FS_T_BBB_DATA_DUMP] = {
282 		.type = UE_BULK,
283 		.endpoint = UE_ADDR_ANY,
284 		.direction = UE_DIR_OUT,
285 		.bufsize = 0,	/* use wMaxPacketSize */
286 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,},
287 		.callback = &ustorage_fs_t_bbb_data_dump_callback,
288 		.usb_mode = USB_MODE_DEVICE,
289 	},
290 
291 	[USTORAGE_FS_T_BBB_DATA_READ] = {
292 		.type = UE_BULK,
293 		.endpoint = UE_ADDR_ANY,
294 		.direction = UE_DIR_OUT,
295 		.bufsize = USTORAGE_FS_BULK_SIZE,
296 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1},
297 		.callback = &ustorage_fs_t_bbb_data_read_callback,
298 		.usb_mode = USB_MODE_DEVICE,
299 	},
300 
301 	[USTORAGE_FS_T_BBB_DATA_WRITE] = {
302 		.type = UE_BULK,
303 		.endpoint = UE_ADDR_ANY,
304 		.direction = UE_DIR_IN,
305 		.bufsize = USTORAGE_FS_BULK_SIZE,
306 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer = 1},
307 		.callback = &ustorage_fs_t_bbb_data_write_callback,
308 		.usb_mode = USB_MODE_DEVICE,
309 	},
310 
311 	[USTORAGE_FS_T_BBB_STATUS] = {
312 		.type = UE_BULK,
313 		.endpoint = UE_ADDR_ANY,
314 		.direction = UE_DIR_IN,
315 		.bufsize = sizeof(ustorage_fs_bbb_csw_t),
316 		.flags = {.short_xfer_ok = 1},
317 		.callback = &ustorage_fs_t_bbb_status_callback,
318 		.usb_mode = USB_MODE_DEVICE,
319 	},
320 };
321 
322 /*
323  * USB device probe/attach/detach
324  */
325 
326 static int
327 ustorage_fs_probe(device_t dev)
328 {
329 	struct usb_attach_arg *uaa = device_get_ivars(dev);
330 	struct usb_interface_descriptor *id;
331 
332 	if (uaa->usb_mode != USB_MODE_DEVICE) {
333 		return (ENXIO);
334 	}
335 	/* Check for a standards compliant device */
336 	id = usbd_get_interface_descriptor(uaa->iface);
337 	if ((id == NULL) ||
338 	    (id->bInterfaceClass != UICLASS_MASS) ||
339 	    (id->bInterfaceSubClass != UISUBCLASS_SCSI) ||
340 	    (id->bInterfaceProtocol != UIPROTO_MASS_BBB)) {
341 		return (ENXIO);
342 	}
343 	return (BUS_PROBE_GENERIC);
344 }
345 
346 static int
347 ustorage_fs_attach(device_t dev)
348 {
349 	struct ustorage_fs_softc *sc = device_get_softc(dev);
350 	struct usb_attach_arg *uaa = device_get_ivars(dev);
351 	struct usb_interface_descriptor *id;
352 	int err;
353 	int unit;
354 
355 	/*
356 	 * NOTE: the softc struct is cleared in device_set_driver.
357 	 * We can safely call ustorage_fs_detach without specifically
358 	 * initializing the struct.
359 	 */
360 
361 	sc->sc_dev = dev;
362 	sc->sc_udev = uaa->device;
363 	unit = device_get_unit(dev);
364 
365 	/* enable power saving mode */
366 	usbd_set_power_mode(uaa->device, USB_POWER_MODE_SAVE);
367 
368 	if (unit == 0) {
369 		if (ustorage_fs_ramdisk == NULL) {
370 			/*
371 			 * allocate a memory image for our ramdisk until
372 			 * further
373 			 */
374 			ustorage_fs_ramdisk =
375 			    kmalloc(USTORAGE_FS_RAM_SECT << 9, M_USB,
376 			    M_ZERO | M_WAITOK);
377 
378 			if (ustorage_fs_ramdisk == NULL) {
379 				return (ENOMEM);
380 			}
381 		}
382 		sc->sc_lun[0].memory_image = ustorage_fs_ramdisk;
383 		sc->sc_lun[0].num_sectors = USTORAGE_FS_RAM_SECT;
384 		sc->sc_lun[0].removable = 1;
385 	}
386 
387 	device_set_usb_desc(dev);
388 
389 	lockinit(&sc->sc_lock, "USTORAGE_FS lock", 0, LK_CANRECURSE);
390 
391 	/* get interface index */
392 
393 	id = usbd_get_interface_descriptor(uaa->iface);
394 	if (id == NULL) {
395 		device_printf(dev, "failed to get "
396 		    "interface number\n");
397 		goto detach;
398 	}
399 	sc->sc_iface_no = id->bInterfaceNumber;
400 
401 	err = usbd_transfer_setup(uaa->device,
402 	    &uaa->info.bIfaceIndex, sc->sc_xfer, ustorage_fs_bbb_config,
403 	    USTORAGE_FS_T_BBB_MAX, sc, &sc->sc_lock);
404 	if (err) {
405 		device_printf(dev, "could not setup required "
406 		    "transfers, %s\n", usbd_errstr(err));
407 		goto detach;
408 	}
409 
410 	sc->sc_cbw = usbd_xfer_get_frame_buffer(sc->sc_xfer[
411 	    USTORAGE_FS_T_BBB_COMMAND], 0);
412 	sc->sc_csw = usbd_xfer_get_frame_buffer(sc->sc_xfer[
413 	    USTORAGE_FS_T_BBB_STATUS], 0);
414  	sc->sc_dma_ptr = usbd_xfer_get_frame_buffer(sc->sc_xfer[
415 	    USTORAGE_FS_T_BBB_DATA_READ], 0);
416 
417 	/* start Mass Storage State Machine */
418 
419 	lockmgr(&sc->sc_lock, LK_EXCLUSIVE);
420 	ustorage_fs_transfer_start(sc, USTORAGE_FS_T_BBB_COMMAND);
421 	lockmgr(&sc->sc_lock, LK_RELEASE);
422 
423 	return (0);			/* success */
424 
425 detach:
426 	ustorage_fs_detach(dev);
427 	return (ENXIO);			/* failure */
428 }
429 
430 static int
431 ustorage_fs_detach(device_t dev)
432 {
433 	struct ustorage_fs_softc *sc = device_get_softc(dev);
434 
435 	/* teardown our statemachine */
436 
437 	usbd_transfer_unsetup(sc->sc_xfer, USTORAGE_FS_T_BBB_MAX);
438 
439 	lockuninit(&sc->sc_lock);
440 
441 	return (0);			/* success */
442 }
443 
444 static int
445 ustorage_fs_suspend(device_t dev)
446 {
447 	device_printf(dev, "suspending\n");
448 	return (0);			/* success */
449 }
450 
451 static int
452 ustorage_fs_resume(device_t dev)
453 {
454 	device_printf(dev, "resuming\n");
455 	return (0);			/* success */
456 }
457 
458 /*
459  * Generic functions to handle transfers
460  */
461 
462 static void
463 ustorage_fs_transfer_start(struct ustorage_fs_softc *sc, uint8_t xfer_index)
464 {
465 	if (sc->sc_xfer[xfer_index]) {
466 		sc->sc_last_xfer_index = xfer_index;
467 		usbd_transfer_start(sc->sc_xfer[xfer_index]);
468 	}
469 }
470 
471 static void
472 ustorage_fs_transfer_stop(struct ustorage_fs_softc *sc)
473 {
474 	usbd_transfer_stop(sc->sc_xfer[sc->sc_last_xfer_index]);
475 	lockmgr(&sc->sc_lock, LK_RELEASE);
476 	usbd_transfer_drain(sc->sc_xfer[sc->sc_last_xfer_index]);
477 	lockmgr(&sc->sc_lock, LK_EXCLUSIVE);
478 }
479 
480 static int
481 ustorage_fs_handle_request(device_t dev,
482     const void *preq, void **pptr, uint16_t *plen,
483     uint16_t offset, uint8_t *pstate)
484 {
485 	struct ustorage_fs_softc *sc = device_get_softc(dev);
486 	const struct usb_device_request *req = preq;
487 	uint8_t is_complete = *pstate;
488 
489 	if (!is_complete) {
490 		if ((req->bmRequestType == UT_WRITE_CLASS_INTERFACE) &&
491 		    (req->bRequest == UR_BBB_RESET)) {
492 			*plen = 0;
493 			lockmgr(&sc->sc_lock, LK_EXCLUSIVE);
494 			ustorage_fs_transfer_stop(sc);
495 			sc->sc_transfer.data_error = 1;
496 			ustorage_fs_transfer_start(sc,
497 			    USTORAGE_FS_T_BBB_COMMAND);
498 			lockmgr(&sc->sc_lock, LK_RELEASE);
499 			return (0);
500 		} else if ((req->bmRequestType == UT_READ_CLASS_INTERFACE) &&
501 			   (req->bRequest == UR_BBB_GET_MAX_LUN)) {
502 			if (offset == 0) {
503 				*plen = 1;
504 				*pptr = &sc->sc_last_lun;
505 			} else {
506 				*plen = 0;
507 			}
508 			return (0);
509 		}
510 	}
511 	return (ENXIO);			/* use builtin handler */
512 }
513 
514 static void
515 ustorage_fs_t_bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
516 {
517 	struct ustorage_fs_softc *sc = usbd_xfer_softc(xfer);
518 	uint32_t tag;
519 	uint8_t err = 0;
520 
521 	DPRINTF("\n");
522 
523 	switch (USB_GET_STATE(xfer)) {
524 	case USB_ST_TRANSFERRED:
525 
526 		tag = UGETDW(sc->sc_cbw->dCBWSignature);
527 
528 		if (tag != CBWSIGNATURE) {
529 			/* do nothing */
530 			DPRINTF("invalid signature 0x%08x\n", tag);
531 			break;
532 		}
533 		tag = UGETDW(sc->sc_cbw->dCBWTag);
534 
535 		/* echo back tag */
536 		USETDW(sc->sc_csw->dCSWTag, tag);
537 
538 		/* reset status */
539 		sc->sc_csw->bCSWStatus = 0;
540 
541 		/* reset data offset, data length and data remainder */
542 		sc->sc_transfer.offset = 0;
543 		sc->sc_transfer.data_rem =
544 		    UGETDW(sc->sc_cbw->dCBWDataTransferLength);
545 
546 		/* reset data flags */
547 		sc->sc_transfer.data_short = 0;
548 
549 		/* extract LUN */
550 		sc->sc_transfer.lun = sc->sc_cbw->bCBWLUN;
551 
552 		if (sc->sc_transfer.data_rem == 0) {
553 			sc->sc_transfer.cbw_dir = DIR_NONE;
554 		} else {
555 			if (sc->sc_cbw->bCBWFlags & CBWFLAGS_IN) {
556 				sc->sc_transfer.cbw_dir = DIR_WRITE;
557 			} else {
558 				sc->sc_transfer.cbw_dir = DIR_READ;
559 			}
560 		}
561 
562 		sc->sc_transfer.cmd_len = sc->sc_cbw->bCDBLength;
563 		if ((sc->sc_transfer.cmd_len > sizeof(sc->sc_cbw->CBWCDB)) ||
564 		    (sc->sc_transfer.cmd_len == 0)) {
565 			/* just halt - this is invalid */
566 			DPRINTF("invalid command length %d bytes\n",
567 			    sc->sc_transfer.cmd_len);
568 			break;
569 		}
570 
571 		err = ustorage_fs_do_cmd(sc);
572 		if (err) {
573 			/* got an error */
574 			DPRINTF("command failed\n");
575 			break;
576 		}
577 		if ((sc->sc_transfer.data_rem > 0) &&
578 		    (sc->sc_transfer.cbw_dir != sc->sc_transfer.cmd_dir)) {
579 			/* contradicting data transfer direction */
580 			err = 1;
581 			DPRINTF("data direction mismatch\n");
582 			break;
583 		}
584 		switch (sc->sc_transfer.cbw_dir) {
585 		case DIR_READ:
586 			ustorage_fs_transfer_start(sc, USTORAGE_FS_T_BBB_DATA_READ);
587 			break;
588 		case DIR_WRITE:
589 			ustorage_fs_transfer_start(sc, USTORAGE_FS_T_BBB_DATA_WRITE);
590 			break;
591 		default:
592 			ustorage_fs_transfer_start(sc,
593 			    USTORAGE_FS_T_BBB_STATUS);
594 			break;
595 		}
596 		break;
597 
598 	case USB_ST_SETUP:
599 tr_setup:
600 		if (sc->sc_transfer.data_error) {
601 			sc->sc_transfer.data_error = 0;
602 			usbd_xfer_set_stall(xfer);
603 			DPRINTF("stall pipe\n");
604 		}
605 		usbd_xfer_set_frame_len(xfer, 0,
606 		    sizeof(ustorage_fs_bbb_cbw_t));
607 		usbd_transfer_submit(xfer);
608 		break;
609 
610 	default:			/* Error */
611 		DPRINTF("error\n");
612 		if (error == USB_ERR_CANCELLED) {
613 			break;
614 		}
615 		/* If the pipe is already stalled, don't do another stall */
616 		if (!usbd_xfer_is_stalled(xfer))
617 			sc->sc_transfer.data_error = 1;
618 
619 		/* try again */
620 		goto tr_setup;
621 	}
622 	if (err) {
623 		if (sc->sc_csw->bCSWStatus == 0) {
624 			/* set some default error code */
625 			sc->sc_csw->bCSWStatus = CSWSTATUS_FAILED;
626 		}
627 		if (sc->sc_transfer.cbw_dir == DIR_READ) {
628 			/* dump all data */
629 			ustorage_fs_transfer_start(sc,
630 			    USTORAGE_FS_T_BBB_DATA_DUMP);
631 			return;
632 		}
633 		if (sc->sc_transfer.cbw_dir == DIR_WRITE) {
634 			/* need to stall before status */
635 			sc->sc_transfer.data_error = 1;
636 		}
637 		ustorage_fs_transfer_start(sc, USTORAGE_FS_T_BBB_STATUS);
638 	}
639 }
640 
641 static void
642 ustorage_fs_t_bbb_data_dump_callback(struct usb_xfer *xfer, usb_error_t error)
643 {
644 	struct ustorage_fs_softc *sc = usbd_xfer_softc(xfer);
645 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
646 	int actlen, sumlen;
647 
648 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
649 
650 	DPRINTF("\n");
651 
652 	switch (USB_GET_STATE(xfer)) {
653 	case USB_ST_TRANSFERRED:
654 		sc->sc_transfer.data_rem -= actlen;
655 		sc->sc_transfer.offset += actlen;
656 
657 		if (actlen != sumlen || sc->sc_transfer.data_rem == 0) {
658 			/* short transfer or end of data */
659 			ustorage_fs_transfer_start(sc,
660 			    USTORAGE_FS_T_BBB_STATUS);
661 			break;
662 		}
663 		/* Fallthrough */
664 
665 	case USB_ST_SETUP:
666 tr_setup:
667 		if (max_bulk > sc->sc_transfer.data_rem) {
668 			max_bulk = sc->sc_transfer.data_rem;
669 		}
670 		if (sc->sc_transfer.data_error) {
671 			sc->sc_transfer.data_error = 0;
672 			usbd_xfer_set_stall(xfer);
673 		}
674 		usbd_xfer_set_frame_len(xfer, 0, max_bulk);
675 		usbd_transfer_submit(xfer);
676 		break;
677 
678 	default:			/* Error */
679 		if (error == USB_ERR_CANCELLED) {
680 			break;
681 		}
682 		/*
683 		 * If the pipe is already stalled, don't do another stall:
684 		 */
685 		if (!usbd_xfer_is_stalled(xfer))
686 			sc->sc_transfer.data_error = 1;
687 
688 		/* try again */
689 		goto tr_setup;
690 	}
691 }
692 
693 static void
694 ustorage_fs_t_bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
695 {
696 	struct ustorage_fs_softc *sc = usbd_xfer_softc(xfer);
697 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
698 	int actlen, sumlen;
699 
700 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
701 
702 	DPRINTF("\n");
703 
704 	switch (USB_GET_STATE(xfer)) {
705 	case USB_ST_TRANSFERRED:
706 		/* XXX copy data from DMA buffer */
707 		memcpy(sc->sc_transfer.data_ptr, sc->sc_dma_ptr, actlen);
708 
709 		sc->sc_transfer.data_rem -= actlen;
710 		sc->sc_transfer.data_ptr += actlen;
711 		sc->sc_transfer.offset += actlen;
712 
713 		if (actlen != sumlen || sc->sc_transfer.data_rem == 0) {
714 			/* short transfer or end of data */
715 			ustorage_fs_transfer_start(sc,
716 			    USTORAGE_FS_T_BBB_STATUS);
717 			break;
718 		}
719 		/* Fallthrough */
720 
721 	case USB_ST_SETUP:
722 tr_setup:
723 		if (max_bulk > sc->sc_transfer.data_rem) {
724 			max_bulk = sc->sc_transfer.data_rem;
725 		}
726 		if (sc->sc_transfer.data_error) {
727 			sc->sc_transfer.data_error = 0;
728 			usbd_xfer_set_stall(xfer);
729 		}
730 
731 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_dma_ptr, max_bulk);
732 		usbd_transfer_submit(xfer);
733 		break;
734 
735 	default:			/* Error */
736 		if (error == USB_ERR_CANCELLED) {
737 			break;
738 		}
739 		/* If the pipe is already stalled, don't do another stall */
740 		if (!usbd_xfer_is_stalled(xfer))
741 			sc->sc_transfer.data_error = 1;
742 
743 		/* try again */
744 		goto tr_setup;
745 	}
746 }
747 
748 static void
749 ustorage_fs_t_bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
750 {
751 	struct ustorage_fs_softc *sc = usbd_xfer_softc(xfer);
752 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
753 	int actlen, sumlen;
754 
755 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
756 
757 	DPRINTF("\n");
758 
759 	switch (USB_GET_STATE(xfer)) {
760 	case USB_ST_TRANSFERRED:
761 		sc->sc_transfer.data_rem -= actlen;
762 		sc->sc_transfer.data_ptr += actlen;
763 		sc->sc_transfer.offset += actlen;
764 
765 		if (actlen != sumlen || sc->sc_transfer.data_rem == 0) {
766 			/* short transfer or end of data */
767 			ustorage_fs_transfer_start(sc,
768 			    USTORAGE_FS_T_BBB_STATUS);
769 			break;
770 		}
771 	case USB_ST_SETUP:
772 tr_setup:
773 		if (max_bulk >= sc->sc_transfer.data_rem) {
774 			max_bulk = sc->sc_transfer.data_rem;
775 			if (sc->sc_transfer.data_short)
776 				usbd_xfer_set_flag(xfer, USB_FORCE_SHORT_XFER);
777 			else
778 				usbd_xfer_clr_flag(xfer, USB_FORCE_SHORT_XFER);
779 		} else
780 			usbd_xfer_clr_flag(xfer, USB_FORCE_SHORT_XFER);
781 
782 		if (sc->sc_transfer.data_error) {
783 			sc->sc_transfer.data_error = 0;
784 			usbd_xfer_set_stall(xfer);
785 		}
786 
787 		/* XXX copy data to DMA buffer */
788 		memcpy(sc->sc_dma_ptr, sc->sc_transfer.data_ptr, max_bulk);
789 
790 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_dma_ptr, max_bulk);
791 		usbd_transfer_submit(xfer);
792 		break;
793 
794 	default:			/* Error */
795 		if (error == USB_ERR_CANCELLED) {
796 			break;
797 		}
798 		/*
799 		 * If the pipe is already stalled, don't do another
800 		 * stall
801 		 */
802 		if (!usbd_xfer_is_stalled(xfer))
803 			sc->sc_transfer.data_error = 1;
804 
805 		/* try again */
806 		goto tr_setup;
807 	}
808 }
809 
810 static void
811 ustorage_fs_t_bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
812 {
813 	struct ustorage_fs_softc *sc = usbd_xfer_softc(xfer);
814 
815 	DPRINTF("\n");
816 
817 	switch (USB_GET_STATE(xfer)) {
818 	case USB_ST_TRANSFERRED:
819 		ustorage_fs_transfer_start(sc, USTORAGE_FS_T_BBB_COMMAND);
820 		break;
821 
822 	case USB_ST_SETUP:
823 tr_setup:
824 		USETDW(sc->sc_csw->dCSWSignature, CSWSIGNATURE);
825 		USETDW(sc->sc_csw->dCSWDataResidue, sc->sc_transfer.data_rem);
826 
827 		if (sc->sc_transfer.data_error) {
828 			sc->sc_transfer.data_error = 0;
829 			usbd_xfer_set_stall(xfer);
830 		}
831 		usbd_xfer_set_frame_len(xfer, 0,
832 		    sizeof(ustorage_fs_bbb_csw_t));
833 		usbd_transfer_submit(xfer);
834 		break;
835 
836 	default:
837 		if (error == USB_ERR_CANCELLED) {
838 			break;
839 		}
840 		/* If the pipe is already stalled, don't do another stall */
841 		if (!usbd_xfer_is_stalled(xfer))
842 			sc->sc_transfer.data_error = 1;
843 
844 		/* try again */
845 		goto tr_setup;
846 	}
847 }
848 
849 /* SCSI commands that we recognize */
850 #define	SC_FORMAT_UNIT			0x04
851 #define	SC_INQUIRY			0x12
852 #define	SC_MODE_SELECT_6		0x15
853 #define	SC_MODE_SELECT_10		0x55
854 #define	SC_MODE_SENSE_6			0x1a
855 #define	SC_MODE_SENSE_10		0x5a
856 #define	SC_PREVENT_ALLOW_MEDIUM_REMOVAL	0x1e
857 #define	SC_READ_6			0x08
858 #define	SC_READ_10			0x28
859 #define	SC_READ_12			0xa8
860 #define	SC_READ_CAPACITY		0x25
861 #define	SC_READ_FORMAT_CAPACITIES	0x23
862 #define	SC_RELEASE			0x17
863 #define	SC_REQUEST_SENSE		0x03
864 #define	SC_RESERVE			0x16
865 #define	SC_SEND_DIAGNOSTIC		0x1d
866 #define	SC_START_STOP_UNIT		0x1b
867 #define	SC_SYNCHRONIZE_CACHE		0x35
868 #define	SC_TEST_UNIT_READY		0x00
869 #define	SC_VERIFY			0x2f
870 #define	SC_WRITE_6			0x0a
871 #define	SC_WRITE_10			0x2a
872 #define	SC_WRITE_12			0xaa
873 
874 /* SCSI Sense Key/Additional Sense Code/ASC Qualifier values */
875 #define	SS_NO_SENSE				0
876 #define	SS_COMMUNICATION_FAILURE		0x040800
877 #define	SS_INVALID_COMMAND			0x052000
878 #define	SS_INVALID_FIELD_IN_CDB			0x052400
879 #define	SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE	0x052100
880 #define	SS_LOGICAL_UNIT_NOT_SUPPORTED		0x052500
881 #define	SS_MEDIUM_NOT_PRESENT			0x023a00
882 #define	SS_MEDIUM_REMOVAL_PREVENTED		0x055302
883 #define	SS_NOT_READY_TO_READY_TRANSITION	0x062800
884 #define	SS_RESET_OCCURRED			0x062900
885 #define	SS_SAVING_PARAMETERS_NOT_SUPPORTED	0x053900
886 #define	SS_UNRECOVERED_READ_ERROR		0x031100
887 #define	SS_WRITE_ERROR				0x030c02
888 #define	SS_WRITE_PROTECTED			0x072700
889 
890 #define	SK(x)		((uint8_t) ((x) >> 16))	/* Sense Key byte, etc. */
891 #define	ASC(x)		((uint8_t) ((x) >> 8))
892 #define	ASCQ(x)		((uint8_t) (x))
893 
894 /* Routines for unaligned data access */
895 
896 static uint16_t
897 get_be16(uint8_t *buf)
898 {
899 	return ((uint16_t)buf[0] << 8) | ((uint16_t)buf[1]);
900 }
901 
902 static uint32_t
903 get_be32(uint8_t *buf)
904 {
905 	return ((uint32_t)buf[0] << 24) | ((uint32_t)buf[1] << 16) |
906 	((uint32_t)buf[2] << 8) | ((uint32_t)buf[3]);
907 }
908 
909 static void
910 put_be16(uint8_t *buf, uint16_t val)
911 {
912 	buf[0] = val >> 8;
913 	buf[1] = val;
914 }
915 
916 static void
917 put_be32(uint8_t *buf, uint32_t val)
918 {
919 	buf[0] = val >> 24;
920 	buf[1] = val >> 16;
921 	buf[2] = val >> 8;
922 	buf[3] = val & 0xff;
923 }
924 
925 /*------------------------------------------------------------------------*
926  *	ustorage_fs_verify
927  *
928  * Returns:
929  *    0: Success
930  * Else: Failure
931  *------------------------------------------------------------------------*/
932 static uint8_t
933 ustorage_fs_verify(struct ustorage_fs_softc *sc)
934 {
935 	struct ustorage_fs_lun *currlun = sc->sc_transfer.currlun;
936 	uint32_t lba;
937 	uint32_t vlen;
938 	uint64_t file_offset;
939 	uint64_t amount_left;
940 
941 	/*
942 	 * Get the starting Logical Block Address
943 	 */
944 	lba = get_be32(&sc->sc_cbw->CBWCDB[2]);
945 
946 	/*
947 	 * We allow DPO (Disable Page Out = don't save data in the cache)
948 	 * but we don't implement it.
949 	 */
950 	if ((sc->sc_cbw->CBWCDB[1] & ~0x10) != 0) {
951 		currlun->sense_data = SS_INVALID_FIELD_IN_CDB;
952 		return (1);
953 	}
954 	vlen = get_be16(&sc->sc_cbw->CBWCDB[7]);
955 	if (vlen == 0) {
956 		goto done;
957 	}
958 	/* No default reply */
959 
960 	/* Prepare to carry out the file verify */
961 	amount_left = vlen;
962 	amount_left <<= 9;
963 	file_offset = lba;
964 	file_offset <<= 9;
965 
966 	/* Range check */
967 	vlen += lba;
968 
969 	if ((vlen < lba) ||
970 	    (vlen > currlun->num_sectors) ||
971 	    (lba >= currlun->num_sectors)) {
972 		currlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
973 		return (1);
974 	}
975 	/* XXX TODO: verify that data is readable */
976 done:
977 	return (ustorage_fs_min_len(sc, 0, -1U));
978 }
979 
980 /*------------------------------------------------------------------------*
981  *	ustorage_fs_inquiry
982  *
983  * Returns:
984  *    0: Success
985  * Else: Failure
986  *------------------------------------------------------------------------*/
987 static uint8_t
988 ustorage_fs_inquiry(struct ustorage_fs_softc *sc)
989 {
990 	uint8_t *buf = sc->sc_transfer.data_ptr;
991 
992 	struct ustorage_fs_lun *currlun = sc->sc_transfer.currlun;
993 
994 	if (!sc->sc_transfer.currlun) {
995 		/* Unsupported LUNs are okay */
996 		memset(buf, 0, 36);
997 		buf[0] = 0x7f;
998 		/* Unsupported, no device - type */
999 		return (ustorage_fs_min_len(sc, 36, -1U));
1000 	}
1001 	memset(buf, 0, 8);
1002 	/* Non - removable, direct - access device */
1003 	if (currlun->removable)
1004 		buf[1] = 0x80;
1005 	buf[2] = 2;
1006 	/* ANSI SCSI level 2 */
1007 	buf[3] = 2;
1008 	/* SCSI - 2 INQUIRY data format */
1009 	buf[4] = 31;
1010 	/* Additional length */
1011 	/* No special options */
1012 	/* Copy in ID string */
1013 	memcpy(buf + 8, USTORAGE_FS_ID_STRING, 28);
1014 
1015 #if (USTORAGE_QDATA_MAX < 36)
1016 #error "(USTORAGE_QDATA_MAX < 36)"
1017 #endif
1018 	return (ustorage_fs_min_len(sc, 36, -1U));
1019 }
1020 
1021 /*------------------------------------------------------------------------*
1022  *	ustorage_fs_request_sense
1023  *
1024  * Returns:
1025  *    0: Success
1026  * Else: Failure
1027  *------------------------------------------------------------------------*/
1028 static uint8_t
1029 ustorage_fs_request_sense(struct ustorage_fs_softc *sc)
1030 {
1031 	uint8_t *buf = sc->sc_transfer.data_ptr;
1032 	struct ustorage_fs_lun *currlun = sc->sc_transfer.currlun;
1033 	uint32_t sd;
1034 	uint32_t sdinfo;
1035 	uint8_t valid;
1036 
1037 	/*
1038 	 * From the SCSI-2 spec., section 7.9 (Unit attention condition):
1039 	 *
1040 	 * If a REQUEST SENSE command is received from an initiator
1041 	 * with a pending unit attention condition (before the target
1042 	 * generates the contingent allegiance condition), then the
1043 	 * target shall either:
1044 	 *   a) report any pending sense data and preserve the unit
1045 	 *	attention condition on the logical unit, or,
1046 	 *   b) report the unit attention condition, may discard any
1047 	 *	pending sense data, and clear the unit attention
1048 	 *	condition on the logical unit for that initiator.
1049 	 *
1050 	 * FSG normally uses option a); enable this code to use option b).
1051 	 */
1052 #if 0
1053 	if (currlun && currlun->unit_attention_data != SS_NO_SENSE) {
1054 		currlun->sense_data = currlun->unit_attention_data;
1055 		currlun->unit_attention_data = SS_NO_SENSE;
1056 	}
1057 #endif
1058 
1059 	if (!currlun) {
1060 		/* Unsupported LUNs are okay */
1061 		sd = SS_LOGICAL_UNIT_NOT_SUPPORTED;
1062 		sdinfo = 0;
1063 		valid = 0;
1064 	} else {
1065 		sd = currlun->sense_data;
1066 		sdinfo = currlun->sense_data_info;
1067 		valid = currlun->info_valid << 7;
1068 		currlun->sense_data = SS_NO_SENSE;
1069 		currlun->sense_data_info = 0;
1070 		currlun->info_valid = 0;
1071 	}
1072 
1073 	memset(buf, 0, 18);
1074 	buf[0] = valid | 0x70;
1075 	/* Valid, current error */
1076 	buf[2] = SK(sd);
1077 	put_be32(&buf[3], sdinfo);
1078 	/* Sense information */
1079 	buf[7] = 18 - 8;
1080 	/* Additional sense length */
1081 	buf[12] = ASC(sd);
1082 	buf[13] = ASCQ(sd);
1083 
1084 #if (USTORAGE_QDATA_MAX < 18)
1085 #error "(USTORAGE_QDATA_MAX < 18)"
1086 #endif
1087 	return (ustorage_fs_min_len(sc, 18, -1U));
1088 }
1089 
1090 /*------------------------------------------------------------------------*
1091  *	ustorage_fs_read_capacity
1092  *
1093  * Returns:
1094  *    0: Success
1095  * Else: Failure
1096  *------------------------------------------------------------------------*/
1097 static uint8_t
1098 ustorage_fs_read_capacity(struct ustorage_fs_softc *sc)
1099 {
1100 	uint8_t *buf = sc->sc_transfer.data_ptr;
1101 	struct ustorage_fs_lun *currlun = sc->sc_transfer.currlun;
1102 	uint32_t lba = get_be32(&sc->sc_cbw->CBWCDB[2]);
1103 	uint8_t pmi = sc->sc_cbw->CBWCDB[8];
1104 
1105 	/* Check the PMI and LBA fields */
1106 	if ((pmi > 1) || ((pmi == 0) && (lba != 0))) {
1107 		currlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1108 		return (1);
1109 	}
1110 	/* Max logical block */
1111 	put_be32(&buf[0], currlun->num_sectors - 1);
1112 	/* Block length */
1113 	put_be32(&buf[4], 512);
1114 
1115 #if (USTORAGE_QDATA_MAX < 8)
1116 #error "(USTORAGE_QDATA_MAX < 8)"
1117 #endif
1118 	return (ustorage_fs_min_len(sc, 8, -1U));
1119 }
1120 
1121 /*------------------------------------------------------------------------*
1122  *	ustorage_fs_mode_sense
1123  *
1124  * Returns:
1125  *    0: Success
1126  * Else: Failure
1127  *------------------------------------------------------------------------*/
1128 static uint8_t
1129 ustorage_fs_mode_sense(struct ustorage_fs_softc *sc)
1130 {
1131 	uint8_t *buf = sc->sc_transfer.data_ptr;
1132 	struct ustorage_fs_lun *currlun = sc->sc_transfer.currlun;
1133 	uint8_t *buf0;
1134 	uint16_t len;
1135 	uint16_t limit;
1136 	uint8_t mscmnd = sc->sc_cbw->CBWCDB[0];
1137 	uint8_t pc;
1138 	uint8_t page_code;
1139 	uint8_t changeable_values;
1140 	uint8_t all_pages;
1141 
1142 	buf0 = buf;
1143 
1144 	if ((sc->sc_cbw->CBWCDB[1] & ~0x08) != 0) {
1145 		/* Mask away DBD */
1146 		currlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1147 		return (1);
1148 	}
1149 	pc = sc->sc_cbw->CBWCDB[2] >> 6;
1150 	page_code = sc->sc_cbw->CBWCDB[2] & 0x3f;
1151 	if (pc == 3) {
1152 		currlun->sense_data = SS_SAVING_PARAMETERS_NOT_SUPPORTED;
1153 		return (1);
1154 	}
1155 	changeable_values = (pc == 1);
1156 	all_pages = (page_code == 0x3f);
1157 
1158 	/*
1159 	 * Write the mode parameter header.  Fixed values are: default
1160 	 * medium type, no cache control (DPOFUA), and no block descriptors.
1161 	 * The only variable value is the WriteProtect bit.  We will fill in
1162 	 * the mode data length later.
1163 	 */
1164 	memset(buf, 0, 8);
1165 	if (mscmnd == SC_MODE_SENSE_6) {
1166 		buf[2] = (currlun->read_only ? 0x80 : 0x00);
1167 		/* WP, DPOFUA */
1168 		buf += 4;
1169 		limit = 255;
1170 	} else {
1171 		/* SC_MODE_SENSE_10 */
1172 		buf[3] = (currlun->read_only ? 0x80 : 0x00);
1173 		/* WP, DPOFUA */
1174 		buf += 8;
1175 		limit = 65535;
1176 		/* Should really be mod_data.buflen */
1177 	}
1178 
1179 	/* No block descriptors */
1180 
1181 	/*
1182 	 * The mode pages, in numerical order.
1183 	 */
1184 	if ((page_code == 0x08) || all_pages) {
1185 		buf[0] = 0x08;
1186 		/* Page code */
1187 		buf[1] = 10;
1188 		/* Page length */
1189 		memset(buf + 2, 0, 10);
1190 		/* None of the fields are changeable */
1191 
1192 		if (!changeable_values) {
1193 			buf[2] = 0x04;
1194 			/* Write cache enable, */
1195 			/* Read cache not disabled */
1196 			/* No cache retention priorities */
1197 			put_be16(&buf[4], 0xffff);
1198 			/* Don 't disable prefetch */
1199 			/* Minimum prefetch = 0 */
1200 			put_be16(&buf[8], 0xffff);
1201 			/* Maximum prefetch */
1202 			put_be16(&buf[10], 0xffff);
1203 			/* Maximum prefetch ceiling */
1204 		}
1205 		buf += 12;
1206 	}
1207 	/*
1208 	 * Check that a valid page was requested and the mode data length
1209 	 * isn't too long.
1210 	 */
1211 	len = buf - buf0;
1212 	if (len > limit) {
1213 		currlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1214 		return (1);
1215 	}
1216 	/* Store the mode data length */
1217 	if (mscmnd == SC_MODE_SENSE_6)
1218 		buf0[0] = len - 1;
1219 	else
1220 		put_be16(buf0, len - 2);
1221 
1222 #if (USTORAGE_QDATA_MAX < 24)
1223 #error "(USTORAGE_QDATA_MAX < 24)"
1224 #endif
1225 	return (ustorage_fs_min_len(sc, len, -1U));
1226 }
1227 
1228 /*------------------------------------------------------------------------*
1229  *	ustorage_fs_start_stop
1230  *
1231  * Returns:
1232  *    0: Success
1233  * Else: Failure
1234  *------------------------------------------------------------------------*/
1235 static uint8_t
1236 ustorage_fs_start_stop(struct ustorage_fs_softc *sc)
1237 {
1238 	struct ustorage_fs_lun *currlun = sc->sc_transfer.currlun;
1239 	uint8_t loej;
1240 	uint8_t start;
1241 	uint8_t immed;
1242 
1243 	if (!currlun->removable) {
1244 		currlun->sense_data = SS_INVALID_COMMAND;
1245 		return (1);
1246 	}
1247 	immed = sc->sc_cbw->CBWCDB[1] & 0x01;
1248 	loej = sc->sc_cbw->CBWCDB[4] & 0x02;
1249 	start = sc->sc_cbw->CBWCDB[4] & 0x01;
1250 
1251 	if (immed || loej || start) {
1252 		/* compile fix */
1253 	}
1254 	return (0);
1255 }
1256 
1257 /*------------------------------------------------------------------------*
1258  *	ustorage_fs_prevent_allow
1259  *
1260  * Returns:
1261  *    0: Success
1262  * Else: Failure
1263  *------------------------------------------------------------------------*/
1264 static uint8_t
1265 ustorage_fs_prevent_allow(struct ustorage_fs_softc *sc)
1266 {
1267 	struct ustorage_fs_lun *currlun = sc->sc_transfer.currlun;
1268 	uint8_t prevent;
1269 
1270 	if (!currlun->removable) {
1271 		currlun->sense_data = SS_INVALID_COMMAND;
1272 		return (1);
1273 	}
1274 	prevent = sc->sc_cbw->CBWCDB[4] & 0x01;
1275 	if ((sc->sc_cbw->CBWCDB[4] & ~0x01) != 0) {
1276 		/* Mask away Prevent */
1277 		currlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1278 		return (1);
1279 	}
1280 	if (currlun->prevent_medium_removal && !prevent) {
1281 		//fsync_sub(currlun);
1282 	}
1283 	currlun->prevent_medium_removal = prevent;
1284 	return (0);
1285 }
1286 
1287 /*------------------------------------------------------------------------*
1288  *	ustorage_fs_read_format_capacities
1289  *
1290  * Returns:
1291  *    0: Success
1292  * Else: Failure
1293  *------------------------------------------------------------------------*/
1294 static uint8_t
1295 ustorage_fs_read_format_capacities(struct ustorage_fs_softc *sc)
1296 {
1297 	uint8_t *buf = sc->sc_transfer.data_ptr;
1298 	struct ustorage_fs_lun *currlun = sc->sc_transfer.currlun;
1299 
1300 	buf[0] = buf[1] = buf[2] = 0;
1301 	buf[3] = 8;
1302 	/* Only the Current / Maximum Capacity Descriptor */
1303 	buf += 4;
1304 
1305 	/* Number of blocks */
1306 	put_be32(&buf[0], currlun->num_sectors);
1307 	/* Block length */
1308 	put_be32(&buf[4], 512);
1309 	/* Current capacity */
1310 	buf[4] = 0x02;
1311 
1312 #if (USTORAGE_QDATA_MAX < 12)
1313 #error "(USTORAGE_QDATA_MAX < 12)"
1314 #endif
1315 	return (ustorage_fs_min_len(sc, 12, -1U));
1316 }
1317 
1318 /*------------------------------------------------------------------------*
1319  *	ustorage_fs_mode_select
1320  *
1321  * Return values:
1322  *    0: Success
1323  * Else: Failure
1324  *------------------------------------------------------------------------*/
1325 static uint8_t
1326 ustorage_fs_mode_select(struct ustorage_fs_softc *sc)
1327 {
1328 	struct ustorage_fs_lun *currlun = sc->sc_transfer.currlun;
1329 
1330 	/* We don't support MODE SELECT */
1331 	currlun->sense_data = SS_INVALID_COMMAND;
1332 	return (1);
1333 }
1334 
1335 /*------------------------------------------------------------------------*
1336  *	ustorage_fs_synchronize_cache
1337  *
1338  * Return values:
1339  *    0: Success
1340  * Else: Failure
1341  *------------------------------------------------------------------------*/
1342 static uint8_t
1343 ustorage_fs_synchronize_cache(struct ustorage_fs_softc *sc)
1344 {
1345 #if 0
1346 	struct ustorage_fs_lun *currlun = sc->sc_transfer.currlun;
1347 	uint8_t rc;
1348 
1349 	/*
1350 	 * We ignore the requested LBA and write out all dirty data buffers.
1351 	 */
1352 	rc = 0;
1353 	if (rc) {
1354 		currlun->sense_data = SS_WRITE_ERROR;
1355 	}
1356 #endif
1357 	return (0);
1358 }
1359 
1360 /*------------------------------------------------------------------------*
1361  *	ustorage_fs_read - read data from disk
1362  *
1363  * Return values:
1364  *    0: Success
1365  * Else: Failure
1366  *------------------------------------------------------------------------*/
1367 static uint8_t
1368 ustorage_fs_read(struct ustorage_fs_softc *sc)
1369 {
1370 	struct ustorage_fs_lun *currlun = sc->sc_transfer.currlun;
1371 	uint64_t file_offset;
1372 	uint32_t lba;
1373 	uint32_t len;
1374 
1375 	/*
1376 	 * Get the starting Logical Block Address and check that it's not
1377 	 * too big
1378 	 */
1379 	if (sc->sc_cbw->CBWCDB[0] == SC_READ_6) {
1380 		lba = (((uint32_t)sc->sc_cbw->CBWCDB[1]) << 16) |
1381 		    get_be16(&sc->sc_cbw->CBWCDB[2]);
1382 	} else {
1383 		lba = get_be32(&sc->sc_cbw->CBWCDB[2]);
1384 
1385 		/*
1386 		 * We allow DPO (Disable Page Out = don't save data in the
1387 		 * cache) and FUA (Force Unit Access = don't read from the
1388 		 * cache), but we don't implement them.
1389 		 */
1390 		if ((sc->sc_cbw->CBWCDB[1] & ~0x18) != 0) {
1391 			currlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1392 			return (1);
1393 		}
1394 	}
1395 	len = sc->sc_transfer.data_rem >> 9;
1396 	len += lba;
1397 
1398 	if ((len < lba) ||
1399 	    (len > currlun->num_sectors) ||
1400 	    (lba >= currlun->num_sectors)) {
1401 		currlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1402 		return (1);
1403 	}
1404 	file_offset = lba;
1405 	file_offset <<= 9;
1406 
1407 	sc->sc_transfer.data_ptr = currlun->memory_image + file_offset;
1408 
1409 	return (0);
1410 }
1411 
1412 /*------------------------------------------------------------------------*
1413  *	ustorage_fs_write - write data to disk
1414  *
1415  * Return values:
1416  *    0: Success
1417  * Else: Failure
1418  *------------------------------------------------------------------------*/
1419 static uint8_t
1420 ustorage_fs_write(struct ustorage_fs_softc *sc)
1421 {
1422 	struct ustorage_fs_lun *currlun = sc->sc_transfer.currlun;
1423 	uint64_t file_offset;
1424 	uint32_t lba;
1425 	uint32_t len;
1426 
1427 	if (currlun->read_only) {
1428 		currlun->sense_data = SS_WRITE_PROTECTED;
1429 		return (1);
1430 	}
1431 	/* XXX clear SYNC */
1432 
1433 	/*
1434 	 * Get the starting Logical Block Address and check that it's not
1435 	 * too big.
1436 	 */
1437 	if (sc->sc_cbw->CBWCDB[0] == SC_WRITE_6)
1438 		lba = (((uint32_t)sc->sc_cbw->CBWCDB[1]) << 16) |
1439 		    get_be16(&sc->sc_cbw->CBWCDB[2]);
1440 	else {
1441 		lba = get_be32(&sc->sc_cbw->CBWCDB[2]);
1442 
1443 		/*
1444 		 * We allow DPO (Disable Page Out = don't save data in the
1445 		 * cache) and FUA (Force Unit Access = write directly to the
1446 		 * medium).  We don't implement DPO; we implement FUA by
1447 		 * performing synchronous output.
1448 		 */
1449 		if ((sc->sc_cbw->CBWCDB[1] & ~0x18) != 0) {
1450 			currlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1451 			return (1);
1452 		}
1453 		if (sc->sc_cbw->CBWCDB[1] & 0x08) {
1454 			/* FUA */
1455 			/* XXX set SYNC flag here */
1456 		}
1457 	}
1458 
1459 	len = sc->sc_transfer.data_rem >> 9;
1460 	len += lba;
1461 
1462 	if ((len < lba) ||
1463 	    (len > currlun->num_sectors) ||
1464 	    (lba >= currlun->num_sectors)) {
1465 		currlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;
1466 		return (1);
1467 	}
1468 	file_offset = lba;
1469 	file_offset <<= 9;
1470 
1471 	sc->sc_transfer.data_ptr = currlun->memory_image + file_offset;
1472 
1473 	return (0);
1474 }
1475 
1476 /*------------------------------------------------------------------------*
1477  *	ustorage_fs_min_len
1478  *
1479  * Return values:
1480  *    0: Success
1481  * Else: Failure
1482  *------------------------------------------------------------------------*/
1483 static uint8_t
1484 ustorage_fs_min_len(struct ustorage_fs_softc *sc, uint32_t len, uint32_t mask)
1485 {
1486 	if (len != sc->sc_transfer.data_rem) {
1487 
1488 		if (sc->sc_transfer.cbw_dir == DIR_READ) {
1489 			/*
1490 			 * there must be something wrong about this SCSI
1491 			 * command
1492 			 */
1493 			sc->sc_csw->bCSWStatus = CSWSTATUS_PHASE;
1494 			return (1);
1495 		}
1496 		/* compute the minimum length */
1497 
1498 		if (sc->sc_transfer.data_rem > len) {
1499 			/* data ends prematurely */
1500 			sc->sc_transfer.data_rem = len;
1501 			sc->sc_transfer.data_short = 1;
1502 		}
1503 		/* check length alignment */
1504 
1505 		if (sc->sc_transfer.data_rem & ~mask) {
1506 			/* data ends prematurely */
1507 			sc->sc_transfer.data_rem &= mask;
1508 			sc->sc_transfer.data_short = 1;
1509 		}
1510 	}
1511 	return (0);
1512 }
1513 
1514 /*------------------------------------------------------------------------*
1515  *	ustorage_fs_check_cmd - check command routine
1516  *
1517  * Check whether the command is properly formed and whether its data
1518  * size and direction agree with the values we already have.
1519  *
1520  * Return values:
1521  *    0: Success
1522  * Else: Failure
1523  *------------------------------------------------------------------------*/
1524 static uint8_t
1525 ustorage_fs_check_cmd(struct ustorage_fs_softc *sc, uint8_t min_cmd_size,
1526     uint16_t mask, uint8_t needs_medium)
1527 {
1528 	struct ustorage_fs_lun *currlun;
1529 	uint8_t lun = (sc->sc_cbw->CBWCDB[1] >> 5);
1530 	uint8_t i;
1531 
1532 	/* Verify the length of the command itself */
1533 	if (min_cmd_size > sc->sc_transfer.cmd_len) {
1534 		DPRINTF("%u > %u\n",
1535 		    min_cmd_size, sc->sc_transfer.cmd_len);
1536 		sc->sc_csw->bCSWStatus = CSWSTATUS_PHASE;
1537 		return (1);
1538 	}
1539 	/* Mask away the LUN */
1540 	sc->sc_cbw->CBWCDB[1] &= 0x1f;
1541 
1542 	/* Check if LUN is correct */
1543 	if (lun != sc->sc_transfer.lun) {
1544 
1545 	}
1546 	/* Check the LUN */
1547 	if (sc->sc_transfer.lun <= sc->sc_last_lun) {
1548 		sc->sc_transfer.currlun = currlun =
1549 		    sc->sc_lun + sc->sc_transfer.lun;
1550 		if (sc->sc_cbw->CBWCDB[0] != SC_REQUEST_SENSE) {
1551 			currlun->sense_data = SS_NO_SENSE;
1552 			currlun->sense_data_info = 0;
1553 			currlun->info_valid = 0;
1554 		}
1555 		/*
1556 		 * If a unit attention condition exists, only INQUIRY
1557 		 * and REQUEST SENSE commands are allowed. Anything
1558 		 * else must fail!
1559 		 */
1560 		if ((currlun->unit_attention_data != SS_NO_SENSE) &&
1561 		    (sc->sc_cbw->CBWCDB[0] != SC_INQUIRY) &&
1562 		    (sc->sc_cbw->CBWCDB[0] != SC_REQUEST_SENSE)) {
1563 			currlun->sense_data = currlun->unit_attention_data;
1564 			currlun->unit_attention_data = SS_NO_SENSE;
1565 			return (1);
1566 		}
1567 	} else {
1568 		sc->sc_transfer.currlun = currlun = NULL;
1569 
1570 		/*
1571 		 * INQUIRY and REQUEST SENSE commands are explicitly allowed
1572 		 * to use unsupported LUNs; all others may not.
1573 		 */
1574 		if ((sc->sc_cbw->CBWCDB[0] != SC_INQUIRY) &&
1575 		    (sc->sc_cbw->CBWCDB[0] != SC_REQUEST_SENSE)) {
1576 			return (1);
1577 		}
1578 	}
1579 
1580 	/*
1581 	 * Check that only command bytes listed in the mask are
1582 	 * non-zero.
1583 	 */
1584 	for (i = 0; i != min_cmd_size; i++) {
1585 		if (sc->sc_cbw->CBWCDB[i] && !(mask & (1UL << i))) {
1586 			if (currlun) {
1587 				currlun->sense_data = SS_INVALID_FIELD_IN_CDB;
1588 			}
1589 			return (1);
1590 		}
1591 	}
1592 
1593 	/*
1594 	 * If the medium isn't mounted and the command needs to access
1595 	 * it, return an error.
1596 	 */
1597 	if (currlun && (!currlun->memory_image) && needs_medium) {
1598 		currlun->sense_data = SS_MEDIUM_NOT_PRESENT;
1599 		return (1);
1600 	}
1601 	return (0);
1602 }
1603 
1604 /*------------------------------------------------------------------------*
1605  *	ustorage_fs_do_cmd - do command
1606  *
1607  * Return values:
1608  *    0: Success
1609  * Else: Failure
1610  *------------------------------------------------------------------------*/
1611 static uint8_t
1612 ustorage_fs_do_cmd(struct ustorage_fs_softc *sc)
1613 {
1614 	uint8_t error = 1;
1615 	uint8_t i;
1616 	uint32_t temp;
1617 	const uint32_t mask9 = (0xFFFFFFFFUL >> 9) << 9;
1618 
1619 	/* set default data transfer pointer */
1620 	sc->sc_transfer.data_ptr = sc->sc_qdata;
1621 
1622 	DPRINTF("cmd_data[0]=0x%02x, data_rem=0x%08x\n",
1623 	    sc->sc_cbw->CBWCDB[0], sc->sc_transfer.data_rem);
1624 
1625 	switch (sc->sc_cbw->CBWCDB[0]) {
1626 	case SC_INQUIRY:
1627 		sc->sc_transfer.cmd_dir = DIR_WRITE;
1628 		error = ustorage_fs_min_len(sc, sc->sc_cbw->CBWCDB[4], -1U);
1629 		if (error) {
1630 			break;
1631 		}
1632 		error = ustorage_fs_check_cmd(sc, 6,
1633 		    (1UL << 4) | 1, 0);
1634 		if (error) {
1635 			break;
1636 		}
1637 		error = ustorage_fs_inquiry(sc);
1638 
1639 		break;
1640 
1641 	case SC_MODE_SELECT_6:
1642 		sc->sc_transfer.cmd_dir = DIR_READ;
1643 		error = ustorage_fs_min_len(sc, sc->sc_cbw->CBWCDB[4], -1U);
1644 		if (error) {
1645 			break;
1646 		}
1647 		error = ustorage_fs_check_cmd(sc, 6,
1648 		    (1UL << 1) | (1UL << 4) | 1, 0);
1649 		if (error) {
1650 			break;
1651 		}
1652 		error = ustorage_fs_mode_select(sc);
1653 
1654 		break;
1655 
1656 	case SC_MODE_SELECT_10:
1657 		sc->sc_transfer.cmd_dir = DIR_READ;
1658 		error = ustorage_fs_min_len(sc,
1659 		    get_be16(&sc->sc_cbw->CBWCDB[7]), -1U);
1660 		if (error) {
1661 			break;
1662 		}
1663 		error = ustorage_fs_check_cmd(sc, 10,
1664 		    (1UL << 1) | (3UL << 7) | 1, 0);
1665 		if (error) {
1666 			break;
1667 		}
1668 		error = ustorage_fs_mode_select(sc);
1669 
1670 		break;
1671 
1672 	case SC_MODE_SENSE_6:
1673 		sc->sc_transfer.cmd_dir = DIR_WRITE;
1674 		error = ustorage_fs_min_len(sc, sc->sc_cbw->CBWCDB[4], -1U);
1675 		if (error) {
1676 			break;
1677 		}
1678 		error = ustorage_fs_check_cmd(sc, 6,
1679 		    (1UL << 1) | (1UL << 2) | (1UL << 4) | 1, 0);
1680 		if (error) {
1681 			break;
1682 		}
1683 		error = ustorage_fs_mode_sense(sc);
1684 
1685 		break;
1686 
1687 	case SC_MODE_SENSE_10:
1688 		sc->sc_transfer.cmd_dir = DIR_WRITE;
1689 		error = ustorage_fs_min_len(sc,
1690 		    get_be16(&sc->sc_cbw->CBWCDB[7]), -1U);
1691 		if (error) {
1692 			break;
1693 		}
1694 		error = ustorage_fs_check_cmd(sc, 10,
1695 		    (1UL << 1) | (1UL << 2) | (3UL << 7) | 1, 0);
1696 		if (error) {
1697 			break;
1698 		}
1699 		error = ustorage_fs_mode_sense(sc);
1700 
1701 		break;
1702 
1703 	case SC_PREVENT_ALLOW_MEDIUM_REMOVAL:
1704 		error = ustorage_fs_min_len(sc, 0, -1U);
1705 		if (error) {
1706 			break;
1707 		}
1708 		error = ustorage_fs_check_cmd(sc, 6,
1709 		    (1UL << 4) | 1, 0);
1710 		if (error) {
1711 			break;
1712 		}
1713 		error = ustorage_fs_prevent_allow(sc);
1714 
1715 		break;
1716 
1717 	case SC_READ_6:
1718 		i = sc->sc_cbw->CBWCDB[4];
1719 		sc->sc_transfer.cmd_dir = DIR_WRITE;
1720 		temp = ((i == 0) ? 256UL : i);
1721 		error = ustorage_fs_min_len(sc, temp << 9, mask9);
1722 		if (error) {
1723 			break;
1724 		}
1725 		error = ustorage_fs_check_cmd(sc, 6,
1726 		    (7UL << 1) | (1UL << 4) | 1, 1);
1727 		if (error) {
1728 			break;
1729 		}
1730 		error = ustorage_fs_read(sc);
1731 
1732 		break;
1733 
1734 	case SC_READ_10:
1735 		sc->sc_transfer.cmd_dir = DIR_WRITE;
1736 		temp = get_be16(&sc->sc_cbw->CBWCDB[7]);
1737 		error = ustorage_fs_min_len(sc, temp << 9, mask9);
1738 		if (error) {
1739 			break;
1740 		}
1741 		error = ustorage_fs_check_cmd(sc, 10,
1742 		    (1UL << 1) | (0xfUL << 2) | (3UL << 7) | 1, 1);
1743 		if (error) {
1744 			break;
1745 		}
1746 		error = ustorage_fs_read(sc);
1747 
1748 		break;
1749 
1750 	case SC_READ_12:
1751 		sc->sc_transfer.cmd_dir = DIR_WRITE;
1752 		temp = get_be32(&sc->sc_cbw->CBWCDB[6]);
1753 		if (temp >= (1UL << (32 - 9))) {
1754 			/* numerical overflow */
1755 			sc->sc_csw->bCSWStatus = CSWSTATUS_FAILED;
1756 			error = 1;
1757 			break;
1758 		}
1759 		error = ustorage_fs_min_len(sc, temp << 9, mask9);
1760 		if (error) {
1761 			break;
1762 		}
1763 		error = ustorage_fs_check_cmd(sc, 12,
1764 		    (1UL << 1) | (0xfUL << 2) | (0xfUL << 6) | 1, 1);
1765 		if (error) {
1766 			break;
1767 		}
1768 		error = ustorage_fs_read(sc);
1769 
1770 		break;
1771 
1772 	case SC_READ_CAPACITY:
1773 		sc->sc_transfer.cmd_dir = DIR_WRITE;
1774 		error = ustorage_fs_check_cmd(sc, 10,
1775 		    (0xfUL << 2) | (1UL << 8) | 1, 1);
1776 		if (error) {
1777 			break;
1778 		}
1779 		error = ustorage_fs_read_capacity(sc);
1780 
1781 		break;
1782 
1783 	case SC_READ_FORMAT_CAPACITIES:
1784 		sc->sc_transfer.cmd_dir = DIR_WRITE;
1785 		error = ustorage_fs_min_len(sc,
1786 		    get_be16(&sc->sc_cbw->CBWCDB[7]), -1U);
1787 		if (error) {
1788 			break;
1789 		}
1790 		error = ustorage_fs_check_cmd(sc, 10,
1791 		    (3UL << 7) | 1, 1);
1792 		if (error) {
1793 			break;
1794 		}
1795 		error = ustorage_fs_read_format_capacities(sc);
1796 
1797 		break;
1798 
1799 	case SC_REQUEST_SENSE:
1800 		sc->sc_transfer.cmd_dir = DIR_WRITE;
1801 		error = ustorage_fs_min_len(sc, sc->sc_cbw->CBWCDB[4], -1U);
1802 		if (error) {
1803 			break;
1804 		}
1805 		error = ustorage_fs_check_cmd(sc, 6,
1806 		    (1UL << 4) | 1, 0);
1807 		if (error) {
1808 			break;
1809 		}
1810 		error = ustorage_fs_request_sense(sc);
1811 
1812 		break;
1813 
1814 	case SC_START_STOP_UNIT:
1815 		error = ustorage_fs_min_len(sc, 0, -1U);
1816 		if (error) {
1817 			break;
1818 		}
1819 		error = ustorage_fs_check_cmd(sc, 6,
1820 		    (1UL << 1) | (1UL << 4) | 1, 0);
1821 		if (error) {
1822 			break;
1823 		}
1824 		error = ustorage_fs_start_stop(sc);
1825 
1826 		break;
1827 
1828 	case SC_SYNCHRONIZE_CACHE:
1829 		error = ustorage_fs_min_len(sc, 0, -1U);
1830 		if (error) {
1831 			break;
1832 		}
1833 		error = ustorage_fs_check_cmd(sc, 10,
1834 		    (0xfUL << 2) | (3UL << 7) | 1, 1);
1835 		if (error) {
1836 			break;
1837 		}
1838 		error = ustorage_fs_synchronize_cache(sc);
1839 
1840 		break;
1841 
1842 	case SC_TEST_UNIT_READY:
1843 		error = ustorage_fs_min_len(sc, 0, -1U);
1844 		if (error) {
1845 			break;
1846 		}
1847 		error = ustorage_fs_check_cmd(sc, 6,
1848 		    0 | 1, 1);
1849 		break;
1850 
1851 		/*
1852 		 * Although optional, this command is used by MS-Windows.
1853 		 * We support a minimal version: BytChk must be 0.
1854 		 */
1855 	case SC_VERIFY:
1856 		error = ustorage_fs_min_len(sc, 0, -1U);
1857 		if (error) {
1858 			break;
1859 		}
1860 		error = ustorage_fs_check_cmd(sc, 10,
1861 		    (1UL << 1) | (0xfUL << 2) | (3UL << 7) | 1, 1);
1862 		if (error) {
1863 			break;
1864 		}
1865 		error = ustorage_fs_verify(sc);
1866 
1867 		break;
1868 
1869 	case SC_WRITE_6:
1870 		i = sc->sc_cbw->CBWCDB[4];
1871 		sc->sc_transfer.cmd_dir = DIR_READ;
1872 		temp = ((i == 0) ? 256UL : i);
1873 		error = ustorage_fs_min_len(sc, temp << 9, mask9);
1874 		if (error) {
1875 			break;
1876 		}
1877 		error = ustorage_fs_check_cmd(sc, 6,
1878 		    (7UL << 1) | (1UL << 4) | 1, 1);
1879 		if (error) {
1880 			break;
1881 		}
1882 		error = ustorage_fs_write(sc);
1883 
1884 		break;
1885 
1886 	case SC_WRITE_10:
1887 		sc->sc_transfer.cmd_dir = DIR_READ;
1888 		temp = get_be16(&sc->sc_cbw->CBWCDB[7]);
1889 		error = ustorage_fs_min_len(sc, temp << 9, mask9);
1890 		if (error) {
1891 			break;
1892 		}
1893 		error = ustorage_fs_check_cmd(sc, 10,
1894 		    (1UL << 1) | (0xfUL << 2) | (3UL << 7) | 1, 1);
1895 		if (error) {
1896 			break;
1897 		}
1898 		error = ustorage_fs_write(sc);
1899 
1900 		break;
1901 
1902 	case SC_WRITE_12:
1903 		sc->sc_transfer.cmd_dir = DIR_READ;
1904 		temp = get_be32(&sc->sc_cbw->CBWCDB[6]);
1905 		if (temp > (mask9 >> 9)) {
1906 			/* numerical overflow */
1907 			sc->sc_csw->bCSWStatus = CSWSTATUS_FAILED;
1908 			error = 1;
1909 			break;
1910 		}
1911 		error = ustorage_fs_min_len(sc, temp << 9, mask9);
1912 		if (error) {
1913 			break;
1914 		}
1915 		error = ustorage_fs_check_cmd(sc, 12,
1916 		    (1UL << 1) | (0xfUL << 2) | (0xfUL << 6) | 1, 1);
1917 		if (error) {
1918 			break;
1919 		}
1920 		error = ustorage_fs_write(sc);
1921 
1922 		break;
1923 
1924 		/*
1925 		 * Some mandatory commands that we recognize but don't
1926 		 * implement.  They don't mean much in this setting.
1927 		 * It's left as an exercise for anyone interested to
1928 		 * implement RESERVE and RELEASE in terms of Posix
1929 		 * locks.
1930 		 */
1931 	case SC_FORMAT_UNIT:
1932 	case SC_RELEASE:
1933 	case SC_RESERVE:
1934 	case SC_SEND_DIAGNOSTIC:
1935 		/* Fallthrough */
1936 
1937 	default:
1938 		error = ustorage_fs_min_len(sc, 0, -1U);
1939 		if (error) {
1940 			break;
1941 		}
1942 		error = ustorage_fs_check_cmd(sc, sc->sc_transfer.cmd_len,
1943 		    0xff, 0);
1944 		if (error) {
1945 			break;
1946 		}
1947 		sc->sc_transfer.currlun->sense_data =
1948 		    SS_INVALID_COMMAND;
1949 		error = 1;
1950 
1951 		break;
1952 	}
1953 	return (error);
1954 }
1955