sys/dev/usb/storage/umass.c

   1 #include <sys/cdefs.h>
   2 __FBSDID("$FreeBSD$");
   3
   4 /*-
   5  * Copyright (c) 1999 MAEKAWA Masahide <bishop@rr.iij4u.or.jp>,
   6  *                    Nick Hibma <n_hibma@FreeBSD.org>
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  28  * SUCH DAMAGE.
  29  *
  30  *      $FreeBSD$
  31  *      $NetBSD: umass.c,v 1.28 2000/04/02 23:46:53 augustss Exp $
  32  */
  33
  34 /* Also already merged from NetBSD:
  35  *      $NetBSD: umass.c,v 1.67 2001/11/25 19:05:22 augustss Exp $
  36  *      $NetBSD: umass.c,v 1.90 2002/11/04 19:17:33 pooka Exp $
  37  *      $NetBSD: umass.c,v 1.108 2003/11/07 17:03:25 wiz Exp $
  38  *      $NetBSD: umass.c,v 1.109 2003/12/04 13:57:31 keihan Exp $
  39  */
  40
  41 /*
  42  * Universal Serial Bus Mass Storage Class specs:
  43  * http://www.usb.org/developers/devclass_docs/usb_msc_overview_1.2.pdf
  44  * http://www.usb.org/developers/devclass_docs/usbmassbulk_10.pdf
  45  * http://www.usb.org/developers/devclass_docs/usb_msc_cbi_1.1.pdf
  46  * http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf
  47  */
  48
  49 /*
  50  * Ported to NetBSD by Lennart Augustsson <augustss@NetBSD.org>.
  51  * Parts of the code written by Jason R. Thorpe <thorpej@shagadelic.org>.
  52  */
  53
  54 /*
  55  * The driver handles 3 Wire Protocols
  56  * - Command/Bulk/Interrupt (CBI)
  57  * - Command/Bulk/Interrupt with Command Completion Interrupt (CBI with CCI)
  58  * - Mass Storage Bulk-Only (BBB)
  59  *   (BBB refers Bulk/Bulk/Bulk for Command/Data/Status phases)
  60  *
  61  * Over these wire protocols it handles the following command protocols
  62  * - SCSI
  63  * - UFI (floppy command set)
  64  * - 8070i (ATAPI)
  65  *
  66  * UFI and 8070i (ATAPI) are transformed versions of the SCSI command set. The
  67  * sc->sc_transform method is used to convert the commands into the appropriate
  68  * format (if at all necessary). For example, UFI requires all commands to be
  69  * 12 bytes in length amongst other things.
  70  *
  71  * The source code below is marked and can be split into a number of pieces
  72  * (in this order):
  73  *
  74  * - probe/attach/detach
  75  * - generic transfer routines
  76  * - BBB
  77  * - CBI
  78  * - CBI_I (in addition to functions from CBI)
  79  * - CAM (Common Access Method)
  80  * - SCSI
  81  * - UFI
  82  * - 8070i (ATAPI)
  83  *
  84  * The protocols are implemented using a state machine, for the transfers as
  85  * well as for the resets. The state machine is contained in umass_t_*_callback.
  86  * The state machine is started through either umass_command_start() or
  87  * umass_reset().
  88  *
  89  * The reason for doing this is a) CAM performs a lot better this way and b) it
  90  * avoids using tsleep from interrupt context (for example after a failed
  91  * transfer).
  92  */
  93
  94 /*
  95  * The SCSI related part of this driver has been derived from the
  96  * dev/ppbus/vpo.c driver, by Nicolas Souchu (nsouch@FreeBSD.org).
  97  *
  98  * The CAM layer uses so called actions which are messages sent to the host
  99  * adapter for completion. The actions come in through umass_cam_action. The
 100  * appropriate block of routines is called depending on the transport protocol
 101  * in use. When the transfer has finished, these routines call
 102  * umass_cam_cb again to complete the CAM command.
 103  */
 104
 105 #include <sys/stdint.h>
 106 #include <sys/stddef.h>
 107 #include <sys/param.h>
 108 #include <sys/queue.h>
 109 #include <sys/types.h>
 110 #include <sys/systm.h>
 111 #include <sys/kernel.h>
 112 #include <sys/bus.h>
 113 #include <sys/linker_set.h>
 114 #include <sys/module.h>
 115 #include <sys/lock.h>
 116 #include <sys/mutex.h>
 117 #include <sys/condvar.h>
 118 #include <sys/sysctl.h>
 119 #include <sys/sx.h>
 120 #include <sys/unistd.h>
 121 #include <sys/callout.h>
 122 #include <sys/malloc.h>
 123 #include <sys/priv.h>
 124
 125 #include <dev/usb/usb.h>
 126 #include <dev/usb/usbdi.h>
 127 #include <dev/usb/usb_device.h>
 128 #include "usbdevs.h"
 129
 130 #include <dev/usb/quirk/usb_quirk.h>
 131
 132 #include <cam/cam.h>
 133 #include <cam/cam_ccb.h>
 134 #include <cam/cam_sim.h>
 135 #include <cam/cam_xpt_sim.h>
 136 #include <cam/scsi/scsi_all.h>
 137 #include <cam/scsi/scsi_da.h>
 138
 139 #include <cam/cam_periph.h>
 140
 141 #define UMASS_EXT_BUFFER
 142 #ifdef UMASS_EXT_BUFFER
 143 /* this enables loading of virtual buffers into DMA */
 144 #define UMASS_USB_FLAGS .ext_buffer=1,
 145 #else
 146 #define UMASS_USB_FLAGS
 147 #endif
 148
 149 #ifdef USB_DEBUG
 150 #define DIF(m, x)                               \
 151   do {                                          \
 152     if (umass_debug & (m)) { x ; }              \
 153   } while (0)
 154
 155 #define DPRINTF(sc, m, fmt, ...)                        \
 156   do {                                                  \
 157     if (umass_debug & (m)) {                            \
 158         printf("%s:%s: " fmt,                           \
 159                (sc) ? (const char *)(sc)->sc_name :     \
 160                (const char *)"umassX",                  \
 161                 __FUNCTION__ ,## __VA_ARGS__);          \
 162     }                                                   \
 163   } while (0)
 164
 165 #define UDMASS_GEN      0x00010000      /* general */
 166 #define UDMASS_SCSI     0x00020000      /* scsi */
 167 #define UDMASS_UFI      0x00040000      /* ufi command set */
 168 #define UDMASS_ATAPI    0x00080000      /* 8070i command set */
 169 #define UDMASS_CMD      (UDMASS_SCSI|UDMASS_UFI|UDMASS_ATAPI)
 170 #define UDMASS_USB      0x00100000      /* USB general */
 171 #define UDMASS_BBB      0x00200000      /* Bulk-Only transfers */
 172 #define UDMASS_CBI      0x00400000      /* CBI transfers */
 173 #define UDMASS_WIRE     (UDMASS_BBB|UDMASS_CBI)
 174 #define UDMASS_ALL      0xffff0000      /* all of the above */
 175 static int umass_debug = 0;
 176
 177 SYSCTL_NODE(_hw_usb, OID_AUTO, umass, CTLFLAG_RW, 0, "USB umass");
 178 SYSCTL_INT(_hw_usb_umass, OID_AUTO, debug, CTLFLAG_RW,
 179     &umass_debug, 0, "umass debug level");
 180
 181 TUNABLE_INT("hw.usb.umass.debug", &umass_debug);
 182 #else
 183 #define DIF(...) do { } while (0)
 184 #define DPRINTF(...) do { } while (0)
 185 #endif
 186
 187 #define UMASS_GONE ((struct umass_softc *)1)
 188
 189 #define UMASS_BULK_SIZE (1 << 17)
 190 #define UMASS_CBI_DIAGNOSTIC_CMDLEN 12  /* bytes */
 191 #define UMASS_MAX_CMDLEN MAX(12, CAM_MAX_CDBLEN)        /* bytes */
 192
 193 /* USB transfer definitions */
 194
 195 #define UMASS_T_BBB_RESET1      0       /* Bulk-Only */
 196 #define UMASS_T_BBB_RESET2      1
 197 #define UMASS_T_BBB_RESET3      2
 198 #define UMASS_T_BBB_COMMAND     3
 199 #define UMASS_T_BBB_DATA_READ   4
 200 #define UMASS_T_BBB_DATA_RD_CS  5
 201 #define UMASS_T_BBB_DATA_WRITE  6
 202 #define UMASS_T_BBB_DATA_WR_CS  7
 203 #define UMASS_T_BBB_STATUS      8
 204 #define UMASS_T_BBB_MAX         9
 205
 206 #define UMASS_T_CBI_RESET1      0       /* CBI */
 207 #define UMASS_T_CBI_RESET2      1
 208 #define UMASS_T_CBI_RESET3      2
 209 #define UMASS_T_CBI_COMMAND     3
 210 #define UMASS_T_CBI_DATA_READ   4
 211 #define UMASS_T_CBI_DATA_RD_CS  5
 212 #define UMASS_T_CBI_DATA_WRITE  6
 213 #define UMASS_T_CBI_DATA_WR_CS  7
 214 #define UMASS_T_CBI_STATUS      8
 215 #define UMASS_T_CBI_RESET4      9
 216 #define UMASS_T_CBI_MAX        10
 217
 218 #define UMASS_T_MAX MAX(UMASS_T_CBI_MAX, UMASS_T_BBB_MAX)
 219
 220 /* Generic definitions */
 221
 222 /* Direction for transfer */
 223 #define DIR_NONE        0
 224 #define DIR_IN          1
 225 #define DIR_OUT         2
 226
 227 /* device name */
 228 #define DEVNAME         "umass"
 229 #define DEVNAME_SIM     "umass-sim"
 230
 231 /* Approximate maximum transfer speeds (assumes 33% overhead). */
 232 #define UMASS_FULL_TRANSFER_SPEED       1000
 233 #define UMASS_HIGH_TRANSFER_SPEED       40000
 234 #define UMASS_FLOPPY_TRANSFER_SPEED     20
 235
 236 #define UMASS_TIMEOUT                   5000    /* ms */
 237
 238 /* CAM specific definitions */
 239
 240 #define UMASS_SCSIID_MAX        1       /* maximum number of drives expected */
 241 #define UMASS_SCSIID_HOST       UMASS_SCSIID_MAX
 242
 243 /* Bulk-Only features */
 244
 245 #define UR_BBB_RESET            0xff    /* Bulk-Only reset */
 246 #define UR_BBB_GET_MAX_LUN      0xfe    /* Get maximum lun */
 247
 248 /* Command Block Wrapper */
 249 typedef struct {
 250         uDWord  dCBWSignature;
 251 #define CBWSIGNATURE    0x43425355
 252         uDWord  dCBWTag;
 253         uDWord  dCBWDataTransferLength;
 254         uByte   bCBWFlags;
 255 #define CBWFLAGS_OUT    0x00
 256 #define CBWFLAGS_IN     0x80
 257         uByte   bCBWLUN;
 258         uByte   bCDBLength;
 259 #define CBWCDBLENGTH    16
 260         uByte   CBWCDB[CBWCDBLENGTH];
 261 } __packed umass_bbb_cbw_t;
 262
 263 #define UMASS_BBB_CBW_SIZE      31
 264
 265 /* Command Status Wrapper */
 266 typedef struct {
 267         uDWord  dCSWSignature;
 268 #define CSWSIGNATURE    0x53425355
 269 #define CSWSIGNATURE_IMAGINATION_DBX1   0x43425355
 270 #define CSWSIGNATURE_OLYMPUS_C1 0x55425355
 271         uDWord  dCSWTag;
 272         uDWord  dCSWDataResidue;
 273         uByte   bCSWStatus;
 274 #define CSWSTATUS_GOOD  0x0
 275 #define CSWSTATUS_FAILED        0x1
 276 #define CSWSTATUS_PHASE 0x2
 277 } __packed umass_bbb_csw_t;
 278
 279 #define UMASS_BBB_CSW_SIZE      13
 280
 281 /* CBI features */
 282
 283 #define UR_CBI_ADSC     0x00
 284
 285 typedef union {
 286         struct {
 287                 uint8_t type;
 288 #define IDB_TYPE_CCI            0x00
 289                 uint8_t value;
 290 #define IDB_VALUE_PASS          0x00
 291 #define IDB_VALUE_FAIL          0x01
 292 #define IDB_VALUE_PHASE         0x02
 293 #define IDB_VALUE_PERSISTENT    0x03
 294 #define IDB_VALUE_STATUS_MASK   0x03
 295         } __packed common;
 296
 297         struct {
 298                 uint8_t asc;
 299                 uint8_t ascq;
 300         } __packed ufi;
 301 } __packed umass_cbi_sbl_t;
 302
 303 struct umass_softc;                     /* see below */
 304
 305 typedef void (umass_callback_t)(struct umass_softc *sc, union ccb *ccb,
 306         uint32_t residue, uint8_t status);
 307
 308 #define STATUS_CMD_OK           0       /* everything ok */
 309 #define STATUS_CMD_UNKNOWN      1       /* will have to fetch sense */
 310 #define STATUS_CMD_FAILED       2       /* transfer was ok, command failed */
 311 #define STATUS_WIRE_FAILED      3       /* couldn't even get command across */
 312
 313 typedef uint8_t (umass_transform_t)(struct umass_softc *sc, uint8_t *cmd_ptr,
 314         uint8_t cmd_len);
 315
 316 /* Wire and command protocol */
 317 #define UMASS_PROTO_BBB         0x0001  /* USB wire protocol */
 318 #define UMASS_PROTO_CBI         0x0002
 319 #define UMASS_PROTO_CBI_I       0x0004
 320 #define UMASS_PROTO_WIRE        0x00ff  /* USB wire protocol mask */
 321 #define UMASS_PROTO_SCSI        0x0100  /* command protocol */
 322 #define UMASS_PROTO_ATAPI       0x0200
 323 #define UMASS_PROTO_UFI         0x0400
 324 #define UMASS_PROTO_RBC         0x0800
 325 #define UMASS_PROTO_COMMAND     0xff00  /* command protocol mask */
 326
 327 /* Device specific quirks */
 328 #define NO_QUIRKS               0x0000
 329         /*
 330          * The drive does not support Test Unit Ready. Convert to Start Unit
 331          */
 332 #define NO_TEST_UNIT_READY      0x0001
 333         /*
 334          * The drive does not reset the Unit Attention state after REQUEST
 335          * SENSE has been sent. The INQUIRY command does not reset the UA
 336          * either, and so CAM runs in circles trying to retrieve the initial
 337          * INQUIRY data.
 338          */
 339 #define RS_NO_CLEAR_UA          0x0002
 340         /* The drive does not support START STOP.  */
 341 #define NO_START_STOP           0x0004
 342         /* Don't ask for full inquiry data (255b).  */
 343 #define FORCE_SHORT_INQUIRY     0x0008
 344         /* Needs to be initialised the Shuttle way */
 345 #define SHUTTLE_INIT            0x0010
 346         /* Drive needs to be switched to alternate iface 1 */
 347 #define ALT_IFACE_1             0x0020
 348         /* Drive does not do 1Mb/s, but just floppy speeds (20kb/s) */
 349 #define FLOPPY_SPEED            0x0040
 350         /* The device can't count and gets the residue of transfers wrong */
 351 #define IGNORE_RESIDUE          0x0080
 352         /* No GetMaxLun call */
 353 #define NO_GETMAXLUN            0x0100
 354         /* The device uses a weird CSWSIGNATURE. */
 355 #define WRONG_CSWSIG            0x0200
 356         /* Device cannot handle INQUIRY so fake a generic response */
 357 #define NO_INQUIRY              0x0400
 358         /* Device cannot handle INQUIRY EVPD, return CHECK CONDITION */
 359 #define NO_INQUIRY_EVPD         0x0800
 360         /* Pad all RBC requests to 12 bytes. */
 361 #define RBC_PAD_TO_12           0x1000
 362         /*
 363          * Device reports number of sectors from READ_CAPACITY, not max
 364          * sector number.
 365          */
 366 #define READ_CAPACITY_OFFBY1    0x2000
 367         /*
 368          * Device cannot handle a SCSI synchronize cache command.  Normally
 369          * this quirk would be handled in the cam layer, but for IDE bridges
 370          * we need to associate the quirk with the bridge and not the
 371          * underlying disk device.  This is handled by faking a success
 372          * result.
 373          */
 374 #define NO_SYNCHRONIZE_CACHE    0x4000
 375
 376 struct umass_softc {
 377
 378         struct scsi_sense cam_scsi_sense;
 379         struct scsi_test_unit_ready cam_scsi_test_unit_ready;
 380         struct mtx sc_mtx;
 381         struct {
 382                 uint8_t *data_ptr;
 383                 union ccb *ccb;
 384                 umass_callback_t *callback;
 385
 386                 uint32_t data_len;      /* bytes */
 387                 uint32_t data_rem;      /* bytes */
 388                 uint32_t data_timeout;  /* ms */
 389                 uint32_t actlen;        /* bytes */
 390
 391                 uint8_t cmd_data[UMASS_MAX_CMDLEN];
 392                 uint8_t cmd_len;        /* bytes */
 393                 uint8_t dir;
 394                 uint8_t lun;
 395         }       sc_transfer;
 396
 397         /* Bulk specific variables for transfers in progress */
 398         umass_bbb_cbw_t cbw;            /* command block wrapper */
 399         umass_bbb_csw_t csw;            /* command status wrapper */
 400
 401         /* CBI specific variables for transfers in progress */
 402         umass_cbi_sbl_t sbl;            /* status block */
 403
 404         device_t sc_dev;
 405         struct usb_device *sc_udev;
 406         struct cam_sim *sc_sim;         /* SCSI Interface Module */
 407         struct usb_xfer *sc_xfer[UMASS_T_MAX];
 408
 409         /*
 410          * The command transform function is used to convert the SCSI
 411          * commands into their derivatives, like UFI, ATAPI, and friends.
 412          */
 413         umass_transform_t *sc_transform;
 414
 415         uint32_t sc_unit;
 416         uint32_t sc_quirks;             /* they got it almost right */
 417         uint32_t sc_proto;              /* wire and cmd protocol */
 418
 419         uint8_t sc_name[16];
 420         uint8_t sc_iface_no;            /* interface number */
 421         uint8_t sc_maxlun;              /* maximum LUN number, inclusive */
 422         uint8_t sc_last_xfer_index;
 423         uint8_t sc_status_try;
 424 };
 425
 426 struct umass_probe_proto {
 427         uint32_t quirks;
 428         uint32_t proto;
 429
 430         int     error;
 431 };
 432
 433 /* prototypes */
 434
 435 static device_probe_t umass_probe;
 436 static device_attach_t umass_attach;
 437 static device_detach_t umass_detach;
 438
 439 static usb_callback_t umass_tr_error;
 440 static usb_callback_t umass_t_bbb_reset1_callback;
 441 static usb_callback_t umass_t_bbb_reset2_callback;
 442 static usb_callback_t umass_t_bbb_reset3_callback;
 443 static usb_callback_t umass_t_bbb_command_callback;
 444 static usb_callback_t umass_t_bbb_data_read_callback;
 445 static usb_callback_t umass_t_bbb_data_rd_cs_callback;
 446 static usb_callback_t umass_t_bbb_data_write_callback;
 447 static usb_callback_t umass_t_bbb_data_wr_cs_callback;
 448 static usb_callback_t umass_t_bbb_status_callback;
 449 static usb_callback_t umass_t_cbi_reset1_callback;
 450 static usb_callback_t umass_t_cbi_reset2_callback;
 451 static usb_callback_t umass_t_cbi_reset3_callback;
 452 static usb_callback_t umass_t_cbi_reset4_callback;
 453 static usb_callback_t umass_t_cbi_command_callback;
 454 static usb_callback_t umass_t_cbi_data_read_callback;
 455 static usb_callback_t umass_t_cbi_data_rd_cs_callback;
 456 static usb_callback_t umass_t_cbi_data_write_callback;
 457 static usb_callback_t umass_t_cbi_data_wr_cs_callback;
 458 static usb_callback_t umass_t_cbi_status_callback;
 459
 460 static void     umass_cancel_ccb(struct umass_softc *);
 461 static void     umass_init_shuttle(struct umass_softc *);
 462 static void     umass_reset(struct umass_softc *);
 463 static void     umass_t_bbb_data_clear_stall_callback(struct usb_xfer *,
 464                     uint8_t, uint8_t, usb_error_t);
 465 static void     umass_command_start(struct umass_softc *, uint8_t, void *,
 466                     uint32_t, uint32_t, umass_callback_t *, union ccb *);
 467 static uint8_t  umass_bbb_get_max_lun(struct umass_softc *);
 468 static void     umass_cbi_start_status(struct umass_softc *);
 469 static void     umass_t_cbi_data_clear_stall_callback(struct usb_xfer *,
 470                     uint8_t, uint8_t, usb_error_t);
 471 static int      umass_cam_attach_sim(struct umass_softc *);
 472 static void     umass_cam_attach(struct umass_softc *);
 473 static void     umass_cam_detach_sim(struct umass_softc *);
 474 static void     umass_cam_action(struct cam_sim *, union ccb *);
 475 static void     umass_cam_poll(struct cam_sim *);
 476 static void     umass_cam_cb(struct umass_softc *, union ccb *, uint32_t,
 477                     uint8_t);
 478 static void     umass_cam_sense_cb(struct umass_softc *, union ccb *, uint32_t,
 479                     uint8_t);
 480 static void     umass_cam_quirk_cb(struct umass_softc *, union ccb *, uint32_t,
 481                     uint8_t);
 482 static uint8_t  umass_scsi_transform(struct umass_softc *, uint8_t *, uint8_t);
 483 static uint8_t  umass_rbc_transform(struct umass_softc *, uint8_t *, uint8_t);
 484 static uint8_t  umass_ufi_transform(struct umass_softc *, uint8_t *, uint8_t);
 485 static uint8_t  umass_atapi_transform(struct umass_softc *, uint8_t *,
 486                     uint8_t);
 487 static uint8_t  umass_no_transform(struct umass_softc *, uint8_t *, uint8_t);
 488 static uint8_t  umass_std_transform(struct umass_softc *, union ccb *, uint8_t
 489                     *, uint8_t);
 490
 491 #ifdef USB_DEBUG
 492 static void     umass_bbb_dump_cbw(struct umass_softc *, umass_bbb_cbw_t *);
 493 static void     umass_bbb_dump_csw(struct umass_softc *, umass_bbb_csw_t *);
 494 static void     umass_cbi_dump_cmd(struct umass_softc *, void *, uint8_t);
 495 static void     umass_dump_buffer(struct umass_softc *, uint8_t *, uint32_t,
 496                     uint32_t);
 497 #endif
 498
 499 static struct usb_config umass_bbb_config[UMASS_T_BBB_MAX] = {
 500
 501         [UMASS_T_BBB_RESET1] = {
 502                 .type = UE_CONTROL,
 503                 .endpoint = 0x00,       /* Control pipe */
 504                 .direction = UE_DIR_ANY,
 505                 .bufsize = sizeof(struct usb_device_request),
 506                 .callback = &umass_t_bbb_reset1_callback,
 507                 .timeout = 5000,        /* 5 seconds */
 508                 .interval = 500,        /* 500 milliseconds */
 509         },
 510
 511         [UMASS_T_BBB_RESET2] = {
 512                 .type = UE_CONTROL,
 513                 .endpoint = 0x00,       /* Control pipe */
 514                 .direction = UE_DIR_ANY,
 515                 .bufsize = sizeof(struct usb_device_request),
 516                 .callback = &umass_t_bbb_reset2_callback,
 517                 .timeout = 5000,        /* 5 seconds */
 518                 .interval = 50, /* 50 milliseconds */
 519         },
 520
 521         [UMASS_T_BBB_RESET3] = {
 522                 .type = UE_CONTROL,
 523                 .endpoint = 0x00,       /* Control pipe */
 524                 .direction = UE_DIR_ANY,
 525                 .bufsize = sizeof(struct usb_device_request),
 526                 .callback = &umass_t_bbb_reset3_callback,
 527                 .timeout = 5000,        /* 5 seconds */
 528                 .interval = 50, /* 50 milliseconds */
 529         },
 530
 531         [UMASS_T_BBB_COMMAND] = {
 532                 .type = UE_BULK,
 533                 .endpoint = UE_ADDR_ANY,
 534                 .direction = UE_DIR_OUT,
 535                 .bufsize = sizeof(umass_bbb_cbw_t),
 536                 .callback = &umass_t_bbb_command_callback,
 537                 .timeout = 5000,        /* 5 seconds */
 538         },
 539
 540         [UMASS_T_BBB_DATA_READ] = {
 541                 .type = UE_BULK,
 542                 .endpoint = UE_ADDR_ANY,
 543                 .direction = UE_DIR_IN,
 544                 .bufsize = UMASS_BULK_SIZE,
 545                 .flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
 546                 .callback = &umass_t_bbb_data_read_callback,
 547                 .timeout = 0,   /* overwritten later */
 548         },
 549
 550         [UMASS_T_BBB_DATA_RD_CS] = {
 551                 .type = UE_CONTROL,
 552                 .endpoint = 0x00,       /* Control pipe */
 553                 .direction = UE_DIR_ANY,
 554                 .bufsize = sizeof(struct usb_device_request),
 555                 .callback = &umass_t_bbb_data_rd_cs_callback,
 556                 .timeout = 5000,        /* 5 seconds */
 557         },
 558
 559         [UMASS_T_BBB_DATA_WRITE] = {
 560                 .type = UE_BULK,
 561                 .endpoint = UE_ADDR_ANY,
 562                 .direction = UE_DIR_OUT,
 563                 .bufsize = UMASS_BULK_SIZE,
 564                 .flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
 565                 .callback = &umass_t_bbb_data_write_callback,
 566                 .timeout = 0,   /* overwritten later */
 567         },
 568
 569         [UMASS_T_BBB_DATA_WR_CS] = {
 570                 .type = UE_CONTROL,
 571                 .endpoint = 0x00,       /* Control pipe */
 572                 .direction = UE_DIR_ANY,
 573                 .bufsize = sizeof(struct usb_device_request),
 574                 .callback = &umass_t_bbb_data_wr_cs_callback,
 575                 .timeout = 5000,        /* 5 seconds */
 576         },
 577
 578         [UMASS_T_BBB_STATUS] = {
 579                 .type = UE_BULK,
 580                 .endpoint = UE_ADDR_ANY,
 581                 .direction = UE_DIR_IN,
 582                 .bufsize = sizeof(umass_bbb_csw_t),
 583                 .flags = {.short_xfer_ok = 1,},
 584                 .callback = &umass_t_bbb_status_callback,
 585                 .timeout = 5000,        /* ms */
 586         },
 587 };
 588
 589 static struct usb_config umass_cbi_config[UMASS_T_CBI_MAX] = {
 590
 591         [UMASS_T_CBI_RESET1] = {
 592                 .type = UE_CONTROL,
 593                 .endpoint = 0x00,       /* Control pipe */
 594                 .direction = UE_DIR_ANY,
 595                 .bufsize = (sizeof(struct usb_device_request) +
 596                     UMASS_CBI_DIAGNOSTIC_CMDLEN),
 597                 .callback = &umass_t_cbi_reset1_callback,
 598                 .timeout = 5000,        /* 5 seconds */
 599                 .interval = 500,        /* 500 milliseconds */
 600         },
 601
 602         [UMASS_T_CBI_RESET2] = {
 603                 .type = UE_CONTROL,
 604                 .endpoint = 0x00,       /* Control pipe */
 605                 .direction = UE_DIR_ANY,
 606                 .bufsize = sizeof(struct usb_device_request),
 607                 .callback = &umass_t_cbi_reset2_callback,
 608                 .timeout = 5000,        /* 5 seconds */
 609                 .interval = 50, /* 50 milliseconds */
 610         },
 611
 612         [UMASS_T_CBI_RESET3] = {
 613                 .type = UE_CONTROL,
 614                 .endpoint = 0x00,       /* Control pipe */
 615                 .direction = UE_DIR_ANY,
 616                 .bufsize = sizeof(struct usb_device_request),
 617                 .callback = &umass_t_cbi_reset3_callback,
 618                 .timeout = 5000,        /* 5 seconds */
 619                 .interval = 50, /* 50 milliseconds */
 620         },
 621
 622         [UMASS_T_CBI_COMMAND] = {
 623                 .type = UE_CONTROL,
 624                 .endpoint = 0x00,       /* Control pipe */
 625                 .direction = UE_DIR_ANY,
 626                 .bufsize = (sizeof(struct usb_device_request) +
 627                     UMASS_MAX_CMDLEN),
 628                 .callback = &umass_t_cbi_command_callback,
 629                 .timeout = 5000,        /* 5 seconds */
 630         },
 631
 632         [UMASS_T_CBI_DATA_READ] = {
 633                 .type = UE_BULK,
 634                 .endpoint = UE_ADDR_ANY,
 635                 .direction = UE_DIR_IN,
 636                 .bufsize = UMASS_BULK_SIZE,
 637                 .flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
 638                 .callback = &umass_t_cbi_data_read_callback,
 639                 .timeout = 0,   /* overwritten later */
 640         },
 641
 642         [UMASS_T_CBI_DATA_RD_CS] = {
 643                 .type = UE_CONTROL,
 644                 .endpoint = 0x00,       /* Control pipe */
 645                 .direction = UE_DIR_ANY,
 646                 .bufsize = sizeof(struct usb_device_request),
 647                 .callback = &umass_t_cbi_data_rd_cs_callback,
 648                 .timeout = 5000,        /* 5 seconds */
 649         },
 650
 651         [UMASS_T_CBI_DATA_WRITE] = {
 652                 .type = UE_BULK,
 653                 .endpoint = UE_ADDR_ANY,
 654                 .direction = UE_DIR_OUT,
 655                 .bufsize = UMASS_BULK_SIZE,
 656                 .flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
 657                 .callback = &umass_t_cbi_data_write_callback,
 658                 .timeout = 0,   /* overwritten later */
 659         },
 660
 661         [UMASS_T_CBI_DATA_WR_CS] = {
 662                 .type = UE_CONTROL,
 663                 .endpoint = 0x00,       /* Control pipe */
 664                 .direction = UE_DIR_ANY,
 665                 .bufsize = sizeof(struct usb_device_request),
 666                 .callback = &umass_t_cbi_data_wr_cs_callback,
 667                 .timeout = 5000,        /* 5 seconds */
 668         },
 669
 670         [UMASS_T_CBI_STATUS] = {
 671                 .type = UE_INTERRUPT,
 672                 .endpoint = UE_ADDR_ANY,
 673                 .direction = UE_DIR_IN,
 674                 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
 675                 .bufsize = sizeof(umass_cbi_sbl_t),
 676                 .callback = &umass_t_cbi_status_callback,
 677                 .timeout = 5000,        /* ms */
 678         },
 679
 680         [UMASS_T_CBI_RESET4] = {
 681                 .type = UE_CONTROL,
 682                 .endpoint = 0x00,       /* Control pipe */
 683                 .direction = UE_DIR_ANY,
 684                 .bufsize = sizeof(struct usb_device_request),
 685                 .callback = &umass_t_cbi_reset4_callback,
 686                 .timeout = 5000,        /* ms */
 687         },
 688 };
 689
 690 /* If device cannot return valid inquiry data, fake it */
 691 static const uint8_t fake_inq_data[SHORT_INQUIRY_LENGTH] = {
 692         0, /* removable */ 0x80, SCSI_REV_2, SCSI_REV_2,
 693          /* additional_length */ 31, 0, 0, 0
 694 };
 695
 696 #define UFI_COMMAND_LENGTH      12      /* UFI commands are always 12 bytes */
 697 #define ATAPI_COMMAND_LENGTH    12      /* ATAPI commands are always 12 bytes */
 698
 699 static devclass_t umass_devclass;
 700
 701 static device_method_t umass_methods[] = {
 702         /* Device interface */
 703         DEVMETHOD(device_probe, umass_probe),
 704         DEVMETHOD(device_attach, umass_attach),
 705         DEVMETHOD(device_detach, umass_detach),
 706         {0, 0}
 707 };
 708
 709 static driver_t umass_driver = {
 710         .name = "umass",
 711         .methods = umass_methods,
 712         .size = sizeof(struct umass_softc),
 713 };
 714
 715 DRIVER_MODULE(umass, uhub, umass_driver, umass_devclass, NULL, 0);
 716 MODULE_DEPEND(umass, usb, 1, 1, 1);
 717 MODULE_DEPEND(umass, cam, 1, 1, 1);
 718 MODULE_VERSION(umass, 1);
 719
 720 /*
 721  * USB device probe/attach/detach
 722  */
 723
 724 static uint16_t
 725 umass_get_proto(struct usb_interface *iface)
 726 {
 727         struct usb_interface_descriptor *id;
 728         uint16_t retval;
 729
 730         retval = 0;
 731
 732         /* Check for a standards compliant device */
 733         id = usbd_get_interface_descriptor(iface);
 734         if ((id == NULL) ||
 735             (id->bInterfaceClass != UICLASS_MASS)) {
 736                 goto done;
 737         }
 738         switch (id->bInterfaceSubClass) {
 739         case UISUBCLASS_SCSI:
 740                 retval |= UMASS_PROTO_SCSI;
 741                 break;
 742         case UISUBCLASS_UFI:
 743                 retval |= UMASS_PROTO_UFI;
 744                 break;
 745         case UISUBCLASS_RBC:
 746                 retval |= UMASS_PROTO_RBC;
 747                 break;
 748         case UISUBCLASS_SFF8020I:
 749         case UISUBCLASS_SFF8070I:
 750                 retval |= UMASS_PROTO_ATAPI;
 751                 break;
 752         default:
 753                 goto done;
 754         }
 755
 756         switch (id->bInterfaceProtocol) {
 757         case UIPROTO_MASS_CBI:
 758                 retval |= UMASS_PROTO_CBI;
 759                 break;
 760         case UIPROTO_MASS_CBI_I:
 761                 retval |= UMASS_PROTO_CBI_I;
 762                 break;
 763         case UIPROTO_MASS_BBB_OLD:
 764         case UIPROTO_MASS_BBB:
 765                 retval |= UMASS_PROTO_BBB;
 766                 break;
 767         default:
 768                 goto done;
 769         }
 770 done:
 771         return (retval);
 772 }
 773
 774 /*
 775  * Match the device we are seeing with the devices supported.
 776  */
 777 static struct umass_probe_proto
 778 umass_probe_proto(device_t dev, struct usb_attach_arg *uaa)
 779 {
 780         struct umass_probe_proto ret;
 781         uint32_t quirks = NO_QUIRKS;
 782         uint32_t proto = umass_get_proto(uaa->iface);
 783
 784         memset(&ret, 0, sizeof(ret));
 785
 786         /* Search for protocol enforcement */
 787
 788         if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_BBB)) {
 789                 proto &= ~UMASS_PROTO_WIRE;
 790                 proto |= UMASS_PROTO_BBB;
 791         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI)) {
 792                 proto &= ~UMASS_PROTO_WIRE;
 793                 proto |= UMASS_PROTO_CBI;
 794         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI_I)) {
 795                 proto &= ~UMASS_PROTO_WIRE;
 796                 proto |= UMASS_PROTO_CBI_I;
 797         }
 798
 799         if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_SCSI)) {
 800                 proto &= ~UMASS_PROTO_COMMAND;
 801                 proto |= UMASS_PROTO_SCSI;
 802         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_ATAPI)) {
 803                 proto &= ~UMASS_PROTO_COMMAND;
 804                 proto |= UMASS_PROTO_ATAPI;
 805         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_UFI)) {
 806                 proto &= ~UMASS_PROTO_COMMAND;
 807                 proto |= UMASS_PROTO_UFI;
 808         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_RBC)) {
 809                 proto &= ~UMASS_PROTO_COMMAND;
 810                 proto |= UMASS_PROTO_RBC;
 811         }
 812
 813         /* Check if the protocol is invalid */
 814
 815         if ((proto & UMASS_PROTO_COMMAND) == 0) {
 816                 ret.error = ENXIO;
 817                 goto done;
 818         }
 819
 820         if ((proto & UMASS_PROTO_WIRE) == 0) {
 821                 ret.error = ENXIO;
 822                 goto done;
 823         }
 824
 825         /* Search for quirks */
 826
 827         if (usb_test_quirk(uaa, UQ_MSC_NO_TEST_UNIT_READY))
 828                 quirks |= NO_TEST_UNIT_READY;
 829         if (usb_test_quirk(uaa, UQ_MSC_NO_RS_CLEAR_UA))
 830                 quirks |= RS_NO_CLEAR_UA;
 831         if (usb_test_quirk(uaa, UQ_MSC_NO_START_STOP))
 832                 quirks |= NO_START_STOP;
 833         if (usb_test_quirk(uaa, UQ_MSC_NO_GETMAXLUN))
 834                 quirks |= NO_GETMAXLUN;
 835         if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY))
 836                 quirks |= NO_INQUIRY;
 837         if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY_EVPD))
 838                 quirks |= NO_INQUIRY_EVPD;
 839         if (usb_test_quirk(uaa, UQ_MSC_NO_SYNC_CACHE))
 840                 quirks |= NO_SYNCHRONIZE_CACHE;
 841         if (usb_test_quirk(uaa, UQ_MSC_SHUTTLE_INIT))
 842                 quirks |= SHUTTLE_INIT;
 843         if (usb_test_quirk(uaa, UQ_MSC_ALT_IFACE_1))
 844                 quirks |= ALT_IFACE_1;
 845         if (usb_test_quirk(uaa, UQ_MSC_FLOPPY_SPEED))
 846                 quirks |= FLOPPY_SPEED;
 847         if (usb_test_quirk(uaa, UQ_MSC_IGNORE_RESIDUE))
 848                 quirks |= IGNORE_RESIDUE;
 849         if (usb_test_quirk(uaa, UQ_MSC_WRONG_CSWSIG))
 850                 quirks |= WRONG_CSWSIG;
 851         if (usb_test_quirk(uaa, UQ_MSC_RBC_PAD_TO_12))
 852                 quirks |= RBC_PAD_TO_12;
 853         if (usb_test_quirk(uaa, UQ_MSC_READ_CAP_OFFBY1))
 854                 quirks |= READ_CAPACITY_OFFBY1;
 855         if (usb_test_quirk(uaa, UQ_MSC_FORCE_SHORT_INQ))
 856                 quirks |= FORCE_SHORT_INQUIRY;
 857
 858 done:
 859         ret.quirks = quirks;
 860         ret.proto = proto;
 861         return (ret);
 862 }
 863
 864 static int
 865 umass_probe(device_t dev)
 866 {
 867         struct usb_attach_arg *uaa = device_get_ivars(dev);
 868         struct umass_probe_proto temp;
 869
 870         if (uaa->usb_mode != USB_MODE_HOST) {
 871                 return (ENXIO);
 872         }
 873         if (uaa->use_generic == 0) {
 874                 /* give other drivers a try first */
 875                 return (ENXIO);
 876         }
 877         temp = umass_probe_proto(dev, uaa);
 878
 879         return (temp.error);
 880 }
 881
 882 static int
 883 umass_attach(device_t dev)
 884 {
 885         struct umass_softc *sc = device_get_softc(dev);
 886         struct usb_attach_arg *uaa = device_get_ivars(dev);
 887         struct umass_probe_proto temp = umass_probe_proto(dev, uaa);
 888         struct usb_interface_descriptor *id;
 889         int32_t err;
 890
 891         /*
 892          * NOTE: the softc struct is bzero-ed in device_set_driver.
 893          * We can safely call umass_detach without specifically
 894          * initializing the struct.
 895          */
 896
 897         sc->sc_dev = dev;
 898         sc->sc_udev = uaa->device;
 899         sc->sc_proto = temp.proto;
 900         sc->sc_quirks = temp.quirks;
 901         sc->sc_unit = device_get_unit(dev);
 902
 903         snprintf(sc->sc_name, sizeof(sc->sc_name),
 904             "%s", device_get_nameunit(dev));
 905
 906         device_set_usb_desc(dev);
 907
 908         mtx_init(&sc->sc_mtx, device_get_nameunit(dev),
 909             NULL, MTX_DEF | MTX_RECURSE);
 910
 911         /* get interface index */
 912
 913         id = usbd_get_interface_descriptor(uaa->iface);
 914         if (id == NULL) {
 915                 device_printf(dev, "failed to get "
 916                     "interface number\n");
 917                 goto detach;
 918         }
 919         sc->sc_iface_no = id->bInterfaceNumber;
 920
 921 #ifdef USB_DEBUG
 922         device_printf(dev, " ");
 923
 924         switch (sc->sc_proto & UMASS_PROTO_COMMAND) {
 925         case UMASS_PROTO_SCSI:
 926                 printf("SCSI");
 927                 break;
 928         case UMASS_PROTO_ATAPI:
 929                 printf("8070i (ATAPI)");
 930                 break;
 931         case UMASS_PROTO_UFI:
 932                 printf("UFI");
 933                 break;
 934         case UMASS_PROTO_RBC:
 935                 printf("RBC");
 936                 break;
 937         default:
 938                 printf("(unknown 0x%02x)",
 939                     sc->sc_proto & UMASS_PROTO_COMMAND);
 940                 break;
 941         }
 942
 943         printf(" over ");
 944
 945         switch (sc->sc_proto & UMASS_PROTO_WIRE) {
 946         case UMASS_PROTO_BBB:
 947                 printf("Bulk-Only");
 948                 break;
 949         case UMASS_PROTO_CBI:           /* uses Comand/Bulk pipes */
 950                 printf("CBI");
 951                 break;
 952         case UMASS_PROTO_CBI_I: /* uses Comand/Bulk/Interrupt pipes */
 953                 printf("CBI with CCI");
 954                 break;
 955         default:
 956                 printf("(unknown 0x%02x)",
 957                     sc->sc_proto & UMASS_PROTO_WIRE);
 958         }
 959
 960         printf("; quirks = 0x%04x\n", sc->sc_quirks);
 961 #endif
 962
 963         if (sc->sc_quirks & ALT_IFACE_1) {
 964                 err = usbd_set_alt_interface_index
 965                     (uaa->device, uaa->info.bIfaceIndex, 1);
 966
 967                 if (err) {
 968                         DPRINTF(sc, UDMASS_USB, "could not switch to "
 969                             "Alt Interface 1\n");
 970                         goto detach;
 971                 }
 972         }
 973         /* allocate all required USB transfers */
 974
 975         if (sc->sc_proto & UMASS_PROTO_BBB) {
 976
 977                 err = usbd_transfer_setup(uaa->device,
 978                     &uaa->info.bIfaceIndex, sc->sc_xfer, umass_bbb_config,
 979                     UMASS_T_BBB_MAX, sc, &sc->sc_mtx);
 980
 981                 /* skip reset first time */
 982                 sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
 983
 984         } else if (sc->sc_proto & (UMASS_PROTO_CBI | UMASS_PROTO_CBI_I)) {
 985
 986                 err = usbd_transfer_setup(uaa->device,
 987                     &uaa->info.bIfaceIndex, sc->sc_xfer, umass_cbi_config,
 988                     UMASS_T_CBI_MAX, sc, &sc->sc_mtx);
 989
 990                 /* skip reset first time */
 991                 sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
 992
 993         } else {
 994                 err = USB_ERR_INVAL;
 995         }
 996
 997         if (err) {
 998                 device_printf(dev, "could not setup required "
 999                     "transfers, %s\n", usbd_errstr(err));
1000                 goto detach;
1001         }
1002         sc->sc_transform =
1003             (sc->sc_proto & UMASS_PROTO_SCSI) ? &umass_scsi_transform :
1004             (sc->sc_proto & UMASS_PROTO_UFI) ? &umass_ufi_transform :
1005             (sc->sc_proto & UMASS_PROTO_ATAPI) ? &umass_atapi_transform :
1006             (sc->sc_proto & UMASS_PROTO_RBC) ? &umass_rbc_transform :
1007             &umass_no_transform;
1008
1009         /* from here onwards the device can be used. */
1010
1011         if (sc->sc_quirks & SHUTTLE_INIT) {
1012                 umass_init_shuttle(sc);
1013         }
1014         /* get the maximum LUN supported by the device */
1015
1016         if (((sc->sc_proto & UMASS_PROTO_WIRE) == UMASS_PROTO_BBB) &&
1017             !(sc->sc_quirks & NO_GETMAXLUN))
1018                 sc->sc_maxlun = umass_bbb_get_max_lun(sc);
1019         else
1020                 sc->sc_maxlun = 0;
1021
1022         /* Prepare the SCSI command block */
1023         sc->cam_scsi_sense.opcode = REQUEST_SENSE;
1024         sc->cam_scsi_test_unit_ready.opcode = TEST_UNIT_READY;
1025
1026         /*
1027          * some devices need a delay after that the configuration value is
1028          * set to function properly:
1029          */
1030         usb_pause_mtx(NULL, hz);
1031
1032         /* register the SIM */
1033         err = umass_cam_attach_sim(sc);
1034         if (err) {
1035                 goto detach;
1036         }
1037         /* scan the SIM */
1038         umass_cam_attach(sc);
1039
1040         DPRINTF(sc, UDMASS_GEN, "Attach finished\n");
1041
1042         return (0);                     /* success */
1043
1044 detach:
1045         umass_detach(dev);
1046         return (ENXIO);                 /* failure */
1047 }
1048
1049 static int
1050 umass_detach(device_t dev)
1051 {
1052         struct umass_softc *sc = device_get_softc(dev);
1053
1054         DPRINTF(sc, UDMASS_USB, "\n");
1055
1056         /* teardown our statemachine */
1057
1058         usbd_transfer_unsetup(sc->sc_xfer, UMASS_T_MAX);
1059
1060 #if (__FreeBSD_version >= 700037)
1061         mtx_lock(&sc->sc_mtx);
1062 #endif
1063         umass_cam_detach_sim(sc);
1064
1065 #if (__FreeBSD_version >= 700037)
1066         mtx_unlock(&sc->sc_mtx);
1067 #endif
1068         mtx_destroy(&sc->sc_mtx);
1069
1070         return (0);                     /* success */
1071 }
1072
1073 static void
1074 umass_init_shuttle(struct umass_softc *sc)
1075 {
1076         struct usb_device_request req;
1077         usb_error_t err;
1078         uint8_t status[2] = {0, 0};
1079
1080         /*
1081          * The Linux driver does this, but no one can tell us what the
1082          * command does.
1083          */
1084         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1085         req.bRequest = 1;               /* XXX unknown command */
1086         USETW(req.wValue, 0);
1087         req.wIndex[0] = sc->sc_iface_no;
1088         req.wIndex[1] = 0;
1089         USETW(req.wLength, sizeof(status));
1090         err = usbd_do_request(sc->sc_udev, NULL, &req, &status);
1091
1092         DPRINTF(sc, UDMASS_GEN, "Shuttle init returned 0x%02x%02x\n",
1093             status[0], status[1]);
1094 }
1095
1096 /*
1097  * Generic functions to handle transfers
1098  */
1099
1100 static void
1101 umass_transfer_start(struct umass_softc *sc, uint8_t xfer_index)
1102 {
1103         DPRINTF(sc, UDMASS_GEN, "transfer index = "
1104             "%d\n", xfer_index);
1105
1106         if (sc->sc_xfer[xfer_index]) {
1107                 sc->sc_last_xfer_index = xfer_index;
1108                 usbd_transfer_start(sc->sc_xfer[xfer_index]);
1109         } else {
1110                 umass_cancel_ccb(sc);
1111         }
1112 }
1113
1114 static void
1115 umass_reset(struct umass_softc *sc)
1116 {
1117         DPRINTF(sc, UDMASS_GEN, "resetting device\n");
1118
1119         /*
1120          * stop the last transfer, if not already stopped:
1121          */
1122         usbd_transfer_stop(sc->sc_xfer[sc->sc_last_xfer_index]);
1123         umass_transfer_start(sc, 0);
1124 }
1125
1126 static void
1127 umass_cancel_ccb(struct umass_softc *sc)
1128 {
1129         union ccb *ccb;
1130
1131         mtx_assert(&sc->sc_mtx, MA_OWNED);
1132
1133         ccb = sc->sc_transfer.ccb;
1134         sc->sc_transfer.ccb = NULL;
1135         sc->sc_last_xfer_index = 0;
1136
1137         if (ccb) {
1138                 (sc->sc_transfer.callback)
1139                     (sc, ccb, (sc->sc_transfer.data_len -
1140                     sc->sc_transfer.actlen), STATUS_WIRE_FAILED);
1141         }
1142 }
1143
1144 static void
1145 umass_tr_error(struct usb_xfer *xfer, usb_error_t error)
1146 {
1147         struct umass_softc *sc = usbd_xfer_softc(xfer);
1148
1149         if (error != USB_ERR_CANCELLED) {
1150
1151                 DPRINTF(sc, UDMASS_GEN, "transfer error, %s -> "
1152                     "reset\n", usbd_errstr(error));
1153         }
1154         umass_cancel_ccb(sc);
1155 }
1156
1157 /*
1158  * BBB protocol specific functions
1159  */
1160
1161 static void
1162 umass_t_bbb_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1163 {
1164         struct umass_softc *sc = usbd_xfer_softc(xfer);
1165         struct usb_device_request req;
1166         struct usb_page_cache *pc;
1167
1168         switch (USB_GET_STATE(xfer)) {
1169         case USB_ST_TRANSFERRED:
1170                 umass_transfer_start(sc, UMASS_T_BBB_RESET2);
1171                 return;
1172
1173         case USB_ST_SETUP:
1174                 /*
1175                  * Reset recovery (5.3.4 in Universal Serial Bus Mass Storage Class)
1176                  *
1177                  * For Reset Recovery the host shall issue in the following order:
1178                  * a) a Bulk-Only Mass Storage Reset
1179                  * b) a Clear Feature HALT to the Bulk-In endpoint
1180                  * c) a Clear Feature HALT to the Bulk-Out endpoint
1181                  *
1182                  * This is done in 3 steps, using 3 transfers:
1183                  * UMASS_T_BBB_RESET1
1184                  * UMASS_T_BBB_RESET2
1185                  * UMASS_T_BBB_RESET3
1186                  */
1187
1188                 DPRINTF(sc, UDMASS_BBB, "BBB reset!\n");
1189
1190                 req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1191                 req.bRequest = UR_BBB_RESET;    /* bulk only reset */
1192                 USETW(req.wValue, 0);
1193                 req.wIndex[0] = sc->sc_iface_no;
1194                 req.wIndex[1] = 0;
1195                 USETW(req.wLength, 0);
1196
1197                 pc = usbd_xfer_get_frame(xfer, 0);
1198                 usbd_copy_in(pc, 0, &req, sizeof(req));
1199
1200                 usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1201                 usbd_xfer_set_frames(xfer, 1);
1202                 usbd_transfer_submit(xfer);
1203                 return;
1204
1205         default:                        /* Error */
1206                 umass_tr_error(xfer, error);
1207                 return;
1208
1209         }
1210 }
1211
1212 static void
1213 umass_t_bbb_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1214 {
1215         umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_RESET3,
1216             UMASS_T_BBB_DATA_READ, error);
1217 }
1218
1219 static void
1220 umass_t_bbb_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1221 {
1222         umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_COMMAND,
1223             UMASS_T_BBB_DATA_WRITE, error);
1224 }
1225
1226 static void
1227 umass_t_bbb_data_clear_stall_callback(struct usb_xfer *xfer,
1228     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1229 {
1230         struct umass_softc *sc = usbd_xfer_softc(xfer);
1231
1232         switch (USB_GET_STATE(xfer)) {
1233         case USB_ST_TRANSFERRED:
1234 tr_transferred:
1235                 umass_transfer_start(sc, next_xfer);
1236                 return;
1237
1238         case USB_ST_SETUP:
1239                 if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1240                         goto tr_transferred;
1241                 }
1242                 return;
1243
1244         default:                        /* Error */
1245                 umass_tr_error(xfer, error);
1246                 return;
1247
1248         }
1249 }
1250
1251 static void
1252 umass_t_bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
1253 {
1254         struct umass_softc *sc = usbd_xfer_softc(xfer);
1255         union ccb *ccb = sc->sc_transfer.ccb;
1256         struct usb_page_cache *pc;
1257         uint32_t tag;
1258
1259         switch (USB_GET_STATE(xfer)) {
1260         case USB_ST_TRANSFERRED:
1261                 umass_transfer_start
1262                     (sc, ((sc->sc_transfer.dir == DIR_IN) ? UMASS_T_BBB_DATA_READ :
1263                     (sc->sc_transfer.dir == DIR_OUT) ? UMASS_T_BBB_DATA_WRITE :
1264                     UMASS_T_BBB_STATUS));
1265                 return;
1266
1267         case USB_ST_SETUP:
1268
1269                 sc->sc_status_try = 0;
1270
1271                 if (ccb) {
1272
1273                         /*
1274                          * the initial value is not important,
1275                          * as long as the values are unique:
1276                          */
1277                         tag = UGETDW(sc->cbw.dCBWTag) + 1;
1278
1279                         USETDW(sc->cbw.dCBWSignature, CBWSIGNATURE);
1280                         USETDW(sc->cbw.dCBWTag, tag);
1281
1282                         /*
1283                          * dCBWDataTransferLength:
1284                          *   This field indicates the number of bytes of data that the host
1285                          *   intends to transfer on the IN or OUT Bulk endpoint(as indicated by
1286                          *   the Direction bit) during the execution of this command. If this
1287                          *   field is set to 0, the device will expect that no data will be
1288                          *   transferred IN or OUT during this command, regardless of the value
1289                          *   of the Direction bit defined in dCBWFlags.
1290                          */
1291                         USETDW(sc->cbw.dCBWDataTransferLength, sc->sc_transfer.data_len);
1292
1293                         /*
1294                          * dCBWFlags:
1295                          *   The bits of the Flags field are defined as follows:
1296                          *     Bits 0-6  reserved
1297                          *     Bit  7    Direction - this bit shall be ignored if the
1298                          *                           dCBWDataTransferLength field is zero.
1299                          *               0 = data Out from host to device
1300                          *               1 = data In from device to host
1301                          */
1302                         sc->cbw.bCBWFlags = ((sc->sc_transfer.dir == DIR_IN) ?
1303                             CBWFLAGS_IN : CBWFLAGS_OUT);
1304                         sc->cbw.bCBWLUN = sc->sc_transfer.lun;
1305
1306                         if (sc->sc_transfer.cmd_len > sizeof(sc->cbw.CBWCDB)) {
1307                                 sc->sc_transfer.cmd_len = sizeof(sc->cbw.CBWCDB);
1308                                 DPRINTF(sc, UDMASS_BBB, "Truncating long command!\n");
1309                         }
1310                         sc->cbw.bCDBLength = sc->sc_transfer.cmd_len;
1311
1312                         bcopy(sc->sc_transfer.cmd_data, sc->cbw.CBWCDB,
1313                             sc->sc_transfer.cmd_len);
1314
1315                         bzero(sc->sc_transfer.cmd_data + sc->sc_transfer.cmd_len,
1316                             sizeof(sc->cbw.CBWCDB) - sc->sc_transfer.cmd_len);
1317
1318                         DIF(UDMASS_BBB, umass_bbb_dump_cbw(sc, &sc->cbw));
1319
1320                         pc = usbd_xfer_get_frame(xfer, 0);
1321                         usbd_copy_in(pc, 0, &sc->cbw, sizeof(sc->cbw));
1322                         usbd_xfer_set_frame_len(xfer, 0, sizeof(sc->cbw));
1323
1324                         usbd_transfer_submit(xfer);
1325                 }
1326                 return;
1327
1328         default:                        /* Error */
1329                 umass_tr_error(xfer, error);
1330                 return;
1331
1332         }
1333 }
1334
1335 static void
1336 umass_t_bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1337 {
1338         struct umass_softc *sc = usbd_xfer_softc(xfer);
1339         uint32_t max_bulk = usbd_xfer_max_len(xfer);
1340 #ifndef UMASS_EXT_BUFFER
1341         struct usb_page_cache *pc;
1342 #endif
1343         int actlen, sumlen;
1344
1345         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1346
1347         switch (USB_GET_STATE(xfer)) {
1348         case USB_ST_TRANSFERRED:
1349 #ifndef UMASS_EXT_BUFFER
1350                 pc = usbd_xfer_get_frame(xfer, 0);
1351                 usbd_copy_out(pc, 0, sc->sc_transfer.data_ptr, actlen);
1352 #endif
1353                 sc->sc_transfer.data_rem -= actlen;
1354                 sc->sc_transfer.data_ptr += actlen;
1355                 sc->sc_transfer.actlen += actlen;
1356
1357                 if (actlen < sumlen) {
1358                         /* short transfer */
1359                         sc->sc_transfer.data_rem = 0;
1360                 }
1361         case USB_ST_SETUP:
1362                 DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1363                     max_bulk, sc->sc_transfer.data_rem);
1364
1365                 if (sc->sc_transfer.data_rem == 0) {
1366                         umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1367                         return;
1368                 }
1369                 if (max_bulk > sc->sc_transfer.data_rem) {
1370                         max_bulk = sc->sc_transfer.data_rem;
1371                 }
1372                 usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1373
1374 #ifdef UMASS_EXT_BUFFER
1375                 usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1376                     max_bulk);
1377 #else
1378                 usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1379 #endif
1380                 usbd_transfer_submit(xfer);
1381                 return;
1382
1383         default:                        /* Error */
1384                 if (error == USB_ERR_CANCELLED) {
1385                         umass_tr_error(xfer, error);
1386                 } else {
1387                         umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1388                 }
1389                 return;
1390
1391         }
1392 }
1393
1394 static void
1395 umass_t_bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1396 {
1397         umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1398             UMASS_T_BBB_DATA_READ, error);
1399 }
1400
1401 static void
1402 umass_t_bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1403 {
1404         struct umass_softc *sc = usbd_xfer_softc(xfer);
1405         uint32_t max_bulk = usbd_xfer_max_len(xfer);
1406 #ifndef UMASS_EXT_BUFFER
1407         struct usb_page_cache *pc;
1408 #endif
1409         int actlen, sumlen;
1410
1411         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1412
1413         switch (USB_GET_STATE(xfer)) {
1414         case USB_ST_TRANSFERRED:
1415                 sc->sc_transfer.data_rem -= actlen;
1416                 sc->sc_transfer.data_ptr += actlen;
1417                 sc->sc_transfer.actlen += actlen;
1418
1419                 if (actlen < sumlen) {
1420                         /* short transfer */
1421                         sc->sc_transfer.data_rem = 0;
1422                 }
1423         case USB_ST_SETUP:
1424                 DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1425                     max_bulk, sc->sc_transfer.data_rem);
1426
1427                 if (sc->sc_transfer.data_rem == 0) {
1428                         umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1429                         return;
1430                 }
1431                 if (max_bulk > sc->sc_transfer.data_rem) {
1432                         max_bulk = sc->sc_transfer.data_rem;
1433                 }
1434                 usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1435
1436 #ifdef UMASS_EXT_BUFFER
1437                 usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1438                     max_bulk);
1439 #else
1440                 pc = usbd_xfer_get_frame(xfer, 0);
1441                 usbd_copy_in(pc, 0, sc->sc_transfer.data_ptr, max_bulk);
1442                 usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1443 #endif
1444
1445                 usbd_transfer_submit(xfer);
1446                 return;
1447
1448         default:                        /* Error */
1449                 if (error == USB_ERR_CANCELLED) {
1450                         umass_tr_error(xfer, error);
1451                 } else {
1452                         umass_transfer_start(sc, UMASS_T_BBB_DATA_WR_CS);
1453                 }
1454                 return;
1455
1456         }
1457 }
1458
1459 static void
1460 umass_t_bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1461 {
1462         umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1463             UMASS_T_BBB_DATA_WRITE, error);
1464 }
1465
1466 static void
1467 umass_t_bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
1468 {
1469         struct umass_softc *sc = usbd_xfer_softc(xfer);
1470         union ccb *ccb = sc->sc_transfer.ccb;
1471         struct usb_page_cache *pc;
1472         uint32_t residue;
1473         int actlen;
1474
1475         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1476
1477         switch (USB_GET_STATE(xfer)) {
1478         case USB_ST_TRANSFERRED:
1479
1480                 /*
1481                  * Do a full reset if there is something wrong with the CSW:
1482                  */
1483                 sc->sc_status_try = 1;
1484
1485                 /* Zero missing parts of the CSW: */
1486
1487                 if (actlen < sizeof(sc->csw)) {
1488                         bzero(&sc->csw, sizeof(sc->csw));
1489                 }
1490                 pc = usbd_xfer_get_frame(xfer, 0);
1491                 usbd_copy_out(pc, 0, &sc->csw, actlen);
1492
1493                 DIF(UDMASS_BBB, umass_bbb_dump_csw(sc, &sc->csw));
1494
1495                 residue = UGETDW(sc->csw.dCSWDataResidue);
1496
1497                 if ((!residue) || (sc->sc_quirks & IGNORE_RESIDUE)) {
1498                         residue = (sc->sc_transfer.data_len -
1499                             sc->sc_transfer.actlen);
1500                 }
1501                 if (residue > sc->sc_transfer.data_len) {
1502                         DPRINTF(sc, UDMASS_BBB, "truncating residue from %d "
1503                             "to %d bytes\n", residue, sc->sc_transfer.data_len);
1504                         residue = sc->sc_transfer.data_len;
1505                 }
1506                 /* translate weird command-status signatures: */
1507                 if (sc->sc_quirks & WRONG_CSWSIG) {
1508
1509                         uint32_t temp = UGETDW(sc->csw.dCSWSignature);
1510
1511                         if ((temp == CSWSIGNATURE_OLYMPUS_C1) ||
1512                             (temp == CSWSIGNATURE_IMAGINATION_DBX1)) {
1513                                 USETDW(sc->csw.dCSWSignature, CSWSIGNATURE);
1514                         }
1515                 }
1516                 /* check CSW and handle eventual error */
1517                 if (UGETDW(sc->csw.dCSWSignature) != CSWSIGNATURE) {
1518                         DPRINTF(sc, UDMASS_BBB, "bad CSW signature 0x%08x != 0x%08x\n",
1519                             UGETDW(sc->csw.dCSWSignature), CSWSIGNATURE);
1520                         /*
1521                          * Invalid CSW: Wrong signature or wrong tag might
1522                          * indicate that we lost synchronization. Reset the
1523                          * device.
1524                          */
1525                         goto tr_error;
1526                 } else if (UGETDW(sc->csw.dCSWTag) != UGETDW(sc->cbw.dCBWTag)) {
1527                         DPRINTF(sc, UDMASS_BBB, "Invalid CSW: tag 0x%08x should be "
1528                             "0x%08x\n", UGETDW(sc->csw.dCSWTag),
1529                             UGETDW(sc->cbw.dCBWTag));
1530                         goto tr_error;
1531                 } else if (sc->csw.bCSWStatus > CSWSTATUS_PHASE) {
1532                         DPRINTF(sc, UDMASS_BBB, "Invalid CSW: status %d > %d\n",
1533                             sc->csw.bCSWStatus, CSWSTATUS_PHASE);
1534                         goto tr_error;
1535                 } else if (sc->csw.bCSWStatus == CSWSTATUS_PHASE) {
1536                         DPRINTF(sc, UDMASS_BBB, "Phase error, residue = "
1537                             "%d\n", residue);
1538                         goto tr_error;
1539                 } else if (sc->sc_transfer.actlen > sc->sc_transfer.data_len) {
1540                         DPRINTF(sc, UDMASS_BBB, "Buffer overrun %d > %d\n",
1541                             sc->sc_transfer.actlen, sc->sc_transfer.data_len);
1542                         goto tr_error;
1543                 } else if (sc->csw.bCSWStatus == CSWSTATUS_FAILED) {
1544                         DPRINTF(sc, UDMASS_BBB, "Command failed, residue = "
1545                             "%d\n", residue);
1546
1547                         sc->sc_transfer.ccb = NULL;
1548
1549                         sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1550
1551                         (sc->sc_transfer.callback)
1552                             (sc, ccb, residue, STATUS_CMD_FAILED);
1553                 } else {
1554                         sc->sc_transfer.ccb = NULL;
1555
1556                         sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1557
1558                         (sc->sc_transfer.callback)
1559                             (sc, ccb, residue, STATUS_CMD_OK);
1560                 }
1561                 return;
1562
1563         case USB_ST_SETUP:
1564                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1565                 usbd_transfer_submit(xfer);
1566                 return;
1567
1568         default:
1569 tr_error:
1570                 DPRINTF(sc, UDMASS_BBB, "Failed to read CSW: %s, try %d\n",
1571                     usbd_errstr(error), sc->sc_status_try);
1572
1573                 if ((error == USB_ERR_CANCELLED) ||
1574                     (sc->sc_status_try)) {
1575                         umass_tr_error(xfer, error);
1576                 } else {
1577                         sc->sc_status_try = 1;
1578                         umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1579                 }
1580                 return;
1581
1582         }
1583 }
1584
1585 static void
1586 umass_command_start(struct umass_softc *sc, uint8_t dir,
1587     void *data_ptr, uint32_t data_len,
1588     uint32_t data_timeout, umass_callback_t *callback,
1589     union ccb *ccb)
1590 {
1591         sc->sc_transfer.lun = ccb->ccb_h.target_lun;
1592
1593         /*
1594          * NOTE: assumes that "sc->sc_transfer.cmd_data" and
1595          * "sc->sc_transfer.cmd_len" has been properly
1596          * initialized.
1597          */
1598
1599         sc->sc_transfer.dir = data_len ? dir : DIR_NONE;
1600         sc->sc_transfer.data_ptr = data_ptr;
1601         sc->sc_transfer.data_len = data_len;
1602         sc->sc_transfer.data_rem = data_len;
1603         sc->sc_transfer.data_timeout = (data_timeout + UMASS_TIMEOUT);
1604
1605         sc->sc_transfer.actlen = 0;
1606         sc->sc_transfer.callback = callback;
1607         sc->sc_transfer.ccb = ccb;
1608
1609         if (sc->sc_xfer[sc->sc_last_xfer_index]) {
1610                 usbd_transfer_start(sc->sc_xfer[sc->sc_last_xfer_index]);
1611         } else {
1612                 ccb->ccb_h.status = CAM_TID_INVALID;
1613                 xpt_done(ccb);
1614         }
1615 }
1616
1617 static uint8_t
1618 umass_bbb_get_max_lun(struct umass_softc *sc)
1619 {
1620         struct usb_device_request req;
1621         usb_error_t err;
1622         uint8_t buf = 0;
1623
1624         /* The Get Max Lun command is a class-specific request. */
1625         req.bmRequestType = UT_READ_CLASS_INTERFACE;
1626         req.bRequest = UR_BBB_GET_MAX_LUN;
1627         USETW(req.wValue, 0);
1628         req.wIndex[0] = sc->sc_iface_no;
1629         req.wIndex[1] = 0;
1630         USETW(req.wLength, 1);
1631
1632         err = usbd_do_request(sc->sc_udev, NULL, &req, &buf);
1633         if (err) {
1634                 buf = 0;
1635
1636                 /* Device doesn't support Get Max Lun request. */
1637                 printf("%s: Get Max Lun not supported (%s)\n",
1638                     sc->sc_name, usbd_errstr(err));
1639         }
1640         return (buf);
1641 }
1642
1643 /*
1644  * Command/Bulk/Interrupt (CBI) specific functions
1645  */
1646
1647 static void
1648 umass_cbi_start_status(struct umass_softc *sc)
1649 {
1650         if (sc->sc_xfer[UMASS_T_CBI_STATUS]) {
1651                 umass_transfer_start(sc, UMASS_T_CBI_STATUS);
1652         } else {
1653                 union ccb *ccb = sc->sc_transfer.ccb;
1654
1655                 sc->sc_transfer.ccb = NULL;
1656
1657                 sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1658
1659                 (sc->sc_transfer.callback)
1660                     (sc, ccb, (sc->sc_transfer.data_len -
1661                     sc->sc_transfer.actlen), STATUS_CMD_UNKNOWN);
1662         }
1663 }
1664
1665 static void
1666 umass_t_cbi_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1667 {
1668         struct umass_softc *sc = usbd_xfer_softc(xfer);
1669         struct usb_device_request req;
1670         struct usb_page_cache *pc;
1671         uint8_t buf[UMASS_CBI_DIAGNOSTIC_CMDLEN];
1672
1673         uint8_t i;
1674
1675         switch (USB_GET_STATE(xfer)) {
1676         case USB_ST_TRANSFERRED:
1677                 umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1678                 break;
1679
1680         case USB_ST_SETUP:
1681                 /*
1682                  * Command Block Reset Protocol
1683                  *
1684                  * First send a reset request to the device. Then clear
1685                  * any possibly stalled bulk endpoints.
1686                  *
1687                  * This is done in 3 steps, using 3 transfers:
1688                  * UMASS_T_CBI_RESET1
1689                  * UMASS_T_CBI_RESET2
1690                  * UMASS_T_CBI_RESET3
1691                  * UMASS_T_CBI_RESET4 (only if there is an interrupt endpoint)
1692                  */
1693
1694                 DPRINTF(sc, UDMASS_CBI, "CBI reset!\n");
1695
1696                 req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1697                 req.bRequest = UR_CBI_ADSC;
1698                 USETW(req.wValue, 0);
1699                 req.wIndex[0] = sc->sc_iface_no;
1700                 req.wIndex[1] = 0;
1701                 USETW(req.wLength, UMASS_CBI_DIAGNOSTIC_CMDLEN);
1702
1703                 /*
1704                  * The 0x1d code is the SEND DIAGNOSTIC command. To
1705                  * distinguish between the two, the last 10 bytes of the CBL
1706                  * is filled with 0xff (section 2.2 of the CBI
1707                  * specification)
1708                  */
1709                 buf[0] = 0x1d;          /* Command Block Reset */
1710                 buf[1] = 0x04;
1711
1712                 for (i = 2; i < UMASS_CBI_DIAGNOSTIC_CMDLEN; i++) {
1713                         buf[i] = 0xff;
1714                 }
1715
1716                 pc = usbd_xfer_get_frame(xfer, 0);
1717                 usbd_copy_in(pc, 0, &req, sizeof(req));
1718                 pc = usbd_xfer_get_frame(xfer, 1);
1719                 usbd_copy_in(pc, 0, buf, sizeof(buf));
1720
1721                 usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1722                 usbd_xfer_set_frame_len(xfer, 1, sizeof(buf));
1723                 usbd_xfer_set_frames(xfer, 2);
1724                 usbd_transfer_submit(xfer);
1725                 break;
1726
1727         default:                        /* Error */
1728                 if (error == USB_ERR_CANCELLED)
1729                         umass_tr_error(xfer, error);
1730                 else
1731                         umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1732                 break;
1733
1734         }
1735 }
1736
1737 static void
1738 umass_t_cbi_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1739 {
1740         umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_RESET3,
1741             UMASS_T_CBI_DATA_READ, error);
1742 }
1743
1744 static void
1745 umass_t_cbi_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1746 {
1747         struct umass_softc *sc = usbd_xfer_softc(xfer);
1748
1749         umass_t_cbi_data_clear_stall_callback
1750             (xfer, (sc->sc_xfer[UMASS_T_CBI_RESET4] &&
1751             sc->sc_xfer[UMASS_T_CBI_STATUS]) ?
1752             UMASS_T_CBI_RESET4 : UMASS_T_CBI_COMMAND,
1753             UMASS_T_CBI_DATA_WRITE, error);
1754 }
1755
1756 static void
1757 umass_t_cbi_reset4_callback(struct usb_xfer *xfer, usb_error_t error)
1758 {
1759         umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_COMMAND,
1760             UMASS_T_CBI_STATUS, error);
1761 }
1762
1763 static void
1764 umass_t_cbi_data_clear_stall_callback(struct usb_xfer *xfer,
1765     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1766 {
1767         struct umass_softc *sc = usbd_xfer_softc(xfer);
1768
1769         switch (USB_GET_STATE(xfer)) {
1770         case USB_ST_TRANSFERRED:
1771 tr_transferred:
1772                 if (next_xfer == UMASS_T_CBI_STATUS) {
1773                         umass_cbi_start_status(sc);
1774                 } else {
1775                         umass_transfer_start(sc, next_xfer);
1776                 }
1777                 break;
1778
1779         case USB_ST_SETUP:
1780                 if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1781                         goto tr_transferred;    /* should not happen */
1782                 }
1783                 break;
1784
1785         default:                        /* Error */
1786                 umass_tr_error(xfer, error);
1787                 break;
1788
1789         }
1790 }
1791
1792 static void
1793 umass_t_cbi_command_callback(struct usb_xfer *xfer, usb_error_t error)
1794 {
1795         struct umass_softc *sc = usbd_xfer_softc(xfer);
1796         union ccb *ccb = sc->sc_transfer.ccb;
1797         struct usb_device_request req;
1798         struct usb_page_cache *pc;
1799
1800         switch (USB_GET_STATE(xfer)) {
1801         case USB_ST_TRANSFERRED:
1802
1803                 if (sc->sc_transfer.dir == DIR_NONE) {
1804                         umass_cbi_start_status(sc);
1805                 } else {
1806                         umass_transfer_start
1807                             (sc, (sc->sc_transfer.dir == DIR_IN) ?
1808                             UMASS_T_CBI_DATA_READ : UMASS_T_CBI_DATA_WRITE);
1809                 }
1810                 break;
1811
1812         case USB_ST_SETUP:
1813
1814                 if (ccb) {
1815
1816                         /*
1817                          * do a CBI transfer with cmd_len bytes from
1818                          * cmd_data, possibly a data phase of data_len
1819                          * bytes from/to the device and finally a status
1820                          * read phase.
1821                          */
1822
1823                         req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1824                         req.bRequest = UR_CBI_ADSC;
1825                         USETW(req.wValue, 0);
1826                         req.wIndex[0] = sc->sc_iface_no;
1827                         req.wIndex[1] = 0;
1828                         req.wLength[0] = sc->sc_transfer.cmd_len;
1829                         req.wLength[1] = 0;
1830
1831                         pc = usbd_xfer_get_frame(xfer, 0);
1832                         usbd_copy_in(pc, 0, &req, sizeof(req));
1833                         pc = usbd_xfer_get_frame(xfer, 1);
1834                         usbd_copy_in(pc, 0, sc->sc_transfer.cmd_data,
1835                             sc->sc_transfer.cmd_len);
1836
1837                         usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1838                         usbd_xfer_set_frame_len(xfer, 1, sc->sc_transfer.cmd_len);
1839                         usbd_xfer_set_frames(xfer,
1840                             sc->sc_transfer.cmd_len ? 2 : 1);
1841
1842                         DIF(UDMASS_CBI,
1843                             umass_cbi_dump_cmd(sc,
1844                             sc->sc_transfer.cmd_data,
1845                             sc->sc_transfer.cmd_len));
1846
1847                         usbd_transfer_submit(xfer);
1848                 }
1849                 break;
1850
1851         default:                        /* Error */
1852                 umass_tr_error(xfer, error);
1853                 /* skip reset */
1854                 sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1855                 break;
1856         }
1857 }
1858
1859 static void
1860 umass_t_cbi_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1861 {
1862         struct umass_softc *sc = usbd_xfer_softc(xfer);
1863         uint32_t max_bulk = usbd_xfer_max_len(xfer);
1864 #ifndef UMASS_EXT_BUFFER
1865         struct usb_page_cache *pc;
1866 #endif
1867         int actlen, sumlen;
1868
1869         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1870
1871         switch (USB_GET_STATE(xfer)) {
1872         case USB_ST_TRANSFERRED:
1873 #ifndef UMASS_EXT_BUFFER
1874                 pc = usbd_xfer_get_frame(xfer, 0);
1875                 usbd_copy_out(pc, 0, sc->sc_transfer.data_ptr, actlen);
1876 #endif
1877                 sc->sc_transfer.data_rem -= actlen;
1878                 sc->sc_transfer.data_ptr += actlen;
1879                 sc->sc_transfer.actlen += actlen;
1880
1881                 if (actlen < sumlen) {
1882                         /* short transfer */
1883                         sc->sc_transfer.data_rem = 0;
1884                 }
1885         case USB_ST_SETUP:
1886                 DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1887                     max_bulk, sc->sc_transfer.data_rem);
1888
1889                 if (sc->sc_transfer.data_rem == 0) {
1890                         umass_cbi_start_status(sc);
1891                         break;
1892                 }
1893                 if (max_bulk > sc->sc_transfer.data_rem) {
1894                         max_bulk = sc->sc_transfer.data_rem;
1895                 }
1896                 usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1897
1898 #ifdef UMASS_EXT_BUFFER
1899                 usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1900                     max_bulk);
1901 #else
1902                 usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1903 #endif
1904                 usbd_transfer_submit(xfer);
1905                 break;
1906
1907         default:                        /* Error */
1908                 if ((error == USB_ERR_CANCELLED) ||
1909                     (sc->sc_transfer.callback != &umass_cam_cb)) {
1910                         umass_tr_error(xfer, error);
1911                 } else {
1912                         umass_transfer_start(sc, UMASS_T_CBI_DATA_RD_CS);
1913                 }
1914                 break;
1915
1916         }
1917 }
1918
1919 static void
1920 umass_t_cbi_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1921 {
1922         umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1923             UMASS_T_CBI_DATA_READ, error);
1924 }
1925
1926 static void
1927 umass_t_cbi_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1928 {
1929         struct umass_softc *sc = usbd_xfer_softc(xfer);
1930         uint32_t max_bulk = usbd_xfer_max_len(xfer);
1931 #ifndef UMASS_EXT_BUFFER
1932         struct usb_page_cache *pc;
1933 #endif
1934         int actlen, sumlen;
1935
1936         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1937
1938         switch (USB_GET_STATE(xfer)) {
1939         case USB_ST_TRANSFERRED:
1940                 sc->sc_transfer.data_rem -= actlen;
1941                 sc->sc_transfer.data_ptr += actlen;
1942                 sc->sc_transfer.actlen += actlen;
1943
1944                 if (actlen < sumlen) {
1945                         /* short transfer */
1946                         sc->sc_transfer.data_rem = 0;
1947                 }
1948         case USB_ST_SETUP:
1949                 DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1950                     max_bulk, sc->sc_transfer.data_rem);
1951
1952                 if (sc->sc_transfer.data_rem == 0) {
1953                         umass_cbi_start_status(sc);
1954                         break;
1955                 }
1956                 if (max_bulk > sc->sc_transfer.data_rem) {
1957                         max_bulk = sc->sc_transfer.data_rem;
1958                 }
1959                 usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1960
1961 #ifdef UMASS_EXT_BUFFER
1962                 usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1963                     max_bulk);
1964 #else
1965                 pc = usbd_xfer_get_frame(xfer, 0);
1966                 usbd_copy_in(pc, 0, sc->sc_transfer.data_ptr, max_bulk);
1967                 usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1968 #endif
1969
1970                 usbd_transfer_submit(xfer);
1971                 break;
1972
1973         default:                        /* Error */
1974                 if ((error == USB_ERR_CANCELLED) ||
1975                     (sc->sc_transfer.callback != &umass_cam_cb)) {
1976                         umass_tr_error(xfer, error);
1977                 } else {
1978                         umass_transfer_start(sc, UMASS_T_CBI_DATA_WR_CS);
1979                 }
1980                 break;
1981
1982         }
1983 }
1984
1985 static void
1986 umass_t_cbi_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1987 {
1988         umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1989             UMASS_T_CBI_DATA_WRITE, error);
1990 }
1991
1992 static void
1993 umass_t_cbi_status_callback(struct usb_xfer *xfer, usb_error_t error)
1994 {
1995         struct umass_softc *sc = usbd_xfer_softc(xfer);
1996         union ccb *ccb = sc->sc_transfer.ccb;
1997         struct usb_page_cache *pc;
1998         uint32_t residue;
1999         uint8_t status;
2000         int actlen;
2001
2002         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
2003
2004         switch (USB_GET_STATE(xfer)) {
2005         case USB_ST_TRANSFERRED:
2006
2007                 if (actlen < sizeof(sc->sbl)) {
2008                         goto tr_setup;
2009                 }
2010                 pc = usbd_xfer_get_frame(xfer, 0);
2011                 usbd_copy_out(pc, 0, &sc->sbl, sizeof(sc->sbl));
2012
2013                 residue = (sc->sc_transfer.data_len -
2014                     sc->sc_transfer.actlen);
2015
2016                 /* dissect the information in the buffer */
2017
2018                 if (sc->sc_proto & UMASS_PROTO_UFI) {
2019
2020                         /*
2021                          * Section 3.4.3.1.3 specifies that the UFI command
2022                          * protocol returns an ASC and ASCQ in the interrupt
2023                          * data block.
2024                          */
2025
2026                         DPRINTF(sc, UDMASS_CBI, "UFI CCI, ASC = 0x%02x, "
2027                             "ASCQ = 0x%02x\n", sc->sbl.ufi.asc,
2028                             sc->sbl.ufi.ascq);
2029
2030                         status = (((sc->sbl.ufi.asc == 0) &&
2031                             (sc->sbl.ufi.ascq == 0)) ?
2032                             STATUS_CMD_OK : STATUS_CMD_FAILED);
2033
2034                         sc->sc_transfer.ccb = NULL;
2035
2036                         sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2037
2038                         (sc->sc_transfer.callback)
2039                             (sc, ccb, residue, status);
2040
2041                         break;
2042
2043                 } else {
2044
2045                         /* Command Interrupt Data Block */
2046
2047                         DPRINTF(sc, UDMASS_CBI, "type=0x%02x, value=0x%02x\n",
2048                             sc->sbl.common.type, sc->sbl.common.value);
2049
2050                         if (sc->sbl.common.type == IDB_TYPE_CCI) {
2051
2052                                 status = (sc->sbl.common.value & IDB_VALUE_STATUS_MASK);
2053
2054                                 status = ((status == IDB_VALUE_PASS) ? STATUS_CMD_OK :
2055                                     (status == IDB_VALUE_FAIL) ? STATUS_CMD_FAILED :
2056                                     (status == IDB_VALUE_PERSISTENT) ? STATUS_CMD_FAILED :
2057                                     STATUS_WIRE_FAILED);
2058
2059                                 sc->sc_transfer.ccb = NULL;
2060
2061                                 sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2062
2063                                 (sc->sc_transfer.callback)
2064                                     (sc, ccb, residue, status);
2065
2066                                 break;
2067                         }
2068                 }
2069
2070                 /* fallthrough */
2071
2072         case USB_ST_SETUP:
2073 tr_setup:
2074                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2075                 usbd_transfer_submit(xfer);
2076                 break;
2077
2078         default:                        /* Error */
2079                 DPRINTF(sc, UDMASS_CBI, "Failed to read CSW: %s\n",
2080                     usbd_errstr(error));
2081                 umass_tr_error(xfer, error);
2082                 break;
2083
2084         }
2085 }
2086
2087 /*
2088  * CAM specific functions (used by SCSI, UFI, 8070i (ATAPI))
2089  */
2090
2091 static int
2092 umass_cam_attach_sim(struct umass_softc *sc)
2093 {
2094         struct cam_devq *devq;          /* Per device Queue */
2095
2096         /*
2097          * A HBA is attached to the CAM layer.
2098          *
2099          * The CAM layer will then after a while start probing for devices on
2100          * the bus. The number of SIMs is limited to one.
2101          */
2102
2103         devq = cam_simq_alloc(1 /* maximum openings */ );
2104         if (devq == NULL) {
2105                 return (ENOMEM);
2106         }
2107         sc->sc_sim = cam_sim_alloc
2108             (&umass_cam_action, &umass_cam_poll,
2109             DEVNAME_SIM,
2110             sc /* priv */ ,
2111             sc->sc_unit /* unit number */ ,
2112 #if (__FreeBSD_version >= 700037)
2113             &sc->sc_mtx /* mutex */ ,
2114 #endif
2115             1 /* maximum device openings */ ,
2116             0 /* maximum tagged device openings */ ,
2117             devq);
2118
2119         if (sc->sc_sim == NULL) {
2120                 cam_simq_free(devq);
2121                 return (ENOMEM);
2122         }
2123
2124 #if (__FreeBSD_version >= 700037)
2125         mtx_lock(&sc->sc_mtx);
2126 #endif
2127
2128 #if (__FreeBSD_version >= 700048)
2129         if (xpt_bus_register(sc->sc_sim, sc->sc_dev, sc->sc_unit) != CAM_SUCCESS) {
2130                 mtx_unlock(&sc->sc_mtx);
2131                 return (ENOMEM);
2132         }
2133 #else
2134         if (xpt_bus_register(sc->sc_sim, sc->sc_unit) != CAM_SUCCESS) {
2135 #if (__FreeBSD_version >= 700037)
2136                 mtx_unlock(&sc->sc_mtx);
2137 #endif
2138                 return (ENOMEM);
2139         }
2140 #endif
2141
2142 #if (__FreeBSD_version >= 700037)
2143         mtx_unlock(&sc->sc_mtx);
2144 #endif
2145         return (0);
2146 }
2147
2148 static void
2149 umass_cam_attach(struct umass_softc *sc)
2150 {
2151 #ifndef USB_DEBUG
2152         if (bootverbose)
2153 #endif
2154                 printf("%s:%d:%d:%d: Attached to scbus%d\n",
2155                     sc->sc_name, cam_sim_path(sc->sc_sim),
2156                     sc->sc_unit, CAM_LUN_WILDCARD,
2157                     cam_sim_path(sc->sc_sim));
2158 }
2159
2160 /* umass_cam_detach
2161  *      detach from the CAM layer
2162  */
2163
2164 static void
2165 umass_cam_detach_sim(struct umass_softc *sc)
2166 {
2167         if (sc->sc_sim != NULL) {
2168                 if (xpt_bus_deregister(cam_sim_path(sc->sc_sim))) {
2169                         /* accessing the softc is not possible after this */
2170                         sc->sc_sim->softc = UMASS_GONE;
2171                         cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2172                 } else {
2173                         panic("%s: CAM layer is busy\n",
2174                             sc->sc_name);
2175                 }
2176                 sc->sc_sim = NULL;
2177         }
2178 }
2179
2180 /* umass_cam_action
2181  *      CAM requests for action come through here
2182  */
2183
2184 static void
2185 umass_cam_action(struct cam_sim *sim, union ccb *ccb)
2186 {
2187         struct umass_softc *sc = (struct umass_softc *)sim->softc;
2188
2189         if (sc == UMASS_GONE ||
2190             (sc != NULL && !usbd_device_attached(sc->sc_udev))) {
2191                 ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2192                 xpt_done(ccb);
2193                 return;
2194         }
2195         if (sc) {
2196 #if (__FreeBSD_version < 700037)
2197                 mtx_lock(&sc->sc_mtx);
2198 #endif
2199         }
2200         /*
2201          * Verify, depending on the operation to perform, that we either got
2202          * a valid sc, because an existing target was referenced, or
2203          * otherwise the SIM is addressed.
2204          *
2205          * This avoids bombing out at a printf and does give the CAM layer some
2206          * sensible feedback on errors.
2207          */
2208         switch (ccb->ccb_h.func_code) {
2209         case XPT_SCSI_IO:
2210         case XPT_RESET_DEV:
2211         case XPT_GET_TRAN_SETTINGS:
2212         case XPT_SET_TRAN_SETTINGS:
2213         case XPT_CALC_GEOMETRY:
2214                 /* the opcodes requiring a target. These should never occur. */
2215                 if (sc == NULL) {
2216                         DPRINTF(sc, UDMASS_GEN, "%s:%d:%d:%d:func_code 0x%04x: "
2217                             "Invalid target (target needed)\n",
2218                             DEVNAME_SIM, cam_sim_path(sc->sc_sim),
2219                             ccb->ccb_h.target_id, ccb->ccb_h.target_lun,
2220                             ccb->ccb_h.func_code);
2221
2222                         ccb->ccb_h.status = CAM_TID_INVALID;
2223                         xpt_done(ccb);
2224                         goto done;
2225                 }
2226                 break;
2227         case XPT_PATH_INQ:
2228         case XPT_NOOP:
2229                 /*
2230                  * The opcodes sometimes aimed at a target (sc is valid),
2231                  * sometimes aimed at the SIM (sc is invalid and target is
2232                  * CAM_TARGET_WILDCARD)
2233                  */
2234                 if ((sc == NULL) &&
2235                     (ccb->ccb_h.target_id != CAM_TARGET_WILDCARD)) {
2236                         DPRINTF(sc, UDMASS_SCSI, "%s:%d:%d:%d:func_code 0x%04x: "
2237                             "Invalid target (no wildcard)\n",
2238                             DEVNAME_SIM, cam_sim_path(sc->sc_sim),
2239                             ccb->ccb_h.target_id, ccb->ccb_h.target_lun,
2240                             ccb->ccb_h.func_code);
2241
2242                         ccb->ccb_h.status = CAM_TID_INVALID;
2243                         xpt_done(ccb);
2244                         goto done;
2245                 }
2246                 break;
2247         default:
2248                 /* XXX Hm, we should check the input parameters */
2249                 break;
2250         }
2251
2252         /* Perform the requested action */
2253         switch (ccb->ccb_h.func_code) {
2254         case XPT_SCSI_IO:
2255                 {
2256                         uint8_t *cmd;
2257                         uint8_t dir;
2258
2259                         if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2260                                 cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2261                         } else {
2262                                 cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2263                         }
2264
2265                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2266                             "cmd: 0x%02x, flags: 0x%02x, "
2267                             "%db cmd/%db data/%db sense\n",
2268                             cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2269                             ccb->ccb_h.target_lun, cmd[0],
2270                             ccb->ccb_h.flags & CAM_DIR_MASK, ccb->csio.cdb_len,
2271                             ccb->csio.dxfer_len, ccb->csio.sense_len);
2272
2273                         if (sc->sc_transfer.ccb) {
2274                                 DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2275                                     "I/O in progress, deferring\n",
2276                                     cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2277                                     ccb->ccb_h.target_lun);
2278                                 ccb->ccb_h.status = CAM_SCSI_BUSY;
2279                                 xpt_done(ccb);
2280                                 goto done;
2281                         }
2282                         switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
2283                         case CAM_DIR_IN:
2284                                 dir = DIR_IN;
2285                                 break;
2286                         case CAM_DIR_OUT:
2287                                 dir = DIR_OUT;
2288                                 DIF(UDMASS_SCSI,
2289                                     umass_dump_buffer(sc, ccb->csio.data_ptr,
2290                                     ccb->csio.dxfer_len, 48));
2291                                 break;
2292                         default:
2293                                 dir = DIR_NONE;
2294                         }
2295
2296                         ccb->ccb_h.status = CAM_REQ_INPROG | CAM_SIM_QUEUED;
2297
2298                         /*
2299                          * sc->sc_transform will convert the command to the
2300                          * command format needed by the specific command set
2301                          * and return the converted command in
2302                          * "sc->sc_transfer.cmd_data"
2303                          */
2304                         if (umass_std_transform(sc, ccb, cmd, ccb->csio.cdb_len)) {
2305
2306                                 if (sc->sc_transfer.cmd_data[0] == INQUIRY) {
2307
2308                                         /*
2309                                          * Umass devices don't generally report their serial numbers
2310                                          * in the usual SCSI way.  Emulate it here.
2311                                          */
2312                                         if ((sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2313                                             sc->sc_transfer.cmd_data[2] == SVPD_UNIT_SERIAL_NUMBER &&
2314                                             sc->sc_udev != NULL &&
2315                                             sc->sc_udev->serial != NULL &&
2316                                             sc->sc_udev->serial[0] != '\0') {
2317                                                 struct scsi_vpd_unit_serial_number *vpd_serial;
2318
2319                                                 vpd_serial = (struct scsi_vpd_unit_serial_number *)ccb->csio.data_ptr;
2320                                                 vpd_serial->length = strlen(sc->sc_udev->serial);
2321                                                 if (vpd_serial->length > sizeof(vpd_serial->serial_num))
2322                                                         vpd_serial->length = sizeof(vpd_serial->serial_num);
2323                                                 memcpy(vpd_serial->serial_num, sc->sc_udev->serial, vpd_serial->length);
2324                                                 ccb->csio.scsi_status = SCSI_STATUS_OK;
2325                                                 ccb->ccb_h.status = CAM_REQ_CMP;
2326                                                 xpt_done(ccb);
2327                                                 goto done;
2328                                         }
2329
2330                                         /*
2331                                          * Handle EVPD inquiry for broken devices first
2332                                          * NO_INQUIRY also implies NO_INQUIRY_EVPD
2333                                          */
2334                                         if ((sc->sc_quirks & (NO_INQUIRY_EVPD | NO_INQUIRY)) &&
2335                                             (sc->sc_transfer.cmd_data[1] & SI_EVPD)) {
2336                                                 struct scsi_sense_data *sense;
2337
2338                                                 sense = &ccb->csio.sense_data;
2339                                                 bzero(sense, sizeof(*sense));
2340                                                 sense->error_code = SSD_CURRENT_ERROR;
2341                                                 sense->flags = SSD_KEY_ILLEGAL_REQUEST;
2342                                                 sense->add_sense_code = 0x24;
2343                                                 sense->extra_len = 10;
2344                                                 ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2345                                                 ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR |
2346                                                     CAM_AUTOSNS_VALID;
2347                                                 xpt_done(ccb);
2348                                                 goto done;
2349                                         }
2350                                         /*
2351                                          * Return fake inquiry data for
2352                                          * broken devices
2353                                          */
2354                                         if (sc->sc_quirks & NO_INQUIRY) {
2355                                                 memcpy(ccb->csio.data_ptr, &fake_inq_data,
2356                                                     sizeof(fake_inq_data));
2357                                                 ccb->csio.scsi_status = SCSI_STATUS_OK;
2358                                                 ccb->ccb_h.status = CAM_REQ_CMP;
2359                                                 xpt_done(ccb);
2360                                                 goto done;
2361                                         }
2362                                         if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2363                                                 ccb->csio.dxfer_len = SHORT_INQUIRY_LENGTH;
2364                                         }
2365                                 } else if (sc->sc_transfer.cmd_data[0] == SYNCHRONIZE_CACHE) {
2366                                         if (sc->sc_quirks & NO_SYNCHRONIZE_CACHE) {
2367                                                 ccb->csio.scsi_status = SCSI_STATUS_OK;
2368                                                 ccb->ccb_h.status = CAM_REQ_CMP;
2369                                                 xpt_done(ccb);
2370                                                 goto done;
2371                                         }
2372                                 }
2373                                 umass_command_start(sc, dir, ccb->csio.data_ptr,
2374                                     ccb->csio.dxfer_len,
2375                                     ccb->ccb_h.timeout,
2376                                     &umass_cam_cb, ccb);
2377                         }
2378                         break;
2379                 }
2380         case XPT_PATH_INQ:
2381                 {
2382                         struct ccb_pathinq *cpi = &ccb->cpi;
2383
2384                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_PATH_INQ:.\n",
2385                             sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2386                             ccb->ccb_h.target_lun);
2387
2388                         /* host specific information */
2389                         cpi->version_num = 1;
2390                         cpi->hba_inquiry = 0;
2391                         cpi->target_sprt = 0;
2392                         cpi->hba_misc = PIM_NO_6_BYTE;
2393                         cpi->hba_eng_cnt = 0;
2394                         cpi->max_target = UMASS_SCSIID_MAX;     /* one target */
2395                         cpi->initiator_id = UMASS_SCSIID_HOST;
2396                         strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2397                         strlcpy(cpi->hba_vid, "USB SCSI", HBA_IDLEN);
2398                         strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2399                         cpi->unit_number = cam_sim_unit(sim);
2400                         cpi->bus_id = sc->sc_unit;
2401 #if (__FreeBSD_version >= 700025)
2402                         cpi->protocol = PROTO_SCSI;
2403                         cpi->protocol_version = SCSI_REV_2;
2404                         cpi->transport = XPORT_USB;
2405                         cpi->transport_version = 0;
2406 #endif
2407                         if (sc == NULL) {
2408                                 cpi->base_transfer_speed = 0;
2409                                 cpi->max_lun = 0;
2410                         } else {
2411                                 if (sc->sc_quirks & FLOPPY_SPEED) {
2412                                         cpi->base_transfer_speed =
2413                                             UMASS_FLOPPY_TRANSFER_SPEED;
2414                                 } else if (usbd_get_speed(sc->sc_udev) ==
2415                                     USB_SPEED_HIGH) {
2416                                         cpi->base_transfer_speed =
2417                                             UMASS_HIGH_TRANSFER_SPEED;
2418                                 } else {
2419                                         cpi->base_transfer_speed =
2420                                             UMASS_FULL_TRANSFER_SPEED;
2421                                 }
2422                                 cpi->max_lun = sc->sc_maxlun;
2423                         }
2424
2425                         cpi->ccb_h.status = CAM_REQ_CMP;
2426                         xpt_done(ccb);
2427                         break;
2428                 }
2429         case XPT_RESET_DEV:
2430                 {
2431                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_RESET_DEV:.\n",
2432                             cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2433                             ccb->ccb_h.target_lun);
2434
2435                         umass_reset(sc);
2436
2437                         ccb->ccb_h.status = CAM_REQ_CMP;
2438                         xpt_done(ccb);
2439                         break;
2440                 }
2441         case XPT_GET_TRAN_SETTINGS:
2442                 {
2443                         struct ccb_trans_settings *cts = &ccb->cts;
2444
2445                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_GET_TRAN_SETTINGS:.\n",
2446                             cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2447                             ccb->ccb_h.target_lun);
2448
2449 #if (__FreeBSD_version >= 700025)
2450                         cts->protocol = PROTO_SCSI;
2451                         cts->protocol_version = SCSI_REV_2;
2452                         cts->transport = XPORT_USB;
2453                         cts->transport_version = 0;
2454                         cts->xport_specific.valid = 0;
2455 #else
2456                         cts->valid = 0;
2457                         cts->flags = 0; /* no disconnection, tagging */
2458 #endif
2459                         ccb->ccb_h.status = CAM_REQ_CMP;
2460                         xpt_done(ccb);
2461                         break;
2462                 }
2463         case XPT_SET_TRAN_SETTINGS:
2464                 {
2465                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SET_TRAN_SETTINGS:.\n",
2466                             cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2467                             ccb->ccb_h.target_lun);
2468
2469                         ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2470                         xpt_done(ccb);
2471                         break;
2472                 }
2473         case XPT_CALC_GEOMETRY:
2474                 {
2475                         cam_calc_geometry(&ccb->ccg, /* extended */ 1);
2476                         xpt_done(ccb);
2477                         break;
2478                 }
2479         case XPT_NOOP:
2480                 {
2481                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_NOOP:.\n",
2482                             sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2483                             ccb->ccb_h.target_lun);
2484
2485                         ccb->ccb_h.status = CAM_REQ_CMP;
2486                         xpt_done(ccb);
2487                         break;
2488                 }
2489         default:
2490                 DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:func_code 0x%04x: "
2491                     "Not implemented\n",
2492                     sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2493                     ccb->ccb_h.target_lun, ccb->ccb_h.func_code);
2494
2495                 ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2496                 xpt_done(ccb);
2497                 break;
2498         }
2499
2500 done:
2501 #if (__FreeBSD_version < 700037)
2502         if (sc) {
2503                 mtx_unlock(&sc->sc_mtx);
2504         }
2505 #endif
2506         return;
2507 }
2508
2509 static void
2510 umass_cam_poll(struct cam_sim *sim)
2511 {
2512         struct umass_softc *sc = (struct umass_softc *)sim->softc;
2513
2514         if (sc == UMASS_GONE)
2515                 return;
2516
2517         DPRINTF(sc, UDMASS_SCSI, "CAM poll\n");
2518
2519         usbd_transfer_poll(sc->sc_xfer, UMASS_T_MAX);
2520 }
2521
2522
2523 /* umass_cam_cb
2524  *      finalise a completed CAM command
2525  */
2526
2527 static void
2528 umass_cam_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2529     uint8_t status)
2530 {
2531         ccb->csio.resid = residue;
2532
2533         switch (status) {
2534         case STATUS_CMD_OK:
2535                 ccb->ccb_h.status = CAM_REQ_CMP;
2536                 if ((sc->sc_quirks & READ_CAPACITY_OFFBY1) &&
2537                     (ccb->ccb_h.func_code == XPT_SCSI_IO) &&
2538                     (ccb->csio.cdb_io.cdb_bytes[0] == READ_CAPACITY)) {
2539                         struct scsi_read_capacity_data *rcap;
2540                         uint32_t maxsector;
2541
2542                         rcap = (void *)(ccb->csio.data_ptr);
2543                         maxsector = scsi_4btoul(rcap->addr) - 1;
2544                         scsi_ulto4b(maxsector, rcap->addr);
2545                 }
2546                 /*
2547                  * We have to add SVPD_UNIT_SERIAL_NUMBER to the list
2548                  * of pages supported by the device - otherwise, CAM
2549                  * will never ask us for the serial number if the
2550                  * device cannot handle that by itself.
2551                  */
2552                 if (ccb->ccb_h.func_code == XPT_SCSI_IO &&
2553                     sc->sc_transfer.cmd_data[0] == INQUIRY &&
2554                     (sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2555                     sc->sc_transfer.cmd_data[2] == SVPD_SUPPORTED_PAGE_LIST &&
2556                     sc->sc_udev != NULL &&
2557                     sc->sc_udev->serial != NULL &&
2558                     sc->sc_udev->serial[0] != '\0') {
2559                         struct ccb_scsiio *csio;
2560                         struct scsi_vpd_supported_page_list *page_list;
2561
2562                         csio = &ccb->csio;
2563                         page_list = (struct scsi_vpd_supported_page_list *)csio->data_ptr;
2564                         if (page_list->length + 1 < SVPD_SUPPORTED_PAGES_SIZE) {
2565                                 page_list->list[page_list->length] = SVPD_UNIT_SERIAL_NUMBER;
2566                                 page_list->length++;
2567                         }
2568                 }
2569                 xpt_done(ccb);
2570                 break;
2571
2572         case STATUS_CMD_UNKNOWN:
2573         case STATUS_CMD_FAILED:
2574
2575                 /* fetch sense data */
2576
2577                 /* the rest of the command was filled in at attach */
2578                 sc->cam_scsi_sense.length = ccb->csio.sense_len;
2579
2580                 DPRINTF(sc, UDMASS_SCSI, "Fetching %d bytes of "
2581                     "sense data\n", ccb->csio.sense_len);
2582
2583                 if (umass_std_transform(sc, ccb, &sc->cam_scsi_sense.opcode,
2584                     sizeof(sc->cam_scsi_sense))) {
2585
2586                         if ((sc->sc_quirks & FORCE_SHORT_INQUIRY) &&
2587                             (sc->sc_transfer.cmd_data[0] == INQUIRY)) {
2588                                 ccb->csio.sense_len = SHORT_INQUIRY_LENGTH;
2589                         }
2590                         umass_command_start(sc, DIR_IN, &ccb->csio.sense_data.error_code,
2591                             ccb->csio.sense_len, ccb->ccb_h.timeout,
2592                             &umass_cam_sense_cb, ccb);
2593                 }
2594                 break;
2595
2596         default:
2597                 /*
2598                  * The wire protocol failed and will hopefully have
2599                  * recovered. We return an error to CAM and let CAM
2600                  * retry the command if necessary. In case of SCSI IO
2601                  * commands we ask the CAM layer to check the
2602                  * condition first. This is a quick hack to make
2603                  * certain devices work.
2604                  */
2605                 if (ccb->ccb_h.func_code == XPT_SCSI_IO) {
2606                         ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR;
2607                         ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2608                 } else {
2609                         ccb->ccb_h.status = CAM_REQ_CMP_ERR;
2610                 }
2611                 xpt_done(ccb);
2612                 break;
2613         }
2614 }
2615
2616 /*
2617  * Finalise a completed autosense operation
2618  */
2619 static void
2620 umass_cam_sense_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2621     uint8_t status)
2622 {
2623         uint8_t *cmd;
2624         uint8_t key;
2625
2626         switch (status) {
2627         case STATUS_CMD_OK:
2628         case STATUS_CMD_UNKNOWN:
2629         case STATUS_CMD_FAILED:
2630
2631                 if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2632                         cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2633                 } else {
2634                         cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2635                 }
2636
2637                 key = (ccb->csio.sense_data.flags & SSD_KEY);
2638
2639                 /*
2640                  * Getting sense data always succeeds (apart from wire
2641                  * failures):
2642                  */
2643                 if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2644                     (cmd[0] == INQUIRY) &&
2645                     (key == SSD_KEY_UNIT_ATTENTION)) {
2646                         /*
2647                          * Ignore unit attention errors in the case where
2648                          * the Unit Attention state is not cleared on
2649                          * REQUEST SENSE. They will appear again at the next
2650                          * command.
2651                          */
2652                         ccb->ccb_h.status = CAM_REQ_CMP;
2653                 } else if (key == SSD_KEY_NO_SENSE) {
2654                         /*
2655                          * No problem after all (in the case of CBI without
2656                          * CCI)
2657                          */
2658                         ccb->ccb_h.status = CAM_REQ_CMP;
2659                 } else if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2660                             (cmd[0] == READ_CAPACITY) &&
2661                     (key == SSD_KEY_UNIT_ATTENTION)) {
2662                         /*
2663                          * Some devices do not clear the unit attention error
2664                          * on request sense. We insert a test unit ready
2665                          * command to make sure we clear the unit attention
2666                          * condition, then allow the retry to proceed as
2667                          * usual.
2668                          */
2669
2670                         ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2671                             | CAM_AUTOSNS_VALID;
2672                         ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2673
2674 #if 0
2675                         DELAY(300000);
2676 #endif
2677                         DPRINTF(sc, UDMASS_SCSI, "Doing a sneaky"
2678                             "TEST_UNIT_READY\n");
2679
2680                         /* the rest of the command was filled in at attach */
2681
2682                         if (umass_std_transform(sc, ccb,
2683                             &sc->cam_scsi_test_unit_ready.opcode,
2684                             sizeof(sc->cam_scsi_test_unit_ready))) {
2685                                 umass_command_start(sc, DIR_NONE, NULL, 0,
2686                                     ccb->ccb_h.timeout,
2687                                     &umass_cam_quirk_cb, ccb);
2688                         }
2689                         break;
2690                 } else {
2691                         ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2692                             | CAM_AUTOSNS_VALID;
2693                         ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2694                 }
2695                 xpt_done(ccb);
2696                 break;
2697
2698         default:
2699                 DPRINTF(sc, UDMASS_SCSI, "Autosense failed, "
2700                     "status %d\n", status);
2701                 ccb->ccb_h.status = CAM_AUTOSENSE_FAIL;
2702                 xpt_done(ccb);
2703         }
2704 }
2705
2706 /*
2707  * This completion code just handles the fact that we sent a test-unit-ready
2708  * after having previously failed a READ CAPACITY with CHECK_COND.  Even
2709  * though this command succeeded, we have to tell CAM to retry.
2710  */
2711 static void
2712 umass_cam_quirk_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2713     uint8_t status)
2714 {
2715         DPRINTF(sc, UDMASS_SCSI, "Test unit ready "
2716             "returned status %d\n", status);
2717
2718         ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2719             | CAM_AUTOSNS_VALID;
2720         ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2721         xpt_done(ccb);
2722 }
2723
2724 /*
2725  * SCSI specific functions
2726  */
2727
2728 static uint8_t
2729 umass_scsi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2730     uint8_t cmd_len)
2731 {
2732         if ((cmd_len == 0) ||
2733             (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2734                 DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2735                     "length: %d bytes\n", cmd_len);
2736                 return (0);             /* failure */
2737         }
2738         sc->sc_transfer.cmd_len = cmd_len;
2739
2740         switch (cmd_ptr[0]) {
2741         case TEST_UNIT_READY:
2742                 if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2743                         DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2744                             "to START_UNIT\n");
2745                         bzero(sc->sc_transfer.cmd_data, cmd_len);
2746                         sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2747                         sc->sc_transfer.cmd_data[4] = SSS_START;
2748                         return (1);
2749                 }
2750                 break;
2751
2752         case INQUIRY:
2753                 /*
2754                  * some drives wedge when asked for full inquiry
2755                  * information.
2756                  */
2757                 if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2758                         bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2759                         sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2760                         return (1);
2761                 }
2762                 break;
2763         }
2764
2765         bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2766         return (1);
2767 }
2768
2769 static uint8_t
2770 umass_rbc_transform(struct umass_softc *sc, uint8_t *cmd_ptr, uint8_t cmd_len)
2771 {
2772         if ((cmd_len == 0) ||
2773             (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2774                 DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2775                     "length: %d bytes\n", cmd_len);
2776                 return (0);             /* failure */
2777         }
2778         switch (cmd_ptr[0]) {
2779                 /* these commands are defined in RBC: */
2780         case READ_10:
2781         case READ_CAPACITY:
2782         case START_STOP_UNIT:
2783         case SYNCHRONIZE_CACHE:
2784         case WRITE_10:
2785         case 0x2f:                      /* VERIFY_10 is absent from
2786                                          * scsi_all.h??? */
2787         case INQUIRY:
2788         case MODE_SELECT_10:
2789         case MODE_SENSE_10:
2790         case TEST_UNIT_READY:
2791         case WRITE_BUFFER:
2792                 /*
2793                  * The following commands are not listed in my copy of the
2794                  * RBC specs. CAM however seems to want those, and at least
2795                  * the Sony DSC device appears to support those as well
2796                  */
2797         case REQUEST_SENSE:
2798         case PREVENT_ALLOW:
2799
2800                 bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2801
2802                 if ((sc->sc_quirks & RBC_PAD_TO_12) && (cmd_len < 12)) {
2803                         bzero(sc->sc_transfer.cmd_data + cmd_len, 12 - cmd_len);
2804                         cmd_len = 12;
2805                 }
2806                 sc->sc_transfer.cmd_len = cmd_len;
2807                 return (1);             /* sucess */
2808
2809                 /* All other commands are not legal in RBC */
2810         default:
2811                 DPRINTF(sc, UDMASS_SCSI, "Unsupported RBC "
2812                     "command 0x%02x\n", cmd_ptr[0]);
2813                 return (0);             /* failure */
2814         }
2815 }
2816
2817 static uint8_t
2818 umass_ufi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2819     uint8_t cmd_len)
2820 {
2821         if ((cmd_len == 0) ||
2822             (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2823                 DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2824                     "length: %d bytes\n", cmd_len);
2825                 return (0);             /* failure */
2826         }
2827         /* An UFI command is always 12 bytes in length */
2828         sc->sc_transfer.cmd_len = UFI_COMMAND_LENGTH;
2829
2830         /* Zero the command data */
2831         bzero(sc->sc_transfer.cmd_data, UFI_COMMAND_LENGTH);
2832
2833         switch (cmd_ptr[0]) {
2834                 /*
2835                  * Commands of which the format has been verified. They
2836                  * should work. Copy the command into the (zeroed out)
2837                  * destination buffer.
2838                  */
2839         case TEST_UNIT_READY:
2840                 if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2841                         /*
2842                          * Some devices do not support this command. Start
2843                          * Stop Unit should give the same results
2844                          */
2845                         DPRINTF(sc, UDMASS_UFI, "Converted TEST_UNIT_READY "
2846                             "to START_UNIT\n");
2847
2848                         sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2849                         sc->sc_transfer.cmd_data[4] = SSS_START;
2850                         return (1);
2851                 }
2852                 break;
2853
2854         case REZERO_UNIT:
2855         case REQUEST_SENSE:
2856         case FORMAT_UNIT:
2857         case INQUIRY:
2858         case START_STOP_UNIT:
2859         case SEND_DIAGNOSTIC:
2860         case PREVENT_ALLOW:
2861         case READ_CAPACITY:
2862         case READ_10:
2863         case WRITE_10:
2864         case POSITION_TO_ELEMENT:       /* SEEK_10 */
2865         case WRITE_AND_VERIFY:
2866         case VERIFY:
2867         case MODE_SELECT_10:
2868         case MODE_SENSE_10:
2869         case READ_12:
2870         case WRITE_12:
2871         case READ_FORMAT_CAPACITIES:
2872                 break;
2873
2874                 /*
2875                  * SYNCHRONIZE_CACHE isn't supported by UFI, nor should it be
2876                  * required for UFI devices, so it is appropriate to fake
2877                  * success.
2878                  */
2879         case SYNCHRONIZE_CACHE:
2880                 return (2);
2881
2882         default:
2883                 DPRINTF(sc, UDMASS_SCSI, "Unsupported UFI "
2884                     "command 0x%02x\n", cmd_ptr[0]);
2885                 return (0);             /* failure */
2886         }
2887
2888         bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2889         return (1);                     /* success */
2890 }
2891
2892 /*
2893  * 8070i (ATAPI) specific functions
2894  */
2895 static uint8_t
2896 umass_atapi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2897     uint8_t cmd_len)
2898 {
2899         if ((cmd_len == 0) ||
2900             (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2901                 DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2902                     "length: %d bytes\n", cmd_len);
2903                 return (0);             /* failure */
2904         }
2905         /* An ATAPI command is always 12 bytes in length. */
2906         sc->sc_transfer.cmd_len = ATAPI_COMMAND_LENGTH;
2907
2908         /* Zero the command data */
2909         bzero(sc->sc_transfer.cmd_data, ATAPI_COMMAND_LENGTH);
2910
2911         switch (cmd_ptr[0]) {
2912                 /*
2913                  * Commands of which the format has been verified. They
2914                  * should work. Copy the command into the destination
2915                  * buffer.
2916                  */
2917         case INQUIRY:
2918                 /*
2919                  * some drives wedge when asked for full inquiry
2920                  * information.
2921                  */
2922                 if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2923                         bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2924
2925                         sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2926                         return (1);
2927                 }
2928                 break;
2929
2930         case TEST_UNIT_READY:
2931                 if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2932                         DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2933                             "to START_UNIT\n");
2934                         sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2935                         sc->sc_transfer.cmd_data[4] = SSS_START;
2936                         return (1);
2937                 }
2938                 break;
2939
2940         case REZERO_UNIT:
2941         case REQUEST_SENSE:
2942         case START_STOP_UNIT:
2943         case SEND_DIAGNOSTIC:
2944         case PREVENT_ALLOW:
2945         case READ_CAPACITY:
2946         case READ_10:
2947         case WRITE_10:
2948         case POSITION_TO_ELEMENT:       /* SEEK_10 */
2949         case SYNCHRONIZE_CACHE:
2950         case MODE_SELECT_10:
2951         case MODE_SENSE_10:
2952         case READ_BUFFER:
2953         case 0x42:                      /* READ_SUBCHANNEL */
2954         case 0x43:                      /* READ_TOC */
2955         case 0x44:                      /* READ_HEADER */
2956         case 0x47:                      /* PLAY_MSF (Play Minute/Second/Frame) */
2957         case 0x48:                      /* PLAY_TRACK */
2958         case 0x49:                      /* PLAY_TRACK_REL */
2959         case 0x4b:                      /* PAUSE */
2960         case 0x51:                      /* READ_DISK_INFO */
2961         case 0x52:                      /* READ_TRACK_INFO */
2962         case 0x54:                      /* SEND_OPC */
2963         case 0x59:                      /* READ_MASTER_CUE */
2964         case 0x5b:                      /* CLOSE_TR_SESSION */
2965         case 0x5c:                      /* READ_BUFFER_CAP */
2966         case 0x5d:                      /* SEND_CUE_SHEET */
2967         case 0xa1:                      /* BLANK */
2968         case 0xa5:                      /* PLAY_12 */
2969         case 0xa6:                      /* EXCHANGE_MEDIUM */
2970         case 0xad:                      /* READ_DVD_STRUCTURE */
2971         case 0xbb:                      /* SET_CD_SPEED */
2972         case 0xe5:                      /* READ_TRACK_INFO_PHILIPS */
2973                 break;
2974
2975         case READ_12:
2976         case WRITE_12:
2977         default:
2978                 DPRINTF(sc, UDMASS_SCSI, "Unsupported ATAPI "
2979                     "command 0x%02x - trying anyway\n",
2980                     cmd_ptr[0]);
2981                 break;
2982         }
2983
2984         bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2985         return (1);                     /* success */
2986 }
2987
2988 static uint8_t
2989 umass_no_transform(struct umass_softc *sc, uint8_t *cmd,
2990     uint8_t cmdlen)
2991 {
2992         return (0);                     /* failure */
2993 }
2994
2995 static uint8_t
2996 umass_std_transform(struct umass_softc *sc, union ccb *ccb,
2997     uint8_t *cmd, uint8_t cmdlen)
2998 {
2999         uint8_t retval;
3000
3001         retval = (sc->sc_transform) (sc, cmd, cmdlen);
3002
3003         if (retval == 2) {
3004                 ccb->ccb_h.status = CAM_REQ_CMP;
3005                 xpt_done(ccb);
3006                 return (0);
3007         } else if (retval == 0) {
3008                 ccb->ccb_h.status = CAM_REQ_INVALID;
3009                 xpt_done(ccb);
3010                 return (0);
3011         }
3012         /* Command should be executed */
3013         return (1);
3014 }
3015
3016 #ifdef USB_DEBUG
3017 static void
3018 umass_bbb_dump_cbw(struct umass_softc *sc, umass_bbb_cbw_t *cbw)
3019 {
3020         uint8_t *c = cbw->CBWCDB;
3021
3022         uint32_t dlen = UGETDW(cbw->dCBWDataTransferLength);
3023         uint32_t tag = UGETDW(cbw->dCBWTag);
3024
3025         uint8_t clen = cbw->bCDBLength;
3026         uint8_t flags = cbw->bCBWFlags;
3027         uint8_t lun = cbw->bCBWLUN;
3028
3029         DPRINTF(sc, UDMASS_BBB, "CBW %d: cmd = %db "
3030             "(0x%02x%02x%02x%02x%02x%02x%s), "
3031             "data = %db, lun = %d, dir = %s\n",
3032             tag, clen,
3033             c[0], c[1], c[2], c[3], c[4], c[5], (clen > 6 ? "..." : ""),
3034             dlen, lun, (flags == CBWFLAGS_IN ? "in" :
3035             (flags == CBWFLAGS_OUT ? "out" : "<invalid>")));
3036 }
3037
3038 static void
3039 umass_bbb_dump_csw(struct umass_softc *sc, umass_bbb_csw_t *csw)
3040 {
3041         uint32_t sig = UGETDW(csw->dCSWSignature);
3042         uint32_t tag = UGETDW(csw->dCSWTag);
3043         uint32_t res = UGETDW(csw->dCSWDataResidue);
3044         uint8_t status = csw->bCSWStatus;
3045
3046         DPRINTF(sc, UDMASS_BBB, "CSW %d: sig = 0x%08x (%s), tag = 0x%08x, "
3047             "res = %d, status = 0x%02x (%s)\n",
3048             tag, sig, (sig == CSWSIGNATURE ? "valid" : "invalid"),
3049             tag, res,
3050             status, (status == CSWSTATUS_GOOD ? "good" :
3051             (status == CSWSTATUS_FAILED ? "failed" :
3052             (status == CSWSTATUS_PHASE ? "phase" : "<invalid>"))));
3053 }
3054
3055 static void
3056 umass_cbi_dump_cmd(struct umass_softc *sc, void *cmd, uint8_t cmdlen)
3057 {
3058         uint8_t *c = cmd;
3059         uint8_t dir = sc->sc_transfer.dir;
3060
3061         DPRINTF(sc, UDMASS_BBB, "cmd = %db "
3062             "(0x%02x%02x%02x%02x%02x%02x%s), "
3063             "data = %db, dir = %s\n",
3064             cmdlen,
3065             c[0], c[1], c[2], c[3], c[4], c[5], (cmdlen > 6 ? "..." : ""),
3066             sc->sc_transfer.data_len,
3067             (dir == DIR_IN ? "in" :
3068             (dir == DIR_OUT ? "out" :
3069             (dir == DIR_NONE ? "no data phase" : "<invalid>"))));
3070 }
3071
3072 static void
3073 umass_dump_buffer(struct umass_softc *sc, uint8_t *buffer, uint32_t buflen,
3074     uint32_t printlen)
3075 {
3076         uint32_t i, j;
3077         char s1[40];
3078         char s2[40];
3079         char s3[5];
3080
3081         s1[0] = '\0';
3082         s3[0] = '\0';
3083
3084         sprintf(s2, " buffer=%p, buflen=%d", buffer, buflen);
3085         for (i = 0; (i < buflen) && (i < printlen); i++) {
3086                 j = i % 16;
3087                 if (j == 0 && i != 0) {
3088                         DPRINTF(sc, UDMASS_GEN, "0x %s%s\n",
3089                             s1, s2);
3090                         s2[0] = '\0';
3091                 }
3092                 sprintf(&s1[j * 2], "%02x", buffer[i] & 0xff);
3093         }
3094         if (buflen > printlen)
3095                 sprintf(s3, " ...");
3096         DPRINTF(sc, UDMASS_GEN, "0x %s%s%s\n",
3097             s1, s2, s3);
3098 }
3099
3100 #endif