xref: /freebsd/sys/dev/usb/storage/umass.c (revision 315ee00f)
1 #include <sys/cdefs.h>
2 /*-
3  * SPDX-License-Identifier: BSD-2-Clause
4  *
5  * Copyright (c) 1999 MAEKAWA Masahide <bishop@rr.iij4u.or.jp>,
6  *		      Nick Hibma <n_hibma@FreeBSD.org>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *	$NetBSD: umass.c,v 1.28 2000/04/02 23:46:53 augustss Exp $
30  */
31 
32 /* Also already merged from NetBSD:
33  *	$NetBSD: umass.c,v 1.67 2001/11/25 19:05:22 augustss Exp $
34  *	$NetBSD: umass.c,v 1.90 2002/11/04 19:17:33 pooka Exp $
35  *	$NetBSD: umass.c,v 1.108 2003/11/07 17:03:25 wiz Exp $
36  *	$NetBSD: umass.c,v 1.109 2003/12/04 13:57:31 keihan Exp $
37  */
38 
39 /*
40  * Universal Serial Bus Mass Storage Class specs:
41  * http://www.usb.org/developers/devclass_docs/usb_msc_overview_1.2.pdf
42  * http://www.usb.org/developers/devclass_docs/usbmassbulk_10.pdf
43  * http://www.usb.org/developers/devclass_docs/usb_msc_cbi_1.1.pdf
44  * http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf
45  */
46 
47 /*
48  * Ported to NetBSD by Lennart Augustsson <augustss@NetBSD.org>.
49  * Parts of the code written by Jason R. Thorpe <thorpej@shagadelic.org>.
50  */
51 
52 /*
53  * The driver handles 3 Wire Protocols
54  * - Command/Bulk/Interrupt (CBI)
55  * - Command/Bulk/Interrupt with Command Completion Interrupt (CBI with CCI)
56  * - Mass Storage Bulk-Only (BBB)
57  *   (BBB refers Bulk/Bulk/Bulk for Command/Data/Status phases)
58  *
59  * Over these wire protocols it handles the following command protocols
60  * - SCSI
61  * - UFI (floppy command set)
62  * - 8070i (ATAPI)
63  *
64  * UFI and 8070i (ATAPI) are transformed versions of the SCSI command set. The
65  * sc->sc_transform method is used to convert the commands into the appropriate
66  * format (if at all necessary). For example, UFI requires all commands to be
67  * 12 bytes in length amongst other things.
68  *
69  * The source code below is marked and can be split into a number of pieces
70  * (in this order):
71  *
72  * - probe/attach/detach
73  * - generic transfer routines
74  * - BBB
75  * - CBI
76  * - CBI_I (in addition to functions from CBI)
77  * - CAM (Common Access Method)
78  * - SCSI
79  * - UFI
80  * - 8070i (ATAPI)
81  *
82  * The protocols are implemented using a state machine, for the transfers as
83  * well as for the resets. The state machine is contained in umass_t_*_callback.
84  * The state machine is started through either umass_command_start() or
85  * umass_reset().
86  *
87  * The reason for doing this is a) CAM performs a lot better this way and b) it
88  * avoids using tsleep from interrupt context (for example after a failed
89  * transfer).
90  */
91 
92 /*
93  * The SCSI related part of this driver has been derived from the
94  * dev/ppbus/vpo.c driver, by Nicolas Souchu (nsouch@FreeBSD.org).
95  *
96  * The CAM layer uses so called actions which are messages sent to the host
97  * adapter for completion. The actions come in through umass_cam_action. The
98  * appropriate block of routines is called depending on the transport protocol
99  * in use. When the transfer has finished, these routines call
100  * umass_cam_cb again to complete the CAM command.
101  */
102 
103 #include <sys/stdint.h>
104 #include <sys/stddef.h>
105 #include <sys/param.h>
106 #include <sys/queue.h>
107 #include <sys/types.h>
108 #include <sys/systm.h>
109 #include <sys/kernel.h>
110 #include <sys/bus.h>
111 #include <sys/module.h>
112 #include <sys/lock.h>
113 #include <sys/mutex.h>
114 #include <sys/condvar.h>
115 #include <sys/sysctl.h>
116 #include <sys/sx.h>
117 #include <sys/unistd.h>
118 #include <sys/callout.h>
119 #include <sys/malloc.h>
120 #include <sys/priv.h>
121 
122 #include <dev/usb/usb.h>
123 #include <dev/usb/usbdi.h>
124 #include <dev/usb/usbdi_util.h>
125 #include "usbdevs.h"
126 
127 #include <dev/usb/quirk/usb_quirk.h>
128 
129 #include <cam/cam.h>
130 #include <cam/cam_ccb.h>
131 #include <cam/cam_sim.h>
132 #include <cam/cam_xpt_sim.h>
133 #include <cam/scsi/scsi_all.h>
134 #include <cam/scsi/scsi_da.h>
135 
136 #include <cam/cam_periph.h>
137 
138 #ifdef USB_DEBUG
139 #define	DIF(m, x)				\
140   do {						\
141     if (umass_debug & (m)) { x ; }		\
142   } while (0)
143 
144 #define	DPRINTF(sc, m, fmt, ...)			\
145   do {							\
146     if (umass_debug & (m)) {				\
147         printf("%s:%s: " fmt,				\
148 	       (sc) ? (const char *)(sc)->sc_name :	\
149 	       (const char *)"umassX",			\
150 		__FUNCTION__ ,## __VA_ARGS__);		\
151     }							\
152   } while (0)
153 
154 #define	UDMASS_GEN	0x00010000	/* general */
155 #define	UDMASS_SCSI	0x00020000	/* scsi */
156 #define	UDMASS_UFI	0x00040000	/* ufi command set */
157 #define	UDMASS_ATAPI	0x00080000	/* 8070i command set */
158 #define	UDMASS_CMD	(UDMASS_SCSI|UDMASS_UFI|UDMASS_ATAPI)
159 #define	UDMASS_USB	0x00100000	/* USB general */
160 #define	UDMASS_BBB	0x00200000	/* Bulk-Only transfers */
161 #define	UDMASS_CBI	0x00400000	/* CBI transfers */
162 #define	UDMASS_WIRE	(UDMASS_BBB|UDMASS_CBI)
163 #define	UDMASS_ALL	0xffff0000	/* all of the above */
164 static int umass_debug;
165 static int umass_throttle;
166 
167 static SYSCTL_NODE(_hw_usb, OID_AUTO, umass, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
168     "USB umass");
169 SYSCTL_INT(_hw_usb_umass, OID_AUTO, debug, CTLFLAG_RWTUN,
170     &umass_debug, 0, "umass debug level");
171 SYSCTL_INT(_hw_usb_umass, OID_AUTO, throttle, CTLFLAG_RWTUN,
172     &umass_throttle, 0, "Forced delay between commands in milliseconds");
173 #else
174 #define	DIF(...) do { } while (0)
175 #define	DPRINTF(...) do { } while (0)
176 #endif
177 
178 #define	UMASS_BULK_SIZE (1 << 17)
179 #define	UMASS_CBI_DIAGNOSTIC_CMDLEN 12	/* bytes */
180 #define	UMASS_MAX_CMDLEN MAX(12, CAM_MAX_CDBLEN)	/* bytes */
181 
182 /* USB transfer definitions */
183 
184 #define	UMASS_T_BBB_RESET1      0	/* Bulk-Only */
185 #define	UMASS_T_BBB_RESET2      1
186 #define	UMASS_T_BBB_RESET3      2
187 #define	UMASS_T_BBB_COMMAND     3
188 #define	UMASS_T_BBB_DATA_READ   4
189 #define	UMASS_T_BBB_DATA_RD_CS  5
190 #define	UMASS_T_BBB_DATA_WRITE  6
191 #define	UMASS_T_BBB_DATA_WR_CS  7
192 #define	UMASS_T_BBB_STATUS      8
193 #define	UMASS_T_BBB_MAX         9
194 
195 #define	UMASS_T_CBI_RESET1      0	/* CBI */
196 #define	UMASS_T_CBI_RESET2      1
197 #define	UMASS_T_CBI_RESET3      2
198 #define	UMASS_T_CBI_COMMAND     3
199 #define	UMASS_T_CBI_DATA_READ   4
200 #define	UMASS_T_CBI_DATA_RD_CS  5
201 #define	UMASS_T_CBI_DATA_WRITE  6
202 #define	UMASS_T_CBI_DATA_WR_CS  7
203 #define	UMASS_T_CBI_STATUS      8
204 #define	UMASS_T_CBI_RESET4      9
205 #define	UMASS_T_CBI_MAX        10
206 
207 #define	UMASS_T_MAX MAX(UMASS_T_CBI_MAX, UMASS_T_BBB_MAX)
208 
209 /* Generic definitions */
210 
211 /* Direction for transfer */
212 #define	DIR_NONE	0
213 #define	DIR_IN		1
214 #define	DIR_OUT		2
215 
216 /* device name */
217 #define	DEVNAME		"umass"
218 #define	DEVNAME_SIM	"umass-sim"
219 
220 /* Approximate maximum transfer speeds (assumes 33% overhead). */
221 #define	UMASS_FULL_TRANSFER_SPEED	1000
222 #define	UMASS_HIGH_TRANSFER_SPEED	40000
223 #define	UMASS_SUPER_TRANSFER_SPEED	400000
224 #define	UMASS_FLOPPY_TRANSFER_SPEED	20
225 
226 #define	UMASS_TIMEOUT			5000	/* ms */
227 
228 /* CAM specific definitions */
229 
230 #define	UMASS_SCSIID_MAX	1	/* maximum number of drives expected */
231 #define	UMASS_SCSIID_HOST	UMASS_SCSIID_MAX
232 
233 /* Bulk-Only features */
234 
235 #define	UR_BBB_RESET		0xff	/* Bulk-Only reset */
236 #define	UR_BBB_GET_MAX_LUN	0xfe	/* Get maximum lun */
237 
238 /* Command Block Wrapper */
239 typedef struct {
240 	uDWord	dCBWSignature;
241 #define	CBWSIGNATURE	0x43425355
242 	uDWord	dCBWTag;
243 	uDWord	dCBWDataTransferLength;
244 	uByte	bCBWFlags;
245 #define	CBWFLAGS_OUT	0x00
246 #define	CBWFLAGS_IN	0x80
247 	uByte	bCBWLUN;
248 	uByte	bCDBLength;
249 #define	CBWCDBLENGTH	16
250 	uByte	CBWCDB[CBWCDBLENGTH];
251 } __packed umass_bbb_cbw_t;
252 
253 #define	UMASS_BBB_CBW_SIZE	31
254 
255 /* Command Status Wrapper */
256 typedef struct {
257 	uDWord	dCSWSignature;
258 #define	CSWSIGNATURE	0x53425355
259 #define	CSWSIGNATURE_IMAGINATION_DBX1	0x43425355
260 #define	CSWSIGNATURE_OLYMPUS_C1	0x55425355
261 	uDWord	dCSWTag;
262 	uDWord	dCSWDataResidue;
263 	uByte	bCSWStatus;
264 #define	CSWSTATUS_GOOD	0x0
265 #define	CSWSTATUS_FAILED	0x1
266 #define	CSWSTATUS_PHASE	0x2
267 } __packed umass_bbb_csw_t;
268 
269 #define	UMASS_BBB_CSW_SIZE	13
270 
271 /* CBI features */
272 
273 #define	UR_CBI_ADSC	0x00
274 
275 typedef union {
276 	struct {
277 		uint8_t	type;
278 #define	IDB_TYPE_CCI		0x00
279 		uint8_t	value;
280 #define	IDB_VALUE_PASS		0x00
281 #define	IDB_VALUE_FAIL		0x01
282 #define	IDB_VALUE_PHASE		0x02
283 #define	IDB_VALUE_PERSISTENT	0x03
284 #define	IDB_VALUE_STATUS_MASK	0x03
285 	} __packed common;
286 
287 	struct {
288 		uint8_t	asc;
289 		uint8_t	ascq;
290 	} __packed ufi;
291 } __packed umass_cbi_sbl_t;
292 
293 struct umass_softc;			/* see below */
294 
295 typedef void (umass_callback_t)(struct umass_softc *sc, union ccb *ccb,
296     	uint32_t residue, uint8_t status);
297 
298 #define	STATUS_CMD_OK		0	/* everything ok */
299 #define	STATUS_CMD_UNKNOWN	1	/* will have to fetch sense */
300 #define	STATUS_CMD_FAILED	2	/* transfer was ok, command failed */
301 #define	STATUS_WIRE_FAILED	3	/* couldn't even get command across */
302 
303 typedef uint8_t (umass_transform_t)(struct umass_softc *sc, uint8_t *cmd_ptr,
304     	uint8_t cmd_len);
305 
306 /* Wire and command protocol */
307 #define	UMASS_PROTO_BBB		0x0001	/* USB wire protocol */
308 #define	UMASS_PROTO_CBI		0x0002
309 #define	UMASS_PROTO_CBI_I	0x0004
310 #define	UMASS_PROTO_WIRE	0x00ff	/* USB wire protocol mask */
311 #define	UMASS_PROTO_SCSI	0x0100	/* command protocol */
312 #define	UMASS_PROTO_ATAPI	0x0200
313 #define	UMASS_PROTO_UFI		0x0400
314 #define	UMASS_PROTO_RBC		0x0800
315 #define	UMASS_PROTO_COMMAND	0xff00	/* command protocol mask */
316 
317 /* Device specific quirks */
318 #define	NO_QUIRKS		0x0000
319 	/*
320 	 * The drive does not support Test Unit Ready. Convert to Start Unit
321 	 */
322 #define	NO_TEST_UNIT_READY	0x0001
323 	/*
324 	 * The drive does not reset the Unit Attention state after REQUEST
325 	 * SENSE has been sent. The INQUIRY command does not reset the UA
326 	 * either, and so CAM runs in circles trying to retrieve the initial
327 	 * INQUIRY data.
328 	 */
329 #define	RS_NO_CLEAR_UA		0x0002
330 	/* The drive does not support START STOP.  */
331 #define	NO_START_STOP		0x0004
332 	/* Don't ask for full inquiry data (255b).  */
333 #define	FORCE_SHORT_INQUIRY	0x0008
334 	/* Needs to be initialised the Shuttle way */
335 #define	SHUTTLE_INIT		0x0010
336 	/* Drive needs to be switched to alternate iface 1 */
337 #define	ALT_IFACE_1		0x0020
338 	/* Drive does not do 1Mb/s, but just floppy speeds (20kb/s) */
339 #define	FLOPPY_SPEED		0x0040
340 	/* The device can't count and gets the residue of transfers wrong */
341 #define	IGNORE_RESIDUE		0x0080
342 	/* No GetMaxLun call */
343 #define	NO_GETMAXLUN		0x0100
344 	/* The device uses a weird CSWSIGNATURE. */
345 #define	WRONG_CSWSIG		0x0200
346 	/* Device cannot handle INQUIRY so fake a generic response */
347 #define	NO_INQUIRY		0x0400
348 	/* Device cannot handle INQUIRY EVPD, return CHECK CONDITION */
349 #define	NO_INQUIRY_EVPD		0x0800
350 	/* Pad all RBC requests to 12 bytes. */
351 #define	RBC_PAD_TO_12		0x1000
352 	/*
353 	 * Device reports number of sectors from READ_CAPACITY, not max
354 	 * sector number.
355 	 */
356 #define	READ_CAPACITY_OFFBY1	0x2000
357 	/*
358 	 * Device cannot handle a SCSI synchronize cache command.  Normally
359 	 * this quirk would be handled in the cam layer, but for IDE bridges
360 	 * we need to associate the quirk with the bridge and not the
361 	 * underlying disk device.  This is handled by faking a success
362 	 * result.
363 	 */
364 #define	NO_SYNCHRONIZE_CACHE	0x4000
365 	/* Device does not support 'PREVENT/ALLOW MEDIUM REMOVAL'. */
366 #define	NO_PREVENT_ALLOW	0x8000
367 
368 struct umass_softc {
369 	struct scsi_sense cam_scsi_sense;
370 	struct scsi_test_unit_ready cam_scsi_test_unit_ready;
371 	struct mtx sc_mtx;
372 	struct {
373 		uint8_t *data_ptr;
374 		union ccb *ccb;
375 		umass_callback_t *callback;
376 
377 		uint32_t data_len;	/* bytes */
378 		uint32_t data_rem;	/* bytes */
379 		uint32_t data_timeout;	/* ms */
380 		uint32_t actlen;	/* bytes */
381 
382 		uint8_t	cmd_data[UMASS_MAX_CMDLEN];
383 		uint8_t	cmd_len;	/* bytes */
384 		uint8_t	dir;
385 		uint8_t	lun;
386 	}	sc_transfer;
387 
388 	/* Bulk specific variables for transfers in progress */
389 	umass_bbb_cbw_t cbw;		/* command block wrapper */
390 	umass_bbb_csw_t csw;		/* command status wrapper */
391 
392 	/* CBI specific variables for transfers in progress */
393 	umass_cbi_sbl_t sbl;		/* status block */
394 
395 	device_t sc_dev;
396 	struct usb_device *sc_udev;
397 	struct cam_sim *sc_sim;		/* SCSI Interface Module */
398 	struct usb_xfer *sc_xfer[UMASS_T_MAX];
399 
400 	/*
401 	 * The command transform function is used to convert the SCSI
402 	 * commands into their derivatives, like UFI, ATAPI, and friends.
403 	 */
404 	umass_transform_t *sc_transform;
405 
406 	uint32_t sc_unit;
407 	uint32_t sc_quirks;		/* they got it almost right */
408 	uint32_t sc_proto;		/* wire and cmd protocol */
409 
410 	uint8_t	sc_name[16];
411 	uint8_t	sc_iface_no;		/* interface number */
412 	uint8_t	sc_maxlun;		/* maximum LUN number, inclusive */
413 	uint8_t	sc_last_xfer_index;
414 	uint8_t	sc_status_try;
415 };
416 
417 struct umass_probe_proto {
418 	uint32_t quirks;
419 	uint32_t proto;
420 
421 	int	error;
422 };
423 
424 /* prototypes */
425 
426 static device_probe_t umass_probe;
427 static device_attach_t umass_attach;
428 static device_detach_t umass_detach;
429 
430 static usb_callback_t umass_tr_error;
431 static usb_callback_t umass_t_bbb_reset1_callback;
432 static usb_callback_t umass_t_bbb_reset2_callback;
433 static usb_callback_t umass_t_bbb_reset3_callback;
434 static usb_callback_t umass_t_bbb_command_callback;
435 static usb_callback_t umass_t_bbb_data_read_callback;
436 static usb_callback_t umass_t_bbb_data_rd_cs_callback;
437 static usb_callback_t umass_t_bbb_data_write_callback;
438 static usb_callback_t umass_t_bbb_data_wr_cs_callback;
439 static usb_callback_t umass_t_bbb_status_callback;
440 static usb_callback_t umass_t_cbi_reset1_callback;
441 static usb_callback_t umass_t_cbi_reset2_callback;
442 static usb_callback_t umass_t_cbi_reset3_callback;
443 static usb_callback_t umass_t_cbi_reset4_callback;
444 static usb_callback_t umass_t_cbi_command_callback;
445 static usb_callback_t umass_t_cbi_data_read_callback;
446 static usb_callback_t umass_t_cbi_data_rd_cs_callback;
447 static usb_callback_t umass_t_cbi_data_write_callback;
448 static usb_callback_t umass_t_cbi_data_wr_cs_callback;
449 static usb_callback_t umass_t_cbi_status_callback;
450 
451 static void	umass_cancel_ccb(struct umass_softc *);
452 static void	umass_init_shuttle(struct umass_softc *);
453 static void	umass_reset(struct umass_softc *);
454 static void	umass_t_bbb_data_clear_stall_callback(struct usb_xfer *,
455 		    uint8_t, uint8_t, usb_error_t);
456 static void	umass_command_start(struct umass_softc *, uint8_t, void *,
457 		    uint32_t, uint32_t, umass_callback_t *, union ccb *);
458 static uint8_t	umass_bbb_get_max_lun(struct umass_softc *);
459 static void	umass_cbi_start_status(struct umass_softc *);
460 static void	umass_t_cbi_data_clear_stall_callback(struct usb_xfer *,
461 		    uint8_t, uint8_t, usb_error_t);
462 static int	umass_cam_attach_sim(struct umass_softc *);
463 static void	umass_cam_attach(struct umass_softc *);
464 static void	umass_cam_detach_sim(struct umass_softc *);
465 static void	umass_cam_action(struct cam_sim *, union ccb *);
466 static void	umass_cam_poll(struct cam_sim *);
467 static void	umass_cam_cb(struct umass_softc *, union ccb *, uint32_t,
468 		    uint8_t);
469 static void	umass_cam_sense_cb(struct umass_softc *, union ccb *, uint32_t,
470 		    uint8_t);
471 static void	umass_cam_quirk_cb(struct umass_softc *, union ccb *, uint32_t,
472 		    uint8_t);
473 static uint8_t	umass_scsi_transform(struct umass_softc *, uint8_t *, uint8_t);
474 static uint8_t	umass_rbc_transform(struct umass_softc *, uint8_t *, uint8_t);
475 static uint8_t	umass_ufi_transform(struct umass_softc *, uint8_t *, uint8_t);
476 static uint8_t	umass_atapi_transform(struct umass_softc *, uint8_t *,
477 		    uint8_t);
478 static uint8_t	umass_no_transform(struct umass_softc *, uint8_t *, uint8_t);
479 static uint8_t	umass_std_transform(struct umass_softc *, union ccb *, uint8_t
480 		    *, uint8_t);
481 
482 #ifdef USB_DEBUG
483 static void	umass_bbb_dump_cbw(struct umass_softc *, umass_bbb_cbw_t *);
484 static void	umass_bbb_dump_csw(struct umass_softc *, umass_bbb_csw_t *);
485 static void	umass_cbi_dump_cmd(struct umass_softc *, void *, uint8_t);
486 static void	umass_dump_buffer(struct umass_softc *, uint8_t *, uint32_t,
487 		    uint32_t);
488 #endif
489 
490 static struct usb_config umass_bbb_config[UMASS_T_BBB_MAX] = {
491 	[UMASS_T_BBB_RESET1] = {
492 		.type = UE_CONTROL,
493 		.endpoint = 0x00,	/* Control pipe */
494 		.direction = UE_DIR_ANY,
495 		.bufsize = sizeof(struct usb_device_request),
496 		.callback = &umass_t_bbb_reset1_callback,
497 		.timeout = 5000,	/* 5 seconds */
498 		.interval = 500,	/* 500 milliseconds */
499 	},
500 
501 	[UMASS_T_BBB_RESET2] = {
502 		.type = UE_CONTROL,
503 		.endpoint = 0x00,	/* Control pipe */
504 		.direction = UE_DIR_ANY,
505 		.bufsize = sizeof(struct usb_device_request),
506 		.callback = &umass_t_bbb_reset2_callback,
507 		.timeout = 5000,	/* 5 seconds */
508 		.interval = 50,	/* 50 milliseconds */
509 	},
510 
511 	[UMASS_T_BBB_RESET3] = {
512 		.type = UE_CONTROL,
513 		.endpoint = 0x00,	/* Control pipe */
514 		.direction = UE_DIR_ANY,
515 		.bufsize = sizeof(struct usb_device_request),
516 		.callback = &umass_t_bbb_reset3_callback,
517 		.timeout = 5000,	/* 5 seconds */
518 		.interval = 50,	/* 50 milliseconds */
519 	},
520 
521 	[UMASS_T_BBB_COMMAND] = {
522 		.type = UE_BULK,
523 		.endpoint = UE_ADDR_ANY,
524 		.direction = UE_DIR_OUT,
525 		.bufsize = sizeof(umass_bbb_cbw_t),
526 		.callback = &umass_t_bbb_command_callback,
527 		.timeout = 5000,	/* 5 seconds */
528 	},
529 
530 	[UMASS_T_BBB_DATA_READ] = {
531 		.type = UE_BULK,
532 		.endpoint = UE_ADDR_ANY,
533 		.direction = UE_DIR_IN,
534 		.bufsize = UMASS_BULK_SIZE,
535 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
536 		.callback = &umass_t_bbb_data_read_callback,
537 		.timeout = 0,	/* overwritten later */
538 	},
539 
540 	[UMASS_T_BBB_DATA_RD_CS] = {
541 		.type = UE_CONTROL,
542 		.endpoint = 0x00,	/* Control pipe */
543 		.direction = UE_DIR_ANY,
544 		.bufsize = sizeof(struct usb_device_request),
545 		.callback = &umass_t_bbb_data_rd_cs_callback,
546 		.timeout = 5000,	/* 5 seconds */
547 	},
548 
549 	[UMASS_T_BBB_DATA_WRITE] = {
550 		.type = UE_BULK,
551 		.endpoint = UE_ADDR_ANY,
552 		.direction = UE_DIR_OUT,
553 		.bufsize = UMASS_BULK_SIZE,
554 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
555 		.callback = &umass_t_bbb_data_write_callback,
556 		.timeout = 0,	/* overwritten later */
557 	},
558 
559 	[UMASS_T_BBB_DATA_WR_CS] = {
560 		.type = UE_CONTROL,
561 		.endpoint = 0x00,	/* Control pipe */
562 		.direction = UE_DIR_ANY,
563 		.bufsize = sizeof(struct usb_device_request),
564 		.callback = &umass_t_bbb_data_wr_cs_callback,
565 		.timeout = 5000,	/* 5 seconds */
566 	},
567 
568 	[UMASS_T_BBB_STATUS] = {
569 		.type = UE_BULK,
570 		.endpoint = UE_ADDR_ANY,
571 		.direction = UE_DIR_IN,
572 		.bufsize = sizeof(umass_bbb_csw_t),
573 		.flags = {.short_xfer_ok = 1,},
574 		.callback = &umass_t_bbb_status_callback,
575 		.timeout = 5000,	/* ms */
576 	},
577 };
578 
579 static struct usb_config umass_cbi_config[UMASS_T_CBI_MAX] = {
580 	[UMASS_T_CBI_RESET1] = {
581 		.type = UE_CONTROL,
582 		.endpoint = 0x00,	/* Control pipe */
583 		.direction = UE_DIR_ANY,
584 		.bufsize = (sizeof(struct usb_device_request) +
585 		    UMASS_CBI_DIAGNOSTIC_CMDLEN),
586 		.callback = &umass_t_cbi_reset1_callback,
587 		.timeout = 5000,	/* 5 seconds */
588 		.interval = 500,	/* 500 milliseconds */
589 	},
590 
591 	[UMASS_T_CBI_RESET2] = {
592 		.type = UE_CONTROL,
593 		.endpoint = 0x00,	/* Control pipe */
594 		.direction = UE_DIR_ANY,
595 		.bufsize = sizeof(struct usb_device_request),
596 		.callback = &umass_t_cbi_reset2_callback,
597 		.timeout = 5000,	/* 5 seconds */
598 		.interval = 50,	/* 50 milliseconds */
599 	},
600 
601 	[UMASS_T_CBI_RESET3] = {
602 		.type = UE_CONTROL,
603 		.endpoint = 0x00,	/* Control pipe */
604 		.direction = UE_DIR_ANY,
605 		.bufsize = sizeof(struct usb_device_request),
606 		.callback = &umass_t_cbi_reset3_callback,
607 		.timeout = 5000,	/* 5 seconds */
608 		.interval = 50,	/* 50 milliseconds */
609 	},
610 
611 	[UMASS_T_CBI_COMMAND] = {
612 		.type = UE_CONTROL,
613 		.endpoint = 0x00,	/* Control pipe */
614 		.direction = UE_DIR_ANY,
615 		.bufsize = (sizeof(struct usb_device_request) +
616 		    UMASS_MAX_CMDLEN),
617 		.callback = &umass_t_cbi_command_callback,
618 		.timeout = 5000,	/* 5 seconds */
619 	},
620 
621 	[UMASS_T_CBI_DATA_READ] = {
622 		.type = UE_BULK,
623 		.endpoint = UE_ADDR_ANY,
624 		.direction = UE_DIR_IN,
625 		.bufsize = UMASS_BULK_SIZE,
626 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
627 		.callback = &umass_t_cbi_data_read_callback,
628 		.timeout = 0,	/* overwritten later */
629 	},
630 
631 	[UMASS_T_CBI_DATA_RD_CS] = {
632 		.type = UE_CONTROL,
633 		.endpoint = 0x00,	/* Control pipe */
634 		.direction = UE_DIR_ANY,
635 		.bufsize = sizeof(struct usb_device_request),
636 		.callback = &umass_t_cbi_data_rd_cs_callback,
637 		.timeout = 5000,	/* 5 seconds */
638 	},
639 
640 	[UMASS_T_CBI_DATA_WRITE] = {
641 		.type = UE_BULK,
642 		.endpoint = UE_ADDR_ANY,
643 		.direction = UE_DIR_OUT,
644 		.bufsize = UMASS_BULK_SIZE,
645 		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
646 		.callback = &umass_t_cbi_data_write_callback,
647 		.timeout = 0,	/* overwritten later */
648 	},
649 
650 	[UMASS_T_CBI_DATA_WR_CS] = {
651 		.type = UE_CONTROL,
652 		.endpoint = 0x00,	/* Control pipe */
653 		.direction = UE_DIR_ANY,
654 		.bufsize = sizeof(struct usb_device_request),
655 		.callback = &umass_t_cbi_data_wr_cs_callback,
656 		.timeout = 5000,	/* 5 seconds */
657 	},
658 
659 	[UMASS_T_CBI_STATUS] = {
660 		.type = UE_INTERRUPT,
661 		.endpoint = UE_ADDR_ANY,
662 		.direction = UE_DIR_IN,
663 		.flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
664 		.bufsize = sizeof(umass_cbi_sbl_t),
665 		.callback = &umass_t_cbi_status_callback,
666 		.timeout = 5000,	/* ms */
667 	},
668 
669 	[UMASS_T_CBI_RESET4] = {
670 		.type = UE_CONTROL,
671 		.endpoint = 0x00,	/* Control pipe */
672 		.direction = UE_DIR_ANY,
673 		.bufsize = sizeof(struct usb_device_request),
674 		.callback = &umass_t_cbi_reset4_callback,
675 		.timeout = 5000,	/* ms */
676 	},
677 };
678 
679 /* If device cannot return valid inquiry data, fake it */
680 static const uint8_t fake_inq_data[SHORT_INQUIRY_LENGTH] = {
681 	0, /* removable */ 0x80, SCSI_REV_2, SCSI_REV_2,
682 	 /* additional_length */ 31, 0, 0, 0
683 };
684 
685 #define	UFI_COMMAND_LENGTH	12	/* UFI commands are always 12 bytes */
686 #define	ATAPI_COMMAND_LENGTH	12	/* ATAPI commands are always 12 bytes */
687 
688 static device_method_t umass_methods[] = {
689 	/* Device interface */
690 	DEVMETHOD(device_probe, umass_probe),
691 	DEVMETHOD(device_attach, umass_attach),
692 	DEVMETHOD(device_detach, umass_detach),
693 
694 	DEVMETHOD_END
695 };
696 
697 static driver_t umass_driver = {
698 	.name = "umass",
699 	.methods = umass_methods,
700 	.size = sizeof(struct umass_softc),
701 };
702 
703 static const STRUCT_USB_HOST_ID __used umass_devs[] = {
704 	/* generic mass storage class */
705 	{USB_IFACE_CLASS(UICLASS_MASS),},
706 };
707 
708 DRIVER_MODULE(umass, uhub, umass_driver, NULL, NULL);
709 MODULE_DEPEND(umass, usb, 1, 1, 1);
710 MODULE_DEPEND(umass, cam, 1, 1, 1);
711 MODULE_VERSION(umass, 1);
712 USB_PNP_HOST_INFO(umass_devs);
713 
714 /*
715  * USB device probe/attach/detach
716  */
717 
718 static uint16_t
719 umass_get_proto(struct usb_interface *iface)
720 {
721 	struct usb_interface_descriptor *id;
722 	uint16_t retval;
723 
724 	retval = 0;
725 
726 	/* Check for a standards compliant device */
727 	id = usbd_get_interface_descriptor(iface);
728 	if ((id == NULL) ||
729 	    (id->bInterfaceClass != UICLASS_MASS)) {
730 		goto done;
731 	}
732 	switch (id->bInterfaceSubClass) {
733 	case UISUBCLASS_SCSI:
734 		retval |= UMASS_PROTO_SCSI;
735 		break;
736 	case UISUBCLASS_UFI:
737 		retval |= UMASS_PROTO_UFI;
738 		break;
739 	case UISUBCLASS_RBC:
740 		retval |= UMASS_PROTO_RBC;
741 		break;
742 	case UISUBCLASS_SFF8020I:
743 	case UISUBCLASS_SFF8070I:
744 		retval |= UMASS_PROTO_ATAPI;
745 		break;
746 	default:
747 		goto done;
748 	}
749 
750 	switch (id->bInterfaceProtocol) {
751 	case UIPROTO_MASS_CBI:
752 		retval |= UMASS_PROTO_CBI;
753 		break;
754 	case UIPROTO_MASS_CBI_I:
755 		retval |= UMASS_PROTO_CBI_I;
756 		break;
757 	case UIPROTO_MASS_BBB_OLD:
758 	case UIPROTO_MASS_BBB:
759 		retval |= UMASS_PROTO_BBB;
760 		break;
761 	default:
762 		goto done;
763 	}
764 done:
765 	return (retval);
766 }
767 
768 /*
769  * Match the device we are seeing with the devices supported.
770  */
771 static struct umass_probe_proto
772 umass_probe_proto(device_t dev, struct usb_attach_arg *uaa)
773 {
774 	struct umass_probe_proto ret;
775 	uint32_t quirks = NO_QUIRKS;
776 	uint32_t proto = umass_get_proto(uaa->iface);
777 
778 	memset(&ret, 0, sizeof(ret));
779 	ret.error = BUS_PROBE_GENERIC;
780 
781 	/* Check if we should deny probing. */
782 	if (usb_test_quirk(uaa, UQ_MSC_IGNORE)) {
783 		ret.error = ENXIO;
784 		goto done;
785 	}
786 
787 	/* Search for protocol enforcement */
788 
789 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_BBB)) {
790 		proto &= ~UMASS_PROTO_WIRE;
791 		proto |= UMASS_PROTO_BBB;
792 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI)) {
793 		proto &= ~UMASS_PROTO_WIRE;
794 		proto |= UMASS_PROTO_CBI;
795 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI_I)) {
796 		proto &= ~UMASS_PROTO_WIRE;
797 		proto |= UMASS_PROTO_CBI_I;
798 	}
799 
800 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_SCSI)) {
801 		proto &= ~UMASS_PROTO_COMMAND;
802 		proto |= UMASS_PROTO_SCSI;
803 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_ATAPI)) {
804 		proto &= ~UMASS_PROTO_COMMAND;
805 		proto |= UMASS_PROTO_ATAPI;
806 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_UFI)) {
807 		proto &= ~UMASS_PROTO_COMMAND;
808 		proto |= UMASS_PROTO_UFI;
809 	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_RBC)) {
810 		proto &= ~UMASS_PROTO_COMMAND;
811 		proto |= UMASS_PROTO_RBC;
812 	}
813 
814 	/* Check if the protocol is invalid */
815 
816 	if ((proto & UMASS_PROTO_COMMAND) == 0) {
817 		ret.error = ENXIO;
818 		goto done;
819 	}
820 
821 	if ((proto & UMASS_PROTO_WIRE) == 0) {
822 		ret.error = ENXIO;
823 		goto done;
824 	}
825 
826 	/* Search for quirks */
827 
828 	if (usb_test_quirk(uaa, UQ_MSC_NO_TEST_UNIT_READY))
829 		quirks |= NO_TEST_UNIT_READY;
830 	if (usb_test_quirk(uaa, UQ_MSC_NO_RS_CLEAR_UA))
831 		quirks |= RS_NO_CLEAR_UA;
832 	if (usb_test_quirk(uaa, UQ_MSC_NO_START_STOP))
833 		quirks |= NO_START_STOP;
834 	if (usb_test_quirk(uaa, UQ_MSC_NO_GETMAXLUN))
835 		quirks |= NO_GETMAXLUN;
836 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY))
837 		quirks |= NO_INQUIRY;
838 	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY_EVPD))
839 		quirks |= NO_INQUIRY_EVPD;
840 	if (usb_test_quirk(uaa, UQ_MSC_NO_PREVENT_ALLOW))
841 		quirks |= NO_PREVENT_ALLOW;
842 	if (usb_test_quirk(uaa, UQ_MSC_NO_SYNC_CACHE))
843 		quirks |= NO_SYNCHRONIZE_CACHE;
844 	if (usb_test_quirk(uaa, UQ_MSC_SHUTTLE_INIT))
845 		quirks |= SHUTTLE_INIT;
846 	if (usb_test_quirk(uaa, UQ_MSC_ALT_IFACE_1))
847 		quirks |= ALT_IFACE_1;
848 	if (usb_test_quirk(uaa, UQ_MSC_FLOPPY_SPEED))
849 		quirks |= FLOPPY_SPEED;
850 	if (usb_test_quirk(uaa, UQ_MSC_IGNORE_RESIDUE))
851 		quirks |= IGNORE_RESIDUE;
852 	if (usb_test_quirk(uaa, UQ_MSC_WRONG_CSWSIG))
853 		quirks |= WRONG_CSWSIG;
854 	if (usb_test_quirk(uaa, UQ_MSC_RBC_PAD_TO_12))
855 		quirks |= RBC_PAD_TO_12;
856 	if (usb_test_quirk(uaa, UQ_MSC_READ_CAP_OFFBY1))
857 		quirks |= READ_CAPACITY_OFFBY1;
858 	if (usb_test_quirk(uaa, UQ_MSC_FORCE_SHORT_INQ))
859 		quirks |= FORCE_SHORT_INQUIRY;
860 
861 done:
862 	ret.quirks = quirks;
863 	ret.proto = proto;
864 	return (ret);
865 }
866 
867 static int
868 umass_probe(device_t dev)
869 {
870 	struct usb_attach_arg *uaa = device_get_ivars(dev);
871 	struct umass_probe_proto temp;
872 
873 	if (uaa->usb_mode != USB_MODE_HOST) {
874 		return (ENXIO);
875 	}
876 	temp = umass_probe_proto(dev, uaa);
877 
878 	return (temp.error);
879 }
880 
881 static int
882 umass_attach(device_t dev)
883 {
884 	struct umass_softc *sc = device_get_softc(dev);
885 	struct usb_attach_arg *uaa = device_get_ivars(dev);
886 	struct umass_probe_proto temp = umass_probe_proto(dev, uaa);
887 	struct usb_interface_descriptor *id;
888 	int err;
889 
890 	/*
891 	 * NOTE: the softc struct is cleared in device_set_driver.
892 	 * We can safely call umass_detach without specifically
893 	 * initializing the struct.
894 	 */
895 
896 	sc->sc_dev = dev;
897 	sc->sc_udev = uaa->device;
898 	sc->sc_proto = temp.proto;
899 	sc->sc_quirks = temp.quirks;
900 	sc->sc_unit = device_get_unit(dev);
901 
902 	snprintf(sc->sc_name, sizeof(sc->sc_name),
903 	    "%s", device_get_nameunit(dev));
904 
905 	device_set_usb_desc(dev);
906 
907         mtx_init(&sc->sc_mtx, device_get_nameunit(dev),
908 	    NULL, MTX_DEF | MTX_RECURSE);
909 
910 	/* get interface index */
911 
912 	id = usbd_get_interface_descriptor(uaa->iface);
913 	if (id == NULL) {
914 		device_printf(dev, "failed to get "
915 		    "interface number\n");
916 		goto detach;
917 	}
918 	sc->sc_iface_no = id->bInterfaceNumber;
919 
920 #ifdef USB_DEBUG
921 	device_printf(dev, " ");
922 
923 	switch (sc->sc_proto & UMASS_PROTO_COMMAND) {
924 	case UMASS_PROTO_SCSI:
925 		printf("SCSI");
926 		break;
927 	case UMASS_PROTO_ATAPI:
928 		printf("8070i (ATAPI)");
929 		break;
930 	case UMASS_PROTO_UFI:
931 		printf("UFI");
932 		break;
933 	case UMASS_PROTO_RBC:
934 		printf("RBC");
935 		break;
936 	default:
937 		printf("(unknown 0x%02x)",
938 		    sc->sc_proto & UMASS_PROTO_COMMAND);
939 		break;
940 	}
941 
942 	printf(" over ");
943 
944 	switch (sc->sc_proto & UMASS_PROTO_WIRE) {
945 	case UMASS_PROTO_BBB:
946 		printf("Bulk-Only");
947 		break;
948 	case UMASS_PROTO_CBI:		/* uses Comand/Bulk pipes */
949 		printf("CBI");
950 		break;
951 	case UMASS_PROTO_CBI_I:	/* uses Comand/Bulk/Interrupt pipes */
952 		printf("CBI with CCI");
953 		break;
954 	default:
955 		printf("(unknown 0x%02x)",
956 		    sc->sc_proto & UMASS_PROTO_WIRE);
957 	}
958 
959 	printf("; quirks = 0x%04x\n", sc->sc_quirks);
960 #endif
961 
962 	if (sc->sc_quirks & ALT_IFACE_1) {
963 		err = usbd_set_alt_interface_index
964 		    (uaa->device, uaa->info.bIfaceIndex, 1);
965 
966 		if (err) {
967 			DPRINTF(sc, UDMASS_USB, "could not switch to "
968 			    "Alt Interface 1\n");
969 			goto detach;
970 		}
971 	}
972 	/* allocate all required USB transfers */
973 
974 	if (sc->sc_proto & UMASS_PROTO_BBB) {
975 		err = usbd_transfer_setup(uaa->device,
976 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_bbb_config,
977 		    UMASS_T_BBB_MAX, sc, &sc->sc_mtx);
978 
979 		/* skip reset first time */
980 		sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
981 
982 	} else if (sc->sc_proto & (UMASS_PROTO_CBI | UMASS_PROTO_CBI_I)) {
983 		err = usbd_transfer_setup(uaa->device,
984 		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_cbi_config,
985 		    UMASS_T_CBI_MAX, sc, &sc->sc_mtx);
986 
987 		/* skip reset first time */
988 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
989 
990 	} else {
991 		err = USB_ERR_INVAL;
992 	}
993 
994 	if (err) {
995 		device_printf(dev, "could not setup required "
996 		    "transfers, %s\n", usbd_errstr(err));
997 		goto detach;
998 	}
999 #ifdef USB_DEBUG
1000 	if (umass_throttle > 0) {
1001 		uint8_t x;
1002 		int iv;
1003 
1004 		iv = umass_throttle;
1005 
1006 		if (iv < 1)
1007 			iv = 1;
1008 		else if (iv > 8000)
1009 			iv = 8000;
1010 
1011 		for (x = 0; x != UMASS_T_MAX; x++) {
1012 			if (sc->sc_xfer[x] != NULL)
1013 				usbd_xfer_set_interval(sc->sc_xfer[x], iv);
1014 		}
1015 	}
1016 #endif
1017 	sc->sc_transform =
1018 	    (sc->sc_proto & UMASS_PROTO_SCSI) ? &umass_scsi_transform :
1019 	    (sc->sc_proto & UMASS_PROTO_UFI) ? &umass_ufi_transform :
1020 	    (sc->sc_proto & UMASS_PROTO_ATAPI) ? &umass_atapi_transform :
1021 	    (sc->sc_proto & UMASS_PROTO_RBC) ? &umass_rbc_transform :
1022 	    &umass_no_transform;
1023 
1024 	/* from here onwards the device can be used. */
1025 
1026 	if (sc->sc_quirks & SHUTTLE_INIT) {
1027 		umass_init_shuttle(sc);
1028 	}
1029 	/* get the maximum LUN supported by the device */
1030 
1031 	if (((sc->sc_proto & UMASS_PROTO_WIRE) == UMASS_PROTO_BBB) &&
1032 	    !(sc->sc_quirks & NO_GETMAXLUN))
1033 		sc->sc_maxlun = umass_bbb_get_max_lun(sc);
1034 	else
1035 		sc->sc_maxlun = 0;
1036 
1037 	/* Prepare the SCSI command block */
1038 	sc->cam_scsi_sense.opcode = REQUEST_SENSE;
1039 	sc->cam_scsi_test_unit_ready.opcode = TEST_UNIT_READY;
1040 
1041 	/* register the SIM */
1042 	err = umass_cam_attach_sim(sc);
1043 	if (err) {
1044 		goto detach;
1045 	}
1046 	/* scan the SIM */
1047 	umass_cam_attach(sc);
1048 
1049 	DPRINTF(sc, UDMASS_GEN, "Attach finished\n");
1050 
1051 	return (0);			/* success */
1052 
1053 detach:
1054 	umass_detach(dev);
1055 	return (ENXIO);			/* failure */
1056 }
1057 
1058 static int
1059 umass_detach(device_t dev)
1060 {
1061 	struct umass_softc *sc = device_get_softc(dev);
1062 
1063 	DPRINTF(sc, UDMASS_USB, "\n");
1064 
1065 	/* teardown our statemachine */
1066 
1067 	usbd_transfer_unsetup(sc->sc_xfer, UMASS_T_MAX);
1068 
1069 	mtx_lock(&sc->sc_mtx);
1070 
1071 	/* cancel any leftover CCB's */
1072 
1073 	umass_cancel_ccb(sc);
1074 
1075 	umass_cam_detach_sim(sc);
1076 
1077 	mtx_unlock(&sc->sc_mtx);
1078 
1079 	mtx_destroy(&sc->sc_mtx);
1080 
1081 	return (0);			/* success */
1082 }
1083 
1084 static void
1085 umass_init_shuttle(struct umass_softc *sc)
1086 {
1087 	struct usb_device_request req;
1088 	uint8_t status[2] = {0, 0};
1089 
1090 	/*
1091 	 * The Linux driver does this, but no one can tell us what the
1092 	 * command does.
1093 	 */
1094 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1095 	req.bRequest = 1;		/* XXX unknown command */
1096 	USETW(req.wValue, 0);
1097 	req.wIndex[0] = sc->sc_iface_no;
1098 	req.wIndex[1] = 0;
1099 	USETW(req.wLength, sizeof(status));
1100 	usbd_do_request(sc->sc_udev, NULL, &req, &status);
1101 
1102 	DPRINTF(sc, UDMASS_GEN, "Shuttle init returned 0x%02x%02x\n",
1103 	    status[0], status[1]);
1104 }
1105 
1106 /*
1107  * Generic functions to handle transfers
1108  */
1109 
1110 static void
1111 umass_transfer_start(struct umass_softc *sc, uint8_t xfer_index)
1112 {
1113 	DPRINTF(sc, UDMASS_GEN, "transfer index = "
1114 	    "%d\n", xfer_index);
1115 
1116 	if (sc->sc_xfer[xfer_index]) {
1117 		sc->sc_last_xfer_index = xfer_index;
1118 		usbd_transfer_start(sc->sc_xfer[xfer_index]);
1119 	} else {
1120 		umass_cancel_ccb(sc);
1121 	}
1122 }
1123 
1124 static void
1125 umass_reset(struct umass_softc *sc)
1126 {
1127 	DPRINTF(sc, UDMASS_GEN, "resetting device\n");
1128 
1129 	/*
1130 	 * stop the last transfer, if not already stopped:
1131 	 */
1132 	usbd_transfer_stop(sc->sc_xfer[sc->sc_last_xfer_index]);
1133 	umass_transfer_start(sc, 0);
1134 }
1135 
1136 static void
1137 umass_cancel_ccb(struct umass_softc *sc)
1138 {
1139 	union ccb *ccb;
1140 
1141 	USB_MTX_ASSERT(&sc->sc_mtx, MA_OWNED);
1142 
1143 	ccb = sc->sc_transfer.ccb;
1144 	sc->sc_transfer.ccb = NULL;
1145 	sc->sc_last_xfer_index = 0;
1146 
1147 	if (ccb) {
1148 		(sc->sc_transfer.callback)
1149 		    (sc, ccb, (sc->sc_transfer.data_len -
1150 		    sc->sc_transfer.actlen), STATUS_WIRE_FAILED);
1151 	}
1152 }
1153 
1154 static void
1155 umass_tr_error(struct usb_xfer *xfer, usb_error_t error)
1156 {
1157 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1158 
1159 	if (error != USB_ERR_CANCELLED) {
1160 		DPRINTF(sc, UDMASS_GEN, "transfer error, %s -> "
1161 		    "reset\n", usbd_errstr(error));
1162 	}
1163 	umass_cancel_ccb(sc);
1164 }
1165 
1166 /*
1167  * BBB protocol specific functions
1168  */
1169 
1170 static void
1171 umass_t_bbb_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1172 {
1173 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1174 	struct usb_device_request req;
1175 	struct usb_page_cache *pc;
1176 
1177 	switch (USB_GET_STATE(xfer)) {
1178 	case USB_ST_TRANSFERRED:
1179 		umass_transfer_start(sc, UMASS_T_BBB_RESET2);
1180 		return;
1181 
1182 	case USB_ST_SETUP:
1183 		/*
1184 		 * Reset recovery (5.3.4 in Universal Serial Bus Mass Storage Class)
1185 		 *
1186 		 * For Reset Recovery the host shall issue in the following order:
1187 		 * a) a Bulk-Only Mass Storage Reset
1188 		 * b) a Clear Feature HALT to the Bulk-In endpoint
1189 		 * c) a Clear Feature HALT to the Bulk-Out endpoint
1190 		 *
1191 		 * This is done in 3 steps, using 3 transfers:
1192 		 * UMASS_T_BBB_RESET1
1193 		 * UMASS_T_BBB_RESET2
1194 		 * UMASS_T_BBB_RESET3
1195 		 */
1196 
1197 		DPRINTF(sc, UDMASS_BBB, "BBB reset!\n");
1198 
1199 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1200 		req.bRequest = UR_BBB_RESET;	/* bulk only reset */
1201 		USETW(req.wValue, 0);
1202 		req.wIndex[0] = sc->sc_iface_no;
1203 		req.wIndex[1] = 0;
1204 		USETW(req.wLength, 0);
1205 
1206 		pc = usbd_xfer_get_frame(xfer, 0);
1207 		usbd_copy_in(pc, 0, &req, sizeof(req));
1208 
1209 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1210 		usbd_xfer_set_frames(xfer, 1);
1211 		usbd_transfer_submit(xfer);
1212 		return;
1213 
1214 	default:			/* Error */
1215 		umass_tr_error(xfer, error);
1216 		return;
1217 	}
1218 }
1219 
1220 static void
1221 umass_t_bbb_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1222 {
1223 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_RESET3,
1224 	    UMASS_T_BBB_DATA_READ, error);
1225 }
1226 
1227 static void
1228 umass_t_bbb_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1229 {
1230 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_COMMAND,
1231 	    UMASS_T_BBB_DATA_WRITE, error);
1232 }
1233 
1234 static void
1235 umass_t_bbb_data_clear_stall_callback(struct usb_xfer *xfer,
1236     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1237 {
1238 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1239 
1240 	switch (USB_GET_STATE(xfer)) {
1241 	case USB_ST_TRANSFERRED:
1242 tr_transferred:
1243 		umass_transfer_start(sc, next_xfer);
1244 		return;
1245 
1246 	case USB_ST_SETUP:
1247 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1248 			goto tr_transferred;
1249 		}
1250 		return;
1251 
1252 	default:			/* Error */
1253 		umass_tr_error(xfer, error);
1254 		return;
1255 	}
1256 }
1257 
1258 static void
1259 umass_t_bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
1260 {
1261 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1262 	union ccb *ccb = sc->sc_transfer.ccb;
1263 	struct usb_page_cache *pc;
1264 	uint32_t tag;
1265 
1266 	switch (USB_GET_STATE(xfer)) {
1267 	case USB_ST_TRANSFERRED:
1268 		umass_transfer_start
1269 		    (sc, ((sc->sc_transfer.dir == DIR_IN) ? UMASS_T_BBB_DATA_READ :
1270 		    (sc->sc_transfer.dir == DIR_OUT) ? UMASS_T_BBB_DATA_WRITE :
1271 		    UMASS_T_BBB_STATUS));
1272 		return;
1273 
1274 	case USB_ST_SETUP:
1275 
1276 		sc->sc_status_try = 0;
1277 
1278 		if (ccb) {
1279 			/*
1280 		         * the initial value is not important,
1281 		         * as long as the values are unique:
1282 		         */
1283 			tag = UGETDW(sc->cbw.dCBWTag) + 1;
1284 
1285 			USETDW(sc->cbw.dCBWSignature, CBWSIGNATURE);
1286 			USETDW(sc->cbw.dCBWTag, tag);
1287 
1288 			/*
1289 		         * dCBWDataTransferLength:
1290 		         *   This field indicates the number of bytes of data that the host
1291 		         *   intends to transfer on the IN or OUT Bulk endpoint(as indicated by
1292 		         *   the Direction bit) during the execution of this command. If this
1293 		         *   field is set to 0, the device will expect that no data will be
1294 		         *   transferred IN or OUT during this command, regardless of the value
1295 		         *   of the Direction bit defined in dCBWFlags.
1296 		         */
1297 			USETDW(sc->cbw.dCBWDataTransferLength, sc->sc_transfer.data_len);
1298 
1299 			/*
1300 		         * dCBWFlags:
1301 		         *   The bits of the Flags field are defined as follows:
1302 		         *     Bits 0-6  reserved
1303 		         *     Bit  7    Direction - this bit shall be ignored if the
1304 		         *                           dCBWDataTransferLength field is zero.
1305 		         *               0 = data Out from host to device
1306 		         *               1 = data In from device to host
1307 		         */
1308 			sc->cbw.bCBWFlags = ((sc->sc_transfer.dir == DIR_IN) ?
1309 			    CBWFLAGS_IN : CBWFLAGS_OUT);
1310 			sc->cbw.bCBWLUN = sc->sc_transfer.lun;
1311 
1312 			if (sc->sc_transfer.cmd_len > sizeof(sc->cbw.CBWCDB)) {
1313 				sc->sc_transfer.cmd_len = sizeof(sc->cbw.CBWCDB);
1314 				DPRINTF(sc, UDMASS_BBB, "Truncating long command!\n");
1315 			}
1316 			sc->cbw.bCDBLength = sc->sc_transfer.cmd_len;
1317 
1318 			/* copy SCSI command data */
1319 			memcpy(sc->cbw.CBWCDB, sc->sc_transfer.cmd_data,
1320 			    sc->sc_transfer.cmd_len);
1321 
1322 			/* clear remaining command area */
1323 			memset(sc->cbw.CBWCDB +
1324 			    sc->sc_transfer.cmd_len, 0,
1325 			    sizeof(sc->cbw.CBWCDB) -
1326 			    sc->sc_transfer.cmd_len);
1327 
1328 			DIF(UDMASS_BBB, umass_bbb_dump_cbw(sc, &sc->cbw));
1329 
1330 			pc = usbd_xfer_get_frame(xfer, 0);
1331 			usbd_copy_in(pc, 0, &sc->cbw, sizeof(sc->cbw));
1332 			usbd_xfer_set_frame_len(xfer, 0, sizeof(sc->cbw));
1333 
1334 			usbd_transfer_submit(xfer);
1335 		}
1336 		return;
1337 
1338 	default:			/* Error */
1339 		umass_tr_error(xfer, error);
1340 		return;
1341 	}
1342 }
1343 
1344 static void
1345 umass_t_bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1346 {
1347 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1348 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1349 	int actlen, sumlen;
1350 
1351 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1352 
1353 	switch (USB_GET_STATE(xfer)) {
1354 	case USB_ST_TRANSFERRED:
1355 		sc->sc_transfer.data_rem -= actlen;
1356 		sc->sc_transfer.data_ptr += actlen;
1357 		sc->sc_transfer.actlen += actlen;
1358 
1359 		if (actlen < sumlen) {
1360 			/* short transfer */
1361 			sc->sc_transfer.data_rem = 0;
1362 		}
1363 	case USB_ST_SETUP:
1364 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1365 		    max_bulk, sc->sc_transfer.data_rem);
1366 
1367 		if (sc->sc_transfer.data_rem == 0) {
1368 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1369 			return;
1370 		}
1371 		if (max_bulk > sc->sc_transfer.data_rem) {
1372 			max_bulk = sc->sc_transfer.data_rem;
1373 		}
1374 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1375 
1376 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1377 		    max_bulk);
1378 
1379 		usbd_transfer_submit(xfer);
1380 		return;
1381 
1382 	default:			/* Error */
1383 		if (error == USB_ERR_CANCELLED) {
1384 			umass_tr_error(xfer, error);
1385 		} else {
1386 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1387 		}
1388 		return;
1389 	}
1390 }
1391 
1392 static void
1393 umass_t_bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1394 {
1395 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1396 	    UMASS_T_BBB_DATA_READ, error);
1397 }
1398 
1399 static void
1400 umass_t_bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1401 {
1402 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1403 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1404 	int actlen, sumlen;
1405 
1406 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1407 
1408 	switch (USB_GET_STATE(xfer)) {
1409 	case USB_ST_TRANSFERRED:
1410 		sc->sc_transfer.data_rem -= actlen;
1411 		sc->sc_transfer.data_ptr += actlen;
1412 		sc->sc_transfer.actlen += actlen;
1413 
1414 		if (actlen < sumlen) {
1415 			/* short transfer */
1416 			sc->sc_transfer.data_rem = 0;
1417 		}
1418 	case USB_ST_SETUP:
1419 		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1420 		    max_bulk, sc->sc_transfer.data_rem);
1421 
1422 		if (sc->sc_transfer.data_rem == 0) {
1423 			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1424 			return;
1425 		}
1426 		if (max_bulk > sc->sc_transfer.data_rem) {
1427 			max_bulk = sc->sc_transfer.data_rem;
1428 		}
1429 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1430 
1431 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1432 		    max_bulk);
1433 
1434 		usbd_transfer_submit(xfer);
1435 		return;
1436 
1437 	default:			/* Error */
1438 		if (error == USB_ERR_CANCELLED) {
1439 			umass_tr_error(xfer, error);
1440 		} else {
1441 			umass_transfer_start(sc, UMASS_T_BBB_DATA_WR_CS);
1442 		}
1443 		return;
1444 	}
1445 }
1446 
1447 static void
1448 umass_t_bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1449 {
1450 	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1451 	    UMASS_T_BBB_DATA_WRITE, error);
1452 }
1453 
1454 static void
1455 umass_t_bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
1456 {
1457 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1458 	union ccb *ccb = sc->sc_transfer.ccb;
1459 	struct usb_page_cache *pc;
1460 	uint32_t residue;
1461 	int actlen;
1462 
1463 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1464 
1465 	switch (USB_GET_STATE(xfer)) {
1466 	case USB_ST_TRANSFERRED:
1467 
1468 		/*
1469 		 * Do a full reset if there is something wrong with the CSW:
1470 		 */
1471 		sc->sc_status_try = 1;
1472 
1473 		/* Zero missing parts of the CSW: */
1474 
1475 		if (actlen < (int)sizeof(sc->csw))
1476 			memset(&sc->csw, 0, sizeof(sc->csw));
1477 
1478 		pc = usbd_xfer_get_frame(xfer, 0);
1479 		usbd_copy_out(pc, 0, &sc->csw, actlen);
1480 
1481 		DIF(UDMASS_BBB, umass_bbb_dump_csw(sc, &sc->csw));
1482 
1483 		residue = UGETDW(sc->csw.dCSWDataResidue);
1484 
1485 		if ((!residue) || (sc->sc_quirks & IGNORE_RESIDUE)) {
1486 			residue = (sc->sc_transfer.data_len -
1487 			    sc->sc_transfer.actlen);
1488 		}
1489 		if (residue > sc->sc_transfer.data_len) {
1490 			DPRINTF(sc, UDMASS_BBB, "truncating residue from %d "
1491 			    "to %d bytes\n", residue, sc->sc_transfer.data_len);
1492 			residue = sc->sc_transfer.data_len;
1493 		}
1494 		/* translate weird command-status signatures: */
1495 		if (sc->sc_quirks & WRONG_CSWSIG) {
1496 			uint32_t temp = UGETDW(sc->csw.dCSWSignature);
1497 
1498 			if ((temp == CSWSIGNATURE_OLYMPUS_C1) ||
1499 			    (temp == CSWSIGNATURE_IMAGINATION_DBX1)) {
1500 				USETDW(sc->csw.dCSWSignature, CSWSIGNATURE);
1501 			}
1502 		}
1503 		/* check CSW and handle eventual error */
1504 		if (UGETDW(sc->csw.dCSWSignature) != CSWSIGNATURE) {
1505 			DPRINTF(sc, UDMASS_BBB, "bad CSW signature 0x%08x != 0x%08x\n",
1506 			    UGETDW(sc->csw.dCSWSignature), CSWSIGNATURE);
1507 			/*
1508 			 * Invalid CSW: Wrong signature or wrong tag might
1509 			 * indicate that we lost synchronization. Reset the
1510 			 * device.
1511 			 */
1512 			goto tr_error;
1513 		} else if (UGETDW(sc->csw.dCSWTag) != UGETDW(sc->cbw.dCBWTag)) {
1514 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: tag 0x%08x should be "
1515 			    "0x%08x\n", UGETDW(sc->csw.dCSWTag),
1516 			    UGETDW(sc->cbw.dCBWTag));
1517 			goto tr_error;
1518 		} else if (sc->csw.bCSWStatus > CSWSTATUS_PHASE) {
1519 			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: status %d > %d\n",
1520 			    sc->csw.bCSWStatus, CSWSTATUS_PHASE);
1521 			goto tr_error;
1522 		} else if (sc->csw.bCSWStatus == CSWSTATUS_PHASE) {
1523 			DPRINTF(sc, UDMASS_BBB, "Phase error, residue = "
1524 			    "%d\n", residue);
1525 			goto tr_error;
1526 		} else if (sc->sc_transfer.actlen > sc->sc_transfer.data_len) {
1527 			DPRINTF(sc, UDMASS_BBB, "Buffer overrun %d > %d\n",
1528 			    sc->sc_transfer.actlen, sc->sc_transfer.data_len);
1529 			goto tr_error;
1530 		} else if (sc->csw.bCSWStatus == CSWSTATUS_FAILED) {
1531 			DPRINTF(sc, UDMASS_BBB, "Command failed, residue = "
1532 			    "%d\n", residue);
1533 
1534 			sc->sc_transfer.ccb = NULL;
1535 
1536 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1537 
1538 			(sc->sc_transfer.callback)
1539 			    (sc, ccb, residue, STATUS_CMD_FAILED);
1540 		} else {
1541 			sc->sc_transfer.ccb = NULL;
1542 
1543 			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1544 
1545 			(sc->sc_transfer.callback)
1546 			    (sc, ccb, residue, STATUS_CMD_OK);
1547 		}
1548 		return;
1549 
1550 	case USB_ST_SETUP:
1551 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1552 		usbd_transfer_submit(xfer);
1553 		return;
1554 
1555 	default:
1556 tr_error:
1557 		DPRINTF(sc, UDMASS_BBB, "Failed to read CSW: %s, try %d\n",
1558 		    usbd_errstr(error), sc->sc_status_try);
1559 
1560 		if ((error == USB_ERR_CANCELLED) ||
1561 		    (sc->sc_status_try)) {
1562 			umass_tr_error(xfer, error);
1563 		} else {
1564 			sc->sc_status_try = 1;
1565 			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1566 		}
1567 		return;
1568 	}
1569 }
1570 
1571 static void
1572 umass_command_start(struct umass_softc *sc, uint8_t dir,
1573     void *data_ptr, uint32_t data_len,
1574     uint32_t data_timeout, umass_callback_t *callback,
1575     union ccb *ccb)
1576 {
1577 	sc->sc_transfer.lun = ccb->ccb_h.target_lun;
1578 
1579 	/*
1580 	 * NOTE: assumes that "sc->sc_transfer.cmd_data" and
1581 	 * "sc->sc_transfer.cmd_len" has been properly
1582 	 * initialized.
1583 	 */
1584 
1585 	sc->sc_transfer.dir = data_len ? dir : DIR_NONE;
1586 	sc->sc_transfer.data_ptr = data_ptr;
1587 	sc->sc_transfer.data_len = data_len;
1588 	sc->sc_transfer.data_rem = data_len;
1589 	sc->sc_transfer.data_timeout = (data_timeout + UMASS_TIMEOUT);
1590 
1591 	sc->sc_transfer.actlen = 0;
1592 	sc->sc_transfer.callback = callback;
1593 	sc->sc_transfer.ccb = ccb;
1594 
1595 	if (sc->sc_xfer[sc->sc_last_xfer_index]) {
1596 		usbd_transfer_start(sc->sc_xfer[sc->sc_last_xfer_index]);
1597 	} else {
1598 		umass_cancel_ccb(sc);
1599 	}
1600 }
1601 
1602 static uint8_t
1603 umass_bbb_get_max_lun(struct umass_softc *sc)
1604 {
1605 	struct usb_device_request req;
1606 	usb_error_t err;
1607 	uint8_t buf = 0;
1608 
1609 	/* The Get Max Lun command is a class-specific request. */
1610 	req.bmRequestType = UT_READ_CLASS_INTERFACE;
1611 	req.bRequest = UR_BBB_GET_MAX_LUN;
1612 	USETW(req.wValue, 0);
1613 	req.wIndex[0] = sc->sc_iface_no;
1614 	req.wIndex[1] = 0;
1615 	USETW(req.wLength, 1);
1616 
1617 	err = usbd_do_request(sc->sc_udev, NULL, &req, &buf);
1618 	if (err) {
1619 		buf = 0;
1620 
1621 		/* Device doesn't support Get Max Lun request. */
1622 		printf("%s: Get Max Lun not supported (%s)\n",
1623 		    sc->sc_name, usbd_errstr(err));
1624 	}
1625 	return (buf);
1626 }
1627 
1628 /*
1629  * Command/Bulk/Interrupt (CBI) specific functions
1630  */
1631 
1632 static void
1633 umass_cbi_start_status(struct umass_softc *sc)
1634 {
1635 	if (sc->sc_xfer[UMASS_T_CBI_STATUS]) {
1636 		umass_transfer_start(sc, UMASS_T_CBI_STATUS);
1637 	} else {
1638 		union ccb *ccb = sc->sc_transfer.ccb;
1639 
1640 		sc->sc_transfer.ccb = NULL;
1641 
1642 		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1643 
1644 		(sc->sc_transfer.callback)
1645 		    (sc, ccb, (sc->sc_transfer.data_len -
1646 		    sc->sc_transfer.actlen), STATUS_CMD_UNKNOWN);
1647 	}
1648 }
1649 
1650 static void
1651 umass_t_cbi_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1652 {
1653 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1654 	struct usb_device_request req;
1655 	struct usb_page_cache *pc;
1656 	uint8_t buf[UMASS_CBI_DIAGNOSTIC_CMDLEN];
1657 
1658 	uint8_t i;
1659 
1660 	switch (USB_GET_STATE(xfer)) {
1661 	case USB_ST_TRANSFERRED:
1662 		umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1663 		break;
1664 
1665 	case USB_ST_SETUP:
1666 		/*
1667 		 * Command Block Reset Protocol
1668 		 *
1669 		 * First send a reset request to the device. Then clear
1670 		 * any possibly stalled bulk endpoints.
1671 		 *
1672 		 * This is done in 3 steps, using 3 transfers:
1673 		 * UMASS_T_CBI_RESET1
1674 		 * UMASS_T_CBI_RESET2
1675 		 * UMASS_T_CBI_RESET3
1676 		 * UMASS_T_CBI_RESET4 (only if there is an interrupt endpoint)
1677 		 */
1678 
1679 		DPRINTF(sc, UDMASS_CBI, "CBI reset!\n");
1680 
1681 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1682 		req.bRequest = UR_CBI_ADSC;
1683 		USETW(req.wValue, 0);
1684 		req.wIndex[0] = sc->sc_iface_no;
1685 		req.wIndex[1] = 0;
1686 		USETW(req.wLength, UMASS_CBI_DIAGNOSTIC_CMDLEN);
1687 
1688 		/*
1689 		 * The 0x1d code is the SEND DIAGNOSTIC command. To
1690 		 * distinguish between the two, the last 10 bytes of the CBL
1691 		 * is filled with 0xff (section 2.2 of the CBI
1692 		 * specification)
1693 		 */
1694 		buf[0] = 0x1d;		/* Command Block Reset */
1695 		buf[1] = 0x04;
1696 
1697 		for (i = 2; i < UMASS_CBI_DIAGNOSTIC_CMDLEN; i++) {
1698 			buf[i] = 0xff;
1699 		}
1700 
1701 		pc = usbd_xfer_get_frame(xfer, 0);
1702 		usbd_copy_in(pc, 0, &req, sizeof(req));
1703 		pc = usbd_xfer_get_frame(xfer, 1);
1704 		usbd_copy_in(pc, 0, buf, sizeof(buf));
1705 
1706 		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1707 		usbd_xfer_set_frame_len(xfer, 1, sizeof(buf));
1708 		usbd_xfer_set_frames(xfer, 2);
1709 		usbd_transfer_submit(xfer);
1710 		break;
1711 
1712 	default:			/* Error */
1713 		if (error == USB_ERR_CANCELLED)
1714 			umass_tr_error(xfer, error);
1715 		else
1716 			umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1717 		break;
1718 	}
1719 }
1720 
1721 static void
1722 umass_t_cbi_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1723 {
1724 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_RESET3,
1725 	    UMASS_T_CBI_DATA_READ, error);
1726 }
1727 
1728 static void
1729 umass_t_cbi_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1730 {
1731 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1732 
1733 	umass_t_cbi_data_clear_stall_callback
1734 	    (xfer, (sc->sc_xfer[UMASS_T_CBI_RESET4] &&
1735 	    sc->sc_xfer[UMASS_T_CBI_STATUS]) ?
1736 	    UMASS_T_CBI_RESET4 : UMASS_T_CBI_COMMAND,
1737 	    UMASS_T_CBI_DATA_WRITE, error);
1738 }
1739 
1740 static void
1741 umass_t_cbi_reset4_callback(struct usb_xfer *xfer, usb_error_t error)
1742 {
1743 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_COMMAND,
1744 	    UMASS_T_CBI_STATUS, error);
1745 }
1746 
1747 static void
1748 umass_t_cbi_data_clear_stall_callback(struct usb_xfer *xfer,
1749     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1750 {
1751 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1752 
1753 	switch (USB_GET_STATE(xfer)) {
1754 	case USB_ST_TRANSFERRED:
1755 tr_transferred:
1756 		if (next_xfer == UMASS_T_CBI_STATUS) {
1757 			umass_cbi_start_status(sc);
1758 		} else {
1759 			umass_transfer_start(sc, next_xfer);
1760 		}
1761 		break;
1762 
1763 	case USB_ST_SETUP:
1764 		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1765 			goto tr_transferred;	/* should not happen */
1766 		}
1767 		break;
1768 
1769 	default:			/* Error */
1770 		umass_tr_error(xfer, error);
1771 		break;
1772 	}
1773 }
1774 
1775 static void
1776 umass_t_cbi_command_callback(struct usb_xfer *xfer, usb_error_t error)
1777 {
1778 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1779 	union ccb *ccb = sc->sc_transfer.ccb;
1780 	struct usb_device_request req;
1781 	struct usb_page_cache *pc;
1782 
1783 	switch (USB_GET_STATE(xfer)) {
1784 	case USB_ST_TRANSFERRED:
1785 
1786 		if (sc->sc_transfer.dir == DIR_NONE) {
1787 			umass_cbi_start_status(sc);
1788 		} else {
1789 			umass_transfer_start
1790 			    (sc, (sc->sc_transfer.dir == DIR_IN) ?
1791 			    UMASS_T_CBI_DATA_READ : UMASS_T_CBI_DATA_WRITE);
1792 		}
1793 		break;
1794 
1795 	case USB_ST_SETUP:
1796 
1797 		if (ccb) {
1798 			/*
1799 		         * do a CBI transfer with cmd_len bytes from
1800 		         * cmd_data, possibly a data phase of data_len
1801 		         * bytes from/to the device and finally a status
1802 		         * read phase.
1803 		         */
1804 
1805 			req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1806 			req.bRequest = UR_CBI_ADSC;
1807 			USETW(req.wValue, 0);
1808 			req.wIndex[0] = sc->sc_iface_no;
1809 			req.wIndex[1] = 0;
1810 			req.wLength[0] = sc->sc_transfer.cmd_len;
1811 			req.wLength[1] = 0;
1812 
1813 			pc = usbd_xfer_get_frame(xfer, 0);
1814 			usbd_copy_in(pc, 0, &req, sizeof(req));
1815 			pc = usbd_xfer_get_frame(xfer, 1);
1816 			usbd_copy_in(pc, 0, sc->sc_transfer.cmd_data,
1817 			    sc->sc_transfer.cmd_len);
1818 
1819 			usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1820 			usbd_xfer_set_frame_len(xfer, 1, sc->sc_transfer.cmd_len);
1821 			usbd_xfer_set_frames(xfer,
1822 			    sc->sc_transfer.cmd_len ? 2 : 1);
1823 
1824 			DIF(UDMASS_CBI,
1825 			    umass_cbi_dump_cmd(sc,
1826 			    sc->sc_transfer.cmd_data,
1827 			    sc->sc_transfer.cmd_len));
1828 
1829 			usbd_transfer_submit(xfer);
1830 		}
1831 		break;
1832 
1833 	default:			/* Error */
1834 		/*
1835 		 * STALL on the control pipe can be result of the command error.
1836 		 * Attempt to clear this STALL same as for bulk pipe also
1837 		 * results in command completion interrupt, but ASC/ASCQ there
1838 		 * look like not always valid, so don't bother about it.
1839 		 */
1840 		if ((error == USB_ERR_STALLED) ||
1841 		    (sc->sc_transfer.callback == &umass_cam_cb)) {
1842 			sc->sc_transfer.ccb = NULL;
1843 			(sc->sc_transfer.callback)
1844 			    (sc, ccb, sc->sc_transfer.data_len,
1845 			    STATUS_CMD_UNKNOWN);
1846 		} else {
1847 			umass_tr_error(xfer, error);
1848 			/* skip reset */
1849 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1850 		}
1851 		break;
1852 	}
1853 }
1854 
1855 static void
1856 umass_t_cbi_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1857 {
1858 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1859 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1860 	int actlen, sumlen;
1861 
1862 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1863 
1864 	switch (USB_GET_STATE(xfer)) {
1865 	case USB_ST_TRANSFERRED:
1866 		sc->sc_transfer.data_rem -= actlen;
1867 		sc->sc_transfer.data_ptr += actlen;
1868 		sc->sc_transfer.actlen += actlen;
1869 
1870 		if (actlen < sumlen) {
1871 			/* short transfer */
1872 			sc->sc_transfer.data_rem = 0;
1873 		}
1874 	case USB_ST_SETUP:
1875 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1876 		    max_bulk, sc->sc_transfer.data_rem);
1877 
1878 		if (sc->sc_transfer.data_rem == 0) {
1879 			umass_cbi_start_status(sc);
1880 			break;
1881 		}
1882 		if (max_bulk > sc->sc_transfer.data_rem) {
1883 			max_bulk = sc->sc_transfer.data_rem;
1884 		}
1885 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1886 
1887 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1888 		    max_bulk);
1889 
1890 		usbd_transfer_submit(xfer);
1891 		break;
1892 
1893 	default:			/* Error */
1894 		if ((error == USB_ERR_CANCELLED) ||
1895 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1896 			umass_tr_error(xfer, error);
1897 		} else {
1898 			umass_transfer_start(sc, UMASS_T_CBI_DATA_RD_CS);
1899 		}
1900 		break;
1901 	}
1902 }
1903 
1904 static void
1905 umass_t_cbi_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1906 {
1907 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1908 	    UMASS_T_CBI_DATA_READ, error);
1909 }
1910 
1911 static void
1912 umass_t_cbi_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1913 {
1914 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1915 	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1916 	int actlen, sumlen;
1917 
1918 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1919 
1920 	switch (USB_GET_STATE(xfer)) {
1921 	case USB_ST_TRANSFERRED:
1922 		sc->sc_transfer.data_rem -= actlen;
1923 		sc->sc_transfer.data_ptr += actlen;
1924 		sc->sc_transfer.actlen += actlen;
1925 
1926 		if (actlen < sumlen) {
1927 			/* short transfer */
1928 			sc->sc_transfer.data_rem = 0;
1929 		}
1930 	case USB_ST_SETUP:
1931 		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1932 		    max_bulk, sc->sc_transfer.data_rem);
1933 
1934 		if (sc->sc_transfer.data_rem == 0) {
1935 			umass_cbi_start_status(sc);
1936 			break;
1937 		}
1938 		if (max_bulk > sc->sc_transfer.data_rem) {
1939 			max_bulk = sc->sc_transfer.data_rem;
1940 		}
1941 		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1942 
1943 		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1944 		    max_bulk);
1945 
1946 		usbd_transfer_submit(xfer);
1947 		break;
1948 
1949 	default:			/* Error */
1950 		if ((error == USB_ERR_CANCELLED) ||
1951 		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1952 			umass_tr_error(xfer, error);
1953 		} else {
1954 			umass_transfer_start(sc, UMASS_T_CBI_DATA_WR_CS);
1955 		}
1956 		break;
1957 	}
1958 }
1959 
1960 static void
1961 umass_t_cbi_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1962 {
1963 	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1964 	    UMASS_T_CBI_DATA_WRITE, error);
1965 }
1966 
1967 static void
1968 umass_t_cbi_status_callback(struct usb_xfer *xfer, usb_error_t error)
1969 {
1970 	struct umass_softc *sc = usbd_xfer_softc(xfer);
1971 	union ccb *ccb = sc->sc_transfer.ccb;
1972 	struct usb_page_cache *pc;
1973 	uint32_t residue;
1974 	uint8_t status;
1975 	int actlen;
1976 
1977 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1978 
1979 	switch (USB_GET_STATE(xfer)) {
1980 	case USB_ST_TRANSFERRED:
1981 
1982 		if (actlen < (int)sizeof(sc->sbl)) {
1983 			goto tr_setup;
1984 		}
1985 		pc = usbd_xfer_get_frame(xfer, 0);
1986 		usbd_copy_out(pc, 0, &sc->sbl, sizeof(sc->sbl));
1987 
1988 		residue = (sc->sc_transfer.data_len -
1989 		    sc->sc_transfer.actlen);
1990 
1991 		/* dissect the information in the buffer */
1992 
1993 		if (sc->sc_proto & UMASS_PROTO_UFI) {
1994 			/*
1995 			 * Section 3.4.3.1.3 specifies that the UFI command
1996 			 * protocol returns an ASC and ASCQ in the interrupt
1997 			 * data block.
1998 			 */
1999 
2000 			DPRINTF(sc, UDMASS_CBI, "UFI CCI, ASC = 0x%02x, "
2001 			    "ASCQ = 0x%02x\n", sc->sbl.ufi.asc,
2002 			    sc->sbl.ufi.ascq);
2003 
2004 			status = (((sc->sbl.ufi.asc == 0) &&
2005 			    (sc->sbl.ufi.ascq == 0)) ?
2006 			    STATUS_CMD_OK : STATUS_CMD_FAILED);
2007 
2008 			sc->sc_transfer.ccb = NULL;
2009 
2010 			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2011 
2012 			(sc->sc_transfer.callback)
2013 			    (sc, ccb, residue, status);
2014 
2015 			break;
2016 
2017 		} else {
2018 			/* Command Interrupt Data Block */
2019 
2020 			DPRINTF(sc, UDMASS_CBI, "type=0x%02x, value=0x%02x\n",
2021 			    sc->sbl.common.type, sc->sbl.common.value);
2022 
2023 			if (sc->sbl.common.type == IDB_TYPE_CCI) {
2024 				status = (sc->sbl.common.value & IDB_VALUE_STATUS_MASK);
2025 
2026 				status = ((status == IDB_VALUE_PASS) ? STATUS_CMD_OK :
2027 				    (status == IDB_VALUE_FAIL) ? STATUS_CMD_FAILED :
2028 				    (status == IDB_VALUE_PERSISTENT) ? STATUS_CMD_FAILED :
2029 				    STATUS_WIRE_FAILED);
2030 
2031 				sc->sc_transfer.ccb = NULL;
2032 
2033 				sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2034 
2035 				(sc->sc_transfer.callback)
2036 				    (sc, ccb, residue, status);
2037 
2038 				break;
2039 			}
2040 		}
2041 
2042 		/* fallthrough */
2043 
2044 	case USB_ST_SETUP:
2045 tr_setup:
2046 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2047 		usbd_transfer_submit(xfer);
2048 		break;
2049 
2050 	default:			/* Error */
2051 		DPRINTF(sc, UDMASS_CBI, "Failed to read CSW: %s\n",
2052 		    usbd_errstr(error));
2053 		umass_tr_error(xfer, error);
2054 		break;
2055 	}
2056 }
2057 
2058 /*
2059  * CAM specific functions (used by SCSI, UFI, 8070i (ATAPI))
2060  */
2061 
2062 static int
2063 umass_cam_attach_sim(struct umass_softc *sc)
2064 {
2065 	struct cam_devq *devq;		/* Per device Queue */
2066 	cam_status status;
2067 
2068 	/*
2069 	 * A HBA is attached to the CAM layer.
2070 	 *
2071 	 * The CAM layer will then after a while start probing for devices on
2072 	 * the bus. The number of SIMs is limited to one.
2073 	 */
2074 
2075 	devq = cam_simq_alloc(1 /* maximum openings */ );
2076 	if (devq == NULL) {
2077 		return (ENOMEM);
2078 	}
2079 	sc->sc_sim = cam_sim_alloc
2080 	    (&umass_cam_action, &umass_cam_poll,
2081 	    DEVNAME_SIM,
2082 	    sc /* priv */ ,
2083 	    sc->sc_unit /* unit number */ ,
2084 	    &sc->sc_mtx /* mutex */ ,
2085 	    1 /* maximum device openings */ ,
2086 	    0 /* maximum tagged device openings */ ,
2087 	    devq);
2088 
2089 	if (sc->sc_sim == NULL) {
2090 		cam_simq_free(devq);
2091 		return (ENOMEM);
2092 	}
2093 
2094 	mtx_lock(&sc->sc_mtx);
2095 	status = xpt_bus_register(sc->sc_sim, sc->sc_dev, sc->sc_unit);
2096 	if (status != CAM_SUCCESS) {
2097 		cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2098 		mtx_unlock(&sc->sc_mtx);
2099 		printf("%s: xpt_bus_register failed with status %#x\n",
2100 		    __func__, status);
2101 		return (ENOMEM);
2102 	}
2103 	mtx_unlock(&sc->sc_mtx);
2104 
2105 	return (0);
2106 }
2107 
2108 static void
2109 umass_cam_attach(struct umass_softc *sc)
2110 {
2111 #ifndef USB_DEBUG
2112 	if (bootverbose)
2113 #endif
2114 		printf("%s:%d:%d: Attached to scbus%d\n",
2115 		    sc->sc_name, cam_sim_path(sc->sc_sim),
2116 		    sc->sc_unit, cam_sim_path(sc->sc_sim));
2117 }
2118 
2119 /* umass_cam_detach
2120  *	detach from the CAM layer
2121  */
2122 
2123 static void
2124 umass_cam_detach_sim(struct umass_softc *sc)
2125 {
2126 	int error;
2127 
2128 	if (sc->sc_sim != NULL) {
2129 		error = xpt_bus_deregister(cam_sim_path(sc->sc_sim));
2130 		if (error == 0) {
2131 			/* accessing the softc is not possible after this */
2132 			sc->sc_sim->softc = NULL;
2133 			DPRINTF(sc, UDMASS_SCSI, "%s: %s:%d:%d caling "
2134 			    "cam_sim_free sim %p refc %u mtx %p\n",
2135 			    __func__, sc->sc_name, cam_sim_path(sc->sc_sim),
2136 			    sc->sc_unit, sc->sc_sim,
2137 			    sc->sc_sim->refcount, sc->sc_sim->mtx);
2138 			cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2139 		} else {
2140 			panic("%s: %s: CAM layer is busy: errno %d\n",
2141 			    __func__, sc->sc_name, error);
2142 		}
2143 		sc->sc_sim = NULL;
2144 	}
2145 }
2146 
2147 /* umass_cam_action
2148  * 	CAM requests for action come through here
2149  */
2150 
2151 static void
2152 umass_cam_action(struct cam_sim *sim, union ccb *ccb)
2153 {
2154 	struct umass_softc *sc = cam_sim_softc(sim);
2155 
2156 	if (sc == NULL) {
2157 		ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2158 		xpt_done(ccb);
2159 		return;
2160 	}
2161 
2162 	/* Perform the requested action */
2163 	switch (ccb->ccb_h.func_code) {
2164 	case XPT_SCSI_IO:
2165 		{
2166 			uint8_t *cmd;
2167 			uint8_t dir;
2168 
2169 			if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2170 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2171 			} else {
2172 				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2173 			}
2174 
2175 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_SCSI_IO: "
2176 			    "cmd: 0x%02x, flags: 0x%02x, "
2177 			    "%db cmd/%db data/%db sense\n",
2178 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2179 			    (uintmax_t)ccb->ccb_h.target_lun, cmd[0],
2180 			    ccb->ccb_h.flags & CAM_DIR_MASK, ccb->csio.cdb_len,
2181 			    ccb->csio.dxfer_len, ccb->csio.sense_len);
2182 
2183 			if (sc->sc_transfer.ccb) {
2184 				DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_SCSI_IO: "
2185 				    "I/O in progress, deferring\n",
2186 				    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2187 				    (uintmax_t)ccb->ccb_h.target_lun);
2188 				ccb->ccb_h.status = CAM_SCSI_BUSY;
2189 				xpt_done(ccb);
2190 				goto done;
2191 			}
2192 			switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
2193 			case CAM_DIR_IN:
2194 				dir = DIR_IN;
2195 				break;
2196 			case CAM_DIR_OUT:
2197 				dir = DIR_OUT;
2198 				DIF(UDMASS_SCSI,
2199 				    umass_dump_buffer(sc, ccb->csio.data_ptr,
2200 				    ccb->csio.dxfer_len, 48));
2201 				break;
2202 			default:
2203 				dir = DIR_NONE;
2204 			}
2205 
2206 			ccb->ccb_h.status = CAM_REQ_INPROG | CAM_SIM_QUEUED;
2207 
2208 			/*
2209 			 * sc->sc_transform will convert the command to the
2210 			 * command format needed by the specific command set
2211 			 * and return the converted command in
2212 			 * "sc->sc_transfer.cmd_data"
2213 			 */
2214 			if (umass_std_transform(sc, ccb, cmd, ccb->csio.cdb_len)) {
2215 				if (sc->sc_transfer.cmd_data[0] == INQUIRY) {
2216 					const char *pserial;
2217 
2218 					pserial = usb_get_serial(sc->sc_udev);
2219 
2220 					/*
2221 					 * Umass devices don't generally report their serial numbers
2222 					 * in the usual SCSI way.  Emulate it here.
2223 					 */
2224 					if ((sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2225 					    (sc->sc_transfer.cmd_data[2] == SVPD_UNIT_SERIAL_NUMBER) &&
2226 					    (pserial[0] != '\0')) {
2227 						struct scsi_vpd_unit_serial_number *vpd_serial;
2228 
2229 						vpd_serial = (struct scsi_vpd_unit_serial_number *)ccb->csio.data_ptr;
2230 						vpd_serial->length = strlen(pserial);
2231 						if (vpd_serial->length > sizeof(vpd_serial->serial_num))
2232 							vpd_serial->length = sizeof(vpd_serial->serial_num);
2233 						memcpy(vpd_serial->serial_num, pserial, vpd_serial->length);
2234 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2235 						ccb->ccb_h.status = CAM_REQ_CMP;
2236 						xpt_done(ccb);
2237 						goto done;
2238 					}
2239 
2240 					/*
2241 					 * Handle EVPD inquiry for broken devices first
2242 					 * NO_INQUIRY also implies NO_INQUIRY_EVPD
2243 					 */
2244 					if ((sc->sc_quirks & (NO_INQUIRY_EVPD | NO_INQUIRY)) &&
2245 					    (sc->sc_transfer.cmd_data[1] & SI_EVPD)) {
2246 						scsi_set_sense_data(&ccb->csio.sense_data,
2247 							/*sense_format*/ SSD_TYPE_NONE,
2248 							/*current_error*/ 1,
2249 							/*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2250 							/*asc*/ 0x24,
2251 							/*ascq*/ 0x00,
2252 							/*extra args*/ SSD_ELEM_NONE);
2253 						ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2254 						ccb->ccb_h.status =
2255 						    CAM_SCSI_STATUS_ERROR |
2256 						    CAM_AUTOSNS_VALID |
2257 						    CAM_DEV_QFRZN;
2258 						xpt_freeze_devq(ccb->ccb_h.path, 1);
2259 						xpt_done(ccb);
2260 						goto done;
2261 					}
2262 					/*
2263 					 * Return fake inquiry data for
2264 					 * broken devices
2265 					 */
2266 					if (sc->sc_quirks & NO_INQUIRY) {
2267 						memcpy(ccb->csio.data_ptr, &fake_inq_data,
2268 						    sizeof(fake_inq_data));
2269 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2270 						ccb->ccb_h.status = CAM_REQ_CMP;
2271 						xpt_done(ccb);
2272 						goto done;
2273 					}
2274 					if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2275 						ccb->csio.dxfer_len = SHORT_INQUIRY_LENGTH;
2276 					}
2277 				} else if (sc->sc_transfer.cmd_data[0] == PREVENT_ALLOW) {
2278 					if (sc->sc_quirks & NO_PREVENT_ALLOW) {
2279 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2280 						ccb->ccb_h.status = CAM_REQ_CMP;
2281 						xpt_done(ccb);
2282 						goto done;
2283 					}
2284 				} else if (sc->sc_transfer.cmd_data[0] == SYNCHRONIZE_CACHE) {
2285 					if (sc->sc_quirks & NO_SYNCHRONIZE_CACHE) {
2286 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2287 						ccb->ccb_h.status = CAM_REQ_CMP;
2288 						xpt_done(ccb);
2289 						goto done;
2290 					}
2291 				} else if (sc->sc_transfer.cmd_data[0] == START_STOP_UNIT) {
2292 					if (sc->sc_quirks & NO_START_STOP) {
2293 						ccb->csio.scsi_status = SCSI_STATUS_OK;
2294 						ccb->ccb_h.status = CAM_REQ_CMP;
2295 						xpt_done(ccb);
2296 						goto done;
2297 					}
2298 				}
2299 				umass_command_start(sc, dir, ccb->csio.data_ptr,
2300 				    ccb->csio.dxfer_len,
2301 				    ccb->ccb_h.timeout,
2302 				    &umass_cam_cb, ccb);
2303 			}
2304 			break;
2305 		}
2306 	case XPT_PATH_INQ:
2307 		{
2308 			struct ccb_pathinq *cpi = &ccb->cpi;
2309 
2310 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_PATH_INQ:.\n",
2311 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2312 			    (uintmax_t)ccb->ccb_h.target_lun);
2313 
2314 			/* host specific information */
2315 			cpi->version_num = 1;
2316 			cpi->hba_inquiry = 0;
2317 			cpi->target_sprt = 0;
2318 			cpi->hba_misc = PIM_NO_6_BYTE;
2319 			cpi->hba_eng_cnt = 0;
2320 			cpi->max_target = UMASS_SCSIID_MAX;	/* one target */
2321 			cpi->initiator_id = UMASS_SCSIID_HOST;
2322 			strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2323 			strlcpy(cpi->hba_vid, "USB SCSI", HBA_IDLEN);
2324 			strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2325 			cpi->unit_number = cam_sim_unit(sim);
2326 			cpi->bus_id = sc->sc_unit;
2327 			cpi->protocol = PROTO_SCSI;
2328 			cpi->protocol_version = SCSI_REV_2;
2329 			cpi->transport = XPORT_USB;
2330 			cpi->transport_version = 0;
2331 
2332 			if (sc == NULL) {
2333 				cpi->base_transfer_speed = 0;
2334 				cpi->max_lun = 0;
2335 			} else {
2336 				if (sc->sc_quirks & FLOPPY_SPEED) {
2337 					cpi->base_transfer_speed =
2338 					    UMASS_FLOPPY_TRANSFER_SPEED;
2339 				} else {
2340 					switch (usbd_get_speed(sc->sc_udev)) {
2341 					case USB_SPEED_SUPER:
2342 						cpi->base_transfer_speed =
2343 						    UMASS_SUPER_TRANSFER_SPEED;
2344 						cpi->maxio = maxphys;
2345 						break;
2346 					case USB_SPEED_HIGH:
2347 						cpi->base_transfer_speed =
2348 						    UMASS_HIGH_TRANSFER_SPEED;
2349 						break;
2350 					default:
2351 						cpi->base_transfer_speed =
2352 						    UMASS_FULL_TRANSFER_SPEED;
2353 						break;
2354 					}
2355 				}
2356 				cpi->max_lun = sc->sc_maxlun;
2357 			}
2358 
2359 			cpi->ccb_h.status = CAM_REQ_CMP;
2360 			xpt_done(ccb);
2361 			break;
2362 		}
2363 	case XPT_RESET_DEV:
2364 		{
2365 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_RESET_DEV:.\n",
2366 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2367 			    (uintmax_t)ccb->ccb_h.target_lun);
2368 
2369 			umass_reset(sc);
2370 
2371 			ccb->ccb_h.status = CAM_REQ_CMP;
2372 			xpt_done(ccb);
2373 			break;
2374 		}
2375 	case XPT_GET_TRAN_SETTINGS:
2376 		{
2377 			struct ccb_trans_settings *cts = &ccb->cts;
2378 
2379 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_GET_TRAN_SETTINGS:.\n",
2380 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2381 			    (uintmax_t)ccb->ccb_h.target_lun);
2382 
2383 			cts->protocol = PROTO_SCSI;
2384 			cts->protocol_version = SCSI_REV_2;
2385 			cts->transport = XPORT_USB;
2386 			cts->transport_version = 0;
2387 			cts->xport_specific.valid = 0;
2388 
2389 			ccb->ccb_h.status = CAM_REQ_CMP;
2390 			xpt_done(ccb);
2391 			break;
2392 		}
2393 	case XPT_SET_TRAN_SETTINGS:
2394 		{
2395 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_SET_TRAN_SETTINGS:.\n",
2396 			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2397 			    (uintmax_t)ccb->ccb_h.target_lun);
2398 
2399 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2400 			xpt_done(ccb);
2401 			break;
2402 		}
2403 	case XPT_CALC_GEOMETRY:
2404 		{
2405 			cam_calc_geometry(&ccb->ccg, /* extended */ 1);
2406 			xpt_done(ccb);
2407 			break;
2408 		}
2409 	case XPT_NOOP:
2410 		{
2411 			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_NOOP:.\n",
2412 			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2413 			    (uintmax_t)ccb->ccb_h.target_lun);
2414 
2415 			ccb->ccb_h.status = CAM_REQ_CMP;
2416 			xpt_done(ccb);
2417 			break;
2418 		}
2419 	default:
2420 		DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:func_code 0x%04x: "
2421 		    "Not implemented\n",
2422 		    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2423 		    (uintmax_t)ccb->ccb_h.target_lun, ccb->ccb_h.func_code);
2424 
2425 		ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2426 		xpt_done(ccb);
2427 		break;
2428 	}
2429 
2430 done:
2431 	return;
2432 }
2433 
2434 static void
2435 umass_cam_poll(struct cam_sim *sim)
2436 {
2437 	struct umass_softc *sc = cam_sim_softc(sim);
2438 
2439 	if (sc == NULL)
2440 		return;
2441 
2442 	DPRINTF(sc, UDMASS_SCSI, "CAM poll\n");
2443 
2444 	usbd_transfer_poll(sc->sc_xfer, UMASS_T_MAX);
2445 }
2446 
2447 /* umass_cam_cb
2448  *	finalise a completed CAM command
2449  */
2450 
2451 static void
2452 umass_cam_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2453     uint8_t status)
2454 {
2455 	ccb->csio.resid = residue;
2456 
2457 	switch (status) {
2458 	case STATUS_CMD_OK:
2459 		ccb->ccb_h.status = CAM_REQ_CMP;
2460 		if ((sc->sc_quirks & READ_CAPACITY_OFFBY1) &&
2461 		    (ccb->ccb_h.func_code == XPT_SCSI_IO) &&
2462 		    (ccb->csio.cdb_io.cdb_bytes[0] == READ_CAPACITY)) {
2463 			struct scsi_read_capacity_data *rcap;
2464 			uint32_t maxsector;
2465 
2466 			rcap = (void *)(ccb->csio.data_ptr);
2467 			maxsector = scsi_4btoul(rcap->addr) - 1;
2468 			scsi_ulto4b(maxsector, rcap->addr);
2469 		}
2470 		/*
2471 		 * We have to add SVPD_UNIT_SERIAL_NUMBER to the list
2472 		 * of pages supported by the device - otherwise, CAM
2473 		 * will never ask us for the serial number if the
2474 		 * device cannot handle that by itself.
2475 		 */
2476 		if (ccb->ccb_h.func_code == XPT_SCSI_IO &&
2477 		    sc->sc_transfer.cmd_data[0] == INQUIRY &&
2478 		    (sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2479 		    sc->sc_transfer.cmd_data[2] == SVPD_SUPPORTED_PAGE_LIST &&
2480 		    (usb_get_serial(sc->sc_udev)[0] != '\0')) {
2481 			struct ccb_scsiio *csio;
2482 			struct scsi_vpd_supported_page_list *page_list;
2483 
2484 			csio = &ccb->csio;
2485 			page_list = (struct scsi_vpd_supported_page_list *)csio->data_ptr;
2486 			if (page_list->length + 1 < SVPD_SUPPORTED_PAGES_SIZE) {
2487 				page_list->list[page_list->length] = SVPD_UNIT_SERIAL_NUMBER;
2488 				page_list->length++;
2489 			}
2490 		}
2491 		xpt_done(ccb);
2492 		break;
2493 
2494 	case STATUS_CMD_UNKNOWN:
2495 	case STATUS_CMD_FAILED:
2496 
2497 		/* fetch sense data */
2498 
2499 		/* the rest of the command was filled in at attach */
2500 		sc->cam_scsi_sense.length = ccb->csio.sense_len;
2501 
2502 		DPRINTF(sc, UDMASS_SCSI, "Fetching %d bytes of "
2503 		    "sense data\n", ccb->csio.sense_len);
2504 
2505 		if (umass_std_transform(sc, ccb, &sc->cam_scsi_sense.opcode,
2506 		    sizeof(sc->cam_scsi_sense))) {
2507 			if ((sc->sc_quirks & FORCE_SHORT_INQUIRY) &&
2508 			    (sc->sc_transfer.cmd_data[0] == INQUIRY)) {
2509 				ccb->csio.sense_len = SHORT_INQUIRY_LENGTH;
2510 			}
2511 			umass_command_start(sc, DIR_IN, &ccb->csio.sense_data.error_code,
2512 			    ccb->csio.sense_len, ccb->ccb_h.timeout,
2513 			    &umass_cam_sense_cb, ccb);
2514 		}
2515 		break;
2516 
2517 	default:
2518 		/*
2519 		 * The wire protocol failed and will hopefully have
2520 		 * recovered. We return an error to CAM and let CAM
2521 		 * retry the command if necessary.
2522 		 */
2523 		xpt_freeze_devq(ccb->ccb_h.path, 1);
2524 		ccb->ccb_h.status = CAM_REQ_CMP_ERR | CAM_DEV_QFRZN;
2525 		xpt_done(ccb);
2526 		break;
2527 	}
2528 }
2529 
2530 /*
2531  * Finalise a completed autosense operation
2532  */
2533 static void
2534 umass_cam_sense_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2535     uint8_t status)
2536 {
2537 	uint8_t *cmd;
2538 
2539 	switch (status) {
2540 	case STATUS_CMD_OK:
2541 	case STATUS_CMD_UNKNOWN:
2542 	case STATUS_CMD_FAILED: {
2543 		int key, sense_len;
2544 
2545 		ccb->csio.sense_resid = residue;
2546 		sense_len = ccb->csio.sense_len - ccb->csio.sense_resid;
2547 		key = scsi_get_sense_key(&ccb->csio.sense_data, sense_len,
2548 					 /*show_errors*/ 1);
2549 
2550 		if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2551 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2552 		} else {
2553 			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2554 		}
2555 
2556 		/*
2557 		 * Getting sense data always succeeds (apart from wire
2558 		 * failures):
2559 		 */
2560 		if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2561 		    (cmd[0] == INQUIRY) &&
2562 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2563 			/*
2564 			 * Ignore unit attention errors in the case where
2565 			 * the Unit Attention state is not cleared on
2566 			 * REQUEST SENSE. They will appear again at the next
2567 			 * command.
2568 			 */
2569 			ccb->ccb_h.status = CAM_REQ_CMP;
2570 		} else if (key == SSD_KEY_NO_SENSE) {
2571 			/*
2572 			 * No problem after all (in the case of CBI without
2573 			 * CCI)
2574 			 */
2575 			ccb->ccb_h.status = CAM_REQ_CMP;
2576 		} else if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2577 			    (cmd[0] == READ_CAPACITY) &&
2578 		    (key == SSD_KEY_UNIT_ATTENTION)) {
2579 			/*
2580 			 * Some devices do not clear the unit attention error
2581 			 * on request sense. We insert a test unit ready
2582 			 * command to make sure we clear the unit attention
2583 			 * condition, then allow the retry to proceed as
2584 			 * usual.
2585 			 */
2586 
2587 			xpt_freeze_devq(ccb->ccb_h.path, 1);
2588 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2589 			    | CAM_AUTOSNS_VALID | CAM_DEV_QFRZN;
2590 			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2591 
2592 #if 0
2593 			DELAY(300000);
2594 #endif
2595 			DPRINTF(sc, UDMASS_SCSI, "Doing a sneaky"
2596 			    "TEST_UNIT_READY\n");
2597 
2598 			/* the rest of the command was filled in at attach */
2599 
2600 			if ((sc->sc_transform)(sc,
2601 			    &sc->cam_scsi_test_unit_ready.opcode,
2602 			    sizeof(sc->cam_scsi_test_unit_ready)) == 1) {
2603 				umass_command_start(sc, DIR_NONE, NULL, 0,
2604 				    ccb->ccb_h.timeout,
2605 				    &umass_cam_quirk_cb, ccb);
2606 				break;
2607 			}
2608 		} else {
2609 			xpt_freeze_devq(ccb->ccb_h.path, 1);
2610 			if (key >= 0) {
2611 				ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2612 				    | CAM_AUTOSNS_VALID | CAM_DEV_QFRZN;
2613 				ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2614 			} else
2615 				ccb->ccb_h.status = CAM_AUTOSENSE_FAIL
2616 				    | CAM_DEV_QFRZN;
2617 		}
2618 		xpt_done(ccb);
2619 		break;
2620 	}
2621 	default:
2622 		DPRINTF(sc, UDMASS_SCSI, "Autosense failed, "
2623 		    "status %d\n", status);
2624 		xpt_freeze_devq(ccb->ccb_h.path, 1);
2625 		ccb->ccb_h.status = CAM_AUTOSENSE_FAIL | CAM_DEV_QFRZN;
2626 		xpt_done(ccb);
2627 	}
2628 }
2629 
2630 /*
2631  * This completion code just handles the fact that we sent a test-unit-ready
2632  * after having previously failed a READ CAPACITY with CHECK_COND.  The CCB
2633  * status for CAM is already set earlier.
2634  */
2635 static void
2636 umass_cam_quirk_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2637     uint8_t status)
2638 {
2639 	DPRINTF(sc, UDMASS_SCSI, "Test unit ready "
2640 	    "returned status %d\n", status);
2641 
2642 	xpt_done(ccb);
2643 }
2644 
2645 /*
2646  * SCSI specific functions
2647  */
2648 
2649 static uint8_t
2650 umass_scsi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2651     uint8_t cmd_len)
2652 {
2653 	if ((cmd_len == 0) ||
2654 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2655 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2656 		    "length: %d bytes\n", cmd_len);
2657 		return (0);		/* failure */
2658 	}
2659 	sc->sc_transfer.cmd_len = cmd_len;
2660 
2661 	switch (cmd_ptr[0]) {
2662 	case TEST_UNIT_READY:
2663 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2664 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2665 			    "to START_UNIT\n");
2666 			memset(sc->sc_transfer.cmd_data, 0, cmd_len);
2667 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2668 			sc->sc_transfer.cmd_data[4] = SSS_START;
2669 			return (1);
2670 		}
2671 		break;
2672 
2673 	case INQUIRY:
2674 		/*
2675 		 * some drives wedge when asked for full inquiry
2676 		 * information.
2677 		 */
2678 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2679 			memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2680 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2681 			return (1);
2682 		}
2683 		break;
2684 	}
2685 
2686 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2687 	return (1);
2688 }
2689 
2690 static uint8_t
2691 umass_rbc_transform(struct umass_softc *sc, uint8_t *cmd_ptr, uint8_t cmd_len)
2692 {
2693 	if ((cmd_len == 0) ||
2694 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2695 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2696 		    "length: %d bytes\n", cmd_len);
2697 		return (0);		/* failure */
2698 	}
2699 	switch (cmd_ptr[0]) {
2700 		/* these commands are defined in RBC: */
2701 	case READ_10:
2702 	case READ_CAPACITY:
2703 	case START_STOP_UNIT:
2704 	case SYNCHRONIZE_CACHE:
2705 	case WRITE_10:
2706 	case VERIFY_10:
2707 	case INQUIRY:
2708 	case MODE_SELECT_10:
2709 	case MODE_SENSE_10:
2710 	case TEST_UNIT_READY:
2711 	case WRITE_BUFFER:
2712 		/*
2713 		 * The following commands are not listed in my copy of the
2714 		 * RBC specs. CAM however seems to want those, and at least
2715 		 * the Sony DSC device appears to support those as well
2716 		 */
2717 	case REQUEST_SENSE:
2718 	case PREVENT_ALLOW:
2719 
2720 		memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2721 
2722 		if ((sc->sc_quirks & RBC_PAD_TO_12) && (cmd_len < 12)) {
2723 			memset(sc->sc_transfer.cmd_data + cmd_len,
2724 			    0, 12 - cmd_len);
2725 			cmd_len = 12;
2726 		}
2727 		sc->sc_transfer.cmd_len = cmd_len;
2728 		return (1);		/* success */
2729 
2730 		/* All other commands are not legal in RBC */
2731 	default:
2732 		DPRINTF(sc, UDMASS_SCSI, "Unsupported RBC "
2733 		    "command 0x%02x\n", cmd_ptr[0]);
2734 		return (0);		/* failure */
2735 	}
2736 }
2737 
2738 static uint8_t
2739 umass_ufi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2740     uint8_t cmd_len)
2741 {
2742 	if ((cmd_len == 0) ||
2743 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2744 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2745 		    "length: %d bytes\n", cmd_len);
2746 		return (0);		/* failure */
2747 	}
2748 	/* An UFI command is always 12 bytes in length */
2749 	sc->sc_transfer.cmd_len = UFI_COMMAND_LENGTH;
2750 
2751 	/* Zero the command data */
2752 	memset(sc->sc_transfer.cmd_data, 0, UFI_COMMAND_LENGTH);
2753 
2754 	switch (cmd_ptr[0]) {
2755 		/*
2756 		 * Commands of which the format has been verified. They
2757 		 * should work. Copy the command into the (zeroed out)
2758 		 * destination buffer.
2759 		 */
2760 	case TEST_UNIT_READY:
2761 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2762 			/*
2763 			 * Some devices do not support this command. Start
2764 			 * Stop Unit should give the same results
2765 			 */
2766 			DPRINTF(sc, UDMASS_UFI, "Converted TEST_UNIT_READY "
2767 			    "to START_UNIT\n");
2768 
2769 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2770 			sc->sc_transfer.cmd_data[4] = SSS_START;
2771 			return (1);
2772 		}
2773 		break;
2774 
2775 	case REZERO_UNIT:
2776 	case REQUEST_SENSE:
2777 	case FORMAT_UNIT:
2778 	case INQUIRY:
2779 	case START_STOP_UNIT:
2780 	case SEND_DIAGNOSTIC:
2781 	case PREVENT_ALLOW:
2782 	case READ_CAPACITY:
2783 	case READ_10:
2784 	case WRITE_10:
2785 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2786 	case WRITE_AND_VERIFY:
2787 	case VERIFY:
2788 	case MODE_SELECT_10:
2789 	case MODE_SENSE_10:
2790 	case READ_12:
2791 	case WRITE_12:
2792 	case READ_FORMAT_CAPACITIES:
2793 		break;
2794 
2795 		/*
2796 		 * SYNCHRONIZE_CACHE isn't supported by UFI, nor should it be
2797 		 * required for UFI devices, so it is appropriate to fake
2798 		 * success.
2799 		 */
2800 	case SYNCHRONIZE_CACHE:
2801 		return (2);
2802 
2803 	default:
2804 		DPRINTF(sc, UDMASS_SCSI, "Unsupported UFI "
2805 		    "command 0x%02x\n", cmd_ptr[0]);
2806 		return (0);		/* failure */
2807 	}
2808 
2809 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2810 	return (1);			/* success */
2811 }
2812 
2813 /*
2814  * 8070i (ATAPI) specific functions
2815  */
2816 static uint8_t
2817 umass_atapi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2818     uint8_t cmd_len)
2819 {
2820 	if ((cmd_len == 0) ||
2821 	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2822 		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2823 		    "length: %d bytes\n", cmd_len);
2824 		return (0);		/* failure */
2825 	}
2826 	/* An ATAPI command is always 12 bytes in length. */
2827 	sc->sc_transfer.cmd_len = ATAPI_COMMAND_LENGTH;
2828 
2829 	/* Zero the command data */
2830 	memset(sc->sc_transfer.cmd_data, 0, ATAPI_COMMAND_LENGTH);
2831 
2832 	switch (cmd_ptr[0]) {
2833 		/*
2834 		 * Commands of which the format has been verified. They
2835 		 * should work. Copy the command into the destination
2836 		 * buffer.
2837 		 */
2838 	case INQUIRY:
2839 		/*
2840 		 * some drives wedge when asked for full inquiry
2841 		 * information.
2842 		 */
2843 		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2844 			memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2845 
2846 			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2847 			return (1);
2848 		}
2849 		break;
2850 
2851 	case TEST_UNIT_READY:
2852 		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2853 			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2854 			    "to START_UNIT\n");
2855 			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2856 			sc->sc_transfer.cmd_data[4] = SSS_START;
2857 			return (1);
2858 		}
2859 		break;
2860 
2861 	case REZERO_UNIT:
2862 	case REQUEST_SENSE:
2863 	case START_STOP_UNIT:
2864 	case SEND_DIAGNOSTIC:
2865 	case PREVENT_ALLOW:
2866 	case READ_CAPACITY:
2867 	case READ_10:
2868 	case WRITE_10:
2869 	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2870 	case SYNCHRONIZE_CACHE:
2871 	case MODE_SELECT_10:
2872 	case MODE_SENSE_10:
2873 	case READ_BUFFER:
2874 	case 0x42:			/* READ_SUBCHANNEL */
2875 	case 0x43:			/* READ_TOC */
2876 	case 0x44:			/* READ_HEADER */
2877 	case 0x47:			/* PLAY_MSF (Play Minute/Second/Frame) */
2878 	case 0x48:			/* PLAY_TRACK */
2879 	case 0x49:			/* PLAY_TRACK_REL */
2880 	case 0x4b:			/* PAUSE */
2881 	case 0x51:			/* READ_DISK_INFO */
2882 	case 0x52:			/* READ_TRACK_INFO */
2883 	case 0x54:			/* SEND_OPC */
2884 	case 0x59:			/* READ_MASTER_CUE */
2885 	case 0x5b:			/* CLOSE_TR_SESSION */
2886 	case 0x5c:			/* READ_BUFFER_CAP */
2887 	case 0x5d:			/* SEND_CUE_SHEET */
2888 	case 0xa1:			/* BLANK */
2889 	case 0xa5:			/* PLAY_12 */
2890 	case 0xa6:			/* EXCHANGE_MEDIUM */
2891 	case 0xad:			/* READ_DVD_STRUCTURE */
2892 	case 0xbb:			/* SET_CD_SPEED */
2893 	case 0xe5:			/* READ_TRACK_INFO_PHILIPS */
2894 		break;
2895 
2896 	case READ_12:
2897 	case WRITE_12:
2898 	default:
2899 		DPRINTF(sc, UDMASS_SCSI, "Unsupported ATAPI "
2900 		    "command 0x%02x - trying anyway\n",
2901 		    cmd_ptr[0]);
2902 		break;
2903 	}
2904 
2905 	memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2906 	return (1);			/* success */
2907 }
2908 
2909 static uint8_t
2910 umass_no_transform(struct umass_softc *sc, uint8_t *cmd,
2911     uint8_t cmdlen)
2912 {
2913 	return (0);			/* failure */
2914 }
2915 
2916 static uint8_t
2917 umass_std_transform(struct umass_softc *sc, union ccb *ccb,
2918     uint8_t *cmd, uint8_t cmdlen)
2919 {
2920 	uint8_t retval;
2921 
2922 	retval = (sc->sc_transform) (sc, cmd, cmdlen);
2923 
2924 	if (retval == 2) {
2925 		ccb->ccb_h.status = CAM_REQ_CMP;
2926 		xpt_done(ccb);
2927 		return (0);
2928 	} else if (retval == 0) {
2929 		xpt_freeze_devq(ccb->ccb_h.path, 1);
2930 		ccb->ccb_h.status = CAM_REQ_INVALID | CAM_DEV_QFRZN;
2931 		xpt_done(ccb);
2932 		return (0);
2933 	}
2934 	/* Command should be executed */
2935 	return (1);
2936 }
2937 
2938 #ifdef USB_DEBUG
2939 static void
2940 umass_bbb_dump_cbw(struct umass_softc *sc, umass_bbb_cbw_t *cbw)
2941 {
2942 	uint8_t *c = cbw->CBWCDB;
2943 
2944 	uint32_t dlen = UGETDW(cbw->dCBWDataTransferLength);
2945 	uint32_t tag = UGETDW(cbw->dCBWTag);
2946 
2947 	uint8_t clen = cbw->bCDBLength;
2948 	uint8_t flags = cbw->bCBWFlags;
2949 	uint8_t lun = cbw->bCBWLUN;
2950 
2951 	DPRINTF(sc, UDMASS_BBB, "CBW %d: cmd = %db "
2952 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
2953 	    "data = %db, lun = %d, dir = %s\n",
2954 	    tag, clen,
2955 	    c[0], c[1], c[2], c[3], c[4], c[5], (clen > 6 ? "..." : ""),
2956 	    dlen, lun, (flags == CBWFLAGS_IN ? "in" :
2957 	    (flags == CBWFLAGS_OUT ? "out" : "<invalid>")));
2958 }
2959 
2960 static void
2961 umass_bbb_dump_csw(struct umass_softc *sc, umass_bbb_csw_t *csw)
2962 {
2963 	uint32_t sig = UGETDW(csw->dCSWSignature);
2964 	uint32_t tag = UGETDW(csw->dCSWTag);
2965 	uint32_t res = UGETDW(csw->dCSWDataResidue);
2966 	uint8_t status = csw->bCSWStatus;
2967 
2968 	DPRINTF(sc, UDMASS_BBB, "CSW %d: sig = 0x%08x (%s), tag = 0x%08x, "
2969 	    "res = %d, status = 0x%02x (%s)\n",
2970 	    tag, sig, (sig == CSWSIGNATURE ? "valid" : "invalid"),
2971 	    tag, res,
2972 	    status, (status == CSWSTATUS_GOOD ? "good" :
2973 	    (status == CSWSTATUS_FAILED ? "failed" :
2974 	    (status == CSWSTATUS_PHASE ? "phase" : "<invalid>"))));
2975 }
2976 
2977 static void
2978 umass_cbi_dump_cmd(struct umass_softc *sc, void *cmd, uint8_t cmdlen)
2979 {
2980 	uint8_t *c = cmd;
2981 	uint8_t dir = sc->sc_transfer.dir;
2982 
2983 	DPRINTF(sc, UDMASS_BBB, "cmd = %db "
2984 	    "(0x%02x%02x%02x%02x%02x%02x%s), "
2985 	    "data = %db, dir = %s\n",
2986 	    cmdlen,
2987 	    c[0], c[1], c[2], c[3], c[4], c[5], (cmdlen > 6 ? "..." : ""),
2988 	    sc->sc_transfer.data_len,
2989 	    (dir == DIR_IN ? "in" :
2990 	    (dir == DIR_OUT ? "out" :
2991 	    (dir == DIR_NONE ? "no data phase" : "<invalid>"))));
2992 }
2993 
2994 static void
2995 umass_dump_buffer(struct umass_softc *sc, uint8_t *buffer, uint32_t buflen,
2996     uint32_t printlen)
2997 {
2998 	uint32_t i, j;
2999 	char s1[40];
3000 	char s2[40];
3001 	char s3[5];
3002 
3003 	s1[0] = '\0';
3004 	s3[0] = '\0';
3005 
3006 	sprintf(s2, " buffer=%p, buflen=%d", buffer, buflen);
3007 	for (i = 0; (i < buflen) && (i < printlen); i++) {
3008 		j = i % 16;
3009 		if (j == 0 && i != 0) {
3010 			DPRINTF(sc, UDMASS_GEN, "0x %s%s\n",
3011 			    s1, s2);
3012 			s2[0] = '\0';
3013 		}
3014 		sprintf(&s1[j * 2], "%02x", buffer[i] & 0xff);
3015 	}
3016 	if (buflen > printlen)
3017 		sprintf(s3, " ...");
3018 	DPRINTF(sc, UDMASS_GEN, "0x %s%s%s\n",
3019 	    s1, s2, s3);
3020 }
3021 
3022 #endif
3023