umass.c revision 225950
1238415Simp#include <sys/cdefs.h>
2238415Simp__FBSDID("$FreeBSD: head/sys/dev/usb/storage/umass.c 225950 2011-10-03 20:32:55Z ken $");
3238415Simp
4238415Simp/*-
5238415Simp * Copyright (c) 1999 MAEKAWA Masahide <bishop@rr.iij4u.or.jp>,
6238415Simp *		      Nick Hibma <n_hibma@FreeBSD.org>
7238415Simp * All rights reserved.
8238415Simp *
9238415Simp * Redistribution and use in source and binary forms, with or without
10238415Simp * modification, are permitted provided that the following conditions
11238415Simp * are met:
12238415Simp * 1. Redistributions of source code must retain the above copyright
13238415Simp *    notice, this list of conditions and the following disclaimer.
14238415Simp * 2. Redistributions in binary form must reproduce the above copyright
15238415Simp *    notice, this list of conditions and the following disclaimer in the
16238415Simp *    documentation and/or other materials provided with the distribution.
17238415Simp *
18238415Simp * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19238415Simp * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20238415Simp * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21238415Simp * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22238415Simp * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23238415Simp * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24238415Simp * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25238415Simp * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26238415Simp * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27238415Simp * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28238415Simp * SUCH DAMAGE.
29238415Simp *
30238415Simp *	$FreeBSD: head/sys/dev/usb/storage/umass.c 225950 2011-10-03 20:32:55Z ken $
31238415Simp *	$NetBSD: umass.c,v 1.28 2000/04/02 23:46:53 augustss Exp $
32238415Simp */
33238415Simp
34238415Simp/* Also already merged from NetBSD:
35238415Simp *	$NetBSD: umass.c,v 1.67 2001/11/25 19:05:22 augustss Exp $
36238415Simp *	$NetBSD: umass.c,v 1.90 2002/11/04 19:17:33 pooka Exp $
37238415Simp *	$NetBSD: umass.c,v 1.108 2003/11/07 17:03:25 wiz Exp $
38238415Simp *	$NetBSD: umass.c,v 1.109 2003/12/04 13:57:31 keihan Exp $
39238415Simp */
40238439Simp
41238439Simp/*
42238415Simp * Universal Serial Bus Mass Storage Class specs:
43238439Simp * http://www.usb.org/developers/devclass_docs/usb_msc_overview_1.2.pdf
44238439Simp * http://www.usb.org/developers/devclass_docs/usbmassbulk_10.pdf
45238415Simp * http://www.usb.org/developers/devclass_docs/usb_msc_cbi_1.1.pdf
46238415Simp * http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf
47238415Simp */
48238415Simp
49238415Simp/*
50238415Simp * Ported to NetBSD by Lennart Augustsson <augustss@NetBSD.org>.
51238415Simp * Parts of the code written by Jason R. Thorpe <thorpej@shagadelic.org>.
52238415Simp */
53238415Simp
54238415Simp/*
55238415Simp * The driver handles 3 Wire Protocols
56238415Simp * - Command/Bulk/Interrupt (CBI)
57238415Simp * - Command/Bulk/Interrupt with Command Completion Interrupt (CBI with CCI)
58238415Simp * - Mass Storage Bulk-Only (BBB)
59238415Simp *   (BBB refers Bulk/Bulk/Bulk for Command/Data/Status phases)
60238415Simp *
61238415Simp * Over these wire protocols it handles the following command protocols
62238415Simp * - SCSI
63238415Simp * - UFI (floppy command set)
64238415Simp * - 8070i (ATAPI)
65238415Simp *
66238415Simp * UFI and 8070i (ATAPI) are transformed versions of the SCSI command set. The
67238439Simp * sc->sc_transform method is used to convert the commands into the appropriate
68238439Simp * format (if at all necessary). For example, UFI requires all commands to be
69238439Simp * 12 bytes in length amongst other things.
70238439Simp *
71238439Simp * The source code below is marked and can be split into a number of pieces
72238439Simp * (in this order):
73238439Simp *
74238439Simp * - probe/attach/detach
75238439Simp * - generic transfer routines
76238439Simp * - BBB
77238439Simp * - CBI
78238439Simp * - CBI_I (in addition to functions from CBI)
79238439Simp * - CAM (Common Access Method)
80238439Simp * - SCSI
81238439Simp * - UFI
82238439Simp * - 8070i (ATAPI)
83238465Simp *
84238465Simp * The protocols are implemented using a state machine, for the transfers as
85238465Simp * well as for the resets. The state machine is contained in umass_t_*_callback.
86238465Simp * The state machine is started through either umass_command_start() or
87238439Simp * umass_reset().
88238439Simp *
89238439Simp * The reason for doing this is a) CAM performs a lot better this way and b) it
90238439Simp * avoids using tsleep from interrupt context (for example after a failed
91238439Simp * transfer).
92238439Simp */
93238439Simp
94238439Simp/*
95248902Sian * The SCSI related part of this driver has been derived from the
96238439Simp * dev/ppbus/vpo.c driver, by Nicolas Souchu (nsouch@FreeBSD.org).
97238439Simp *
98238439Simp * The CAM layer uses so called actions which are messages sent to the host
99238439Simp * adapter for completion. The actions come in through umass_cam_action. The
100238439Simp * appropriate block of routines is called depending on the transport protocol
101238439Simp * in use. When the transfer has finished, these routines call
102238439Simp * umass_cam_cb again to complete the CAM command.
103238439Simp */
104238439Simp
105238439Simp#include <sys/stdint.h>
106238439Simp#include <sys/stddef.h>
107238439Simp#include <sys/param.h>
108238439Simp#include <sys/queue.h>
109238439Simp#include <sys/types.h>
110238439Simp#include <sys/systm.h>
111238439Simp#include <sys/kernel.h>
112238439Simp#include <sys/bus.h>
113238439Simp#include <sys/module.h>
114238439Simp#include <sys/lock.h>
115238439Simp#include <sys/mutex.h>
116238439Simp#include <sys/condvar.h>
117238439Simp#include <sys/sysctl.h>
118238439Simp#include <sys/sx.h>
119238439Simp#include <sys/unistd.h>
120238439Simp#include <sys/callout.h>
121238439Simp#include <sys/malloc.h>
122238439Simp#include <sys/priv.h>
123238439Simp
124238439Simp#include <dev/usb/usb.h>
125238439Simp#include <dev/usb/usbdi.h>
126238439Simp#include <dev/usb/usbdi_util.h>
127238439Simp#include "usbdevs.h"
128238439Simp
129238465Simp#include <dev/usb/quirk/usb_quirk.h>
130238465Simp
131238465Simp#include <cam/cam.h>
132238465Simp#include <cam/cam_ccb.h>
133238465Simp#include <cam/cam_sim.h>
134238465Simp#include <cam/cam_xpt_sim.h>
135238465Simp#include <cam/scsi/scsi_all.h>
136238465Simp#include <cam/scsi/scsi_da.h>
137238465Simp
138238465Simp#include <cam/cam_periph.h>
139238465Simp
140238465Simp#define UMASS_EXT_BUFFER
141238465Simp#ifdef UMASS_EXT_BUFFER
142238465Simp/* this enables loading of virtual buffers into DMA */
143#define	UMASS_USB_FLAGS .ext_buffer=1,
144#else
145#define	UMASS_USB_FLAGS
146#endif
147
148#ifdef USB_DEBUG
149#define	DIF(m, x)				\
150  do {						\
151    if (umass_debug & (m)) { x ; }		\
152  } while (0)
153
154#define	DPRINTF(sc, m, fmt, ...)			\
155  do {							\
156    if (umass_debug & (m)) {				\
157        printf("%s:%s: " fmt,				\
158	       (sc) ? (const char *)(sc)->sc_name :	\
159	       (const char *)"umassX",			\
160		__FUNCTION__ ,## __VA_ARGS__);		\
161    }							\
162  } while (0)
163
164#define	UDMASS_GEN	0x00010000	/* general */
165#define	UDMASS_SCSI	0x00020000	/* scsi */
166#define	UDMASS_UFI	0x00040000	/* ufi command set */
167#define	UDMASS_ATAPI	0x00080000	/* 8070i command set */
168#define	UDMASS_CMD	(UDMASS_SCSI|UDMASS_UFI|UDMASS_ATAPI)
169#define	UDMASS_USB	0x00100000	/* USB general */
170#define	UDMASS_BBB	0x00200000	/* Bulk-Only transfers */
171#define	UDMASS_CBI	0x00400000	/* CBI transfers */
172#define	UDMASS_WIRE	(UDMASS_BBB|UDMASS_CBI)
173#define	UDMASS_ALL	0xffff0000	/* all of the above */
174static int umass_debug = 0;
175
176SYSCTL_NODE(_hw_usb, OID_AUTO, umass, CTLFLAG_RW, 0, "USB umass");
177SYSCTL_INT(_hw_usb_umass, OID_AUTO, debug, CTLFLAG_RW,
178    &umass_debug, 0, "umass debug level");
179
180TUNABLE_INT("hw.usb.umass.debug", &umass_debug);
181#else
182#define	DIF(...) do { } while (0)
183#define	DPRINTF(...) do { } while (0)
184#endif
185
186#define	UMASS_GONE ((struct umass_softc *)1)
187
188#define	UMASS_BULK_SIZE (1 << 17)
189#define	UMASS_CBI_DIAGNOSTIC_CMDLEN 12	/* bytes */
190#define	UMASS_MAX_CMDLEN MAX(12, CAM_MAX_CDBLEN)	/* bytes */
191
192/* USB transfer definitions */
193
194#define	UMASS_T_BBB_RESET1      0	/* Bulk-Only */
195#define	UMASS_T_BBB_RESET2      1
196#define	UMASS_T_BBB_RESET3      2
197#define	UMASS_T_BBB_COMMAND     3
198#define	UMASS_T_BBB_DATA_READ   4
199#define	UMASS_T_BBB_DATA_RD_CS  5
200#define	UMASS_T_BBB_DATA_WRITE  6
201#define	UMASS_T_BBB_DATA_WR_CS  7
202#define	UMASS_T_BBB_STATUS      8
203#define	UMASS_T_BBB_MAX         9
204
205#define	UMASS_T_CBI_RESET1      0	/* CBI */
206#define	UMASS_T_CBI_RESET2      1
207#define	UMASS_T_CBI_RESET3      2
208#define	UMASS_T_CBI_COMMAND     3
209#define	UMASS_T_CBI_DATA_READ   4
210#define	UMASS_T_CBI_DATA_RD_CS  5
211#define	UMASS_T_CBI_DATA_WRITE  6
212#define	UMASS_T_CBI_DATA_WR_CS  7
213#define	UMASS_T_CBI_STATUS      8
214#define	UMASS_T_CBI_RESET4      9
215#define	UMASS_T_CBI_MAX        10
216
217#define	UMASS_T_MAX MAX(UMASS_T_CBI_MAX, UMASS_T_BBB_MAX)
218
219/* Generic definitions */
220
221/* Direction for transfer */
222#define	DIR_NONE	0
223#define	DIR_IN		1
224#define	DIR_OUT		2
225
226/* device name */
227#define	DEVNAME		"umass"
228#define	DEVNAME_SIM	"umass-sim"
229
230/* Approximate maximum transfer speeds (assumes 33% overhead). */
231#define	UMASS_FULL_TRANSFER_SPEED	1000
232#define	UMASS_HIGH_TRANSFER_SPEED	40000
233#define	UMASS_SUPER_TRANSFER_SPEED	400000
234#define	UMASS_FLOPPY_TRANSFER_SPEED	20
235
236#define	UMASS_TIMEOUT			5000	/* ms */
237
238/* CAM specific definitions */
239
240#define	UMASS_SCSIID_MAX	1	/* maximum number of drives expected */
241#define	UMASS_SCSIID_HOST	UMASS_SCSIID_MAX
242
243/* Bulk-Only features */
244
245#define	UR_BBB_RESET		0xff	/* Bulk-Only reset */
246#define	UR_BBB_GET_MAX_LUN	0xfe	/* Get maximum lun */
247
248/* Command Block Wrapper */
249typedef struct {
250	uDWord	dCBWSignature;
251#define	CBWSIGNATURE	0x43425355
252	uDWord	dCBWTag;
253	uDWord	dCBWDataTransferLength;
254	uByte	bCBWFlags;
255#define	CBWFLAGS_OUT	0x00
256#define	CBWFLAGS_IN	0x80
257	uByte	bCBWLUN;
258	uByte	bCDBLength;
259#define	CBWCDBLENGTH	16
260	uByte	CBWCDB[CBWCDBLENGTH];
261} __packed umass_bbb_cbw_t;
262
263#define	UMASS_BBB_CBW_SIZE	31
264
265/* Command Status Wrapper */
266typedef struct {
267	uDWord	dCSWSignature;
268#define	CSWSIGNATURE	0x53425355
269#define	CSWSIGNATURE_IMAGINATION_DBX1	0x43425355
270#define	CSWSIGNATURE_OLYMPUS_C1	0x55425355
271	uDWord	dCSWTag;
272	uDWord	dCSWDataResidue;
273	uByte	bCSWStatus;
274#define	CSWSTATUS_GOOD	0x0
275#define	CSWSTATUS_FAILED	0x1
276#define	CSWSTATUS_PHASE	0x2
277} __packed umass_bbb_csw_t;
278
279#define	UMASS_BBB_CSW_SIZE	13
280
281/* CBI features */
282
283#define	UR_CBI_ADSC	0x00
284
285typedef union {
286	struct {
287		uint8_t	type;
288#define	IDB_TYPE_CCI		0x00
289		uint8_t	value;
290#define	IDB_VALUE_PASS		0x00
291#define	IDB_VALUE_FAIL		0x01
292#define	IDB_VALUE_PHASE		0x02
293#define	IDB_VALUE_PERSISTENT	0x03
294#define	IDB_VALUE_STATUS_MASK	0x03
295	} __packed common;
296
297	struct {
298		uint8_t	asc;
299		uint8_t	ascq;
300	} __packed ufi;
301} __packed umass_cbi_sbl_t;
302
303struct umass_softc;			/* see below */
304
305typedef void (umass_callback_t)(struct umass_softc *sc, union ccb *ccb,
306    	uint32_t residue, uint8_t status);
307
308#define	STATUS_CMD_OK		0	/* everything ok */
309#define	STATUS_CMD_UNKNOWN	1	/* will have to fetch sense */
310#define	STATUS_CMD_FAILED	2	/* transfer was ok, command failed */
311#define	STATUS_WIRE_FAILED	3	/* couldn't even get command across */
312
313typedef uint8_t (umass_transform_t)(struct umass_softc *sc, uint8_t *cmd_ptr,
314    	uint8_t cmd_len);
315
316/* Wire and command protocol */
317#define	UMASS_PROTO_BBB		0x0001	/* USB wire protocol */
318#define	UMASS_PROTO_CBI		0x0002
319#define	UMASS_PROTO_CBI_I	0x0004
320#define	UMASS_PROTO_WIRE	0x00ff	/* USB wire protocol mask */
321#define	UMASS_PROTO_SCSI	0x0100	/* command protocol */
322#define	UMASS_PROTO_ATAPI	0x0200
323#define	UMASS_PROTO_UFI		0x0400
324#define	UMASS_PROTO_RBC		0x0800
325#define	UMASS_PROTO_COMMAND	0xff00	/* command protocol mask */
326
327/* Device specific quirks */
328#define	NO_QUIRKS		0x0000
329	/*
330	 * The drive does not support Test Unit Ready. Convert to Start Unit
331	 */
332#define	NO_TEST_UNIT_READY	0x0001
333	/*
334	 * The drive does not reset the Unit Attention state after REQUEST
335	 * SENSE has been sent. The INQUIRY command does not reset the UA
336	 * either, and so CAM runs in circles trying to retrieve the initial
337	 * INQUIRY data.
338	 */
339#define	RS_NO_CLEAR_UA		0x0002
340	/* The drive does not support START STOP.  */
341#define	NO_START_STOP		0x0004
342	/* Don't ask for full inquiry data (255b).  */
343#define	FORCE_SHORT_INQUIRY	0x0008
344	/* Needs to be initialised the Shuttle way */
345#define	SHUTTLE_INIT		0x0010
346	/* Drive needs to be switched to alternate iface 1 */
347#define	ALT_IFACE_1		0x0020
348	/* Drive does not do 1Mb/s, but just floppy speeds (20kb/s) */
349#define	FLOPPY_SPEED		0x0040
350	/* The device can't count and gets the residue of transfers wrong */
351#define	IGNORE_RESIDUE		0x0080
352	/* No GetMaxLun call */
353#define	NO_GETMAXLUN		0x0100
354	/* The device uses a weird CSWSIGNATURE. */
355#define	WRONG_CSWSIG		0x0200
356	/* Device cannot handle INQUIRY so fake a generic response */
357#define	NO_INQUIRY		0x0400
358	/* Device cannot handle INQUIRY EVPD, return CHECK CONDITION */
359#define	NO_INQUIRY_EVPD		0x0800
360	/* Pad all RBC requests to 12 bytes. */
361#define	RBC_PAD_TO_12		0x1000
362	/*
363	 * Device reports number of sectors from READ_CAPACITY, not max
364	 * sector number.
365	 */
366#define	READ_CAPACITY_OFFBY1	0x2000
367	/*
368	 * Device cannot handle a SCSI synchronize cache command.  Normally
369	 * this quirk would be handled in the cam layer, but for IDE bridges
370	 * we need to associate the quirk with the bridge and not the
371	 * underlying disk device.  This is handled by faking a success
372	 * result.
373	 */
374#define	NO_SYNCHRONIZE_CACHE	0x4000
375
376struct umass_softc {
377
378	struct scsi_sense cam_scsi_sense;
379	struct scsi_test_unit_ready cam_scsi_test_unit_ready;
380	struct mtx sc_mtx;
381	struct {
382		uint8_t *data_ptr;
383		union ccb *ccb;
384		umass_callback_t *callback;
385
386		uint32_t data_len;	/* bytes */
387		uint32_t data_rem;	/* bytes */
388		uint32_t data_timeout;	/* ms */
389		uint32_t actlen;	/* bytes */
390
391		uint8_t	cmd_data[UMASS_MAX_CMDLEN];
392		uint8_t	cmd_len;	/* bytes */
393		uint8_t	dir;
394		uint8_t	lun;
395	}	sc_transfer;
396
397	/* Bulk specific variables for transfers in progress */
398	umass_bbb_cbw_t cbw;		/* command block wrapper */
399	umass_bbb_csw_t csw;		/* command status wrapper */
400
401	/* CBI specific variables for transfers in progress */
402	umass_cbi_sbl_t sbl;		/* status block */
403
404	device_t sc_dev;
405	struct usb_device *sc_udev;
406	struct cam_sim *sc_sim;		/* SCSI Interface Module */
407	struct usb_xfer *sc_xfer[UMASS_T_MAX];
408
409	/*
410	 * The command transform function is used to convert the SCSI
411	 * commands into their derivatives, like UFI, ATAPI, and friends.
412	 */
413	umass_transform_t *sc_transform;
414
415	uint32_t sc_unit;
416	uint32_t sc_quirks;		/* they got it almost right */
417	uint32_t sc_proto;		/* wire and cmd protocol */
418
419	uint8_t	sc_name[16];
420	uint8_t	sc_iface_no;		/* interface number */
421	uint8_t	sc_maxlun;		/* maximum LUN number, inclusive */
422	uint8_t	sc_last_xfer_index;
423	uint8_t	sc_status_try;
424};
425
426struct umass_probe_proto {
427	uint32_t quirks;
428	uint32_t proto;
429
430	int	error;
431};
432
433/* prototypes */
434
435static device_probe_t umass_probe;
436static device_attach_t umass_attach;
437static device_detach_t umass_detach;
438
439static usb_callback_t umass_tr_error;
440static usb_callback_t umass_t_bbb_reset1_callback;
441static usb_callback_t umass_t_bbb_reset2_callback;
442static usb_callback_t umass_t_bbb_reset3_callback;
443static usb_callback_t umass_t_bbb_command_callback;
444static usb_callback_t umass_t_bbb_data_read_callback;
445static usb_callback_t umass_t_bbb_data_rd_cs_callback;
446static usb_callback_t umass_t_bbb_data_write_callback;
447static usb_callback_t umass_t_bbb_data_wr_cs_callback;
448static usb_callback_t umass_t_bbb_status_callback;
449static usb_callback_t umass_t_cbi_reset1_callback;
450static usb_callback_t umass_t_cbi_reset2_callback;
451static usb_callback_t umass_t_cbi_reset3_callback;
452static usb_callback_t umass_t_cbi_reset4_callback;
453static usb_callback_t umass_t_cbi_command_callback;
454static usb_callback_t umass_t_cbi_data_read_callback;
455static usb_callback_t umass_t_cbi_data_rd_cs_callback;
456static usb_callback_t umass_t_cbi_data_write_callback;
457static usb_callback_t umass_t_cbi_data_wr_cs_callback;
458static usb_callback_t umass_t_cbi_status_callback;
459
460static void	umass_cancel_ccb(struct umass_softc *);
461static void	umass_init_shuttle(struct umass_softc *);
462static void	umass_reset(struct umass_softc *);
463static void	umass_t_bbb_data_clear_stall_callback(struct usb_xfer *,
464		    uint8_t, uint8_t, usb_error_t);
465static void	umass_command_start(struct umass_softc *, uint8_t, void *,
466		    uint32_t, uint32_t, umass_callback_t *, union ccb *);
467static uint8_t	umass_bbb_get_max_lun(struct umass_softc *);
468static void	umass_cbi_start_status(struct umass_softc *);
469static void	umass_t_cbi_data_clear_stall_callback(struct usb_xfer *,
470		    uint8_t, uint8_t, usb_error_t);
471static int	umass_cam_attach_sim(struct umass_softc *);
472static void	umass_cam_attach(struct umass_softc *);
473static void	umass_cam_detach_sim(struct umass_softc *);
474static void	umass_cam_action(struct cam_sim *, union ccb *);
475static void	umass_cam_poll(struct cam_sim *);
476static void	umass_cam_cb(struct umass_softc *, union ccb *, uint32_t,
477		    uint8_t);
478static void	umass_cam_sense_cb(struct umass_softc *, union ccb *, uint32_t,
479		    uint8_t);
480static void	umass_cam_quirk_cb(struct umass_softc *, union ccb *, uint32_t,
481		    uint8_t);
482static uint8_t	umass_scsi_transform(struct umass_softc *, uint8_t *, uint8_t);
483static uint8_t	umass_rbc_transform(struct umass_softc *, uint8_t *, uint8_t);
484static uint8_t	umass_ufi_transform(struct umass_softc *, uint8_t *, uint8_t);
485static uint8_t	umass_atapi_transform(struct umass_softc *, uint8_t *,
486		    uint8_t);
487static uint8_t	umass_no_transform(struct umass_softc *, uint8_t *, uint8_t);
488static uint8_t	umass_std_transform(struct umass_softc *, union ccb *, uint8_t
489		    *, uint8_t);
490
491#ifdef USB_DEBUG
492static void	umass_bbb_dump_cbw(struct umass_softc *, umass_bbb_cbw_t *);
493static void	umass_bbb_dump_csw(struct umass_softc *, umass_bbb_csw_t *);
494static void	umass_cbi_dump_cmd(struct umass_softc *, void *, uint8_t);
495static void	umass_dump_buffer(struct umass_softc *, uint8_t *, uint32_t,
496		    uint32_t);
497#endif
498
499static struct usb_config umass_bbb_config[UMASS_T_BBB_MAX] = {
500
501	[UMASS_T_BBB_RESET1] = {
502		.type = UE_CONTROL,
503		.endpoint = 0x00,	/* Control pipe */
504		.direction = UE_DIR_ANY,
505		.bufsize = sizeof(struct usb_device_request),
506		.callback = &umass_t_bbb_reset1_callback,
507		.timeout = 5000,	/* 5 seconds */
508		.interval = 500,	/* 500 milliseconds */
509	},
510
511	[UMASS_T_BBB_RESET2] = {
512		.type = UE_CONTROL,
513		.endpoint = 0x00,	/* Control pipe */
514		.direction = UE_DIR_ANY,
515		.bufsize = sizeof(struct usb_device_request),
516		.callback = &umass_t_bbb_reset2_callback,
517		.timeout = 5000,	/* 5 seconds */
518		.interval = 50,	/* 50 milliseconds */
519	},
520
521	[UMASS_T_BBB_RESET3] = {
522		.type = UE_CONTROL,
523		.endpoint = 0x00,	/* Control pipe */
524		.direction = UE_DIR_ANY,
525		.bufsize = sizeof(struct usb_device_request),
526		.callback = &umass_t_bbb_reset3_callback,
527		.timeout = 5000,	/* 5 seconds */
528		.interval = 50,	/* 50 milliseconds */
529	},
530
531	[UMASS_T_BBB_COMMAND] = {
532		.type = UE_BULK,
533		.endpoint = UE_ADDR_ANY,
534		.direction = UE_DIR_OUT,
535		.bufsize = sizeof(umass_bbb_cbw_t),
536		.callback = &umass_t_bbb_command_callback,
537		.timeout = 5000,	/* 5 seconds */
538	},
539
540	[UMASS_T_BBB_DATA_READ] = {
541		.type = UE_BULK,
542		.endpoint = UE_ADDR_ANY,
543		.direction = UE_DIR_IN,
544		.bufsize = UMASS_BULK_SIZE,
545		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
546		.callback = &umass_t_bbb_data_read_callback,
547		.timeout = 0,	/* overwritten later */
548	},
549
550	[UMASS_T_BBB_DATA_RD_CS] = {
551		.type = UE_CONTROL,
552		.endpoint = 0x00,	/* Control pipe */
553		.direction = UE_DIR_ANY,
554		.bufsize = sizeof(struct usb_device_request),
555		.callback = &umass_t_bbb_data_rd_cs_callback,
556		.timeout = 5000,	/* 5 seconds */
557	},
558
559	[UMASS_T_BBB_DATA_WRITE] = {
560		.type = UE_BULK,
561		.endpoint = UE_ADDR_ANY,
562		.direction = UE_DIR_OUT,
563		.bufsize = UMASS_BULK_SIZE,
564		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
565		.callback = &umass_t_bbb_data_write_callback,
566		.timeout = 0,	/* overwritten later */
567	},
568
569	[UMASS_T_BBB_DATA_WR_CS] = {
570		.type = UE_CONTROL,
571		.endpoint = 0x00,	/* Control pipe */
572		.direction = UE_DIR_ANY,
573		.bufsize = sizeof(struct usb_device_request),
574		.callback = &umass_t_bbb_data_wr_cs_callback,
575		.timeout = 5000,	/* 5 seconds */
576	},
577
578	[UMASS_T_BBB_STATUS] = {
579		.type = UE_BULK,
580		.endpoint = UE_ADDR_ANY,
581		.direction = UE_DIR_IN,
582		.bufsize = sizeof(umass_bbb_csw_t),
583		.flags = {.short_xfer_ok = 1,},
584		.callback = &umass_t_bbb_status_callback,
585		.timeout = 5000,	/* ms */
586	},
587};
588
589static struct usb_config umass_cbi_config[UMASS_T_CBI_MAX] = {
590
591	[UMASS_T_CBI_RESET1] = {
592		.type = UE_CONTROL,
593		.endpoint = 0x00,	/* Control pipe */
594		.direction = UE_DIR_ANY,
595		.bufsize = (sizeof(struct usb_device_request) +
596		    UMASS_CBI_DIAGNOSTIC_CMDLEN),
597		.callback = &umass_t_cbi_reset1_callback,
598		.timeout = 5000,	/* 5 seconds */
599		.interval = 500,	/* 500 milliseconds */
600	},
601
602	[UMASS_T_CBI_RESET2] = {
603		.type = UE_CONTROL,
604		.endpoint = 0x00,	/* Control pipe */
605		.direction = UE_DIR_ANY,
606		.bufsize = sizeof(struct usb_device_request),
607		.callback = &umass_t_cbi_reset2_callback,
608		.timeout = 5000,	/* 5 seconds */
609		.interval = 50,	/* 50 milliseconds */
610	},
611
612	[UMASS_T_CBI_RESET3] = {
613		.type = UE_CONTROL,
614		.endpoint = 0x00,	/* Control pipe */
615		.direction = UE_DIR_ANY,
616		.bufsize = sizeof(struct usb_device_request),
617		.callback = &umass_t_cbi_reset3_callback,
618		.timeout = 5000,	/* 5 seconds */
619		.interval = 50,	/* 50 milliseconds */
620	},
621
622	[UMASS_T_CBI_COMMAND] = {
623		.type = UE_CONTROL,
624		.endpoint = 0x00,	/* Control pipe */
625		.direction = UE_DIR_ANY,
626		.bufsize = (sizeof(struct usb_device_request) +
627		    UMASS_MAX_CMDLEN),
628		.callback = &umass_t_cbi_command_callback,
629		.timeout = 5000,	/* 5 seconds */
630	},
631
632	[UMASS_T_CBI_DATA_READ] = {
633		.type = UE_BULK,
634		.endpoint = UE_ADDR_ANY,
635		.direction = UE_DIR_IN,
636		.bufsize = UMASS_BULK_SIZE,
637		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
638		.callback = &umass_t_cbi_data_read_callback,
639		.timeout = 0,	/* overwritten later */
640	},
641
642	[UMASS_T_CBI_DATA_RD_CS] = {
643		.type = UE_CONTROL,
644		.endpoint = 0x00,	/* Control pipe */
645		.direction = UE_DIR_ANY,
646		.bufsize = sizeof(struct usb_device_request),
647		.callback = &umass_t_cbi_data_rd_cs_callback,
648		.timeout = 5000,	/* 5 seconds */
649	},
650
651	[UMASS_T_CBI_DATA_WRITE] = {
652		.type = UE_BULK,
653		.endpoint = UE_ADDR_ANY,
654		.direction = UE_DIR_OUT,
655		.bufsize = UMASS_BULK_SIZE,
656		.flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
657		.callback = &umass_t_cbi_data_write_callback,
658		.timeout = 0,	/* overwritten later */
659	},
660
661	[UMASS_T_CBI_DATA_WR_CS] = {
662		.type = UE_CONTROL,
663		.endpoint = 0x00,	/* Control pipe */
664		.direction = UE_DIR_ANY,
665		.bufsize = sizeof(struct usb_device_request),
666		.callback = &umass_t_cbi_data_wr_cs_callback,
667		.timeout = 5000,	/* 5 seconds */
668	},
669
670	[UMASS_T_CBI_STATUS] = {
671		.type = UE_INTERRUPT,
672		.endpoint = UE_ADDR_ANY,
673		.direction = UE_DIR_IN,
674		.flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
675		.bufsize = sizeof(umass_cbi_sbl_t),
676		.callback = &umass_t_cbi_status_callback,
677		.timeout = 5000,	/* ms */
678	},
679
680	[UMASS_T_CBI_RESET4] = {
681		.type = UE_CONTROL,
682		.endpoint = 0x00,	/* Control pipe */
683		.direction = UE_DIR_ANY,
684		.bufsize = sizeof(struct usb_device_request),
685		.callback = &umass_t_cbi_reset4_callback,
686		.timeout = 5000,	/* ms */
687	},
688};
689
690/* If device cannot return valid inquiry data, fake it */
691static const uint8_t fake_inq_data[SHORT_INQUIRY_LENGTH] = {
692	0, /* removable */ 0x80, SCSI_REV_2, SCSI_REV_2,
693	 /* additional_length */ 31, 0, 0, 0
694};
695
696#define	UFI_COMMAND_LENGTH	12	/* UFI commands are always 12 bytes */
697#define	ATAPI_COMMAND_LENGTH	12	/* ATAPI commands are always 12 bytes */
698
699static devclass_t umass_devclass;
700
701static device_method_t umass_methods[] = {
702	/* Device interface */
703	DEVMETHOD(device_probe, umass_probe),
704	DEVMETHOD(device_attach, umass_attach),
705	DEVMETHOD(device_detach, umass_detach),
706	{0, 0}
707};
708
709static driver_t umass_driver = {
710	.name = "umass",
711	.methods = umass_methods,
712	.size = sizeof(struct umass_softc),
713};
714
715DRIVER_MODULE(umass, uhub, umass_driver, umass_devclass, NULL, 0);
716MODULE_DEPEND(umass, usb, 1, 1, 1);
717MODULE_DEPEND(umass, cam, 1, 1, 1);
718MODULE_VERSION(umass, 1);
719
720/*
721 * USB device probe/attach/detach
722 */
723
724static const STRUCT_USB_HOST_ID __used umass_devs[] = {
725	/* generic mass storage class */
726	{USB_IFACE_CLASS(UICLASS_MASS),},
727};
728
729static uint16_t
730umass_get_proto(struct usb_interface *iface)
731{
732	struct usb_interface_descriptor *id;
733	uint16_t retval;
734
735	retval = 0;
736
737	/* Check for a standards compliant device */
738	id = usbd_get_interface_descriptor(iface);
739	if ((id == NULL) ||
740	    (id->bInterfaceClass != UICLASS_MASS)) {
741		goto done;
742	}
743	switch (id->bInterfaceSubClass) {
744	case UISUBCLASS_SCSI:
745		retval |= UMASS_PROTO_SCSI;
746		break;
747	case UISUBCLASS_UFI:
748		retval |= UMASS_PROTO_UFI;
749		break;
750	case UISUBCLASS_RBC:
751		retval |= UMASS_PROTO_RBC;
752		break;
753	case UISUBCLASS_SFF8020I:
754	case UISUBCLASS_SFF8070I:
755		retval |= UMASS_PROTO_ATAPI;
756		break;
757	default:
758		goto done;
759	}
760
761	switch (id->bInterfaceProtocol) {
762	case UIPROTO_MASS_CBI:
763		retval |= UMASS_PROTO_CBI;
764		break;
765	case UIPROTO_MASS_CBI_I:
766		retval |= UMASS_PROTO_CBI_I;
767		break;
768	case UIPROTO_MASS_BBB_OLD:
769	case UIPROTO_MASS_BBB:
770		retval |= UMASS_PROTO_BBB;
771		break;
772	default:
773		goto done;
774	}
775done:
776	return (retval);
777}
778
779/*
780 * Match the device we are seeing with the devices supported.
781 */
782static struct umass_probe_proto
783umass_probe_proto(device_t dev, struct usb_attach_arg *uaa)
784{
785	struct umass_probe_proto ret;
786	uint32_t quirks = NO_QUIRKS;
787	uint32_t proto = umass_get_proto(uaa->iface);
788
789	memset(&ret, 0, sizeof(ret));
790	ret.error = BUS_PROBE_GENERIC;
791
792	/* Search for protocol enforcement */
793
794	if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_BBB)) {
795		proto &= ~UMASS_PROTO_WIRE;
796		proto |= UMASS_PROTO_BBB;
797	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI)) {
798		proto &= ~UMASS_PROTO_WIRE;
799		proto |= UMASS_PROTO_CBI;
800	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI_I)) {
801		proto &= ~UMASS_PROTO_WIRE;
802		proto |= UMASS_PROTO_CBI_I;
803	}
804
805	if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_SCSI)) {
806		proto &= ~UMASS_PROTO_COMMAND;
807		proto |= UMASS_PROTO_SCSI;
808	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_ATAPI)) {
809		proto &= ~UMASS_PROTO_COMMAND;
810		proto |= UMASS_PROTO_ATAPI;
811	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_UFI)) {
812		proto &= ~UMASS_PROTO_COMMAND;
813		proto |= UMASS_PROTO_UFI;
814	} else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_RBC)) {
815		proto &= ~UMASS_PROTO_COMMAND;
816		proto |= UMASS_PROTO_RBC;
817	}
818
819	/* Check if the protocol is invalid */
820
821	if ((proto & UMASS_PROTO_COMMAND) == 0) {
822		ret.error = ENXIO;
823		goto done;
824	}
825
826	if ((proto & UMASS_PROTO_WIRE) == 0) {
827		ret.error = ENXIO;
828		goto done;
829	}
830
831	/* Search for quirks */
832
833	if (usb_test_quirk(uaa, UQ_MSC_NO_TEST_UNIT_READY))
834		quirks |= NO_TEST_UNIT_READY;
835	if (usb_test_quirk(uaa, UQ_MSC_NO_RS_CLEAR_UA))
836		quirks |= RS_NO_CLEAR_UA;
837	if (usb_test_quirk(uaa, UQ_MSC_NO_START_STOP))
838		quirks |= NO_START_STOP;
839	if (usb_test_quirk(uaa, UQ_MSC_NO_GETMAXLUN))
840		quirks |= NO_GETMAXLUN;
841	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY))
842		quirks |= NO_INQUIRY;
843	if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY_EVPD))
844		quirks |= NO_INQUIRY_EVPD;
845	if (usb_test_quirk(uaa, UQ_MSC_NO_SYNC_CACHE))
846		quirks |= NO_SYNCHRONIZE_CACHE;
847	if (usb_test_quirk(uaa, UQ_MSC_SHUTTLE_INIT))
848		quirks |= SHUTTLE_INIT;
849	if (usb_test_quirk(uaa, UQ_MSC_ALT_IFACE_1))
850		quirks |= ALT_IFACE_1;
851	if (usb_test_quirk(uaa, UQ_MSC_FLOPPY_SPEED))
852		quirks |= FLOPPY_SPEED;
853	if (usb_test_quirk(uaa, UQ_MSC_IGNORE_RESIDUE))
854		quirks |= IGNORE_RESIDUE;
855	if (usb_test_quirk(uaa, UQ_MSC_WRONG_CSWSIG))
856		quirks |= WRONG_CSWSIG;
857	if (usb_test_quirk(uaa, UQ_MSC_RBC_PAD_TO_12))
858		quirks |= RBC_PAD_TO_12;
859	if (usb_test_quirk(uaa, UQ_MSC_READ_CAP_OFFBY1))
860		quirks |= READ_CAPACITY_OFFBY1;
861	if (usb_test_quirk(uaa, UQ_MSC_FORCE_SHORT_INQ))
862		quirks |= FORCE_SHORT_INQUIRY;
863
864done:
865	ret.quirks = quirks;
866	ret.proto = proto;
867	return (ret);
868}
869
870static int
871umass_probe(device_t dev)
872{
873	struct usb_attach_arg *uaa = device_get_ivars(dev);
874	struct umass_probe_proto temp;
875
876	if (uaa->usb_mode != USB_MODE_HOST) {
877		return (ENXIO);
878	}
879	temp = umass_probe_proto(dev, uaa);
880
881	return (temp.error);
882}
883
884static int
885umass_attach(device_t dev)
886{
887	struct umass_softc *sc = device_get_softc(dev);
888	struct usb_attach_arg *uaa = device_get_ivars(dev);
889	struct umass_probe_proto temp = umass_probe_proto(dev, uaa);
890	struct usb_interface_descriptor *id;
891	int32_t err;
892
893	/*
894	 * NOTE: the softc struct is bzero-ed in device_set_driver.
895	 * We can safely call umass_detach without specifically
896	 * initializing the struct.
897	 */
898
899	sc->sc_dev = dev;
900	sc->sc_udev = uaa->device;
901	sc->sc_proto = temp.proto;
902	sc->sc_quirks = temp.quirks;
903	sc->sc_unit = device_get_unit(dev);
904
905	snprintf(sc->sc_name, sizeof(sc->sc_name),
906	    "%s", device_get_nameunit(dev));
907
908	device_set_usb_desc(dev);
909
910        mtx_init(&sc->sc_mtx, device_get_nameunit(dev),
911	    NULL, MTX_DEF | MTX_RECURSE);
912
913	/* get interface index */
914
915	id = usbd_get_interface_descriptor(uaa->iface);
916	if (id == NULL) {
917		device_printf(dev, "failed to get "
918		    "interface number\n");
919		goto detach;
920	}
921	sc->sc_iface_no = id->bInterfaceNumber;
922
923#ifdef USB_DEBUG
924	device_printf(dev, " ");
925
926	switch (sc->sc_proto & UMASS_PROTO_COMMAND) {
927	case UMASS_PROTO_SCSI:
928		printf("SCSI");
929		break;
930	case UMASS_PROTO_ATAPI:
931		printf("8070i (ATAPI)");
932		break;
933	case UMASS_PROTO_UFI:
934		printf("UFI");
935		break;
936	case UMASS_PROTO_RBC:
937		printf("RBC");
938		break;
939	default:
940		printf("(unknown 0x%02x)",
941		    sc->sc_proto & UMASS_PROTO_COMMAND);
942		break;
943	}
944
945	printf(" over ");
946
947	switch (sc->sc_proto & UMASS_PROTO_WIRE) {
948	case UMASS_PROTO_BBB:
949		printf("Bulk-Only");
950		break;
951	case UMASS_PROTO_CBI:		/* uses Comand/Bulk pipes */
952		printf("CBI");
953		break;
954	case UMASS_PROTO_CBI_I:	/* uses Comand/Bulk/Interrupt pipes */
955		printf("CBI with CCI");
956		break;
957	default:
958		printf("(unknown 0x%02x)",
959		    sc->sc_proto & UMASS_PROTO_WIRE);
960	}
961
962	printf("; quirks = 0x%04x\n", sc->sc_quirks);
963#endif
964
965	if (sc->sc_quirks & ALT_IFACE_1) {
966		err = usbd_set_alt_interface_index
967		    (uaa->device, uaa->info.bIfaceIndex, 1);
968
969		if (err) {
970			DPRINTF(sc, UDMASS_USB, "could not switch to "
971			    "Alt Interface 1\n");
972			goto detach;
973		}
974	}
975	/* allocate all required USB transfers */
976
977	if (sc->sc_proto & UMASS_PROTO_BBB) {
978
979		err = usbd_transfer_setup(uaa->device,
980		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_bbb_config,
981		    UMASS_T_BBB_MAX, sc, &sc->sc_mtx);
982
983		/* skip reset first time */
984		sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
985
986	} else if (sc->sc_proto & (UMASS_PROTO_CBI | UMASS_PROTO_CBI_I)) {
987
988		err = usbd_transfer_setup(uaa->device,
989		    &uaa->info.bIfaceIndex, sc->sc_xfer, umass_cbi_config,
990		    UMASS_T_CBI_MAX, sc, &sc->sc_mtx);
991
992		/* skip reset first time */
993		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
994
995	} else {
996		err = USB_ERR_INVAL;
997	}
998
999	if (err) {
1000		device_printf(dev, "could not setup required "
1001		    "transfers, %s\n", usbd_errstr(err));
1002		goto detach;
1003	}
1004	sc->sc_transform =
1005	    (sc->sc_proto & UMASS_PROTO_SCSI) ? &umass_scsi_transform :
1006	    (sc->sc_proto & UMASS_PROTO_UFI) ? &umass_ufi_transform :
1007	    (sc->sc_proto & UMASS_PROTO_ATAPI) ? &umass_atapi_transform :
1008	    (sc->sc_proto & UMASS_PROTO_RBC) ? &umass_rbc_transform :
1009	    &umass_no_transform;
1010
1011	/* from here onwards the device can be used. */
1012
1013	if (sc->sc_quirks & SHUTTLE_INIT) {
1014		umass_init_shuttle(sc);
1015	}
1016	/* get the maximum LUN supported by the device */
1017
1018	if (((sc->sc_proto & UMASS_PROTO_WIRE) == UMASS_PROTO_BBB) &&
1019	    !(sc->sc_quirks & NO_GETMAXLUN))
1020		sc->sc_maxlun = umass_bbb_get_max_lun(sc);
1021	else
1022		sc->sc_maxlun = 0;
1023
1024	/* Prepare the SCSI command block */
1025	sc->cam_scsi_sense.opcode = REQUEST_SENSE;
1026	sc->cam_scsi_test_unit_ready.opcode = TEST_UNIT_READY;
1027
1028	/* register the SIM */
1029	err = umass_cam_attach_sim(sc);
1030	if (err) {
1031		goto detach;
1032	}
1033	/* scan the SIM */
1034	umass_cam_attach(sc);
1035
1036	DPRINTF(sc, UDMASS_GEN, "Attach finished\n");
1037
1038	return (0);			/* success */
1039
1040detach:
1041	umass_detach(dev);
1042	return (ENXIO);			/* failure */
1043}
1044
1045static int
1046umass_detach(device_t dev)
1047{
1048	struct umass_softc *sc = device_get_softc(dev);
1049
1050	DPRINTF(sc, UDMASS_USB, "\n");
1051
1052	/* teardown our statemachine */
1053
1054	usbd_transfer_unsetup(sc->sc_xfer, UMASS_T_MAX);
1055
1056#if (__FreeBSD_version >= 700037)
1057	mtx_lock(&sc->sc_mtx);
1058#endif
1059	umass_cam_detach_sim(sc);
1060
1061#if (__FreeBSD_version >= 700037)
1062	mtx_unlock(&sc->sc_mtx);
1063#endif
1064	mtx_destroy(&sc->sc_mtx);
1065
1066	return (0);			/* success */
1067}
1068
1069static void
1070umass_init_shuttle(struct umass_softc *sc)
1071{
1072	struct usb_device_request req;
1073	usb_error_t err;
1074	uint8_t status[2] = {0, 0};
1075
1076	/*
1077	 * The Linux driver does this, but no one can tell us what the
1078	 * command does.
1079	 */
1080	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1081	req.bRequest = 1;		/* XXX unknown command */
1082	USETW(req.wValue, 0);
1083	req.wIndex[0] = sc->sc_iface_no;
1084	req.wIndex[1] = 0;
1085	USETW(req.wLength, sizeof(status));
1086	err = usbd_do_request(sc->sc_udev, NULL, &req, &status);
1087
1088	DPRINTF(sc, UDMASS_GEN, "Shuttle init returned 0x%02x%02x\n",
1089	    status[0], status[1]);
1090}
1091
1092/*
1093 * Generic functions to handle transfers
1094 */
1095
1096static void
1097umass_transfer_start(struct umass_softc *sc, uint8_t xfer_index)
1098{
1099	DPRINTF(sc, UDMASS_GEN, "transfer index = "
1100	    "%d\n", xfer_index);
1101
1102	if (sc->sc_xfer[xfer_index]) {
1103		sc->sc_last_xfer_index = xfer_index;
1104		usbd_transfer_start(sc->sc_xfer[xfer_index]);
1105	} else {
1106		umass_cancel_ccb(sc);
1107	}
1108}
1109
1110static void
1111umass_reset(struct umass_softc *sc)
1112{
1113	DPRINTF(sc, UDMASS_GEN, "resetting device\n");
1114
1115	/*
1116	 * stop the last transfer, if not already stopped:
1117	 */
1118	usbd_transfer_stop(sc->sc_xfer[sc->sc_last_xfer_index]);
1119	umass_transfer_start(sc, 0);
1120}
1121
1122static void
1123umass_cancel_ccb(struct umass_softc *sc)
1124{
1125	union ccb *ccb;
1126
1127	mtx_assert(&sc->sc_mtx, MA_OWNED);
1128
1129	ccb = sc->sc_transfer.ccb;
1130	sc->sc_transfer.ccb = NULL;
1131	sc->sc_last_xfer_index = 0;
1132
1133	if (ccb) {
1134		(sc->sc_transfer.callback)
1135		    (sc, ccb, (sc->sc_transfer.data_len -
1136		    sc->sc_transfer.actlen), STATUS_WIRE_FAILED);
1137	}
1138}
1139
1140static void
1141umass_tr_error(struct usb_xfer *xfer, usb_error_t error)
1142{
1143	struct umass_softc *sc = usbd_xfer_softc(xfer);
1144
1145	if (error != USB_ERR_CANCELLED) {
1146
1147		DPRINTF(sc, UDMASS_GEN, "transfer error, %s -> "
1148		    "reset\n", usbd_errstr(error));
1149	}
1150	umass_cancel_ccb(sc);
1151}
1152
1153/*
1154 * BBB protocol specific functions
1155 */
1156
1157static void
1158umass_t_bbb_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1159{
1160	struct umass_softc *sc = usbd_xfer_softc(xfer);
1161	struct usb_device_request req;
1162	struct usb_page_cache *pc;
1163
1164	switch (USB_GET_STATE(xfer)) {
1165	case USB_ST_TRANSFERRED:
1166		umass_transfer_start(sc, UMASS_T_BBB_RESET2);
1167		return;
1168
1169	case USB_ST_SETUP:
1170		/*
1171		 * Reset recovery (5.3.4 in Universal Serial Bus Mass Storage Class)
1172		 *
1173		 * For Reset Recovery the host shall issue in the following order:
1174		 * a) a Bulk-Only Mass Storage Reset
1175		 * b) a Clear Feature HALT to the Bulk-In endpoint
1176		 * c) a Clear Feature HALT to the Bulk-Out endpoint
1177		 *
1178		 * This is done in 3 steps, using 3 transfers:
1179		 * UMASS_T_BBB_RESET1
1180		 * UMASS_T_BBB_RESET2
1181		 * UMASS_T_BBB_RESET3
1182		 */
1183
1184		DPRINTF(sc, UDMASS_BBB, "BBB reset!\n");
1185
1186		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1187		req.bRequest = UR_BBB_RESET;	/* bulk only reset */
1188		USETW(req.wValue, 0);
1189		req.wIndex[0] = sc->sc_iface_no;
1190		req.wIndex[1] = 0;
1191		USETW(req.wLength, 0);
1192
1193		pc = usbd_xfer_get_frame(xfer, 0);
1194		usbd_copy_in(pc, 0, &req, sizeof(req));
1195
1196		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1197		usbd_xfer_set_frames(xfer, 1);
1198		usbd_transfer_submit(xfer);
1199		return;
1200
1201	default:			/* Error */
1202		umass_tr_error(xfer, error);
1203		return;
1204
1205	}
1206}
1207
1208static void
1209umass_t_bbb_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1210{
1211	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_RESET3,
1212	    UMASS_T_BBB_DATA_READ, error);
1213}
1214
1215static void
1216umass_t_bbb_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1217{
1218	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_COMMAND,
1219	    UMASS_T_BBB_DATA_WRITE, error);
1220}
1221
1222static void
1223umass_t_bbb_data_clear_stall_callback(struct usb_xfer *xfer,
1224    uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1225{
1226	struct umass_softc *sc = usbd_xfer_softc(xfer);
1227
1228	switch (USB_GET_STATE(xfer)) {
1229	case USB_ST_TRANSFERRED:
1230tr_transferred:
1231		umass_transfer_start(sc, next_xfer);
1232		return;
1233
1234	case USB_ST_SETUP:
1235		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1236			goto tr_transferred;
1237		}
1238		return;
1239
1240	default:			/* Error */
1241		umass_tr_error(xfer, error);
1242		return;
1243
1244	}
1245}
1246
1247static void
1248umass_t_bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
1249{
1250	struct umass_softc *sc = usbd_xfer_softc(xfer);
1251	union ccb *ccb = sc->sc_transfer.ccb;
1252	struct usb_page_cache *pc;
1253	uint32_t tag;
1254
1255	switch (USB_GET_STATE(xfer)) {
1256	case USB_ST_TRANSFERRED:
1257		umass_transfer_start
1258		    (sc, ((sc->sc_transfer.dir == DIR_IN) ? UMASS_T_BBB_DATA_READ :
1259		    (sc->sc_transfer.dir == DIR_OUT) ? UMASS_T_BBB_DATA_WRITE :
1260		    UMASS_T_BBB_STATUS));
1261		return;
1262
1263	case USB_ST_SETUP:
1264
1265		sc->sc_status_try = 0;
1266
1267		if (ccb) {
1268
1269			/*
1270		         * the initial value is not important,
1271		         * as long as the values are unique:
1272		         */
1273			tag = UGETDW(sc->cbw.dCBWTag) + 1;
1274
1275			USETDW(sc->cbw.dCBWSignature, CBWSIGNATURE);
1276			USETDW(sc->cbw.dCBWTag, tag);
1277
1278			/*
1279		         * dCBWDataTransferLength:
1280		         *   This field indicates the number of bytes of data that the host
1281		         *   intends to transfer on the IN or OUT Bulk endpoint(as indicated by
1282		         *   the Direction bit) during the execution of this command. If this
1283		         *   field is set to 0, the device will expect that no data will be
1284		         *   transferred IN or OUT during this command, regardless of the value
1285		         *   of the Direction bit defined in dCBWFlags.
1286		         */
1287			USETDW(sc->cbw.dCBWDataTransferLength, sc->sc_transfer.data_len);
1288
1289			/*
1290		         * dCBWFlags:
1291		         *   The bits of the Flags field are defined as follows:
1292		         *     Bits 0-6  reserved
1293		         *     Bit  7    Direction - this bit shall be ignored if the
1294		         *                           dCBWDataTransferLength field is zero.
1295		         *               0 = data Out from host to device
1296		         *               1 = data In from device to host
1297		         */
1298			sc->cbw.bCBWFlags = ((sc->sc_transfer.dir == DIR_IN) ?
1299			    CBWFLAGS_IN : CBWFLAGS_OUT);
1300			sc->cbw.bCBWLUN = sc->sc_transfer.lun;
1301
1302			if (sc->sc_transfer.cmd_len > sizeof(sc->cbw.CBWCDB)) {
1303				sc->sc_transfer.cmd_len = sizeof(sc->cbw.CBWCDB);
1304				DPRINTF(sc, UDMASS_BBB, "Truncating long command!\n");
1305			}
1306			sc->cbw.bCDBLength = sc->sc_transfer.cmd_len;
1307
1308			bcopy(sc->sc_transfer.cmd_data, sc->cbw.CBWCDB,
1309			    sc->sc_transfer.cmd_len);
1310
1311			bzero(sc->sc_transfer.cmd_data + sc->sc_transfer.cmd_len,
1312			    sizeof(sc->cbw.CBWCDB) - sc->sc_transfer.cmd_len);
1313
1314			DIF(UDMASS_BBB, umass_bbb_dump_cbw(sc, &sc->cbw));
1315
1316			pc = usbd_xfer_get_frame(xfer, 0);
1317			usbd_copy_in(pc, 0, &sc->cbw, sizeof(sc->cbw));
1318			usbd_xfer_set_frame_len(xfer, 0, sizeof(sc->cbw));
1319
1320			usbd_transfer_submit(xfer);
1321		}
1322		return;
1323
1324	default:			/* Error */
1325		umass_tr_error(xfer, error);
1326		return;
1327
1328	}
1329}
1330
1331static void
1332umass_t_bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1333{
1334	struct umass_softc *sc = usbd_xfer_softc(xfer);
1335	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1336#ifndef UMASS_EXT_BUFFER
1337	struct usb_page_cache *pc;
1338#endif
1339	int actlen, sumlen;
1340
1341	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1342
1343	switch (USB_GET_STATE(xfer)) {
1344	case USB_ST_TRANSFERRED:
1345#ifndef UMASS_EXT_BUFFER
1346		pc = usbd_xfer_get_frame(xfer, 0);
1347		usbd_copy_out(pc, 0, sc->sc_transfer.data_ptr, actlen);
1348#endif
1349		sc->sc_transfer.data_rem -= actlen;
1350		sc->sc_transfer.data_ptr += actlen;
1351		sc->sc_transfer.actlen += actlen;
1352
1353		if (actlen < sumlen) {
1354			/* short transfer */
1355			sc->sc_transfer.data_rem = 0;
1356		}
1357	case USB_ST_SETUP:
1358		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1359		    max_bulk, sc->sc_transfer.data_rem);
1360
1361		if (sc->sc_transfer.data_rem == 0) {
1362			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1363			return;
1364		}
1365		if (max_bulk > sc->sc_transfer.data_rem) {
1366			max_bulk = sc->sc_transfer.data_rem;
1367		}
1368		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1369
1370#ifdef UMASS_EXT_BUFFER
1371		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1372		    max_bulk);
1373#else
1374		usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1375#endif
1376		usbd_transfer_submit(xfer);
1377		return;
1378
1379	default:			/* Error */
1380		if (error == USB_ERR_CANCELLED) {
1381			umass_tr_error(xfer, error);
1382		} else {
1383			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1384		}
1385		return;
1386
1387	}
1388}
1389
1390static void
1391umass_t_bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1392{
1393	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1394	    UMASS_T_BBB_DATA_READ, error);
1395}
1396
1397static void
1398umass_t_bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1399{
1400	struct umass_softc *sc = usbd_xfer_softc(xfer);
1401	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1402#ifndef UMASS_EXT_BUFFER
1403	struct usb_page_cache *pc;
1404#endif
1405	int actlen, sumlen;
1406
1407	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1408
1409	switch (USB_GET_STATE(xfer)) {
1410	case USB_ST_TRANSFERRED:
1411		sc->sc_transfer.data_rem -= actlen;
1412		sc->sc_transfer.data_ptr += actlen;
1413		sc->sc_transfer.actlen += actlen;
1414
1415		if (actlen < sumlen) {
1416			/* short transfer */
1417			sc->sc_transfer.data_rem = 0;
1418		}
1419	case USB_ST_SETUP:
1420		DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1421		    max_bulk, sc->sc_transfer.data_rem);
1422
1423		if (sc->sc_transfer.data_rem == 0) {
1424			umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1425			return;
1426		}
1427		if (max_bulk > sc->sc_transfer.data_rem) {
1428			max_bulk = sc->sc_transfer.data_rem;
1429		}
1430		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1431
1432#ifdef UMASS_EXT_BUFFER
1433		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1434		    max_bulk);
1435#else
1436		pc = usbd_xfer_get_frame(xfer, 0);
1437		usbd_copy_in(pc, 0, sc->sc_transfer.data_ptr, max_bulk);
1438		usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1439#endif
1440
1441		usbd_transfer_submit(xfer);
1442		return;
1443
1444	default:			/* Error */
1445		if (error == USB_ERR_CANCELLED) {
1446			umass_tr_error(xfer, error);
1447		} else {
1448			umass_transfer_start(sc, UMASS_T_BBB_DATA_WR_CS);
1449		}
1450		return;
1451
1452	}
1453}
1454
1455static void
1456umass_t_bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1457{
1458	umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1459	    UMASS_T_BBB_DATA_WRITE, error);
1460}
1461
1462static void
1463umass_t_bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
1464{
1465	struct umass_softc *sc = usbd_xfer_softc(xfer);
1466	union ccb *ccb = sc->sc_transfer.ccb;
1467	struct usb_page_cache *pc;
1468	uint32_t residue;
1469	int actlen;
1470
1471	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1472
1473	switch (USB_GET_STATE(xfer)) {
1474	case USB_ST_TRANSFERRED:
1475
1476		/*
1477		 * Do a full reset if there is something wrong with the CSW:
1478		 */
1479		sc->sc_status_try = 1;
1480
1481		/* Zero missing parts of the CSW: */
1482
1483		if (actlen < sizeof(sc->csw)) {
1484			bzero(&sc->csw, sizeof(sc->csw));
1485		}
1486		pc = usbd_xfer_get_frame(xfer, 0);
1487		usbd_copy_out(pc, 0, &sc->csw, actlen);
1488
1489		DIF(UDMASS_BBB, umass_bbb_dump_csw(sc, &sc->csw));
1490
1491		residue = UGETDW(sc->csw.dCSWDataResidue);
1492
1493		if ((!residue) || (sc->sc_quirks & IGNORE_RESIDUE)) {
1494			residue = (sc->sc_transfer.data_len -
1495			    sc->sc_transfer.actlen);
1496		}
1497		if (residue > sc->sc_transfer.data_len) {
1498			DPRINTF(sc, UDMASS_BBB, "truncating residue from %d "
1499			    "to %d bytes\n", residue, sc->sc_transfer.data_len);
1500			residue = sc->sc_transfer.data_len;
1501		}
1502		/* translate weird command-status signatures: */
1503		if (sc->sc_quirks & WRONG_CSWSIG) {
1504
1505			uint32_t temp = UGETDW(sc->csw.dCSWSignature);
1506
1507			if ((temp == CSWSIGNATURE_OLYMPUS_C1) ||
1508			    (temp == CSWSIGNATURE_IMAGINATION_DBX1)) {
1509				USETDW(sc->csw.dCSWSignature, CSWSIGNATURE);
1510			}
1511		}
1512		/* check CSW and handle eventual error */
1513		if (UGETDW(sc->csw.dCSWSignature) != CSWSIGNATURE) {
1514			DPRINTF(sc, UDMASS_BBB, "bad CSW signature 0x%08x != 0x%08x\n",
1515			    UGETDW(sc->csw.dCSWSignature), CSWSIGNATURE);
1516			/*
1517			 * Invalid CSW: Wrong signature or wrong tag might
1518			 * indicate that we lost synchronization. Reset the
1519			 * device.
1520			 */
1521			goto tr_error;
1522		} else if (UGETDW(sc->csw.dCSWTag) != UGETDW(sc->cbw.dCBWTag)) {
1523			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: tag 0x%08x should be "
1524			    "0x%08x\n", UGETDW(sc->csw.dCSWTag),
1525			    UGETDW(sc->cbw.dCBWTag));
1526			goto tr_error;
1527		} else if (sc->csw.bCSWStatus > CSWSTATUS_PHASE) {
1528			DPRINTF(sc, UDMASS_BBB, "Invalid CSW: status %d > %d\n",
1529			    sc->csw.bCSWStatus, CSWSTATUS_PHASE);
1530			goto tr_error;
1531		} else if (sc->csw.bCSWStatus == CSWSTATUS_PHASE) {
1532			DPRINTF(sc, UDMASS_BBB, "Phase error, residue = "
1533			    "%d\n", residue);
1534			goto tr_error;
1535		} else if (sc->sc_transfer.actlen > sc->sc_transfer.data_len) {
1536			DPRINTF(sc, UDMASS_BBB, "Buffer overrun %d > %d\n",
1537			    sc->sc_transfer.actlen, sc->sc_transfer.data_len);
1538			goto tr_error;
1539		} else if (sc->csw.bCSWStatus == CSWSTATUS_FAILED) {
1540			DPRINTF(sc, UDMASS_BBB, "Command failed, residue = "
1541			    "%d\n", residue);
1542
1543			sc->sc_transfer.ccb = NULL;
1544
1545			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1546
1547			(sc->sc_transfer.callback)
1548			    (sc, ccb, residue, STATUS_CMD_FAILED);
1549		} else {
1550			sc->sc_transfer.ccb = NULL;
1551
1552			sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1553
1554			(sc->sc_transfer.callback)
1555			    (sc, ccb, residue, STATUS_CMD_OK);
1556		}
1557		return;
1558
1559	case USB_ST_SETUP:
1560		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1561		usbd_transfer_submit(xfer);
1562		return;
1563
1564	default:
1565tr_error:
1566		DPRINTF(sc, UDMASS_BBB, "Failed to read CSW: %s, try %d\n",
1567		    usbd_errstr(error), sc->sc_status_try);
1568
1569		if ((error == USB_ERR_CANCELLED) ||
1570		    (sc->sc_status_try)) {
1571			umass_tr_error(xfer, error);
1572		} else {
1573			sc->sc_status_try = 1;
1574			umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1575		}
1576		return;
1577
1578	}
1579}
1580
1581static void
1582umass_command_start(struct umass_softc *sc, uint8_t dir,
1583    void *data_ptr, uint32_t data_len,
1584    uint32_t data_timeout, umass_callback_t *callback,
1585    union ccb *ccb)
1586{
1587	sc->sc_transfer.lun = ccb->ccb_h.target_lun;
1588
1589	/*
1590	 * NOTE: assumes that "sc->sc_transfer.cmd_data" and
1591	 * "sc->sc_transfer.cmd_len" has been properly
1592	 * initialized.
1593	 */
1594
1595	sc->sc_transfer.dir = data_len ? dir : DIR_NONE;
1596	sc->sc_transfer.data_ptr = data_ptr;
1597	sc->sc_transfer.data_len = data_len;
1598	sc->sc_transfer.data_rem = data_len;
1599	sc->sc_transfer.data_timeout = (data_timeout + UMASS_TIMEOUT);
1600
1601	sc->sc_transfer.actlen = 0;
1602	sc->sc_transfer.callback = callback;
1603	sc->sc_transfer.ccb = ccb;
1604
1605	if (sc->sc_xfer[sc->sc_last_xfer_index]) {
1606		usbd_transfer_start(sc->sc_xfer[sc->sc_last_xfer_index]);
1607	} else {
1608		ccb->ccb_h.status = CAM_TID_INVALID;
1609		xpt_done(ccb);
1610	}
1611}
1612
1613static uint8_t
1614umass_bbb_get_max_lun(struct umass_softc *sc)
1615{
1616	struct usb_device_request req;
1617	usb_error_t err;
1618	uint8_t buf = 0;
1619
1620	/* The Get Max Lun command is a class-specific request. */
1621	req.bmRequestType = UT_READ_CLASS_INTERFACE;
1622	req.bRequest = UR_BBB_GET_MAX_LUN;
1623	USETW(req.wValue, 0);
1624	req.wIndex[0] = sc->sc_iface_no;
1625	req.wIndex[1] = 0;
1626	USETW(req.wLength, 1);
1627
1628	err = usbd_do_request(sc->sc_udev, NULL, &req, &buf);
1629	if (err) {
1630		buf = 0;
1631
1632		/* Device doesn't support Get Max Lun request. */
1633		printf("%s: Get Max Lun not supported (%s)\n",
1634		    sc->sc_name, usbd_errstr(err));
1635	}
1636	return (buf);
1637}
1638
1639/*
1640 * Command/Bulk/Interrupt (CBI) specific functions
1641 */
1642
1643static void
1644umass_cbi_start_status(struct umass_softc *sc)
1645{
1646	if (sc->sc_xfer[UMASS_T_CBI_STATUS]) {
1647		umass_transfer_start(sc, UMASS_T_CBI_STATUS);
1648	} else {
1649		union ccb *ccb = sc->sc_transfer.ccb;
1650
1651		sc->sc_transfer.ccb = NULL;
1652
1653		sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1654
1655		(sc->sc_transfer.callback)
1656		    (sc, ccb, (sc->sc_transfer.data_len -
1657		    sc->sc_transfer.actlen), STATUS_CMD_UNKNOWN);
1658	}
1659}
1660
1661static void
1662umass_t_cbi_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1663{
1664	struct umass_softc *sc = usbd_xfer_softc(xfer);
1665	struct usb_device_request req;
1666	struct usb_page_cache *pc;
1667	uint8_t buf[UMASS_CBI_DIAGNOSTIC_CMDLEN];
1668
1669	uint8_t i;
1670
1671	switch (USB_GET_STATE(xfer)) {
1672	case USB_ST_TRANSFERRED:
1673		umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1674		break;
1675
1676	case USB_ST_SETUP:
1677		/*
1678		 * Command Block Reset Protocol
1679		 *
1680		 * First send a reset request to the device. Then clear
1681		 * any possibly stalled bulk endpoints.
1682		 *
1683		 * This is done in 3 steps, using 3 transfers:
1684		 * UMASS_T_CBI_RESET1
1685		 * UMASS_T_CBI_RESET2
1686		 * UMASS_T_CBI_RESET3
1687		 * UMASS_T_CBI_RESET4 (only if there is an interrupt endpoint)
1688		 */
1689
1690		DPRINTF(sc, UDMASS_CBI, "CBI reset!\n");
1691
1692		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1693		req.bRequest = UR_CBI_ADSC;
1694		USETW(req.wValue, 0);
1695		req.wIndex[0] = sc->sc_iface_no;
1696		req.wIndex[1] = 0;
1697		USETW(req.wLength, UMASS_CBI_DIAGNOSTIC_CMDLEN);
1698
1699		/*
1700		 * The 0x1d code is the SEND DIAGNOSTIC command. To
1701		 * distinguish between the two, the last 10 bytes of the CBL
1702		 * is filled with 0xff (section 2.2 of the CBI
1703		 * specification)
1704		 */
1705		buf[0] = 0x1d;		/* Command Block Reset */
1706		buf[1] = 0x04;
1707
1708		for (i = 2; i < UMASS_CBI_DIAGNOSTIC_CMDLEN; i++) {
1709			buf[i] = 0xff;
1710		}
1711
1712		pc = usbd_xfer_get_frame(xfer, 0);
1713		usbd_copy_in(pc, 0, &req, sizeof(req));
1714		pc = usbd_xfer_get_frame(xfer, 1);
1715		usbd_copy_in(pc, 0, buf, sizeof(buf));
1716
1717		usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1718		usbd_xfer_set_frame_len(xfer, 1, sizeof(buf));
1719		usbd_xfer_set_frames(xfer, 2);
1720		usbd_transfer_submit(xfer);
1721		break;
1722
1723	default:			/* Error */
1724		if (error == USB_ERR_CANCELLED)
1725			umass_tr_error(xfer, error);
1726		else
1727			umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1728		break;
1729
1730	}
1731}
1732
1733static void
1734umass_t_cbi_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1735{
1736	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_RESET3,
1737	    UMASS_T_CBI_DATA_READ, error);
1738}
1739
1740static void
1741umass_t_cbi_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1742{
1743	struct umass_softc *sc = usbd_xfer_softc(xfer);
1744
1745	umass_t_cbi_data_clear_stall_callback
1746	    (xfer, (sc->sc_xfer[UMASS_T_CBI_RESET4] &&
1747	    sc->sc_xfer[UMASS_T_CBI_STATUS]) ?
1748	    UMASS_T_CBI_RESET4 : UMASS_T_CBI_COMMAND,
1749	    UMASS_T_CBI_DATA_WRITE, error);
1750}
1751
1752static void
1753umass_t_cbi_reset4_callback(struct usb_xfer *xfer, usb_error_t error)
1754{
1755	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_COMMAND,
1756	    UMASS_T_CBI_STATUS, error);
1757}
1758
1759static void
1760umass_t_cbi_data_clear_stall_callback(struct usb_xfer *xfer,
1761    uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1762{
1763	struct umass_softc *sc = usbd_xfer_softc(xfer);
1764
1765	switch (USB_GET_STATE(xfer)) {
1766	case USB_ST_TRANSFERRED:
1767tr_transferred:
1768		if (next_xfer == UMASS_T_CBI_STATUS) {
1769			umass_cbi_start_status(sc);
1770		} else {
1771			umass_transfer_start(sc, next_xfer);
1772		}
1773		break;
1774
1775	case USB_ST_SETUP:
1776		if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1777			goto tr_transferred;	/* should not happen */
1778		}
1779		break;
1780
1781	default:			/* Error */
1782		umass_tr_error(xfer, error);
1783		break;
1784
1785	}
1786}
1787
1788static void
1789umass_t_cbi_command_callback(struct usb_xfer *xfer, usb_error_t error)
1790{
1791	struct umass_softc *sc = usbd_xfer_softc(xfer);
1792	union ccb *ccb = sc->sc_transfer.ccb;
1793	struct usb_device_request req;
1794	struct usb_page_cache *pc;
1795
1796	switch (USB_GET_STATE(xfer)) {
1797	case USB_ST_TRANSFERRED:
1798
1799		if (sc->sc_transfer.dir == DIR_NONE) {
1800			umass_cbi_start_status(sc);
1801		} else {
1802			umass_transfer_start
1803			    (sc, (sc->sc_transfer.dir == DIR_IN) ?
1804			    UMASS_T_CBI_DATA_READ : UMASS_T_CBI_DATA_WRITE);
1805		}
1806		break;
1807
1808	case USB_ST_SETUP:
1809
1810		if (ccb) {
1811
1812			/*
1813		         * do a CBI transfer with cmd_len bytes from
1814		         * cmd_data, possibly a data phase of data_len
1815		         * bytes from/to the device and finally a status
1816		         * read phase.
1817		         */
1818
1819			req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1820			req.bRequest = UR_CBI_ADSC;
1821			USETW(req.wValue, 0);
1822			req.wIndex[0] = sc->sc_iface_no;
1823			req.wIndex[1] = 0;
1824			req.wLength[0] = sc->sc_transfer.cmd_len;
1825			req.wLength[1] = 0;
1826
1827			pc = usbd_xfer_get_frame(xfer, 0);
1828			usbd_copy_in(pc, 0, &req, sizeof(req));
1829			pc = usbd_xfer_get_frame(xfer, 1);
1830			usbd_copy_in(pc, 0, sc->sc_transfer.cmd_data,
1831			    sc->sc_transfer.cmd_len);
1832
1833			usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1834			usbd_xfer_set_frame_len(xfer, 1, sc->sc_transfer.cmd_len);
1835			usbd_xfer_set_frames(xfer,
1836			    sc->sc_transfer.cmd_len ? 2 : 1);
1837
1838			DIF(UDMASS_CBI,
1839			    umass_cbi_dump_cmd(sc,
1840			    sc->sc_transfer.cmd_data,
1841			    sc->sc_transfer.cmd_len));
1842
1843			usbd_transfer_submit(xfer);
1844		}
1845		break;
1846
1847	default:			/* Error */
1848		/*
1849		 * STALL on the control pipe can be result of the command error.
1850		 * Attempt to clear this STALL same as for bulk pipe also
1851		 * results in command completion interrupt, but ASC/ASCQ there
1852		 * look like not always valid, so don't bother about it.
1853		 */
1854		if ((error == USB_ERR_STALLED) ||
1855		    (sc->sc_transfer.callback == &umass_cam_cb)) {
1856			sc->sc_transfer.ccb = NULL;
1857			(sc->sc_transfer.callback)
1858			    (sc, ccb, sc->sc_transfer.data_len,
1859			    STATUS_CMD_UNKNOWN);
1860		} else {
1861			umass_tr_error(xfer, error);
1862			/* skip reset */
1863			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1864		}
1865		break;
1866	}
1867}
1868
1869static void
1870umass_t_cbi_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1871{
1872	struct umass_softc *sc = usbd_xfer_softc(xfer);
1873	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1874#ifndef UMASS_EXT_BUFFER
1875	struct usb_page_cache *pc;
1876#endif
1877	int actlen, sumlen;
1878
1879	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1880
1881	switch (USB_GET_STATE(xfer)) {
1882	case USB_ST_TRANSFERRED:
1883#ifndef UMASS_EXT_BUFFER
1884		pc = usbd_xfer_get_frame(xfer, 0);
1885		usbd_copy_out(pc, 0, sc->sc_transfer.data_ptr, actlen);
1886#endif
1887		sc->sc_transfer.data_rem -= actlen;
1888		sc->sc_transfer.data_ptr += actlen;
1889		sc->sc_transfer.actlen += actlen;
1890
1891		if (actlen < sumlen) {
1892			/* short transfer */
1893			sc->sc_transfer.data_rem = 0;
1894		}
1895	case USB_ST_SETUP:
1896		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1897		    max_bulk, sc->sc_transfer.data_rem);
1898
1899		if (sc->sc_transfer.data_rem == 0) {
1900			umass_cbi_start_status(sc);
1901			break;
1902		}
1903		if (max_bulk > sc->sc_transfer.data_rem) {
1904			max_bulk = sc->sc_transfer.data_rem;
1905		}
1906		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1907
1908#ifdef UMASS_EXT_BUFFER
1909		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1910		    max_bulk);
1911#else
1912		usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1913#endif
1914		usbd_transfer_submit(xfer);
1915		break;
1916
1917	default:			/* Error */
1918		if ((error == USB_ERR_CANCELLED) ||
1919		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1920			umass_tr_error(xfer, error);
1921		} else {
1922			umass_transfer_start(sc, UMASS_T_CBI_DATA_RD_CS);
1923		}
1924		break;
1925
1926	}
1927}
1928
1929static void
1930umass_t_cbi_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1931{
1932	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1933	    UMASS_T_CBI_DATA_READ, error);
1934}
1935
1936static void
1937umass_t_cbi_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1938{
1939	struct umass_softc *sc = usbd_xfer_softc(xfer);
1940	uint32_t max_bulk = usbd_xfer_max_len(xfer);
1941#ifndef UMASS_EXT_BUFFER
1942	struct usb_page_cache *pc;
1943#endif
1944	int actlen, sumlen;
1945
1946	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1947
1948	switch (USB_GET_STATE(xfer)) {
1949	case USB_ST_TRANSFERRED:
1950		sc->sc_transfer.data_rem -= actlen;
1951		sc->sc_transfer.data_ptr += actlen;
1952		sc->sc_transfer.actlen += actlen;
1953
1954		if (actlen < sumlen) {
1955			/* short transfer */
1956			sc->sc_transfer.data_rem = 0;
1957		}
1958	case USB_ST_SETUP:
1959		DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1960		    max_bulk, sc->sc_transfer.data_rem);
1961
1962		if (sc->sc_transfer.data_rem == 0) {
1963			umass_cbi_start_status(sc);
1964			break;
1965		}
1966		if (max_bulk > sc->sc_transfer.data_rem) {
1967			max_bulk = sc->sc_transfer.data_rem;
1968		}
1969		usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1970
1971#ifdef UMASS_EXT_BUFFER
1972		usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1973		    max_bulk);
1974#else
1975		pc = usbd_xfer_get_frame(xfer, 0);
1976		usbd_copy_in(pc, 0, sc->sc_transfer.data_ptr, max_bulk);
1977		usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1978#endif
1979
1980		usbd_transfer_submit(xfer);
1981		break;
1982
1983	default:			/* Error */
1984		if ((error == USB_ERR_CANCELLED) ||
1985		    (sc->sc_transfer.callback != &umass_cam_cb)) {
1986			umass_tr_error(xfer, error);
1987		} else {
1988			umass_transfer_start(sc, UMASS_T_CBI_DATA_WR_CS);
1989		}
1990		break;
1991
1992	}
1993}
1994
1995static void
1996umass_t_cbi_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1997{
1998	umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1999	    UMASS_T_CBI_DATA_WRITE, error);
2000}
2001
2002static void
2003umass_t_cbi_status_callback(struct usb_xfer *xfer, usb_error_t error)
2004{
2005	struct umass_softc *sc = usbd_xfer_softc(xfer);
2006	union ccb *ccb = sc->sc_transfer.ccb;
2007	struct usb_page_cache *pc;
2008	uint32_t residue;
2009	uint8_t status;
2010	int actlen;
2011
2012	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
2013
2014	switch (USB_GET_STATE(xfer)) {
2015	case USB_ST_TRANSFERRED:
2016
2017		if (actlen < sizeof(sc->sbl)) {
2018			goto tr_setup;
2019		}
2020		pc = usbd_xfer_get_frame(xfer, 0);
2021		usbd_copy_out(pc, 0, &sc->sbl, sizeof(sc->sbl));
2022
2023		residue = (sc->sc_transfer.data_len -
2024		    sc->sc_transfer.actlen);
2025
2026		/* dissect the information in the buffer */
2027
2028		if (sc->sc_proto & UMASS_PROTO_UFI) {
2029
2030			/*
2031			 * Section 3.4.3.1.3 specifies that the UFI command
2032			 * protocol returns an ASC and ASCQ in the interrupt
2033			 * data block.
2034			 */
2035
2036			DPRINTF(sc, UDMASS_CBI, "UFI CCI, ASC = 0x%02x, "
2037			    "ASCQ = 0x%02x\n", sc->sbl.ufi.asc,
2038			    sc->sbl.ufi.ascq);
2039
2040			status = (((sc->sbl.ufi.asc == 0) &&
2041			    (sc->sbl.ufi.ascq == 0)) ?
2042			    STATUS_CMD_OK : STATUS_CMD_FAILED);
2043
2044			sc->sc_transfer.ccb = NULL;
2045
2046			sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2047
2048			(sc->sc_transfer.callback)
2049			    (sc, ccb, residue, status);
2050
2051			break;
2052
2053		} else {
2054
2055			/* Command Interrupt Data Block */
2056
2057			DPRINTF(sc, UDMASS_CBI, "type=0x%02x, value=0x%02x\n",
2058			    sc->sbl.common.type, sc->sbl.common.value);
2059
2060			if (sc->sbl.common.type == IDB_TYPE_CCI) {
2061
2062				status = (sc->sbl.common.value & IDB_VALUE_STATUS_MASK);
2063
2064				status = ((status == IDB_VALUE_PASS) ? STATUS_CMD_OK :
2065				    (status == IDB_VALUE_FAIL) ? STATUS_CMD_FAILED :
2066				    (status == IDB_VALUE_PERSISTENT) ? STATUS_CMD_FAILED :
2067				    STATUS_WIRE_FAILED);
2068
2069				sc->sc_transfer.ccb = NULL;
2070
2071				sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2072
2073				(sc->sc_transfer.callback)
2074				    (sc, ccb, residue, status);
2075
2076				break;
2077			}
2078		}
2079
2080		/* fallthrough */
2081
2082	case USB_ST_SETUP:
2083tr_setup:
2084		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2085		usbd_transfer_submit(xfer);
2086		break;
2087
2088	default:			/* Error */
2089		DPRINTF(sc, UDMASS_CBI, "Failed to read CSW: %s\n",
2090		    usbd_errstr(error));
2091		umass_tr_error(xfer, error);
2092		break;
2093
2094	}
2095}
2096
2097/*
2098 * CAM specific functions (used by SCSI, UFI, 8070i (ATAPI))
2099 */
2100
2101static int
2102umass_cam_attach_sim(struct umass_softc *sc)
2103{
2104	struct cam_devq *devq;		/* Per device Queue */
2105
2106	/*
2107	 * A HBA is attached to the CAM layer.
2108	 *
2109	 * The CAM layer will then after a while start probing for devices on
2110	 * the bus. The number of SIMs is limited to one.
2111	 */
2112
2113	devq = cam_simq_alloc(1 /* maximum openings */ );
2114	if (devq == NULL) {
2115		return (ENOMEM);
2116	}
2117	sc->sc_sim = cam_sim_alloc
2118	    (&umass_cam_action, &umass_cam_poll,
2119	    DEVNAME_SIM,
2120	    sc /* priv */ ,
2121	    sc->sc_unit /* unit number */ ,
2122#if (__FreeBSD_version >= 700037)
2123	    &sc->sc_mtx /* mutex */ ,
2124#endif
2125	    1 /* maximum device openings */ ,
2126	    0 /* maximum tagged device openings */ ,
2127	    devq);
2128
2129	if (sc->sc_sim == NULL) {
2130		cam_simq_free(devq);
2131		return (ENOMEM);
2132	}
2133
2134#if (__FreeBSD_version >= 700037)
2135	mtx_lock(&sc->sc_mtx);
2136#endif
2137
2138#if (__FreeBSD_version >= 700048)
2139	if (xpt_bus_register(sc->sc_sim, sc->sc_dev, sc->sc_unit) != CAM_SUCCESS) {
2140		mtx_unlock(&sc->sc_mtx);
2141		return (ENOMEM);
2142	}
2143#else
2144	if (xpt_bus_register(sc->sc_sim, sc->sc_unit) != CAM_SUCCESS) {
2145#if (__FreeBSD_version >= 700037)
2146		mtx_unlock(&sc->sc_mtx);
2147#endif
2148		return (ENOMEM);
2149	}
2150#endif
2151
2152#if (__FreeBSD_version >= 700037)
2153	mtx_unlock(&sc->sc_mtx);
2154#endif
2155	return (0);
2156}
2157
2158static void
2159umass_cam_attach(struct umass_softc *sc)
2160{
2161#ifndef USB_DEBUG
2162	if (bootverbose)
2163#endif
2164		printf("%s:%d:%d:%d: Attached to scbus%d\n",
2165		    sc->sc_name, cam_sim_path(sc->sc_sim),
2166		    sc->sc_unit, CAM_LUN_WILDCARD,
2167		    cam_sim_path(sc->sc_sim));
2168}
2169
2170/* umass_cam_detach
2171 *	detach from the CAM layer
2172 */
2173
2174static void
2175umass_cam_detach_sim(struct umass_softc *sc)
2176{
2177	if (sc->sc_sim != NULL) {
2178		if (xpt_bus_deregister(cam_sim_path(sc->sc_sim))) {
2179			/* accessing the softc is not possible after this */
2180			sc->sc_sim->softc = UMASS_GONE;
2181			cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2182		} else {
2183			panic("%s: CAM layer is busy\n",
2184			    sc->sc_name);
2185		}
2186		sc->sc_sim = NULL;
2187	}
2188}
2189
2190/* umass_cam_action
2191 * 	CAM requests for action come through here
2192 */
2193
2194static void
2195umass_cam_action(struct cam_sim *sim, union ccb *ccb)
2196{
2197	struct umass_softc *sc = (struct umass_softc *)sim->softc;
2198
2199	if (sc == UMASS_GONE ||
2200	    (sc != NULL && !usbd_device_attached(sc->sc_udev))) {
2201		ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2202		xpt_done(ccb);
2203		return;
2204	}
2205	if (sc) {
2206#if (__FreeBSD_version < 700037)
2207		mtx_lock(&sc->sc_mtx);
2208#endif
2209	}
2210	/*
2211	 * Verify, depending on the operation to perform, that we either got
2212	 * a valid sc, because an existing target was referenced, or
2213	 * otherwise the SIM is addressed.
2214	 *
2215	 * This avoids bombing out at a printf and does give the CAM layer some
2216	 * sensible feedback on errors.
2217	 */
2218	switch (ccb->ccb_h.func_code) {
2219	case XPT_SCSI_IO:
2220	case XPT_RESET_DEV:
2221	case XPT_GET_TRAN_SETTINGS:
2222	case XPT_SET_TRAN_SETTINGS:
2223	case XPT_CALC_GEOMETRY:
2224		/* the opcodes requiring a target. These should never occur. */
2225		if (sc == NULL) {
2226			DPRINTF(sc, UDMASS_GEN, "%s:%d:%d:%d:func_code 0x%04x: "
2227			    "Invalid target (target needed)\n",
2228			    DEVNAME_SIM, cam_sim_path(sc->sc_sim),
2229			    ccb->ccb_h.target_id, ccb->ccb_h.target_lun,
2230			    ccb->ccb_h.func_code);
2231
2232			ccb->ccb_h.status = CAM_TID_INVALID;
2233			xpt_done(ccb);
2234			goto done;
2235		}
2236		break;
2237	case XPT_PATH_INQ:
2238	case XPT_NOOP:
2239		/*
2240		 * The opcodes sometimes aimed at a target (sc is valid),
2241		 * sometimes aimed at the SIM (sc is invalid and target is
2242		 * CAM_TARGET_WILDCARD)
2243		 */
2244		if ((sc == NULL) &&
2245		    (ccb->ccb_h.target_id != CAM_TARGET_WILDCARD)) {
2246			DPRINTF(sc, UDMASS_SCSI, "%s:%d:%d:%d:func_code 0x%04x: "
2247			    "Invalid target (no wildcard)\n",
2248			    DEVNAME_SIM, cam_sim_path(sc->sc_sim),
2249			    ccb->ccb_h.target_id, ccb->ccb_h.target_lun,
2250			    ccb->ccb_h.func_code);
2251
2252			ccb->ccb_h.status = CAM_TID_INVALID;
2253			xpt_done(ccb);
2254			goto done;
2255		}
2256		break;
2257	default:
2258		/* XXX Hm, we should check the input parameters */
2259		break;
2260	}
2261
2262	/* Perform the requested action */
2263	switch (ccb->ccb_h.func_code) {
2264	case XPT_SCSI_IO:
2265		{
2266			uint8_t *cmd;
2267			uint8_t dir;
2268
2269			if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2270				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2271			} else {
2272				cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2273			}
2274
2275			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2276			    "cmd: 0x%02x, flags: 0x%02x, "
2277			    "%db cmd/%db data/%db sense\n",
2278			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2279			    ccb->ccb_h.target_lun, cmd[0],
2280			    ccb->ccb_h.flags & CAM_DIR_MASK, ccb->csio.cdb_len,
2281			    ccb->csio.dxfer_len, ccb->csio.sense_len);
2282
2283			if (sc->sc_transfer.ccb) {
2284				DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2285				    "I/O in progress, deferring\n",
2286				    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2287				    ccb->ccb_h.target_lun);
2288				ccb->ccb_h.status = CAM_SCSI_BUSY;
2289				xpt_done(ccb);
2290				goto done;
2291			}
2292			switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
2293			case CAM_DIR_IN:
2294				dir = DIR_IN;
2295				break;
2296			case CAM_DIR_OUT:
2297				dir = DIR_OUT;
2298				DIF(UDMASS_SCSI,
2299				    umass_dump_buffer(sc, ccb->csio.data_ptr,
2300				    ccb->csio.dxfer_len, 48));
2301				break;
2302			default:
2303				dir = DIR_NONE;
2304			}
2305
2306			ccb->ccb_h.status = CAM_REQ_INPROG | CAM_SIM_QUEUED;
2307
2308			/*
2309			 * sc->sc_transform will convert the command to the
2310			 * command format needed by the specific command set
2311			 * and return the converted command in
2312			 * "sc->sc_transfer.cmd_data"
2313			 */
2314			if (umass_std_transform(sc, ccb, cmd, ccb->csio.cdb_len)) {
2315
2316				if (sc->sc_transfer.cmd_data[0] == INQUIRY) {
2317					const char *pserial;
2318
2319					pserial = usb_get_serial(sc->sc_udev);
2320
2321					/*
2322					 * Umass devices don't generally report their serial numbers
2323					 * in the usual SCSI way.  Emulate it here.
2324					 */
2325					if ((sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2326					    (sc->sc_transfer.cmd_data[2] == SVPD_UNIT_SERIAL_NUMBER) &&
2327					    (pserial[0] != '\0')) {
2328						struct scsi_vpd_unit_serial_number *vpd_serial;
2329
2330						vpd_serial = (struct scsi_vpd_unit_serial_number *)ccb->csio.data_ptr;
2331						vpd_serial->length = strlen(pserial);
2332						if (vpd_serial->length > sizeof(vpd_serial->serial_num))
2333							vpd_serial->length = sizeof(vpd_serial->serial_num);
2334						memcpy(vpd_serial->serial_num, pserial, vpd_serial->length);
2335						ccb->csio.scsi_status = SCSI_STATUS_OK;
2336						ccb->ccb_h.status = CAM_REQ_CMP;
2337						xpt_done(ccb);
2338						goto done;
2339					}
2340
2341					/*
2342					 * Handle EVPD inquiry for broken devices first
2343					 * NO_INQUIRY also implies NO_INQUIRY_EVPD
2344					 */
2345					if ((sc->sc_quirks & (NO_INQUIRY_EVPD | NO_INQUIRY)) &&
2346					    (sc->sc_transfer.cmd_data[1] & SI_EVPD)) {
2347
2348						scsi_set_sense_data(&ccb->csio.sense_data,
2349							/*sense_format*/ SSD_TYPE_NONE,
2350							/*current_error*/ 1,
2351							/*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2352							/*asc*/ 0x24,
2353							/*ascq*/ 0x00,
2354							/*extra args*/ SSD_ELEM_NONE);
2355						ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2356						ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR |
2357						    CAM_AUTOSNS_VALID;
2358						xpt_done(ccb);
2359						goto done;
2360					}
2361					/*
2362					 * Return fake inquiry data for
2363					 * broken devices
2364					 */
2365					if (sc->sc_quirks & NO_INQUIRY) {
2366						memcpy(ccb->csio.data_ptr, &fake_inq_data,
2367						    sizeof(fake_inq_data));
2368						ccb->csio.scsi_status = SCSI_STATUS_OK;
2369						ccb->ccb_h.status = CAM_REQ_CMP;
2370						xpt_done(ccb);
2371						goto done;
2372					}
2373					if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2374						ccb->csio.dxfer_len = SHORT_INQUIRY_LENGTH;
2375					}
2376				} else if (sc->sc_transfer.cmd_data[0] == SYNCHRONIZE_CACHE) {
2377					if (sc->sc_quirks & NO_SYNCHRONIZE_CACHE) {
2378						ccb->csio.scsi_status = SCSI_STATUS_OK;
2379						ccb->ccb_h.status = CAM_REQ_CMP;
2380						xpt_done(ccb);
2381						goto done;
2382					}
2383				}
2384				umass_command_start(sc, dir, ccb->csio.data_ptr,
2385				    ccb->csio.dxfer_len,
2386				    ccb->ccb_h.timeout,
2387				    &umass_cam_cb, ccb);
2388			}
2389			break;
2390		}
2391	case XPT_PATH_INQ:
2392		{
2393			struct ccb_pathinq *cpi = &ccb->cpi;
2394
2395			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_PATH_INQ:.\n",
2396			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2397			    ccb->ccb_h.target_lun);
2398
2399			/* host specific information */
2400			cpi->version_num = 1;
2401			cpi->hba_inquiry = 0;
2402			cpi->target_sprt = 0;
2403			cpi->hba_misc = PIM_NO_6_BYTE;
2404			cpi->hba_eng_cnt = 0;
2405			cpi->max_target = UMASS_SCSIID_MAX;	/* one target */
2406			cpi->initiator_id = UMASS_SCSIID_HOST;
2407			strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2408			strlcpy(cpi->hba_vid, "USB SCSI", HBA_IDLEN);
2409			strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2410			cpi->unit_number = cam_sim_unit(sim);
2411			cpi->bus_id = sc->sc_unit;
2412#if (__FreeBSD_version >= 700025)
2413			cpi->protocol = PROTO_SCSI;
2414			cpi->protocol_version = SCSI_REV_2;
2415			cpi->transport = XPORT_USB;
2416			cpi->transport_version = 0;
2417#endif
2418			if (sc == NULL) {
2419				cpi->base_transfer_speed = 0;
2420				cpi->max_lun = 0;
2421			} else {
2422				if (sc->sc_quirks & FLOPPY_SPEED) {
2423					cpi->base_transfer_speed =
2424					    UMASS_FLOPPY_TRANSFER_SPEED;
2425				} else {
2426					switch (usbd_get_speed(sc->sc_udev)) {
2427					case USB_SPEED_SUPER:
2428						cpi->base_transfer_speed =
2429						    UMASS_SUPER_TRANSFER_SPEED;
2430						cpi->maxio = MAXPHYS;
2431						break;
2432					case USB_SPEED_HIGH:
2433						cpi->base_transfer_speed =
2434						    UMASS_HIGH_TRANSFER_SPEED;
2435						break;
2436					default:
2437						cpi->base_transfer_speed =
2438						    UMASS_FULL_TRANSFER_SPEED;
2439						break;
2440					}
2441				}
2442				cpi->max_lun = sc->sc_maxlun;
2443			}
2444
2445			cpi->ccb_h.status = CAM_REQ_CMP;
2446			xpt_done(ccb);
2447			break;
2448		}
2449	case XPT_RESET_DEV:
2450		{
2451			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_RESET_DEV:.\n",
2452			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2453			    ccb->ccb_h.target_lun);
2454
2455			umass_reset(sc);
2456
2457			ccb->ccb_h.status = CAM_REQ_CMP;
2458			xpt_done(ccb);
2459			break;
2460		}
2461	case XPT_GET_TRAN_SETTINGS:
2462		{
2463			struct ccb_trans_settings *cts = &ccb->cts;
2464
2465			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_GET_TRAN_SETTINGS:.\n",
2466			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2467			    ccb->ccb_h.target_lun);
2468
2469#if (__FreeBSD_version >= 700025)
2470			cts->protocol = PROTO_SCSI;
2471			cts->protocol_version = SCSI_REV_2;
2472			cts->transport = XPORT_USB;
2473			cts->transport_version = 0;
2474			cts->xport_specific.valid = 0;
2475#else
2476			cts->valid = 0;
2477			cts->flags = 0;	/* no disconnection, tagging */
2478#endif
2479			ccb->ccb_h.status = CAM_REQ_CMP;
2480			xpt_done(ccb);
2481			break;
2482		}
2483	case XPT_SET_TRAN_SETTINGS:
2484		{
2485			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SET_TRAN_SETTINGS:.\n",
2486			    cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2487			    ccb->ccb_h.target_lun);
2488
2489			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2490			xpt_done(ccb);
2491			break;
2492		}
2493	case XPT_CALC_GEOMETRY:
2494		{
2495			cam_calc_geometry(&ccb->ccg, /* extended */ 1);
2496			xpt_done(ccb);
2497			break;
2498		}
2499	case XPT_NOOP:
2500		{
2501			DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_NOOP:.\n",
2502			    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2503			    ccb->ccb_h.target_lun);
2504
2505			ccb->ccb_h.status = CAM_REQ_CMP;
2506			xpt_done(ccb);
2507			break;
2508		}
2509	default:
2510		DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:func_code 0x%04x: "
2511		    "Not implemented\n",
2512		    sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2513		    ccb->ccb_h.target_lun, ccb->ccb_h.func_code);
2514
2515		ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2516		xpt_done(ccb);
2517		break;
2518	}
2519
2520done:
2521#if (__FreeBSD_version < 700037)
2522	if (sc) {
2523		mtx_unlock(&sc->sc_mtx);
2524	}
2525#endif
2526	return;
2527}
2528
2529static void
2530umass_cam_poll(struct cam_sim *sim)
2531{
2532	struct umass_softc *sc = (struct umass_softc *)sim->softc;
2533
2534	if (sc == UMASS_GONE)
2535		return;
2536
2537	DPRINTF(sc, UDMASS_SCSI, "CAM poll\n");
2538
2539	usbd_transfer_poll(sc->sc_xfer, UMASS_T_MAX);
2540}
2541
2542
2543/* umass_cam_cb
2544 *	finalise a completed CAM command
2545 */
2546
2547static void
2548umass_cam_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2549    uint8_t status)
2550{
2551	ccb->csio.resid = residue;
2552
2553	switch (status) {
2554	case STATUS_CMD_OK:
2555		ccb->ccb_h.status = CAM_REQ_CMP;
2556		if ((sc->sc_quirks & READ_CAPACITY_OFFBY1) &&
2557		    (ccb->ccb_h.func_code == XPT_SCSI_IO) &&
2558		    (ccb->csio.cdb_io.cdb_bytes[0] == READ_CAPACITY)) {
2559			struct scsi_read_capacity_data *rcap;
2560			uint32_t maxsector;
2561
2562			rcap = (void *)(ccb->csio.data_ptr);
2563			maxsector = scsi_4btoul(rcap->addr) - 1;
2564			scsi_ulto4b(maxsector, rcap->addr);
2565		}
2566		/*
2567		 * We have to add SVPD_UNIT_SERIAL_NUMBER to the list
2568		 * of pages supported by the device - otherwise, CAM
2569		 * will never ask us for the serial number if the
2570		 * device cannot handle that by itself.
2571		 */
2572		if (ccb->ccb_h.func_code == XPT_SCSI_IO &&
2573		    sc->sc_transfer.cmd_data[0] == INQUIRY &&
2574		    (sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2575		    sc->sc_transfer.cmd_data[2] == SVPD_SUPPORTED_PAGE_LIST &&
2576		    (usb_get_serial(sc->sc_udev)[0] != '\0')) {
2577			struct ccb_scsiio *csio;
2578			struct scsi_vpd_supported_page_list *page_list;
2579
2580			csio = &ccb->csio;
2581			page_list = (struct scsi_vpd_supported_page_list *)csio->data_ptr;
2582			if (page_list->length + 1 < SVPD_SUPPORTED_PAGES_SIZE) {
2583				page_list->list[page_list->length] = SVPD_UNIT_SERIAL_NUMBER;
2584				page_list->length++;
2585			}
2586		}
2587		xpt_done(ccb);
2588		break;
2589
2590	case STATUS_CMD_UNKNOWN:
2591	case STATUS_CMD_FAILED:
2592
2593		/* fetch sense data */
2594
2595		/* the rest of the command was filled in at attach */
2596		sc->cam_scsi_sense.length = ccb->csio.sense_len;
2597
2598		DPRINTF(sc, UDMASS_SCSI, "Fetching %d bytes of "
2599		    "sense data\n", ccb->csio.sense_len);
2600
2601		if (umass_std_transform(sc, ccb, &sc->cam_scsi_sense.opcode,
2602		    sizeof(sc->cam_scsi_sense))) {
2603
2604			if ((sc->sc_quirks & FORCE_SHORT_INQUIRY) &&
2605			    (sc->sc_transfer.cmd_data[0] == INQUIRY)) {
2606				ccb->csio.sense_len = SHORT_INQUIRY_LENGTH;
2607			}
2608			umass_command_start(sc, DIR_IN, &ccb->csio.sense_data.error_code,
2609			    ccb->csio.sense_len, ccb->ccb_h.timeout,
2610			    &umass_cam_sense_cb, ccb);
2611		}
2612		break;
2613
2614	default:
2615		/*
2616		 * The wire protocol failed and will hopefully have
2617		 * recovered. We return an error to CAM and let CAM
2618		 * retry the command if necessary.
2619		 */
2620		ccb->ccb_h.status = CAM_REQ_CMP_ERR;
2621		xpt_done(ccb);
2622		break;
2623	}
2624}
2625
2626/*
2627 * Finalise a completed autosense operation
2628 */
2629static void
2630umass_cam_sense_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2631    uint8_t status)
2632{
2633	uint8_t *cmd;
2634
2635	switch (status) {
2636	case STATUS_CMD_OK:
2637	case STATUS_CMD_UNKNOWN:
2638	case STATUS_CMD_FAILED: {
2639		int key, sense_len;
2640
2641		ccb->csio.sense_resid = residue;
2642		sense_len = ccb->csio.sense_len - ccb->csio.sense_resid;
2643		key = scsi_get_sense_key(&ccb->csio.sense_data, sense_len,
2644					 /*show_errors*/ 1);
2645
2646		if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2647			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2648		} else {
2649			cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2650		}
2651
2652		/*
2653		 * Getting sense data always succeeds (apart from wire
2654		 * failures):
2655		 */
2656		if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2657		    (cmd[0] == INQUIRY) &&
2658		    (key == SSD_KEY_UNIT_ATTENTION)) {
2659			/*
2660			 * Ignore unit attention errors in the case where
2661			 * the Unit Attention state is not cleared on
2662			 * REQUEST SENSE. They will appear again at the next
2663			 * command.
2664			 */
2665			ccb->ccb_h.status = CAM_REQ_CMP;
2666		} else if (key == SSD_KEY_NO_SENSE) {
2667			/*
2668			 * No problem after all (in the case of CBI without
2669			 * CCI)
2670			 */
2671			ccb->ccb_h.status = CAM_REQ_CMP;
2672		} else if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2673			    (cmd[0] == READ_CAPACITY) &&
2674		    (key == SSD_KEY_UNIT_ATTENTION)) {
2675			/*
2676			 * Some devices do not clear the unit attention error
2677			 * on request sense. We insert a test unit ready
2678			 * command to make sure we clear the unit attention
2679			 * condition, then allow the retry to proceed as
2680			 * usual.
2681			 */
2682
2683			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2684			    | CAM_AUTOSNS_VALID;
2685			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2686
2687#if 0
2688			DELAY(300000);
2689#endif
2690			DPRINTF(sc, UDMASS_SCSI, "Doing a sneaky"
2691			    "TEST_UNIT_READY\n");
2692
2693			/* the rest of the command was filled in at attach */
2694
2695			if (umass_std_transform(sc, ccb,
2696			    &sc->cam_scsi_test_unit_ready.opcode,
2697			    sizeof(sc->cam_scsi_test_unit_ready))) {
2698				umass_command_start(sc, DIR_NONE, NULL, 0,
2699				    ccb->ccb_h.timeout,
2700				    &umass_cam_quirk_cb, ccb);
2701			}
2702			break;
2703		} else {
2704			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2705			    | CAM_AUTOSNS_VALID;
2706			ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2707		}
2708		xpt_done(ccb);
2709		break;
2710	}
2711	default:
2712		DPRINTF(sc, UDMASS_SCSI, "Autosense failed, "
2713		    "status %d\n", status);
2714		ccb->ccb_h.status = CAM_AUTOSENSE_FAIL;
2715		xpt_done(ccb);
2716	}
2717}
2718
2719/*
2720 * This completion code just handles the fact that we sent a test-unit-ready
2721 * after having previously failed a READ CAPACITY with CHECK_COND.  Even
2722 * though this command succeeded, we have to tell CAM to retry.
2723 */
2724static void
2725umass_cam_quirk_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2726    uint8_t status)
2727{
2728	DPRINTF(sc, UDMASS_SCSI, "Test unit ready "
2729	    "returned status %d\n", status);
2730
2731	ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2732	    | CAM_AUTOSNS_VALID;
2733	ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2734	xpt_done(ccb);
2735}
2736
2737/*
2738 * SCSI specific functions
2739 */
2740
2741static uint8_t
2742umass_scsi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2743    uint8_t cmd_len)
2744{
2745	if ((cmd_len == 0) ||
2746	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2747		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2748		    "length: %d bytes\n", cmd_len);
2749		return (0);		/* failure */
2750	}
2751	sc->sc_transfer.cmd_len = cmd_len;
2752
2753	switch (cmd_ptr[0]) {
2754	case TEST_UNIT_READY:
2755		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2756			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2757			    "to START_UNIT\n");
2758			bzero(sc->sc_transfer.cmd_data, cmd_len);
2759			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2760			sc->sc_transfer.cmd_data[4] = SSS_START;
2761			return (1);
2762		}
2763		break;
2764
2765	case INQUIRY:
2766		/*
2767		 * some drives wedge when asked for full inquiry
2768		 * information.
2769		 */
2770		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2771			bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2772			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2773			return (1);
2774		}
2775		break;
2776	}
2777
2778	bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2779	return (1);
2780}
2781
2782static uint8_t
2783umass_rbc_transform(struct umass_softc *sc, uint8_t *cmd_ptr, uint8_t cmd_len)
2784{
2785	if ((cmd_len == 0) ||
2786	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2787		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2788		    "length: %d bytes\n", cmd_len);
2789		return (0);		/* failure */
2790	}
2791	switch (cmd_ptr[0]) {
2792		/* these commands are defined in RBC: */
2793	case READ_10:
2794	case READ_CAPACITY:
2795	case START_STOP_UNIT:
2796	case SYNCHRONIZE_CACHE:
2797	case WRITE_10:
2798	case 0x2f:			/* VERIFY_10 is absent from
2799					 * scsi_all.h??? */
2800	case INQUIRY:
2801	case MODE_SELECT_10:
2802	case MODE_SENSE_10:
2803	case TEST_UNIT_READY:
2804	case WRITE_BUFFER:
2805		/*
2806		 * The following commands are not listed in my copy of the
2807		 * RBC specs. CAM however seems to want those, and at least
2808		 * the Sony DSC device appears to support those as well
2809		 */
2810	case REQUEST_SENSE:
2811	case PREVENT_ALLOW:
2812
2813		bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2814
2815		if ((sc->sc_quirks & RBC_PAD_TO_12) && (cmd_len < 12)) {
2816			bzero(sc->sc_transfer.cmd_data + cmd_len, 12 - cmd_len);
2817			cmd_len = 12;
2818		}
2819		sc->sc_transfer.cmd_len = cmd_len;
2820		return (1);		/* sucess */
2821
2822		/* All other commands are not legal in RBC */
2823	default:
2824		DPRINTF(sc, UDMASS_SCSI, "Unsupported RBC "
2825		    "command 0x%02x\n", cmd_ptr[0]);
2826		return (0);		/* failure */
2827	}
2828}
2829
2830static uint8_t
2831umass_ufi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2832    uint8_t cmd_len)
2833{
2834	if ((cmd_len == 0) ||
2835	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2836		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2837		    "length: %d bytes\n", cmd_len);
2838		return (0);		/* failure */
2839	}
2840	/* An UFI command is always 12 bytes in length */
2841	sc->sc_transfer.cmd_len = UFI_COMMAND_LENGTH;
2842
2843	/* Zero the command data */
2844	bzero(sc->sc_transfer.cmd_data, UFI_COMMAND_LENGTH);
2845
2846	switch (cmd_ptr[0]) {
2847		/*
2848		 * Commands of which the format has been verified. They
2849		 * should work. Copy the command into the (zeroed out)
2850		 * destination buffer.
2851		 */
2852	case TEST_UNIT_READY:
2853		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2854			/*
2855			 * Some devices do not support this command. Start
2856			 * Stop Unit should give the same results
2857			 */
2858			DPRINTF(sc, UDMASS_UFI, "Converted TEST_UNIT_READY "
2859			    "to START_UNIT\n");
2860
2861			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2862			sc->sc_transfer.cmd_data[4] = SSS_START;
2863			return (1);
2864		}
2865		break;
2866
2867	case REZERO_UNIT:
2868	case REQUEST_SENSE:
2869	case FORMAT_UNIT:
2870	case INQUIRY:
2871	case START_STOP_UNIT:
2872	case SEND_DIAGNOSTIC:
2873	case PREVENT_ALLOW:
2874	case READ_CAPACITY:
2875	case READ_10:
2876	case WRITE_10:
2877	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2878	case WRITE_AND_VERIFY:
2879	case VERIFY:
2880	case MODE_SELECT_10:
2881	case MODE_SENSE_10:
2882	case READ_12:
2883	case WRITE_12:
2884	case READ_FORMAT_CAPACITIES:
2885		break;
2886
2887		/*
2888		 * SYNCHRONIZE_CACHE isn't supported by UFI, nor should it be
2889		 * required for UFI devices, so it is appropriate to fake
2890		 * success.
2891		 */
2892	case SYNCHRONIZE_CACHE:
2893		return (2);
2894
2895	default:
2896		DPRINTF(sc, UDMASS_SCSI, "Unsupported UFI "
2897		    "command 0x%02x\n", cmd_ptr[0]);
2898		return (0);		/* failure */
2899	}
2900
2901	bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2902	return (1);			/* success */
2903}
2904
2905/*
2906 * 8070i (ATAPI) specific functions
2907 */
2908static uint8_t
2909umass_atapi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2910    uint8_t cmd_len)
2911{
2912	if ((cmd_len == 0) ||
2913	    (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2914		DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2915		    "length: %d bytes\n", cmd_len);
2916		return (0);		/* failure */
2917	}
2918	/* An ATAPI command is always 12 bytes in length. */
2919	sc->sc_transfer.cmd_len = ATAPI_COMMAND_LENGTH;
2920
2921	/* Zero the command data */
2922	bzero(sc->sc_transfer.cmd_data, ATAPI_COMMAND_LENGTH);
2923
2924	switch (cmd_ptr[0]) {
2925		/*
2926		 * Commands of which the format has been verified. They
2927		 * should work. Copy the command into the destination
2928		 * buffer.
2929		 */
2930	case INQUIRY:
2931		/*
2932		 * some drives wedge when asked for full inquiry
2933		 * information.
2934		 */
2935		if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2936			bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2937
2938			sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2939			return (1);
2940		}
2941		break;
2942
2943	case TEST_UNIT_READY:
2944		if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2945			DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2946			    "to START_UNIT\n");
2947			sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2948			sc->sc_transfer.cmd_data[4] = SSS_START;
2949			return (1);
2950		}
2951		break;
2952
2953	case REZERO_UNIT:
2954	case REQUEST_SENSE:
2955	case START_STOP_UNIT:
2956	case SEND_DIAGNOSTIC:
2957	case PREVENT_ALLOW:
2958	case READ_CAPACITY:
2959	case READ_10:
2960	case WRITE_10:
2961	case POSITION_TO_ELEMENT:	/* SEEK_10 */
2962	case SYNCHRONIZE_CACHE:
2963	case MODE_SELECT_10:
2964	case MODE_SENSE_10:
2965	case READ_BUFFER:
2966	case 0x42:			/* READ_SUBCHANNEL */
2967	case 0x43:			/* READ_TOC */
2968	case 0x44:			/* READ_HEADER */
2969	case 0x47:			/* PLAY_MSF (Play Minute/Second/Frame) */
2970	case 0x48:			/* PLAY_TRACK */
2971	case 0x49:			/* PLAY_TRACK_REL */
2972	case 0x4b:			/* PAUSE */
2973	case 0x51:			/* READ_DISK_INFO */
2974	case 0x52:			/* READ_TRACK_INFO */
2975	case 0x54:			/* SEND_OPC */
2976	case 0x59:			/* READ_MASTER_CUE */
2977	case 0x5b:			/* CLOSE_TR_SESSION */
2978	case 0x5c:			/* READ_BUFFER_CAP */
2979	case 0x5d:			/* SEND_CUE_SHEET */
2980	case 0xa1:			/* BLANK */
2981	case 0xa5:			/* PLAY_12 */
2982	case 0xa6:			/* EXCHANGE_MEDIUM */
2983	case 0xad:			/* READ_DVD_STRUCTURE */
2984	case 0xbb:			/* SET_CD_SPEED */
2985	case 0xe5:			/* READ_TRACK_INFO_PHILIPS */
2986		break;
2987
2988	case READ_12:
2989	case WRITE_12:
2990	default:
2991		DPRINTF(sc, UDMASS_SCSI, "Unsupported ATAPI "
2992		    "command 0x%02x - trying anyway\n",
2993		    cmd_ptr[0]);
2994		break;
2995	}
2996
2997	bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2998	return (1);			/* success */
2999}
3000
3001static uint8_t
3002umass_no_transform(struct umass_softc *sc, uint8_t *cmd,
3003    uint8_t cmdlen)
3004{
3005	return (0);			/* failure */
3006}
3007
3008static uint8_t
3009umass_std_transform(struct umass_softc *sc, union ccb *ccb,
3010    uint8_t *cmd, uint8_t cmdlen)
3011{
3012	uint8_t retval;
3013
3014	retval = (sc->sc_transform) (sc, cmd, cmdlen);
3015
3016	if (retval == 2) {
3017		ccb->ccb_h.status = CAM_REQ_CMP;
3018		xpt_done(ccb);
3019		return (0);
3020	} else if (retval == 0) {
3021		ccb->ccb_h.status = CAM_REQ_INVALID;
3022		xpt_done(ccb);
3023		return (0);
3024	}
3025	/* Command should be executed */
3026	return (1);
3027}
3028
3029#ifdef USB_DEBUG
3030static void
3031umass_bbb_dump_cbw(struct umass_softc *sc, umass_bbb_cbw_t *cbw)
3032{
3033	uint8_t *c = cbw->CBWCDB;
3034
3035	uint32_t dlen = UGETDW(cbw->dCBWDataTransferLength);
3036	uint32_t tag = UGETDW(cbw->dCBWTag);
3037
3038	uint8_t clen = cbw->bCDBLength;
3039	uint8_t flags = cbw->bCBWFlags;
3040	uint8_t lun = cbw->bCBWLUN;
3041
3042	DPRINTF(sc, UDMASS_BBB, "CBW %d: cmd = %db "
3043	    "(0x%02x%02x%02x%02x%02x%02x%s), "
3044	    "data = %db, lun = %d, dir = %s\n",
3045	    tag, clen,
3046	    c[0], c[1], c[2], c[3], c[4], c[5], (clen > 6 ? "..." : ""),
3047	    dlen, lun, (flags == CBWFLAGS_IN ? "in" :
3048	    (flags == CBWFLAGS_OUT ? "out" : "<invalid>")));
3049}
3050
3051static void
3052umass_bbb_dump_csw(struct umass_softc *sc, umass_bbb_csw_t *csw)
3053{
3054	uint32_t sig = UGETDW(csw->dCSWSignature);
3055	uint32_t tag = UGETDW(csw->dCSWTag);
3056	uint32_t res = UGETDW(csw->dCSWDataResidue);
3057	uint8_t status = csw->bCSWStatus;
3058
3059	DPRINTF(sc, UDMASS_BBB, "CSW %d: sig = 0x%08x (%s), tag = 0x%08x, "
3060	    "res = %d, status = 0x%02x (%s)\n",
3061	    tag, sig, (sig == CSWSIGNATURE ? "valid" : "invalid"),
3062	    tag, res,
3063	    status, (status == CSWSTATUS_GOOD ? "good" :
3064	    (status == CSWSTATUS_FAILED ? "failed" :
3065	    (status == CSWSTATUS_PHASE ? "phase" : "<invalid>"))));
3066}
3067
3068static void
3069umass_cbi_dump_cmd(struct umass_softc *sc, void *cmd, uint8_t cmdlen)
3070{
3071	uint8_t *c = cmd;
3072	uint8_t dir = sc->sc_transfer.dir;
3073
3074	DPRINTF(sc, UDMASS_BBB, "cmd = %db "
3075	    "(0x%02x%02x%02x%02x%02x%02x%s), "
3076	    "data = %db, dir = %s\n",
3077	    cmdlen,
3078	    c[0], c[1], c[2], c[3], c[4], c[5], (cmdlen > 6 ? "..." : ""),
3079	    sc->sc_transfer.data_len,
3080	    (dir == DIR_IN ? "in" :
3081	    (dir == DIR_OUT ? "out" :
3082	    (dir == DIR_NONE ? "no data phase" : "<invalid>"))));
3083}
3084
3085static void
3086umass_dump_buffer(struct umass_softc *sc, uint8_t *buffer, uint32_t buflen,
3087    uint32_t printlen)
3088{
3089	uint32_t i, j;
3090	char s1[40];
3091	char s2[40];
3092	char s3[5];
3093
3094	s1[0] = '\0';
3095	s3[0] = '\0';
3096
3097	sprintf(s2, " buffer=%p, buflen=%d", buffer, buflen);
3098	for (i = 0; (i < buflen) && (i < printlen); i++) {
3099		j = i % 16;
3100		if (j == 0 && i != 0) {
3101			DPRINTF(sc, UDMASS_GEN, "0x %s%s\n",
3102			    s1, s2);
3103			s2[0] = '\0';
3104		}
3105		sprintf(&s1[j * 2], "%02x", buffer[i] & 0xff);
3106	}
3107	if (buflen > printlen)
3108		sprintf(s3, " ...");
3109	DPRINTF(sc, UDMASS_GEN, "0x %s%s%s\n",
3110	    s1, s2, s3);
3111}
3112
3113#endif
3114