sys/dev/usb/storage/umass.c

   1 #include <sys/cdefs.h>
   2 __FBSDID("$FreeBSD$");
   3
   4 /*-
   5  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
   6  *
   7  * Copyright (c) 1999 MAEKAWA Masahide <bishop@rr.iij4u.or.jp>,
   8  *                    Nick Hibma <n_hibma@FreeBSD.org>
   9  * All rights reserved.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  *
  32  *      $FreeBSD$
  33  *      $NetBSD: umass.c,v 1.28 2000/04/02 23:46:53 augustss Exp $
  34  */
  35
  36 /* Also already merged from NetBSD:
  37  *      $NetBSD: umass.c,v 1.67 2001/11/25 19:05:22 augustss Exp $
  38  *      $NetBSD: umass.c,v 1.90 2002/11/04 19:17:33 pooka Exp $
  39  *      $NetBSD: umass.c,v 1.108 2003/11/07 17:03:25 wiz Exp $
  40  *      $NetBSD: umass.c,v 1.109 2003/12/04 13:57:31 keihan Exp $
  41  */
  42
  43 /*
  44  * Universal Serial Bus Mass Storage Class specs:
  45  * http://www.usb.org/developers/devclass_docs/usb_msc_overview_1.2.pdf
  46  * http://www.usb.org/developers/devclass_docs/usbmassbulk_10.pdf
  47  * http://www.usb.org/developers/devclass_docs/usb_msc_cbi_1.1.pdf
  48  * http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf
  49  */
  50
  51 /*
  52  * Ported to NetBSD by Lennart Augustsson <augustss@NetBSD.org>.
  53  * Parts of the code written by Jason R. Thorpe <thorpej@shagadelic.org>.
  54  */
  55
  56 /*
  57  * The driver handles 3 Wire Protocols
  58  * - Command/Bulk/Interrupt (CBI)
  59  * - Command/Bulk/Interrupt with Command Completion Interrupt (CBI with CCI)
  60  * - Mass Storage Bulk-Only (BBB)
  61  *   (BBB refers Bulk/Bulk/Bulk for Command/Data/Status phases)
  62  *
  63  * Over these wire protocols it handles the following command protocols
  64  * - SCSI
  65  * - UFI (floppy command set)
  66  * - 8070i (ATAPI)
  67  *
  68  * UFI and 8070i (ATAPI) are transformed versions of the SCSI command set. The
  69  * sc->sc_transform method is used to convert the commands into the appropriate
  70  * format (if at all necessary). For example, UFI requires all commands to be
  71  * 12 bytes in length amongst other things.
  72  *
  73  * The source code below is marked and can be split into a number of pieces
  74  * (in this order):
  75  *
  76  * - probe/attach/detach
  77  * - generic transfer routines
  78  * - BBB
  79  * - CBI
  80  * - CBI_I (in addition to functions from CBI)
  81  * - CAM (Common Access Method)
  82  * - SCSI
  83  * - UFI
  84  * - 8070i (ATAPI)
  85  *
  86  * The protocols are implemented using a state machine, for the transfers as
  87  * well as for the resets. The state machine is contained in umass_t_*_callback.
  88  * The state machine is started through either umass_command_start() or
  89  * umass_reset().
  90  *
  91  * The reason for doing this is a) CAM performs a lot better this way and b) it
  92  * avoids using tsleep from interrupt context (for example after a failed
  93  * transfer).
  94  */
  95
  96 /*
  97  * The SCSI related part of this driver has been derived from the
  98  * dev/ppbus/vpo.c driver, by Nicolas Souchu (nsouch@FreeBSD.org).
  99  *
 100  * The CAM layer uses so called actions which are messages sent to the host
 101  * adapter for completion. The actions come in through umass_cam_action. The
 102  * appropriate block of routines is called depending on the transport protocol
 103  * in use. When the transfer has finished, these routines call
 104  * umass_cam_cb again to complete the CAM command.
 105  */
 106
 107 #include <sys/stdint.h>
 108 #include <sys/stddef.h>
 109 #include <sys/param.h>
 110 #include <sys/queue.h>
 111 #include <sys/types.h>
 112 #include <sys/systm.h>
 113 #include <sys/kernel.h>
 114 #include <sys/bus.h>
 115 #include <sys/module.h>
 116 #include <sys/lock.h>
 117 #include <sys/mutex.h>
 118 #include <sys/condvar.h>
 119 #include <sys/sysctl.h>
 120 #include <sys/sx.h>
 121 #include <sys/unistd.h>
 122 #include <sys/callout.h>
 123 #include <sys/malloc.h>
 124 #include <sys/priv.h>
 125
 126 #include <dev/usb/usb.h>
 127 #include <dev/usb/usbdi.h>
 128 #include <dev/usb/usbdi_util.h>
 129 #include "usbdevs.h"
 130
 131 #include <dev/usb/quirk/usb_quirk.h>
 132
 133 #include <cam/cam.h>
 134 #include <cam/cam_ccb.h>
 135 #include <cam/cam_sim.h>
 136 #include <cam/cam_xpt_sim.h>
 137 #include <cam/scsi/scsi_all.h>
 138 #include <cam/scsi/scsi_da.h>
 139
 140 #include <cam/cam_periph.h>
 141
 142 #ifdef USB_DEBUG
 143 #define DIF(m, x)                               \
 144   do {                                          \
 145     if (umass_debug & (m)) { x ; }              \
 146   } while (0)
 147
 148 #define DPRINTF(sc, m, fmt, ...)                        \
 149   do {                                                  \
 150     if (umass_debug & (m)) {                            \
 151         printf("%s:%s: " fmt,                           \
 152                (sc) ? (const char *)(sc)->sc_name :     \
 153                (const char *)"umassX",                  \
 154                 __FUNCTION__ ,## __VA_ARGS__);          \
 155     }                                                   \
 156   } while (0)
 157
 158 #define UDMASS_GEN      0x00010000      /* general */
 159 #define UDMASS_SCSI     0x00020000      /* scsi */
 160 #define UDMASS_UFI      0x00040000      /* ufi command set */
 161 #define UDMASS_ATAPI    0x00080000      /* 8070i command set */
 162 #define UDMASS_CMD      (UDMASS_SCSI|UDMASS_UFI|UDMASS_ATAPI)
 163 #define UDMASS_USB      0x00100000      /* USB general */
 164 #define UDMASS_BBB      0x00200000      /* Bulk-Only transfers */
 165 #define UDMASS_CBI      0x00400000      /* CBI transfers */
 166 #define UDMASS_WIRE     (UDMASS_BBB|UDMASS_CBI)
 167 #define UDMASS_ALL      0xffff0000      /* all of the above */
 168 static int umass_debug;
 169 static int umass_throttle;
 170
 171 static SYSCTL_NODE(_hw_usb, OID_AUTO, umass, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
 172     "USB umass");
 173 SYSCTL_INT(_hw_usb_umass, OID_AUTO, debug, CTLFLAG_RWTUN,
 174     &umass_debug, 0, "umass debug level");
 175 SYSCTL_INT(_hw_usb_umass, OID_AUTO, throttle, CTLFLAG_RWTUN,
 176     &umass_throttle, 0, "Forced delay between commands in milliseconds");
 177 #else
 178 #define DIF(...) do { } while (0)
 179 #define DPRINTF(...) do { } while (0)
 180 #endif
 181
 182 #define UMASS_BULK_SIZE (1 << 17)
 183 #define UMASS_CBI_DIAGNOSTIC_CMDLEN 12  /* bytes */
 184 #define UMASS_MAX_CMDLEN MAX(12, CAM_MAX_CDBLEN)        /* bytes */
 185
 186 /* USB transfer definitions */
 187
 188 #define UMASS_T_BBB_RESET1      0       /* Bulk-Only */
 189 #define UMASS_T_BBB_RESET2      1
 190 #define UMASS_T_BBB_RESET3      2
 191 #define UMASS_T_BBB_COMMAND     3
 192 #define UMASS_T_BBB_DATA_READ   4
 193 #define UMASS_T_BBB_DATA_RD_CS  5
 194 #define UMASS_T_BBB_DATA_WRITE  6
 195 #define UMASS_T_BBB_DATA_WR_CS  7
 196 #define UMASS_T_BBB_STATUS      8
 197 #define UMASS_T_BBB_MAX         9
 198
 199 #define UMASS_T_CBI_RESET1      0       /* CBI */
 200 #define UMASS_T_CBI_RESET2      1
 201 #define UMASS_T_CBI_RESET3      2
 202 #define UMASS_T_CBI_COMMAND     3
 203 #define UMASS_T_CBI_DATA_READ   4
 204 #define UMASS_T_CBI_DATA_RD_CS  5
 205 #define UMASS_T_CBI_DATA_WRITE  6
 206 #define UMASS_T_CBI_DATA_WR_CS  7
 207 #define UMASS_T_CBI_STATUS      8
 208 #define UMASS_T_CBI_RESET4      9
 209 #define UMASS_T_CBI_MAX        10
 210
 211 #define UMASS_T_MAX MAX(UMASS_T_CBI_MAX, UMASS_T_BBB_MAX)
 212
 213 /* Generic definitions */
 214
 215 /* Direction for transfer */
 216 #define DIR_NONE        0
 217 #define DIR_IN          1
 218 #define DIR_OUT         2
 219
 220 /* device name */
 221 #define DEVNAME         "umass"
 222 #define DEVNAME_SIM     "umass-sim"
 223
 224 /* Approximate maximum transfer speeds (assumes 33% overhead). */
 225 #define UMASS_FULL_TRANSFER_SPEED       1000
 226 #define UMASS_HIGH_TRANSFER_SPEED       40000
 227 #define UMASS_SUPER_TRANSFER_SPEED      400000
 228 #define UMASS_FLOPPY_TRANSFER_SPEED     20
 229
 230 #define UMASS_TIMEOUT                   5000    /* ms */
 231
 232 /* CAM specific definitions */
 233
 234 #define UMASS_SCSIID_MAX        1       /* maximum number of drives expected */
 235 #define UMASS_SCSIID_HOST       UMASS_SCSIID_MAX
 236
 237 /* Bulk-Only features */
 238
 239 #define UR_BBB_RESET            0xff    /* Bulk-Only reset */
 240 #define UR_BBB_GET_MAX_LUN      0xfe    /* Get maximum lun */
 241
 242 /* Command Block Wrapper */
 243 typedef struct {
 244         uDWord  dCBWSignature;
 245 #define CBWSIGNATURE    0x43425355
 246         uDWord  dCBWTag;
 247         uDWord  dCBWDataTransferLength;
 248         uByte   bCBWFlags;
 249 #define CBWFLAGS_OUT    0x00
 250 #define CBWFLAGS_IN     0x80
 251         uByte   bCBWLUN;
 252         uByte   bCDBLength;
 253 #define CBWCDBLENGTH    16
 254         uByte   CBWCDB[CBWCDBLENGTH];
 255 } __packed umass_bbb_cbw_t;
 256
 257 #define UMASS_BBB_CBW_SIZE      31
 258
 259 /* Command Status Wrapper */
 260 typedef struct {
 261         uDWord  dCSWSignature;
 262 #define CSWSIGNATURE    0x53425355
 263 #define CSWSIGNATURE_IMAGINATION_DBX1   0x43425355
 264 #define CSWSIGNATURE_OLYMPUS_C1 0x55425355
 265         uDWord  dCSWTag;
 266         uDWord  dCSWDataResidue;
 267         uByte   bCSWStatus;
 268 #define CSWSTATUS_GOOD  0x0
 269 #define CSWSTATUS_FAILED        0x1
 270 #define CSWSTATUS_PHASE 0x2
 271 } __packed umass_bbb_csw_t;
 272
 273 #define UMASS_BBB_CSW_SIZE      13
 274
 275 /* CBI features */
 276
 277 #define UR_CBI_ADSC     0x00
 278
 279 typedef union {
 280         struct {
 281                 uint8_t type;
 282 #define IDB_TYPE_CCI            0x00
 283                 uint8_t value;
 284 #define IDB_VALUE_PASS          0x00
 285 #define IDB_VALUE_FAIL          0x01
 286 #define IDB_VALUE_PHASE         0x02
 287 #define IDB_VALUE_PERSISTENT    0x03
 288 #define IDB_VALUE_STATUS_MASK   0x03
 289         } __packed common;
 290
 291         struct {
 292                 uint8_t asc;
 293                 uint8_t ascq;
 294         } __packed ufi;
 295 } __packed umass_cbi_sbl_t;
 296
 297 struct umass_softc;                     /* see below */
 298
 299 typedef void (umass_callback_t)(struct umass_softc *sc, union ccb *ccb,
 300         uint32_t residue, uint8_t status);
 301
 302 #define STATUS_CMD_OK           0       /* everything ok */
 303 #define STATUS_CMD_UNKNOWN      1       /* will have to fetch sense */
 304 #define STATUS_CMD_FAILED       2       /* transfer was ok, command failed */
 305 #define STATUS_WIRE_FAILED      3       /* couldn't even get command across */
 306
 307 typedef uint8_t (umass_transform_t)(struct umass_softc *sc, uint8_t *cmd_ptr,
 308         uint8_t cmd_len);
 309
 310 /* Wire and command protocol */
 311 #define UMASS_PROTO_BBB         0x0001  /* USB wire protocol */
 312 #define UMASS_PROTO_CBI         0x0002
 313 #define UMASS_PROTO_CBI_I       0x0004
 314 #define UMASS_PROTO_WIRE        0x00ff  /* USB wire protocol mask */
 315 #define UMASS_PROTO_SCSI        0x0100  /* command protocol */
 316 #define UMASS_PROTO_ATAPI       0x0200
 317 #define UMASS_PROTO_UFI         0x0400
 318 #define UMASS_PROTO_RBC         0x0800
 319 #define UMASS_PROTO_COMMAND     0xff00  /* command protocol mask */
 320
 321 /* Device specific quirks */
 322 #define NO_QUIRKS               0x0000
 323         /*
 324          * The drive does not support Test Unit Ready. Convert to Start Unit
 325          */
 326 #define NO_TEST_UNIT_READY      0x0001
 327         /*
 328          * The drive does not reset the Unit Attention state after REQUEST
 329          * SENSE has been sent. The INQUIRY command does not reset the UA
 330          * either, and so CAM runs in circles trying to retrieve the initial
 331          * INQUIRY data.
 332          */
 333 #define RS_NO_CLEAR_UA          0x0002
 334         /* The drive does not support START STOP.  */
 335 #define NO_START_STOP           0x0004
 336         /* Don't ask for full inquiry data (255b).  */
 337 #define FORCE_SHORT_INQUIRY     0x0008
 338         /* Needs to be initialised the Shuttle way */
 339 #define SHUTTLE_INIT            0x0010
 340         /* Drive needs to be switched to alternate iface 1 */
 341 #define ALT_IFACE_1             0x0020
 342         /* Drive does not do 1Mb/s, but just floppy speeds (20kb/s) */
 343 #define FLOPPY_SPEED            0x0040
 344         /* The device can't count and gets the residue of transfers wrong */
 345 #define IGNORE_RESIDUE          0x0080
 346         /* No GetMaxLun call */
 347 #define NO_GETMAXLUN            0x0100
 348         /* The device uses a weird CSWSIGNATURE. */
 349 #define WRONG_CSWSIG            0x0200
 350         /* Device cannot handle INQUIRY so fake a generic response */
 351 #define NO_INQUIRY              0x0400
 352         /* Device cannot handle INQUIRY EVPD, return CHECK CONDITION */
 353 #define NO_INQUIRY_EVPD         0x0800
 354         /* Pad all RBC requests to 12 bytes. */
 355 #define RBC_PAD_TO_12           0x1000
 356         /*
 357          * Device reports number of sectors from READ_CAPACITY, not max
 358          * sector number.
 359          */
 360 #define READ_CAPACITY_OFFBY1    0x2000
 361         /*
 362          * Device cannot handle a SCSI synchronize cache command.  Normally
 363          * this quirk would be handled in the cam layer, but for IDE bridges
 364          * we need to associate the quirk with the bridge and not the
 365          * underlying disk device.  This is handled by faking a success
 366          * result.
 367          */
 368 #define NO_SYNCHRONIZE_CACHE    0x4000
 369         /* Device does not support 'PREVENT/ALLOW MEDIUM REMOVAL'. */
 370 #define NO_PREVENT_ALLOW        0x8000
 371
 372 struct umass_softc {
 373         struct scsi_sense cam_scsi_sense;
 374         struct scsi_test_unit_ready cam_scsi_test_unit_ready;
 375         struct mtx sc_mtx;
 376         struct {
 377                 uint8_t *data_ptr;
 378                 union ccb *ccb;
 379                 umass_callback_t *callback;
 380
 381                 uint32_t data_len;      /* bytes */
 382                 uint32_t data_rem;      /* bytes */
 383                 uint32_t data_timeout;  /* ms */
 384                 uint32_t actlen;        /* bytes */
 385
 386                 uint8_t cmd_data[UMASS_MAX_CMDLEN];
 387                 uint8_t cmd_len;        /* bytes */
 388                 uint8_t dir;
 389                 uint8_t lun;
 390         }       sc_transfer;
 391
 392         /* Bulk specific variables for transfers in progress */
 393         umass_bbb_cbw_t cbw;            /* command block wrapper */
 394         umass_bbb_csw_t csw;            /* command status wrapper */
 395
 396         /* CBI specific variables for transfers in progress */
 397         umass_cbi_sbl_t sbl;            /* status block */
 398
 399         device_t sc_dev;
 400         struct usb_device *sc_udev;
 401         struct cam_sim *sc_sim;         /* SCSI Interface Module */
 402         struct usb_xfer *sc_xfer[UMASS_T_MAX];
 403
 404         /*
 405          * The command transform function is used to convert the SCSI
 406          * commands into their derivatives, like UFI, ATAPI, and friends.
 407          */
 408         umass_transform_t *sc_transform;
 409
 410         uint32_t sc_unit;
 411         uint32_t sc_quirks;             /* they got it almost right */
 412         uint32_t sc_proto;              /* wire and cmd protocol */
 413
 414         uint8_t sc_name[16];
 415         uint8_t sc_iface_no;            /* interface number */
 416         uint8_t sc_maxlun;              /* maximum LUN number, inclusive */
 417         uint8_t sc_last_xfer_index;
 418         uint8_t sc_status_try;
 419 };
 420
 421 struct umass_probe_proto {
 422         uint32_t quirks;
 423         uint32_t proto;
 424
 425         int     error;
 426 };
 427
 428 /* prototypes */
 429
 430 static device_probe_t umass_probe;
 431 static device_attach_t umass_attach;
 432 static device_detach_t umass_detach;
 433
 434 static usb_callback_t umass_tr_error;
 435 static usb_callback_t umass_t_bbb_reset1_callback;
 436 static usb_callback_t umass_t_bbb_reset2_callback;
 437 static usb_callback_t umass_t_bbb_reset3_callback;
 438 static usb_callback_t umass_t_bbb_command_callback;
 439 static usb_callback_t umass_t_bbb_data_read_callback;
 440 static usb_callback_t umass_t_bbb_data_rd_cs_callback;
 441 static usb_callback_t umass_t_bbb_data_write_callback;
 442 static usb_callback_t umass_t_bbb_data_wr_cs_callback;
 443 static usb_callback_t umass_t_bbb_status_callback;
 444 static usb_callback_t umass_t_cbi_reset1_callback;
 445 static usb_callback_t umass_t_cbi_reset2_callback;
 446 static usb_callback_t umass_t_cbi_reset3_callback;
 447 static usb_callback_t umass_t_cbi_reset4_callback;
 448 static usb_callback_t umass_t_cbi_command_callback;
 449 static usb_callback_t umass_t_cbi_data_read_callback;
 450 static usb_callback_t umass_t_cbi_data_rd_cs_callback;
 451 static usb_callback_t umass_t_cbi_data_write_callback;
 452 static usb_callback_t umass_t_cbi_data_wr_cs_callback;
 453 static usb_callback_t umass_t_cbi_status_callback;
 454
 455 static void     umass_cancel_ccb(struct umass_softc *);
 456 static void     umass_init_shuttle(struct umass_softc *);
 457 static void     umass_reset(struct umass_softc *);
 458 static void     umass_t_bbb_data_clear_stall_callback(struct usb_xfer *,
 459                     uint8_t, uint8_t, usb_error_t);
 460 static void     umass_command_start(struct umass_softc *, uint8_t, void *,
 461                     uint32_t, uint32_t, umass_callback_t *, union ccb *);
 462 static uint8_t  umass_bbb_get_max_lun(struct umass_softc *);
 463 static void     umass_cbi_start_status(struct umass_softc *);
 464 static void     umass_t_cbi_data_clear_stall_callback(struct usb_xfer *,
 465                     uint8_t, uint8_t, usb_error_t);
 466 static int      umass_cam_attach_sim(struct umass_softc *);
 467 static void     umass_cam_attach(struct umass_softc *);
 468 static void     umass_cam_detach_sim(struct umass_softc *);
 469 static void     umass_cam_action(struct cam_sim *, union ccb *);
 470 static void     umass_cam_poll(struct cam_sim *);
 471 static void     umass_cam_cb(struct umass_softc *, union ccb *, uint32_t,
 472                     uint8_t);
 473 static void     umass_cam_sense_cb(struct umass_softc *, union ccb *, uint32_t,
 474                     uint8_t);
 475 static void     umass_cam_quirk_cb(struct umass_softc *, union ccb *, uint32_t,
 476                     uint8_t);
 477 static uint8_t  umass_scsi_transform(struct umass_softc *, uint8_t *, uint8_t);
 478 static uint8_t  umass_rbc_transform(struct umass_softc *, uint8_t *, uint8_t);
 479 static uint8_t  umass_ufi_transform(struct umass_softc *, uint8_t *, uint8_t);
 480 static uint8_t  umass_atapi_transform(struct umass_softc *, uint8_t *,
 481                     uint8_t);
 482 static uint8_t  umass_no_transform(struct umass_softc *, uint8_t *, uint8_t);
 483 static uint8_t  umass_std_transform(struct umass_softc *, union ccb *, uint8_t
 484                     *, uint8_t);
 485
 486 #ifdef USB_DEBUG
 487 static void     umass_bbb_dump_cbw(struct umass_softc *, umass_bbb_cbw_t *);
 488 static void     umass_bbb_dump_csw(struct umass_softc *, umass_bbb_csw_t *);
 489 static void     umass_cbi_dump_cmd(struct umass_softc *, void *, uint8_t);
 490 static void     umass_dump_buffer(struct umass_softc *, uint8_t *, uint32_t,
 491                     uint32_t);
 492 #endif
 493
 494 static struct usb_config umass_bbb_config[UMASS_T_BBB_MAX] = {
 495         [UMASS_T_BBB_RESET1] = {
 496                 .type = UE_CONTROL,
 497                 .endpoint = 0x00,       /* Control pipe */
 498                 .direction = UE_DIR_ANY,
 499                 .bufsize = sizeof(struct usb_device_request),
 500                 .callback = &umass_t_bbb_reset1_callback,
 501                 .timeout = 5000,        /* 5 seconds */
 502                 .interval = 500,        /* 500 milliseconds */
 503         },
 504
 505         [UMASS_T_BBB_RESET2] = {
 506                 .type = UE_CONTROL,
 507                 .endpoint = 0x00,       /* Control pipe */
 508                 .direction = UE_DIR_ANY,
 509                 .bufsize = sizeof(struct usb_device_request),
 510                 .callback = &umass_t_bbb_reset2_callback,
 511                 .timeout = 5000,        /* 5 seconds */
 512                 .interval = 50, /* 50 milliseconds */
 513         },
 514
 515         [UMASS_T_BBB_RESET3] = {
 516                 .type = UE_CONTROL,
 517                 .endpoint = 0x00,       /* Control pipe */
 518                 .direction = UE_DIR_ANY,
 519                 .bufsize = sizeof(struct usb_device_request),
 520                 .callback = &umass_t_bbb_reset3_callback,
 521                 .timeout = 5000,        /* 5 seconds */
 522                 .interval = 50, /* 50 milliseconds */
 523         },
 524
 525         [UMASS_T_BBB_COMMAND] = {
 526                 .type = UE_BULK,
 527                 .endpoint = UE_ADDR_ANY,
 528                 .direction = UE_DIR_OUT,
 529                 .bufsize = sizeof(umass_bbb_cbw_t),
 530                 .callback = &umass_t_bbb_command_callback,
 531                 .timeout = 5000,        /* 5 seconds */
 532         },
 533
 534         [UMASS_T_BBB_DATA_READ] = {
 535                 .type = UE_BULK,
 536                 .endpoint = UE_ADDR_ANY,
 537                 .direction = UE_DIR_IN,
 538                 .bufsize = UMASS_BULK_SIZE,
 539                 .flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
 540                 .callback = &umass_t_bbb_data_read_callback,
 541                 .timeout = 0,   /* overwritten later */
 542         },
 543
 544         [UMASS_T_BBB_DATA_RD_CS] = {
 545                 .type = UE_CONTROL,
 546                 .endpoint = 0x00,       /* Control pipe */
 547                 .direction = UE_DIR_ANY,
 548                 .bufsize = sizeof(struct usb_device_request),
 549                 .callback = &umass_t_bbb_data_rd_cs_callback,
 550                 .timeout = 5000,        /* 5 seconds */
 551         },
 552
 553         [UMASS_T_BBB_DATA_WRITE] = {
 554                 .type = UE_BULK,
 555                 .endpoint = UE_ADDR_ANY,
 556                 .direction = UE_DIR_OUT,
 557                 .bufsize = UMASS_BULK_SIZE,
 558                 .flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
 559                 .callback = &umass_t_bbb_data_write_callback,
 560                 .timeout = 0,   /* overwritten later */
 561         },
 562
 563         [UMASS_T_BBB_DATA_WR_CS] = {
 564                 .type = UE_CONTROL,
 565                 .endpoint = 0x00,       /* Control pipe */
 566                 .direction = UE_DIR_ANY,
 567                 .bufsize = sizeof(struct usb_device_request),
 568                 .callback = &umass_t_bbb_data_wr_cs_callback,
 569                 .timeout = 5000,        /* 5 seconds */
 570         },
 571
 572         [UMASS_T_BBB_STATUS] = {
 573                 .type = UE_BULK,
 574                 .endpoint = UE_ADDR_ANY,
 575                 .direction = UE_DIR_IN,
 576                 .bufsize = sizeof(umass_bbb_csw_t),
 577                 .flags = {.short_xfer_ok = 1,},
 578                 .callback = &umass_t_bbb_status_callback,
 579                 .timeout = 5000,        /* ms */
 580         },
 581 };
 582
 583 static struct usb_config umass_cbi_config[UMASS_T_CBI_MAX] = {
 584         [UMASS_T_CBI_RESET1] = {
 585                 .type = UE_CONTROL,
 586                 .endpoint = 0x00,       /* Control pipe */
 587                 .direction = UE_DIR_ANY,
 588                 .bufsize = (sizeof(struct usb_device_request) +
 589                     UMASS_CBI_DIAGNOSTIC_CMDLEN),
 590                 .callback = &umass_t_cbi_reset1_callback,
 591                 .timeout = 5000,        /* 5 seconds */
 592                 .interval = 500,        /* 500 milliseconds */
 593         },
 594
 595         [UMASS_T_CBI_RESET2] = {
 596                 .type = UE_CONTROL,
 597                 .endpoint = 0x00,       /* Control pipe */
 598                 .direction = UE_DIR_ANY,
 599                 .bufsize = sizeof(struct usb_device_request),
 600                 .callback = &umass_t_cbi_reset2_callback,
 601                 .timeout = 5000,        /* 5 seconds */
 602                 .interval = 50, /* 50 milliseconds */
 603         },
 604
 605         [UMASS_T_CBI_RESET3] = {
 606                 .type = UE_CONTROL,
 607                 .endpoint = 0x00,       /* Control pipe */
 608                 .direction = UE_DIR_ANY,
 609                 .bufsize = sizeof(struct usb_device_request),
 610                 .callback = &umass_t_cbi_reset3_callback,
 611                 .timeout = 5000,        /* 5 seconds */
 612                 .interval = 50, /* 50 milliseconds */
 613         },
 614
 615         [UMASS_T_CBI_COMMAND] = {
 616                 .type = UE_CONTROL,
 617                 .endpoint = 0x00,       /* Control pipe */
 618                 .direction = UE_DIR_ANY,
 619                 .bufsize = (sizeof(struct usb_device_request) +
 620                     UMASS_MAX_CMDLEN),
 621                 .callback = &umass_t_cbi_command_callback,
 622                 .timeout = 5000,        /* 5 seconds */
 623         },
 624
 625         [UMASS_T_CBI_DATA_READ] = {
 626                 .type = UE_BULK,
 627                 .endpoint = UE_ADDR_ANY,
 628                 .direction = UE_DIR_IN,
 629                 .bufsize = UMASS_BULK_SIZE,
 630                 .flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
 631                 .callback = &umass_t_cbi_data_read_callback,
 632                 .timeout = 0,   /* overwritten later */
 633         },
 634
 635         [UMASS_T_CBI_DATA_RD_CS] = {
 636                 .type = UE_CONTROL,
 637                 .endpoint = 0x00,       /* Control pipe */
 638                 .direction = UE_DIR_ANY,
 639                 .bufsize = sizeof(struct usb_device_request),
 640                 .callback = &umass_t_cbi_data_rd_cs_callback,
 641                 .timeout = 5000,        /* 5 seconds */
 642         },
 643
 644         [UMASS_T_CBI_DATA_WRITE] = {
 645                 .type = UE_BULK,
 646                 .endpoint = UE_ADDR_ANY,
 647                 .direction = UE_DIR_OUT,
 648                 .bufsize = UMASS_BULK_SIZE,
 649                 .flags = {.proxy_buffer = 1,.short_xfer_ok = 1,.ext_buffer=1,},
 650                 .callback = &umass_t_cbi_data_write_callback,
 651                 .timeout = 0,   /* overwritten later */
 652         },
 653
 654         [UMASS_T_CBI_DATA_WR_CS] = {
 655                 .type = UE_CONTROL,
 656                 .endpoint = 0x00,       /* Control pipe */
 657                 .direction = UE_DIR_ANY,
 658                 .bufsize = sizeof(struct usb_device_request),
 659                 .callback = &umass_t_cbi_data_wr_cs_callback,
 660                 .timeout = 5000,        /* 5 seconds */
 661         },
 662
 663         [UMASS_T_CBI_STATUS] = {
 664                 .type = UE_INTERRUPT,
 665                 .endpoint = UE_ADDR_ANY,
 666                 .direction = UE_DIR_IN,
 667                 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
 668                 .bufsize = sizeof(umass_cbi_sbl_t),
 669                 .callback = &umass_t_cbi_status_callback,
 670                 .timeout = 5000,        /* ms */
 671         },
 672
 673         [UMASS_T_CBI_RESET4] = {
 674                 .type = UE_CONTROL,
 675                 .endpoint = 0x00,       /* Control pipe */
 676                 .direction = UE_DIR_ANY,
 677                 .bufsize = sizeof(struct usb_device_request),
 678                 .callback = &umass_t_cbi_reset4_callback,
 679                 .timeout = 5000,        /* ms */
 680         },
 681 };
 682
 683 /* If device cannot return valid inquiry data, fake it */
 684 static const uint8_t fake_inq_data[SHORT_INQUIRY_LENGTH] = {
 685         0, /* removable */ 0x80, SCSI_REV_2, SCSI_REV_2,
 686          /* additional_length */ 31, 0, 0, 0
 687 };
 688
 689 #define UFI_COMMAND_LENGTH      12      /* UFI commands are always 12 bytes */
 690 #define ATAPI_COMMAND_LENGTH    12      /* ATAPI commands are always 12 bytes */
 691
 692 static devclass_t umass_devclass;
 693
 694 static device_method_t umass_methods[] = {
 695         /* Device interface */
 696         DEVMETHOD(device_probe, umass_probe),
 697         DEVMETHOD(device_attach, umass_attach),
 698         DEVMETHOD(device_detach, umass_detach),
 699
 700         DEVMETHOD_END
 701 };
 702
 703 static driver_t umass_driver = {
 704         .name = "umass",
 705         .methods = umass_methods,
 706         .size = sizeof(struct umass_softc),
 707 };
 708
 709 static const STRUCT_USB_HOST_ID __used umass_devs[] = {
 710         /* generic mass storage class */
 711         {USB_IFACE_CLASS(UICLASS_MASS),},
 712 };
 713
 714 DRIVER_MODULE(umass, uhub, umass_driver, umass_devclass, NULL, 0);
 715 MODULE_DEPEND(umass, usb, 1, 1, 1);
 716 MODULE_DEPEND(umass, cam, 1, 1, 1);
 717 MODULE_VERSION(umass, 1);
 718 USB_PNP_HOST_INFO(umass_devs);
 719
 720 /*
 721  * USB device probe/attach/detach
 722  */
 723
 724 static uint16_t
 725 umass_get_proto(struct usb_interface *iface)
 726 {
 727         struct usb_interface_descriptor *id;
 728         uint16_t retval;
 729
 730         retval = 0;
 731
 732         /* Check for a standards compliant device */
 733         id = usbd_get_interface_descriptor(iface);
 734         if ((id == NULL) ||
 735             (id->bInterfaceClass != UICLASS_MASS)) {
 736                 goto done;
 737         }
 738         switch (id->bInterfaceSubClass) {
 739         case UISUBCLASS_SCSI:
 740                 retval |= UMASS_PROTO_SCSI;
 741                 break;
 742         case UISUBCLASS_UFI:
 743                 retval |= UMASS_PROTO_UFI;
 744                 break;
 745         case UISUBCLASS_RBC:
 746                 retval |= UMASS_PROTO_RBC;
 747                 break;
 748         case UISUBCLASS_SFF8020I:
 749         case UISUBCLASS_SFF8070I:
 750                 retval |= UMASS_PROTO_ATAPI;
 751                 break;
 752         default:
 753                 goto done;
 754         }
 755
 756         switch (id->bInterfaceProtocol) {
 757         case UIPROTO_MASS_CBI:
 758                 retval |= UMASS_PROTO_CBI;
 759                 break;
 760         case UIPROTO_MASS_CBI_I:
 761                 retval |= UMASS_PROTO_CBI_I;
 762                 break;
 763         case UIPROTO_MASS_BBB_OLD:
 764         case UIPROTO_MASS_BBB:
 765                 retval |= UMASS_PROTO_BBB;
 766                 break;
 767         default:
 768                 goto done;
 769         }
 770 done:
 771         return (retval);
 772 }
 773
 774 /*
 775  * Match the device we are seeing with the devices supported.
 776  */
 777 static struct umass_probe_proto
 778 umass_probe_proto(device_t dev, struct usb_attach_arg *uaa)
 779 {
 780         struct umass_probe_proto ret;
 781         uint32_t quirks = NO_QUIRKS;
 782         uint32_t proto = umass_get_proto(uaa->iface);
 783
 784         memset(&ret, 0, sizeof(ret));
 785         ret.error = BUS_PROBE_GENERIC;
 786
 787         /* Search for protocol enforcement */
 788
 789         if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_BBB)) {
 790                 proto &= ~UMASS_PROTO_WIRE;
 791                 proto |= UMASS_PROTO_BBB;
 792         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI)) {
 793                 proto &= ~UMASS_PROTO_WIRE;
 794                 proto |= UMASS_PROTO_CBI;
 795         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI_I)) {
 796                 proto &= ~UMASS_PROTO_WIRE;
 797                 proto |= UMASS_PROTO_CBI_I;
 798         }
 799
 800         if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_SCSI)) {
 801                 proto &= ~UMASS_PROTO_COMMAND;
 802                 proto |= UMASS_PROTO_SCSI;
 803         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_ATAPI)) {
 804                 proto &= ~UMASS_PROTO_COMMAND;
 805                 proto |= UMASS_PROTO_ATAPI;
 806         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_UFI)) {
 807                 proto &= ~UMASS_PROTO_COMMAND;
 808                 proto |= UMASS_PROTO_UFI;
 809         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_RBC)) {
 810                 proto &= ~UMASS_PROTO_COMMAND;
 811                 proto |= UMASS_PROTO_RBC;
 812         }
 813
 814         /* Check if the protocol is invalid */
 815
 816         if ((proto & UMASS_PROTO_COMMAND) == 0) {
 817                 ret.error = ENXIO;
 818                 goto done;
 819         }
 820
 821         if ((proto & UMASS_PROTO_WIRE) == 0) {
 822                 ret.error = ENXIO;
 823                 goto done;
 824         }
 825
 826         /* Search for quirks */
 827
 828         if (usb_test_quirk(uaa, UQ_MSC_NO_TEST_UNIT_READY))
 829                 quirks |= NO_TEST_UNIT_READY;
 830         if (usb_test_quirk(uaa, UQ_MSC_NO_RS_CLEAR_UA))
 831                 quirks |= RS_NO_CLEAR_UA;
 832         if (usb_test_quirk(uaa, UQ_MSC_NO_START_STOP))
 833                 quirks |= NO_START_STOP;
 834         if (usb_test_quirk(uaa, UQ_MSC_NO_GETMAXLUN))
 835                 quirks |= NO_GETMAXLUN;
 836         if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY))
 837                 quirks |= NO_INQUIRY;
 838         if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY_EVPD))
 839                 quirks |= NO_INQUIRY_EVPD;
 840         if (usb_test_quirk(uaa, UQ_MSC_NO_PREVENT_ALLOW))
 841                 quirks |= NO_PREVENT_ALLOW;
 842         if (usb_test_quirk(uaa, UQ_MSC_NO_SYNC_CACHE))
 843                 quirks |= NO_SYNCHRONIZE_CACHE;
 844         if (usb_test_quirk(uaa, UQ_MSC_SHUTTLE_INIT))
 845                 quirks |= SHUTTLE_INIT;
 846         if (usb_test_quirk(uaa, UQ_MSC_ALT_IFACE_1))
 847                 quirks |= ALT_IFACE_1;
 848         if (usb_test_quirk(uaa, UQ_MSC_FLOPPY_SPEED))
 849                 quirks |= FLOPPY_SPEED;
 850         if (usb_test_quirk(uaa, UQ_MSC_IGNORE_RESIDUE))
 851                 quirks |= IGNORE_RESIDUE;
 852         if (usb_test_quirk(uaa, UQ_MSC_WRONG_CSWSIG))
 853                 quirks |= WRONG_CSWSIG;
 854         if (usb_test_quirk(uaa, UQ_MSC_RBC_PAD_TO_12))
 855                 quirks |= RBC_PAD_TO_12;
 856         if (usb_test_quirk(uaa, UQ_MSC_READ_CAP_OFFBY1))
 857                 quirks |= READ_CAPACITY_OFFBY1;
 858         if (usb_test_quirk(uaa, UQ_MSC_FORCE_SHORT_INQ))
 859                 quirks |= FORCE_SHORT_INQUIRY;
 860
 861 done:
 862         ret.quirks = quirks;
 863         ret.proto = proto;
 864         return (ret);
 865 }
 866
 867 static int
 868 umass_probe(device_t dev)
 869 {
 870         struct usb_attach_arg *uaa = device_get_ivars(dev);
 871         struct umass_probe_proto temp;
 872
 873         if (uaa->usb_mode != USB_MODE_HOST) {
 874                 return (ENXIO);
 875         }
 876         temp = umass_probe_proto(dev, uaa);
 877
 878         return (temp.error);
 879 }
 880
 881 static int
 882 umass_attach(device_t dev)
 883 {
 884         struct umass_softc *sc = device_get_softc(dev);
 885         struct usb_attach_arg *uaa = device_get_ivars(dev);
 886         struct umass_probe_proto temp = umass_probe_proto(dev, uaa);
 887         struct usb_interface_descriptor *id;
 888         int err;
 889
 890         /*
 891          * NOTE: the softc struct is cleared in device_set_driver.
 892          * We can safely call umass_detach without specifically
 893          * initializing the struct.
 894          */
 895
 896         sc->sc_dev = dev;
 897         sc->sc_udev = uaa->device;
 898         sc->sc_proto = temp.proto;
 899         sc->sc_quirks = temp.quirks;
 900         sc->sc_unit = device_get_unit(dev);
 901
 902         snprintf(sc->sc_name, sizeof(sc->sc_name),
 903             "%s", device_get_nameunit(dev));
 904
 905         device_set_usb_desc(dev);
 906
 907         mtx_init(&sc->sc_mtx, device_get_nameunit(dev),
 908             NULL, MTX_DEF | MTX_RECURSE);
 909
 910         /* get interface index */
 911
 912         id = usbd_get_interface_descriptor(uaa->iface);
 913         if (id == NULL) {
 914                 device_printf(dev, "failed to get "
 915                     "interface number\n");
 916                 goto detach;
 917         }
 918         sc->sc_iface_no = id->bInterfaceNumber;
 919
 920 #ifdef USB_DEBUG
 921         device_printf(dev, " ");
 922
 923         switch (sc->sc_proto & UMASS_PROTO_COMMAND) {
 924         case UMASS_PROTO_SCSI:
 925                 printf("SCSI");
 926                 break;
 927         case UMASS_PROTO_ATAPI:
 928                 printf("8070i (ATAPI)");
 929                 break;
 930         case UMASS_PROTO_UFI:
 931                 printf("UFI");
 932                 break;
 933         case UMASS_PROTO_RBC:
 934                 printf("RBC");
 935                 break;
 936         default:
 937                 printf("(unknown 0x%02x)",
 938                     sc->sc_proto & UMASS_PROTO_COMMAND);
 939                 break;
 940         }
 941
 942         printf(" over ");
 943
 944         switch (sc->sc_proto & UMASS_PROTO_WIRE) {
 945         case UMASS_PROTO_BBB:
 946                 printf("Bulk-Only");
 947                 break;
 948         case UMASS_PROTO_CBI:           /* uses Comand/Bulk pipes */
 949                 printf("CBI");
 950                 break;
 951         case UMASS_PROTO_CBI_I: /* uses Comand/Bulk/Interrupt pipes */
 952                 printf("CBI with CCI");
 953                 break;
 954         default:
 955                 printf("(unknown 0x%02x)",
 956                     sc->sc_proto & UMASS_PROTO_WIRE);
 957         }
 958
 959         printf("; quirks = 0x%04x\n", sc->sc_quirks);
 960 #endif
 961
 962         if (sc->sc_quirks & ALT_IFACE_1) {
 963                 err = usbd_set_alt_interface_index
 964                     (uaa->device, uaa->info.bIfaceIndex, 1);
 965
 966                 if (err) {
 967                         DPRINTF(sc, UDMASS_USB, "could not switch to "
 968                             "Alt Interface 1\n");
 969                         goto detach;
 970                 }
 971         }
 972         /* allocate all required USB transfers */
 973
 974         if (sc->sc_proto & UMASS_PROTO_BBB) {
 975                 err = usbd_transfer_setup(uaa->device,
 976                     &uaa->info.bIfaceIndex, sc->sc_xfer, umass_bbb_config,
 977                     UMASS_T_BBB_MAX, sc, &sc->sc_mtx);
 978
 979                 /* skip reset first time */
 980                 sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
 981
 982         } else if (sc->sc_proto & (UMASS_PROTO_CBI | UMASS_PROTO_CBI_I)) {
 983                 err = usbd_transfer_setup(uaa->device,
 984                     &uaa->info.bIfaceIndex, sc->sc_xfer, umass_cbi_config,
 985                     UMASS_T_CBI_MAX, sc, &sc->sc_mtx);
 986
 987                 /* skip reset first time */
 988                 sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
 989
 990         } else {
 991                 err = USB_ERR_INVAL;
 992         }
 993
 994         if (err) {
 995                 device_printf(dev, "could not setup required "
 996                     "transfers, %s\n", usbd_errstr(err));
 997                 goto detach;
 998         }
 999 #ifdef USB_DEBUG
1000         if (umass_throttle > 0) {
1001                 uint8_t x;
1002                 int iv;
1003
1004                 iv = umass_throttle;
1005
1006                 if (iv < 1)
1007                         iv = 1;
1008                 else if (iv > 8000)
1009                         iv = 8000;
1010
1011                 for (x = 0; x != UMASS_T_MAX; x++) {
1012                         if (sc->sc_xfer[x] != NULL)
1013                                 usbd_xfer_set_interval(sc->sc_xfer[x], iv);
1014                 }
1015         }
1016 #endif
1017         sc->sc_transform =
1018             (sc->sc_proto & UMASS_PROTO_SCSI) ? &umass_scsi_transform :
1019             (sc->sc_proto & UMASS_PROTO_UFI) ? &umass_ufi_transform :
1020             (sc->sc_proto & UMASS_PROTO_ATAPI) ? &umass_atapi_transform :
1021             (sc->sc_proto & UMASS_PROTO_RBC) ? &umass_rbc_transform :
1022             &umass_no_transform;
1023
1024         /* from here onwards the device can be used. */
1025
1026         if (sc->sc_quirks & SHUTTLE_INIT) {
1027                 umass_init_shuttle(sc);
1028         }
1029         /* get the maximum LUN supported by the device */
1030
1031         if (((sc->sc_proto & UMASS_PROTO_WIRE) == UMASS_PROTO_BBB) &&
1032             !(sc->sc_quirks & NO_GETMAXLUN))
1033                 sc->sc_maxlun = umass_bbb_get_max_lun(sc);
1034         else
1035                 sc->sc_maxlun = 0;
1036
1037         /* Prepare the SCSI command block */
1038         sc->cam_scsi_sense.opcode = REQUEST_SENSE;
1039         sc->cam_scsi_test_unit_ready.opcode = TEST_UNIT_READY;
1040
1041         /* register the SIM */
1042         err = umass_cam_attach_sim(sc);
1043         if (err) {
1044                 goto detach;
1045         }
1046         /* scan the SIM */
1047         umass_cam_attach(sc);
1048
1049         DPRINTF(sc, UDMASS_GEN, "Attach finished\n");
1050
1051         return (0);                     /* success */
1052
1053 detach:
1054         umass_detach(dev);
1055         return (ENXIO);                 /* failure */
1056 }
1057
1058 static int
1059 umass_detach(device_t dev)
1060 {
1061         struct umass_softc *sc = device_get_softc(dev);
1062
1063         DPRINTF(sc, UDMASS_USB, "\n");
1064
1065         /* teardown our statemachine */
1066
1067         usbd_transfer_unsetup(sc->sc_xfer, UMASS_T_MAX);
1068
1069         mtx_lock(&sc->sc_mtx);
1070
1071         /* cancel any leftover CCB's */
1072
1073         umass_cancel_ccb(sc);
1074
1075         umass_cam_detach_sim(sc);
1076
1077         mtx_unlock(&sc->sc_mtx);
1078
1079         mtx_destroy(&sc->sc_mtx);
1080
1081         return (0);                     /* success */
1082 }
1083
1084 static void
1085 umass_init_shuttle(struct umass_softc *sc)
1086 {
1087         struct usb_device_request req;
1088         uint8_t status[2] = {0, 0};
1089
1090         /*
1091          * The Linux driver does this, but no one can tell us what the
1092          * command does.
1093          */
1094         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1095         req.bRequest = 1;               /* XXX unknown command */
1096         USETW(req.wValue, 0);
1097         req.wIndex[0] = sc->sc_iface_no;
1098         req.wIndex[1] = 0;
1099         USETW(req.wLength, sizeof(status));
1100         usbd_do_request(sc->sc_udev, NULL, &req, &status);
1101
1102         DPRINTF(sc, UDMASS_GEN, "Shuttle init returned 0x%02x%02x\n",
1103             status[0], status[1]);
1104 }
1105
1106 /*
1107  * Generic functions to handle transfers
1108  */
1109
1110 static void
1111 umass_transfer_start(struct umass_softc *sc, uint8_t xfer_index)
1112 {
1113         DPRINTF(sc, UDMASS_GEN, "transfer index = "
1114             "%d\n", xfer_index);
1115
1116         if (sc->sc_xfer[xfer_index]) {
1117                 sc->sc_last_xfer_index = xfer_index;
1118                 usbd_transfer_start(sc->sc_xfer[xfer_index]);
1119         } else {
1120                 umass_cancel_ccb(sc);
1121         }
1122 }
1123
1124 static void
1125 umass_reset(struct umass_softc *sc)
1126 {
1127         DPRINTF(sc, UDMASS_GEN, "resetting device\n");
1128
1129         /*
1130          * stop the last transfer, if not already stopped:
1131          */
1132         usbd_transfer_stop(sc->sc_xfer[sc->sc_last_xfer_index]);
1133         umass_transfer_start(sc, 0);
1134 }
1135
1136 static void
1137 umass_cancel_ccb(struct umass_softc *sc)
1138 {
1139         union ccb *ccb;
1140
1141         USB_MTX_ASSERT(&sc->sc_mtx, MA_OWNED);
1142
1143         ccb = sc->sc_transfer.ccb;
1144         sc->sc_transfer.ccb = NULL;
1145         sc->sc_last_xfer_index = 0;
1146
1147         if (ccb) {
1148                 (sc->sc_transfer.callback)
1149                     (sc, ccb, (sc->sc_transfer.data_len -
1150                     sc->sc_transfer.actlen), STATUS_WIRE_FAILED);
1151         }
1152 }
1153
1154 static void
1155 umass_tr_error(struct usb_xfer *xfer, usb_error_t error)
1156 {
1157         struct umass_softc *sc = usbd_xfer_softc(xfer);
1158
1159         if (error != USB_ERR_CANCELLED) {
1160                 DPRINTF(sc, UDMASS_GEN, "transfer error, %s -> "
1161                     "reset\n", usbd_errstr(error));
1162         }
1163         umass_cancel_ccb(sc);
1164 }
1165
1166 /*
1167  * BBB protocol specific functions
1168  */
1169
1170 static void
1171 umass_t_bbb_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1172 {
1173         struct umass_softc *sc = usbd_xfer_softc(xfer);
1174         struct usb_device_request req;
1175         struct usb_page_cache *pc;
1176
1177         switch (USB_GET_STATE(xfer)) {
1178         case USB_ST_TRANSFERRED:
1179                 umass_transfer_start(sc, UMASS_T_BBB_RESET2);
1180                 return;
1181
1182         case USB_ST_SETUP:
1183                 /*
1184                  * Reset recovery (5.3.4 in Universal Serial Bus Mass Storage Class)
1185                  *
1186                  * For Reset Recovery the host shall issue in the following order:
1187                  * a) a Bulk-Only Mass Storage Reset
1188                  * b) a Clear Feature HALT to the Bulk-In endpoint
1189                  * c) a Clear Feature HALT to the Bulk-Out endpoint
1190                  *
1191                  * This is done in 3 steps, using 3 transfers:
1192                  * UMASS_T_BBB_RESET1
1193                  * UMASS_T_BBB_RESET2
1194                  * UMASS_T_BBB_RESET3
1195                  */
1196
1197                 DPRINTF(sc, UDMASS_BBB, "BBB reset!\n");
1198
1199                 req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1200                 req.bRequest = UR_BBB_RESET;    /* bulk only reset */
1201                 USETW(req.wValue, 0);
1202                 req.wIndex[0] = sc->sc_iface_no;
1203                 req.wIndex[1] = 0;
1204                 USETW(req.wLength, 0);
1205
1206                 pc = usbd_xfer_get_frame(xfer, 0);
1207                 usbd_copy_in(pc, 0, &req, sizeof(req));
1208
1209                 usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1210                 usbd_xfer_set_frames(xfer, 1);
1211                 usbd_transfer_submit(xfer);
1212                 return;
1213
1214         default:                        /* Error */
1215                 umass_tr_error(xfer, error);
1216                 return;
1217         }
1218 }
1219
1220 static void
1221 umass_t_bbb_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1222 {
1223         umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_RESET3,
1224             UMASS_T_BBB_DATA_READ, error);
1225 }
1226
1227 static void
1228 umass_t_bbb_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1229 {
1230         umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_COMMAND,
1231             UMASS_T_BBB_DATA_WRITE, error);
1232 }
1233
1234 static void
1235 umass_t_bbb_data_clear_stall_callback(struct usb_xfer *xfer,
1236     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1237 {
1238         struct umass_softc *sc = usbd_xfer_softc(xfer);
1239
1240         switch (USB_GET_STATE(xfer)) {
1241         case USB_ST_TRANSFERRED:
1242 tr_transferred:
1243                 umass_transfer_start(sc, next_xfer);
1244                 return;
1245
1246         case USB_ST_SETUP:
1247                 if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1248                         goto tr_transferred;
1249                 }
1250                 return;
1251
1252         default:                        /* Error */
1253                 umass_tr_error(xfer, error);
1254                 return;
1255         }
1256 }
1257
1258 static void
1259 umass_t_bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
1260 {
1261         struct umass_softc *sc = usbd_xfer_softc(xfer);
1262         union ccb *ccb = sc->sc_transfer.ccb;
1263         struct usb_page_cache *pc;
1264         uint32_t tag;
1265
1266         switch (USB_GET_STATE(xfer)) {
1267         case USB_ST_TRANSFERRED:
1268                 umass_transfer_start
1269                     (sc, ((sc->sc_transfer.dir == DIR_IN) ? UMASS_T_BBB_DATA_READ :
1270                     (sc->sc_transfer.dir == DIR_OUT) ? UMASS_T_BBB_DATA_WRITE :
1271                     UMASS_T_BBB_STATUS));
1272                 return;
1273
1274         case USB_ST_SETUP:
1275
1276                 sc->sc_status_try = 0;
1277
1278                 if (ccb) {
1279                         /*
1280                          * the initial value is not important,
1281                          * as long as the values are unique:
1282                          */
1283                         tag = UGETDW(sc->cbw.dCBWTag) + 1;
1284
1285                         USETDW(sc->cbw.dCBWSignature, CBWSIGNATURE);
1286                         USETDW(sc->cbw.dCBWTag, tag);
1287
1288                         /*
1289                          * dCBWDataTransferLength:
1290                          *   This field indicates the number of bytes of data that the host
1291                          *   intends to transfer on the IN or OUT Bulk endpoint(as indicated by
1292                          *   the Direction bit) during the execution of this command. If this
1293                          *   field is set to 0, the device will expect that no data will be
1294                          *   transferred IN or OUT during this command, regardless of the value
1295                          *   of the Direction bit defined in dCBWFlags.
1296                          */
1297                         USETDW(sc->cbw.dCBWDataTransferLength, sc->sc_transfer.data_len);
1298
1299                         /*
1300                          * dCBWFlags:
1301                          *   The bits of the Flags field are defined as follows:
1302                          *     Bits 0-6  reserved
1303                          *     Bit  7    Direction - this bit shall be ignored if the
1304                          *                           dCBWDataTransferLength field is zero.
1305                          *               0 = data Out from host to device
1306                          *               1 = data In from device to host
1307                          */
1308                         sc->cbw.bCBWFlags = ((sc->sc_transfer.dir == DIR_IN) ?
1309                             CBWFLAGS_IN : CBWFLAGS_OUT);
1310                         sc->cbw.bCBWLUN = sc->sc_transfer.lun;
1311
1312                         if (sc->sc_transfer.cmd_len > sizeof(sc->cbw.CBWCDB)) {
1313                                 sc->sc_transfer.cmd_len = sizeof(sc->cbw.CBWCDB);
1314                                 DPRINTF(sc, UDMASS_BBB, "Truncating long command!\n");
1315                         }
1316                         sc->cbw.bCDBLength = sc->sc_transfer.cmd_len;
1317
1318                         /* copy SCSI command data */
1319                         memcpy(sc->cbw.CBWCDB, sc->sc_transfer.cmd_data,
1320                             sc->sc_transfer.cmd_len);
1321
1322                         /* clear remaining command area */
1323                         memset(sc->cbw.CBWCDB +
1324                             sc->sc_transfer.cmd_len, 0,
1325                             sizeof(sc->cbw.CBWCDB) -
1326                             sc->sc_transfer.cmd_len);
1327
1328                         DIF(UDMASS_BBB, umass_bbb_dump_cbw(sc, &sc->cbw));
1329
1330                         pc = usbd_xfer_get_frame(xfer, 0);
1331                         usbd_copy_in(pc, 0, &sc->cbw, sizeof(sc->cbw));
1332                         usbd_xfer_set_frame_len(xfer, 0, sizeof(sc->cbw));
1333
1334                         usbd_transfer_submit(xfer);
1335                 }
1336                 return;
1337
1338         default:                        /* Error */
1339                 umass_tr_error(xfer, error);
1340                 return;
1341         }
1342 }
1343
1344 static void
1345 umass_t_bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1346 {
1347         struct umass_softc *sc = usbd_xfer_softc(xfer);
1348         uint32_t max_bulk = usbd_xfer_max_len(xfer);
1349         int actlen, sumlen;
1350
1351         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1352
1353         switch (USB_GET_STATE(xfer)) {
1354         case USB_ST_TRANSFERRED:
1355                 sc->sc_transfer.data_rem -= actlen;
1356                 sc->sc_transfer.data_ptr += actlen;
1357                 sc->sc_transfer.actlen += actlen;
1358
1359                 if (actlen < sumlen) {
1360                         /* short transfer */
1361                         sc->sc_transfer.data_rem = 0;
1362                 }
1363         case USB_ST_SETUP:
1364                 DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1365                     max_bulk, sc->sc_transfer.data_rem);
1366
1367                 if (sc->sc_transfer.data_rem == 0) {
1368                         umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1369                         return;
1370                 }
1371                 if (max_bulk > sc->sc_transfer.data_rem) {
1372                         max_bulk = sc->sc_transfer.data_rem;
1373                 }
1374                 usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1375
1376                 usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1377                     max_bulk);
1378
1379                 usbd_transfer_submit(xfer);
1380                 return;
1381
1382         default:                        /* Error */
1383                 if (error == USB_ERR_CANCELLED) {
1384                         umass_tr_error(xfer, error);
1385                 } else {
1386                         umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1387                 }
1388                 return;
1389         }
1390 }
1391
1392 static void
1393 umass_t_bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1394 {
1395         umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1396             UMASS_T_BBB_DATA_READ, error);
1397 }
1398
1399 static void
1400 umass_t_bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1401 {
1402         struct umass_softc *sc = usbd_xfer_softc(xfer);
1403         uint32_t max_bulk = usbd_xfer_max_len(xfer);
1404         int actlen, sumlen;
1405
1406         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1407
1408         switch (USB_GET_STATE(xfer)) {
1409         case USB_ST_TRANSFERRED:
1410                 sc->sc_transfer.data_rem -= actlen;
1411                 sc->sc_transfer.data_ptr += actlen;
1412                 sc->sc_transfer.actlen += actlen;
1413
1414                 if (actlen < sumlen) {
1415                         /* short transfer */
1416                         sc->sc_transfer.data_rem = 0;
1417                 }
1418         case USB_ST_SETUP:
1419                 DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1420                     max_bulk, sc->sc_transfer.data_rem);
1421
1422                 if (sc->sc_transfer.data_rem == 0) {
1423                         umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1424                         return;
1425                 }
1426                 if (max_bulk > sc->sc_transfer.data_rem) {
1427                         max_bulk = sc->sc_transfer.data_rem;
1428                 }
1429                 usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1430
1431                 usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1432                     max_bulk);
1433
1434                 usbd_transfer_submit(xfer);
1435                 return;
1436
1437         default:                        /* Error */
1438                 if (error == USB_ERR_CANCELLED) {
1439                         umass_tr_error(xfer, error);
1440                 } else {
1441                         umass_transfer_start(sc, UMASS_T_BBB_DATA_WR_CS);
1442                 }
1443                 return;
1444         }
1445 }
1446
1447 static void
1448 umass_t_bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1449 {
1450         umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1451             UMASS_T_BBB_DATA_WRITE, error);
1452 }
1453
1454 static void
1455 umass_t_bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
1456 {
1457         struct umass_softc *sc = usbd_xfer_softc(xfer);
1458         union ccb *ccb = sc->sc_transfer.ccb;
1459         struct usb_page_cache *pc;
1460         uint32_t residue;
1461         int actlen;
1462
1463         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1464
1465         switch (USB_GET_STATE(xfer)) {
1466         case USB_ST_TRANSFERRED:
1467
1468                 /*
1469                  * Do a full reset if there is something wrong with the CSW:
1470                  */
1471                 sc->sc_status_try = 1;
1472
1473                 /* Zero missing parts of the CSW: */
1474
1475                 if (actlen < (int)sizeof(sc->csw))
1476                         memset(&sc->csw, 0, sizeof(sc->csw));
1477
1478                 pc = usbd_xfer_get_frame(xfer, 0);
1479                 usbd_copy_out(pc, 0, &sc->csw, actlen);
1480
1481                 DIF(UDMASS_BBB, umass_bbb_dump_csw(sc, &sc->csw));
1482
1483                 residue = UGETDW(sc->csw.dCSWDataResidue);
1484
1485                 if ((!residue) || (sc->sc_quirks & IGNORE_RESIDUE)) {
1486                         residue = (sc->sc_transfer.data_len -
1487                             sc->sc_transfer.actlen);
1488                 }
1489                 if (residue > sc->sc_transfer.data_len) {
1490                         DPRINTF(sc, UDMASS_BBB, "truncating residue from %d "
1491                             "to %d bytes\n", residue, sc->sc_transfer.data_len);
1492                         residue = sc->sc_transfer.data_len;
1493                 }
1494                 /* translate weird command-status signatures: */
1495                 if (sc->sc_quirks & WRONG_CSWSIG) {
1496                         uint32_t temp = UGETDW(sc->csw.dCSWSignature);
1497
1498                         if ((temp == CSWSIGNATURE_OLYMPUS_C1) ||
1499                             (temp == CSWSIGNATURE_IMAGINATION_DBX1)) {
1500                                 USETDW(sc->csw.dCSWSignature, CSWSIGNATURE);
1501                         }
1502                 }
1503                 /* check CSW and handle eventual error */
1504                 if (UGETDW(sc->csw.dCSWSignature) != CSWSIGNATURE) {
1505                         DPRINTF(sc, UDMASS_BBB, "bad CSW signature 0x%08x != 0x%08x\n",
1506                             UGETDW(sc->csw.dCSWSignature), CSWSIGNATURE);
1507                         /*
1508                          * Invalid CSW: Wrong signature or wrong tag might
1509                          * indicate that we lost synchronization. Reset the
1510                          * device.
1511                          */
1512                         goto tr_error;
1513                 } else if (UGETDW(sc->csw.dCSWTag) != UGETDW(sc->cbw.dCBWTag)) {
1514                         DPRINTF(sc, UDMASS_BBB, "Invalid CSW: tag 0x%08x should be "
1515                             "0x%08x\n", UGETDW(sc->csw.dCSWTag),
1516                             UGETDW(sc->cbw.dCBWTag));
1517                         goto tr_error;
1518                 } else if (sc->csw.bCSWStatus > CSWSTATUS_PHASE) {
1519                         DPRINTF(sc, UDMASS_BBB, "Invalid CSW: status %d > %d\n",
1520                             sc->csw.bCSWStatus, CSWSTATUS_PHASE);
1521                         goto tr_error;
1522                 } else if (sc->csw.bCSWStatus == CSWSTATUS_PHASE) {
1523                         DPRINTF(sc, UDMASS_BBB, "Phase error, residue = "
1524                             "%d\n", residue);
1525                         goto tr_error;
1526                 } else if (sc->sc_transfer.actlen > sc->sc_transfer.data_len) {
1527                         DPRINTF(sc, UDMASS_BBB, "Buffer overrun %d > %d\n",
1528                             sc->sc_transfer.actlen, sc->sc_transfer.data_len);
1529                         goto tr_error;
1530                 } else if (sc->csw.bCSWStatus == CSWSTATUS_FAILED) {
1531                         DPRINTF(sc, UDMASS_BBB, "Command failed, residue = "
1532                             "%d\n", residue);
1533
1534                         sc->sc_transfer.ccb = NULL;
1535
1536                         sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1537
1538                         (sc->sc_transfer.callback)
1539                             (sc, ccb, residue, STATUS_CMD_FAILED);
1540                 } else {
1541                         sc->sc_transfer.ccb = NULL;
1542
1543                         sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1544
1545                         (sc->sc_transfer.callback)
1546                             (sc, ccb, residue, STATUS_CMD_OK);
1547                 }
1548                 return;
1549
1550         case USB_ST_SETUP:
1551                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1552                 usbd_transfer_submit(xfer);
1553                 return;
1554
1555         default:
1556 tr_error:
1557                 DPRINTF(sc, UDMASS_BBB, "Failed to read CSW: %s, try %d\n",
1558                     usbd_errstr(error), sc->sc_status_try);
1559
1560                 if ((error == USB_ERR_CANCELLED) ||
1561                     (sc->sc_status_try)) {
1562                         umass_tr_error(xfer, error);
1563                 } else {
1564                         sc->sc_status_try = 1;
1565                         umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1566                 }
1567                 return;
1568         }
1569 }
1570
1571 static void
1572 umass_command_start(struct umass_softc *sc, uint8_t dir,
1573     void *data_ptr, uint32_t data_len,
1574     uint32_t data_timeout, umass_callback_t *callback,
1575     union ccb *ccb)
1576 {
1577         sc->sc_transfer.lun = ccb->ccb_h.target_lun;
1578
1579         /*
1580          * NOTE: assumes that "sc->sc_transfer.cmd_data" and
1581          * "sc->sc_transfer.cmd_len" has been properly
1582          * initialized.
1583          */
1584
1585         sc->sc_transfer.dir = data_len ? dir : DIR_NONE;
1586         sc->sc_transfer.data_ptr = data_ptr;
1587         sc->sc_transfer.data_len = data_len;
1588         sc->sc_transfer.data_rem = data_len;
1589         sc->sc_transfer.data_timeout = (data_timeout + UMASS_TIMEOUT);
1590
1591         sc->sc_transfer.actlen = 0;
1592         sc->sc_transfer.callback = callback;
1593         sc->sc_transfer.ccb = ccb;
1594
1595         if (sc->sc_xfer[sc->sc_last_xfer_index]) {
1596                 usbd_transfer_start(sc->sc_xfer[sc->sc_last_xfer_index]);
1597         } else {
1598                 umass_cancel_ccb(sc);
1599         }
1600 }
1601
1602 static uint8_t
1603 umass_bbb_get_max_lun(struct umass_softc *sc)
1604 {
1605         struct usb_device_request req;
1606         usb_error_t err;
1607         uint8_t buf = 0;
1608
1609         /* The Get Max Lun command is a class-specific request. */
1610         req.bmRequestType = UT_READ_CLASS_INTERFACE;
1611         req.bRequest = UR_BBB_GET_MAX_LUN;
1612         USETW(req.wValue, 0);
1613         req.wIndex[0] = sc->sc_iface_no;
1614         req.wIndex[1] = 0;
1615         USETW(req.wLength, 1);
1616
1617         err = usbd_do_request(sc->sc_udev, NULL, &req, &buf);
1618         if (err) {
1619                 buf = 0;
1620
1621                 /* Device doesn't support Get Max Lun request. */
1622                 printf("%s: Get Max Lun not supported (%s)\n",
1623                     sc->sc_name, usbd_errstr(err));
1624         }
1625         return (buf);
1626 }
1627
1628 /*
1629  * Command/Bulk/Interrupt (CBI) specific functions
1630  */
1631
1632 static void
1633 umass_cbi_start_status(struct umass_softc *sc)
1634 {
1635         if (sc->sc_xfer[UMASS_T_CBI_STATUS]) {
1636                 umass_transfer_start(sc, UMASS_T_CBI_STATUS);
1637         } else {
1638                 union ccb *ccb = sc->sc_transfer.ccb;
1639
1640                 sc->sc_transfer.ccb = NULL;
1641
1642                 sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1643
1644                 (sc->sc_transfer.callback)
1645                     (sc, ccb, (sc->sc_transfer.data_len -
1646                     sc->sc_transfer.actlen), STATUS_CMD_UNKNOWN);
1647         }
1648 }
1649
1650 static void
1651 umass_t_cbi_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1652 {
1653         struct umass_softc *sc = usbd_xfer_softc(xfer);
1654         struct usb_device_request req;
1655         struct usb_page_cache *pc;
1656         uint8_t buf[UMASS_CBI_DIAGNOSTIC_CMDLEN];
1657
1658         uint8_t i;
1659
1660         switch (USB_GET_STATE(xfer)) {
1661         case USB_ST_TRANSFERRED:
1662                 umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1663                 break;
1664
1665         case USB_ST_SETUP:
1666                 /*
1667                  * Command Block Reset Protocol
1668                  *
1669                  * First send a reset request to the device. Then clear
1670                  * any possibly stalled bulk endpoints.
1671                  *
1672                  * This is done in 3 steps, using 3 transfers:
1673                  * UMASS_T_CBI_RESET1
1674                  * UMASS_T_CBI_RESET2
1675                  * UMASS_T_CBI_RESET3
1676                  * UMASS_T_CBI_RESET4 (only if there is an interrupt endpoint)
1677                  */
1678
1679                 DPRINTF(sc, UDMASS_CBI, "CBI reset!\n");
1680
1681                 req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1682                 req.bRequest = UR_CBI_ADSC;
1683                 USETW(req.wValue, 0);
1684                 req.wIndex[0] = sc->sc_iface_no;
1685                 req.wIndex[1] = 0;
1686                 USETW(req.wLength, UMASS_CBI_DIAGNOSTIC_CMDLEN);
1687
1688                 /*
1689                  * The 0x1d code is the SEND DIAGNOSTIC command. To
1690                  * distinguish between the two, the last 10 bytes of the CBL
1691                  * is filled with 0xff (section 2.2 of the CBI
1692                  * specification)
1693                  */
1694                 buf[0] = 0x1d;          /* Command Block Reset */
1695                 buf[1] = 0x04;
1696
1697                 for (i = 2; i < UMASS_CBI_DIAGNOSTIC_CMDLEN; i++) {
1698                         buf[i] = 0xff;
1699                 }
1700
1701                 pc = usbd_xfer_get_frame(xfer, 0);
1702                 usbd_copy_in(pc, 0, &req, sizeof(req));
1703                 pc = usbd_xfer_get_frame(xfer, 1);
1704                 usbd_copy_in(pc, 0, buf, sizeof(buf));
1705
1706                 usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1707                 usbd_xfer_set_frame_len(xfer, 1, sizeof(buf));
1708                 usbd_xfer_set_frames(xfer, 2);
1709                 usbd_transfer_submit(xfer);
1710                 break;
1711
1712         default:                        /* Error */
1713                 if (error == USB_ERR_CANCELLED)
1714                         umass_tr_error(xfer, error);
1715                 else
1716                         umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1717                 break;
1718         }
1719 }
1720
1721 static void
1722 umass_t_cbi_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1723 {
1724         umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_RESET3,
1725             UMASS_T_CBI_DATA_READ, error);
1726 }
1727
1728 static void
1729 umass_t_cbi_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1730 {
1731         struct umass_softc *sc = usbd_xfer_softc(xfer);
1732
1733         umass_t_cbi_data_clear_stall_callback
1734             (xfer, (sc->sc_xfer[UMASS_T_CBI_RESET4] &&
1735             sc->sc_xfer[UMASS_T_CBI_STATUS]) ?
1736             UMASS_T_CBI_RESET4 : UMASS_T_CBI_COMMAND,
1737             UMASS_T_CBI_DATA_WRITE, error);
1738 }
1739
1740 static void
1741 umass_t_cbi_reset4_callback(struct usb_xfer *xfer, usb_error_t error)
1742 {
1743         umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_COMMAND,
1744             UMASS_T_CBI_STATUS, error);
1745 }
1746
1747 static void
1748 umass_t_cbi_data_clear_stall_callback(struct usb_xfer *xfer,
1749     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1750 {
1751         struct umass_softc *sc = usbd_xfer_softc(xfer);
1752
1753         switch (USB_GET_STATE(xfer)) {
1754         case USB_ST_TRANSFERRED:
1755 tr_transferred:
1756                 if (next_xfer == UMASS_T_CBI_STATUS) {
1757                         umass_cbi_start_status(sc);
1758                 } else {
1759                         umass_transfer_start(sc, next_xfer);
1760                 }
1761                 break;
1762
1763         case USB_ST_SETUP:
1764                 if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1765                         goto tr_transferred;    /* should not happen */
1766                 }
1767                 break;
1768
1769         default:                        /* Error */
1770                 umass_tr_error(xfer, error);
1771                 break;
1772         }
1773 }
1774
1775 static void
1776 umass_t_cbi_command_callback(struct usb_xfer *xfer, usb_error_t error)
1777 {
1778         struct umass_softc *sc = usbd_xfer_softc(xfer);
1779         union ccb *ccb = sc->sc_transfer.ccb;
1780         struct usb_device_request req;
1781         struct usb_page_cache *pc;
1782
1783         switch (USB_GET_STATE(xfer)) {
1784         case USB_ST_TRANSFERRED:
1785
1786                 if (sc->sc_transfer.dir == DIR_NONE) {
1787                         umass_cbi_start_status(sc);
1788                 } else {
1789                         umass_transfer_start
1790                             (sc, (sc->sc_transfer.dir == DIR_IN) ?
1791                             UMASS_T_CBI_DATA_READ : UMASS_T_CBI_DATA_WRITE);
1792                 }
1793                 break;
1794
1795         case USB_ST_SETUP:
1796
1797                 if (ccb) {
1798                         /*
1799                          * do a CBI transfer with cmd_len bytes from
1800                          * cmd_data, possibly a data phase of data_len
1801                          * bytes from/to the device and finally a status
1802                          * read phase.
1803                          */
1804
1805                         req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1806                         req.bRequest = UR_CBI_ADSC;
1807                         USETW(req.wValue, 0);
1808                         req.wIndex[0] = sc->sc_iface_no;
1809                         req.wIndex[1] = 0;
1810                         req.wLength[0] = sc->sc_transfer.cmd_len;
1811                         req.wLength[1] = 0;
1812
1813                         pc = usbd_xfer_get_frame(xfer, 0);
1814                         usbd_copy_in(pc, 0, &req, sizeof(req));
1815                         pc = usbd_xfer_get_frame(xfer, 1);
1816                         usbd_copy_in(pc, 0, sc->sc_transfer.cmd_data,
1817                             sc->sc_transfer.cmd_len);
1818
1819                         usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1820                         usbd_xfer_set_frame_len(xfer, 1, sc->sc_transfer.cmd_len);
1821                         usbd_xfer_set_frames(xfer,
1822                             sc->sc_transfer.cmd_len ? 2 : 1);
1823
1824                         DIF(UDMASS_CBI,
1825                             umass_cbi_dump_cmd(sc,
1826                             sc->sc_transfer.cmd_data,
1827                             sc->sc_transfer.cmd_len));
1828
1829                         usbd_transfer_submit(xfer);
1830                 }
1831                 break;
1832
1833         default:                        /* Error */
1834                 /*
1835                  * STALL on the control pipe can be result of the command error.
1836                  * Attempt to clear this STALL same as for bulk pipe also
1837                  * results in command completion interrupt, but ASC/ASCQ there
1838                  * look like not always valid, so don't bother about it.
1839                  */
1840                 if ((error == USB_ERR_STALLED) ||
1841                     (sc->sc_transfer.callback == &umass_cam_cb)) {
1842                         sc->sc_transfer.ccb = NULL;
1843                         (sc->sc_transfer.callback)
1844                             (sc, ccb, sc->sc_transfer.data_len,
1845                             STATUS_CMD_UNKNOWN);
1846                 } else {
1847                         umass_tr_error(xfer, error);
1848                         /* skip reset */
1849                         sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1850                 }
1851                 break;
1852         }
1853 }
1854
1855 static void
1856 umass_t_cbi_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1857 {
1858         struct umass_softc *sc = usbd_xfer_softc(xfer);
1859         uint32_t max_bulk = usbd_xfer_max_len(xfer);
1860         int actlen, sumlen;
1861
1862         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1863
1864         switch (USB_GET_STATE(xfer)) {
1865         case USB_ST_TRANSFERRED:
1866                 sc->sc_transfer.data_rem -= actlen;
1867                 sc->sc_transfer.data_ptr += actlen;
1868                 sc->sc_transfer.actlen += actlen;
1869
1870                 if (actlen < sumlen) {
1871                         /* short transfer */
1872                         sc->sc_transfer.data_rem = 0;
1873                 }
1874         case USB_ST_SETUP:
1875                 DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1876                     max_bulk, sc->sc_transfer.data_rem);
1877
1878                 if (sc->sc_transfer.data_rem == 0) {
1879                         umass_cbi_start_status(sc);
1880                         break;
1881                 }
1882                 if (max_bulk > sc->sc_transfer.data_rem) {
1883                         max_bulk = sc->sc_transfer.data_rem;
1884                 }
1885                 usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1886
1887                 usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1888                     max_bulk);
1889
1890                 usbd_transfer_submit(xfer);
1891                 break;
1892
1893         default:                        /* Error */
1894                 if ((error == USB_ERR_CANCELLED) ||
1895                     (sc->sc_transfer.callback != &umass_cam_cb)) {
1896                         umass_tr_error(xfer, error);
1897                 } else {
1898                         umass_transfer_start(sc, UMASS_T_CBI_DATA_RD_CS);
1899                 }
1900                 break;
1901         }
1902 }
1903
1904 static void
1905 umass_t_cbi_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1906 {
1907         umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1908             UMASS_T_CBI_DATA_READ, error);
1909 }
1910
1911 static void
1912 umass_t_cbi_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1913 {
1914         struct umass_softc *sc = usbd_xfer_softc(xfer);
1915         uint32_t max_bulk = usbd_xfer_max_len(xfer);
1916         int actlen, sumlen;
1917
1918         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1919
1920         switch (USB_GET_STATE(xfer)) {
1921         case USB_ST_TRANSFERRED:
1922                 sc->sc_transfer.data_rem -= actlen;
1923                 sc->sc_transfer.data_ptr += actlen;
1924                 sc->sc_transfer.actlen += actlen;
1925
1926                 if (actlen < sumlen) {
1927                         /* short transfer */
1928                         sc->sc_transfer.data_rem = 0;
1929                 }
1930         case USB_ST_SETUP:
1931                 DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1932                     max_bulk, sc->sc_transfer.data_rem);
1933
1934                 if (sc->sc_transfer.data_rem == 0) {
1935                         umass_cbi_start_status(sc);
1936                         break;
1937                 }
1938                 if (max_bulk > sc->sc_transfer.data_rem) {
1939                         max_bulk = sc->sc_transfer.data_rem;
1940                 }
1941                 usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1942
1943                 usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1944                     max_bulk);
1945
1946                 usbd_transfer_submit(xfer);
1947                 break;
1948
1949         default:                        /* Error */
1950                 if ((error == USB_ERR_CANCELLED) ||
1951                     (sc->sc_transfer.callback != &umass_cam_cb)) {
1952                         umass_tr_error(xfer, error);
1953                 } else {
1954                         umass_transfer_start(sc, UMASS_T_CBI_DATA_WR_CS);
1955                 }
1956                 break;
1957         }
1958 }
1959
1960 static void
1961 umass_t_cbi_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1962 {
1963         umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1964             UMASS_T_CBI_DATA_WRITE, error);
1965 }
1966
1967 static void
1968 umass_t_cbi_status_callback(struct usb_xfer *xfer, usb_error_t error)
1969 {
1970         struct umass_softc *sc = usbd_xfer_softc(xfer);
1971         union ccb *ccb = sc->sc_transfer.ccb;
1972         struct usb_page_cache *pc;
1973         uint32_t residue;
1974         uint8_t status;
1975         int actlen;
1976
1977         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1978
1979         switch (USB_GET_STATE(xfer)) {
1980         case USB_ST_TRANSFERRED:
1981
1982                 if (actlen < (int)sizeof(sc->sbl)) {
1983                         goto tr_setup;
1984                 }
1985                 pc = usbd_xfer_get_frame(xfer, 0);
1986                 usbd_copy_out(pc, 0, &sc->sbl, sizeof(sc->sbl));
1987
1988                 residue = (sc->sc_transfer.data_len -
1989                     sc->sc_transfer.actlen);
1990
1991                 /* dissect the information in the buffer */
1992
1993                 if (sc->sc_proto & UMASS_PROTO_UFI) {
1994                         /*
1995                          * Section 3.4.3.1.3 specifies that the UFI command
1996                          * protocol returns an ASC and ASCQ in the interrupt
1997                          * data block.
1998                          */
1999
2000                         DPRINTF(sc, UDMASS_CBI, "UFI CCI, ASC = 0x%02x, "
2001                             "ASCQ = 0x%02x\n", sc->sbl.ufi.asc,
2002                             sc->sbl.ufi.ascq);
2003
2004                         status = (((sc->sbl.ufi.asc == 0) &&
2005                             (sc->sbl.ufi.ascq == 0)) ?
2006                             STATUS_CMD_OK : STATUS_CMD_FAILED);
2007
2008                         sc->sc_transfer.ccb = NULL;
2009
2010                         sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2011
2012                         (sc->sc_transfer.callback)
2013                             (sc, ccb, residue, status);
2014
2015                         break;
2016
2017                 } else {
2018                         /* Command Interrupt Data Block */
2019
2020                         DPRINTF(sc, UDMASS_CBI, "type=0x%02x, value=0x%02x\n",
2021                             sc->sbl.common.type, sc->sbl.common.value);
2022
2023                         if (sc->sbl.common.type == IDB_TYPE_CCI) {
2024                                 status = (sc->sbl.common.value & IDB_VALUE_STATUS_MASK);
2025
2026                                 status = ((status == IDB_VALUE_PASS) ? STATUS_CMD_OK :
2027                                     (status == IDB_VALUE_FAIL) ? STATUS_CMD_FAILED :
2028                                     (status == IDB_VALUE_PERSISTENT) ? STATUS_CMD_FAILED :
2029                                     STATUS_WIRE_FAILED);
2030
2031                                 sc->sc_transfer.ccb = NULL;
2032
2033                                 sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2034
2035                                 (sc->sc_transfer.callback)
2036                                     (sc, ccb, residue, status);
2037
2038                                 break;
2039                         }
2040                 }
2041
2042                 /* fallthrough */
2043
2044         case USB_ST_SETUP:
2045 tr_setup:
2046                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2047                 usbd_transfer_submit(xfer);
2048                 break;
2049
2050         default:                        /* Error */
2051                 DPRINTF(sc, UDMASS_CBI, "Failed to read CSW: %s\n",
2052                     usbd_errstr(error));
2053                 umass_tr_error(xfer, error);
2054                 break;
2055         }
2056 }
2057
2058 /*
2059  * CAM specific functions (used by SCSI, UFI, 8070i (ATAPI))
2060  */
2061
2062 static int
2063 umass_cam_attach_sim(struct umass_softc *sc)
2064 {
2065         struct cam_devq *devq;          /* Per device Queue */
2066         cam_status status;
2067
2068         /*
2069          * A HBA is attached to the CAM layer.
2070          *
2071          * The CAM layer will then after a while start probing for devices on
2072          * the bus. The number of SIMs is limited to one.
2073          */
2074
2075         devq = cam_simq_alloc(1 /* maximum openings */ );
2076         if (devq == NULL) {
2077                 return (ENOMEM);
2078         }
2079         sc->sc_sim = cam_sim_alloc
2080             (&umass_cam_action, &umass_cam_poll,
2081             DEVNAME_SIM,
2082             sc /* priv */ ,
2083             sc->sc_unit /* unit number */ ,
2084             &sc->sc_mtx /* mutex */ ,
2085             1 /* maximum device openings */ ,
2086             0 /* maximum tagged device openings */ ,
2087             devq);
2088
2089         if (sc->sc_sim == NULL) {
2090                 cam_simq_free(devq);
2091                 return (ENOMEM);
2092         }
2093
2094         mtx_lock(&sc->sc_mtx);
2095         status = xpt_bus_register(sc->sc_sim, sc->sc_dev, sc->sc_unit);
2096         if (status != CAM_SUCCESS) {
2097                 cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2098                 mtx_unlock(&sc->sc_mtx);
2099                 printf("%s: xpt_bus_register failed with status %#x\n",
2100                     __func__, status);
2101                 return (ENOMEM);
2102         }
2103         mtx_unlock(&sc->sc_mtx);
2104
2105         return (0);
2106 }
2107
2108 static void
2109 umass_cam_attach(struct umass_softc *sc)
2110 {
2111 #ifndef USB_DEBUG
2112         if (bootverbose)
2113 #endif
2114                 printf("%s:%d:%d: Attached to scbus%d\n",
2115                     sc->sc_name, cam_sim_path(sc->sc_sim),
2116                     sc->sc_unit, cam_sim_path(sc->sc_sim));
2117 }
2118
2119 /* umass_cam_detach
2120  *      detach from the CAM layer
2121  */
2122
2123 static void
2124 umass_cam_detach_sim(struct umass_softc *sc)
2125 {
2126         cam_status status;
2127
2128         if (sc->sc_sim != NULL) {
2129                 status = xpt_bus_deregister(cam_sim_path(sc->sc_sim));
2130                 if (status == CAM_REQ_CMP) {
2131                         /* accessing the softc is not possible after this */
2132                         sc->sc_sim->softc = NULL;
2133                         DPRINTF(sc, UDMASS_SCSI, "%s: %s:%d:%d caling "
2134                             "cam_sim_free sim %p refc %u mtx %p\n",
2135                             __func__, sc->sc_name, cam_sim_path(sc->sc_sim),
2136                             sc->sc_unit, sc->sc_sim,
2137                             sc->sc_sim->refcount, sc->sc_sim->mtx);
2138                         cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2139                 } else {
2140                         panic("%s: %s: CAM layer is busy: %#x\n",
2141                             __func__, sc->sc_name, status);
2142                 }
2143                 sc->sc_sim = NULL;
2144         }
2145 }
2146
2147 /* umass_cam_action
2148  *      CAM requests for action come through here
2149  */
2150
2151 static void
2152 umass_cam_action(struct cam_sim *sim, union ccb *ccb)
2153 {
2154         struct umass_softc *sc = (struct umass_softc *)sim->softc;
2155
2156         if (sc == NULL) {
2157                 ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2158                 xpt_done(ccb);
2159                 return;
2160         }
2161
2162         /* Perform the requested action */
2163         switch (ccb->ccb_h.func_code) {
2164         case XPT_SCSI_IO:
2165                 {
2166                         uint8_t *cmd;
2167                         uint8_t dir;
2168
2169                         if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2170                                 cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2171                         } else {
2172                                 cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2173                         }
2174
2175                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_SCSI_IO: "
2176                             "cmd: 0x%02x, flags: 0x%02x, "
2177                             "%db cmd/%db data/%db sense\n",
2178                             cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2179                             (uintmax_t)ccb->ccb_h.target_lun, cmd[0],
2180                             ccb->ccb_h.flags & CAM_DIR_MASK, ccb->csio.cdb_len,
2181                             ccb->csio.dxfer_len, ccb->csio.sense_len);
2182
2183                         if (sc->sc_transfer.ccb) {
2184                                 DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_SCSI_IO: "
2185                                     "I/O in progress, deferring\n",
2186                                     cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2187                                     (uintmax_t)ccb->ccb_h.target_lun);
2188                                 ccb->ccb_h.status = CAM_SCSI_BUSY;
2189                                 xpt_done(ccb);
2190                                 goto done;
2191                         }
2192                         switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
2193                         case CAM_DIR_IN:
2194                                 dir = DIR_IN;
2195                                 break;
2196                         case CAM_DIR_OUT:
2197                                 dir = DIR_OUT;
2198                                 DIF(UDMASS_SCSI,
2199                                     umass_dump_buffer(sc, ccb->csio.data_ptr,
2200                                     ccb->csio.dxfer_len, 48));
2201                                 break;
2202                         default:
2203                                 dir = DIR_NONE;
2204                         }
2205
2206                         ccb->ccb_h.status = CAM_REQ_INPROG | CAM_SIM_QUEUED;
2207
2208                         /*
2209                          * sc->sc_transform will convert the command to the
2210                          * command format needed by the specific command set
2211                          * and return the converted command in
2212                          * "sc->sc_transfer.cmd_data"
2213                          */
2214                         if (umass_std_transform(sc, ccb, cmd, ccb->csio.cdb_len)) {
2215                                 if (sc->sc_transfer.cmd_data[0] == INQUIRY) {
2216                                         const char *pserial;
2217
2218                                         pserial = usb_get_serial(sc->sc_udev);
2219
2220                                         /*
2221                                          * Umass devices don't generally report their serial numbers
2222                                          * in the usual SCSI way.  Emulate it here.
2223                                          */
2224                                         if ((sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2225                                             (sc->sc_transfer.cmd_data[2] == SVPD_UNIT_SERIAL_NUMBER) &&
2226                                             (pserial[0] != '\0')) {
2227                                                 struct scsi_vpd_unit_serial_number *vpd_serial;
2228
2229                                                 vpd_serial = (struct scsi_vpd_unit_serial_number *)ccb->csio.data_ptr;
2230                                                 vpd_serial->length = strlen(pserial);
2231                                                 if (vpd_serial->length > sizeof(vpd_serial->serial_num))
2232                                                         vpd_serial->length = sizeof(vpd_serial->serial_num);
2233                                                 memcpy(vpd_serial->serial_num, pserial, vpd_serial->length);
2234                                                 ccb->csio.scsi_status = SCSI_STATUS_OK;
2235                                                 ccb->ccb_h.status = CAM_REQ_CMP;
2236                                                 xpt_done(ccb);
2237                                                 goto done;
2238                                         }
2239
2240                                         /*
2241                                          * Handle EVPD inquiry for broken devices first
2242                                          * NO_INQUIRY also implies NO_INQUIRY_EVPD
2243                                          */
2244                                         if ((sc->sc_quirks & (NO_INQUIRY_EVPD | NO_INQUIRY)) &&
2245                                             (sc->sc_transfer.cmd_data[1] & SI_EVPD)) {
2246                                                 scsi_set_sense_data(&ccb->csio.sense_data,
2247                                                         /*sense_format*/ SSD_TYPE_NONE,
2248                                                         /*current_error*/ 1,
2249                                                         /*sense_key*/ SSD_KEY_ILLEGAL_REQUEST,
2250                                                         /*asc*/ 0x24,
2251                                                         /*ascq*/ 0x00,
2252                                                         /*extra args*/ SSD_ELEM_NONE);
2253                                                 ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2254                                                 ccb->ccb_h.status =
2255                                                     CAM_SCSI_STATUS_ERROR |
2256                                                     CAM_AUTOSNS_VALID |
2257                                                     CAM_DEV_QFRZN;
2258                                                 xpt_freeze_devq(ccb->ccb_h.path, 1);
2259                                                 xpt_done(ccb);
2260                                                 goto done;
2261                                         }
2262                                         /*
2263                                          * Return fake inquiry data for
2264                                          * broken devices
2265                                          */
2266                                         if (sc->sc_quirks & NO_INQUIRY) {
2267                                                 memcpy(ccb->csio.data_ptr, &fake_inq_data,
2268                                                     sizeof(fake_inq_data));
2269                                                 ccb->csio.scsi_status = SCSI_STATUS_OK;
2270                                                 ccb->ccb_h.status = CAM_REQ_CMP;
2271                                                 xpt_done(ccb);
2272                                                 goto done;
2273                                         }
2274                                         if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2275                                                 ccb->csio.dxfer_len = SHORT_INQUIRY_LENGTH;
2276                                         }
2277                                 } else if (sc->sc_transfer.cmd_data[0] == PREVENT_ALLOW) {
2278                                         if (sc->sc_quirks & NO_PREVENT_ALLOW) {
2279                                                 ccb->csio.scsi_status = SCSI_STATUS_OK;
2280                                                 ccb->ccb_h.status = CAM_REQ_CMP;
2281                                                 xpt_done(ccb);
2282                                                 goto done;
2283                                         }
2284                                 } else if (sc->sc_transfer.cmd_data[0] == SYNCHRONIZE_CACHE) {
2285                                         if (sc->sc_quirks & NO_SYNCHRONIZE_CACHE) {
2286                                                 ccb->csio.scsi_status = SCSI_STATUS_OK;
2287                                                 ccb->ccb_h.status = CAM_REQ_CMP;
2288                                                 xpt_done(ccb);
2289                                                 goto done;
2290                                         }
2291                                 }
2292                                 umass_command_start(sc, dir, ccb->csio.data_ptr,
2293                                     ccb->csio.dxfer_len,
2294                                     ccb->ccb_h.timeout,
2295                                     &umass_cam_cb, ccb);
2296                         }
2297                         break;
2298                 }
2299         case XPT_PATH_INQ:
2300                 {
2301                         struct ccb_pathinq *cpi = &ccb->cpi;
2302
2303                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_PATH_INQ:.\n",
2304                             sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2305                             (uintmax_t)ccb->ccb_h.target_lun);
2306
2307                         /* host specific information */
2308                         cpi->version_num = 1;
2309                         cpi->hba_inquiry = 0;
2310                         cpi->target_sprt = 0;
2311                         cpi->hba_misc = PIM_NO_6_BYTE;
2312                         cpi->hba_eng_cnt = 0;
2313                         cpi->max_target = UMASS_SCSIID_MAX;     /* one target */
2314                         cpi->initiator_id = UMASS_SCSIID_HOST;
2315                         strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2316                         strlcpy(cpi->hba_vid, "USB SCSI", HBA_IDLEN);
2317                         strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2318                         cpi->unit_number = cam_sim_unit(sim);
2319                         cpi->bus_id = sc->sc_unit;
2320                         cpi->protocol = PROTO_SCSI;
2321                         cpi->protocol_version = SCSI_REV_2;
2322                         cpi->transport = XPORT_USB;
2323                         cpi->transport_version = 0;
2324
2325                         if (sc == NULL) {
2326                                 cpi->base_transfer_speed = 0;
2327                                 cpi->max_lun = 0;
2328                         } else {
2329                                 if (sc->sc_quirks & FLOPPY_SPEED) {
2330                                         cpi->base_transfer_speed =
2331                                             UMASS_FLOPPY_TRANSFER_SPEED;
2332                                 } else {
2333                                         switch (usbd_get_speed(sc->sc_udev)) {
2334                                         case USB_SPEED_SUPER:
2335                                                 cpi->base_transfer_speed =
2336                                                     UMASS_SUPER_TRANSFER_SPEED;
2337                                                 cpi->maxio = MAXPHYS;
2338                                                 break;
2339                                         case USB_SPEED_HIGH:
2340                                                 cpi->base_transfer_speed =
2341                                                     UMASS_HIGH_TRANSFER_SPEED;
2342                                                 break;
2343                                         default:
2344                                                 cpi->base_transfer_speed =
2345                                                     UMASS_FULL_TRANSFER_SPEED;
2346                                                 break;
2347                                         }
2348                                 }
2349                                 cpi->max_lun = sc->sc_maxlun;
2350                         }
2351
2352                         cpi->ccb_h.status = CAM_REQ_CMP;
2353                         xpt_done(ccb);
2354                         break;
2355                 }
2356         case XPT_RESET_DEV:
2357                 {
2358                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_RESET_DEV:.\n",
2359                             cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2360                             (uintmax_t)ccb->ccb_h.target_lun);
2361
2362                         umass_reset(sc);
2363
2364                         ccb->ccb_h.status = CAM_REQ_CMP;
2365                         xpt_done(ccb);
2366                         break;
2367                 }
2368         case XPT_GET_TRAN_SETTINGS:
2369                 {
2370                         struct ccb_trans_settings *cts = &ccb->cts;
2371
2372                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_GET_TRAN_SETTINGS:.\n",
2373                             cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2374                             (uintmax_t)ccb->ccb_h.target_lun);
2375
2376                         cts->protocol = PROTO_SCSI;
2377                         cts->protocol_version = SCSI_REV_2;
2378                         cts->transport = XPORT_USB;
2379                         cts->transport_version = 0;
2380                         cts->xport_specific.valid = 0;
2381
2382                         ccb->ccb_h.status = CAM_REQ_CMP;
2383                         xpt_done(ccb);
2384                         break;
2385                 }
2386         case XPT_SET_TRAN_SETTINGS:
2387                 {
2388                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_SET_TRAN_SETTINGS:.\n",
2389                             cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2390                             (uintmax_t)ccb->ccb_h.target_lun);
2391
2392                         ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2393                         xpt_done(ccb);
2394                         break;
2395                 }
2396         case XPT_CALC_GEOMETRY:
2397                 {
2398                         cam_calc_geometry(&ccb->ccg, /* extended */ 1);
2399                         xpt_done(ccb);
2400                         break;
2401                 }
2402         case XPT_NOOP:
2403                 {
2404                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:XPT_NOOP:.\n",
2405                             sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2406                             (uintmax_t)ccb->ccb_h.target_lun);
2407
2408                         ccb->ccb_h.status = CAM_REQ_CMP;
2409                         xpt_done(ccb);
2410                         break;
2411                 }
2412         default:
2413                 DPRINTF(sc, UDMASS_SCSI, "%d:%d:%jx:func_code 0x%04x: "
2414                     "Not implemented\n",
2415                     sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2416                     (uintmax_t)ccb->ccb_h.target_lun, ccb->ccb_h.func_code);
2417
2418                 ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2419                 xpt_done(ccb);
2420                 break;
2421         }
2422
2423 done:
2424         return;
2425 }
2426
2427 static void
2428 umass_cam_poll(struct cam_sim *sim)
2429 {
2430         struct umass_softc *sc = (struct umass_softc *)sim->softc;
2431
2432         if (sc == NULL)
2433                 return;
2434
2435         DPRINTF(sc, UDMASS_SCSI, "CAM poll\n");
2436
2437         usbd_transfer_poll(sc->sc_xfer, UMASS_T_MAX);
2438 }
2439
2440 /* umass_cam_cb
2441  *      finalise a completed CAM command
2442  */
2443
2444 static void
2445 umass_cam_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2446     uint8_t status)
2447 {
2448         ccb->csio.resid = residue;
2449
2450         switch (status) {
2451         case STATUS_CMD_OK:
2452                 ccb->ccb_h.status = CAM_REQ_CMP;
2453                 if ((sc->sc_quirks & READ_CAPACITY_OFFBY1) &&
2454                     (ccb->ccb_h.func_code == XPT_SCSI_IO) &&
2455                     (ccb->csio.cdb_io.cdb_bytes[0] == READ_CAPACITY)) {
2456                         struct scsi_read_capacity_data *rcap;
2457                         uint32_t maxsector;
2458
2459                         rcap = (void *)(ccb->csio.data_ptr);
2460                         maxsector = scsi_4btoul(rcap->addr) - 1;
2461                         scsi_ulto4b(maxsector, rcap->addr);
2462                 }
2463                 /*
2464                  * We have to add SVPD_UNIT_SERIAL_NUMBER to the list
2465                  * of pages supported by the device - otherwise, CAM
2466                  * will never ask us for the serial number if the
2467                  * device cannot handle that by itself.
2468                  */
2469                 if (ccb->ccb_h.func_code == XPT_SCSI_IO &&
2470                     sc->sc_transfer.cmd_data[0] == INQUIRY &&
2471                     (sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2472                     sc->sc_transfer.cmd_data[2] == SVPD_SUPPORTED_PAGE_LIST &&
2473                     (usb_get_serial(sc->sc_udev)[0] != '\0')) {
2474                         struct ccb_scsiio *csio;
2475                         struct scsi_vpd_supported_page_list *page_list;
2476
2477                         csio = &ccb->csio;
2478                         page_list = (struct scsi_vpd_supported_page_list *)csio->data_ptr;
2479                         if (page_list->length + 1 < SVPD_SUPPORTED_PAGES_SIZE) {
2480                                 page_list->list[page_list->length] = SVPD_UNIT_SERIAL_NUMBER;
2481                                 page_list->length++;
2482                         }
2483                 }
2484                 xpt_done(ccb);
2485                 break;
2486
2487         case STATUS_CMD_UNKNOWN:
2488         case STATUS_CMD_FAILED:
2489
2490                 /* fetch sense data */
2491
2492                 /* the rest of the command was filled in at attach */
2493                 sc->cam_scsi_sense.length = ccb->csio.sense_len;
2494
2495                 DPRINTF(sc, UDMASS_SCSI, "Fetching %d bytes of "
2496                     "sense data\n", ccb->csio.sense_len);
2497
2498                 if (umass_std_transform(sc, ccb, &sc->cam_scsi_sense.opcode,
2499                     sizeof(sc->cam_scsi_sense))) {
2500                         if ((sc->sc_quirks & FORCE_SHORT_INQUIRY) &&
2501                             (sc->sc_transfer.cmd_data[0] == INQUIRY)) {
2502                                 ccb->csio.sense_len = SHORT_INQUIRY_LENGTH;
2503                         }
2504                         umass_command_start(sc, DIR_IN, &ccb->csio.sense_data.error_code,
2505                             ccb->csio.sense_len, ccb->ccb_h.timeout,
2506                             &umass_cam_sense_cb, ccb);
2507                 }
2508                 break;
2509
2510         default:
2511                 /*
2512                  * The wire protocol failed and will hopefully have
2513                  * recovered. We return an error to CAM and let CAM
2514                  * retry the command if necessary.
2515                  */
2516                 xpt_freeze_devq(ccb->ccb_h.path, 1);
2517                 ccb->ccb_h.status = CAM_REQ_CMP_ERR | CAM_DEV_QFRZN;
2518                 xpt_done(ccb);
2519                 break;
2520         }
2521 }
2522
2523 /*
2524  * Finalise a completed autosense operation
2525  */
2526 static void
2527 umass_cam_sense_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2528     uint8_t status)
2529 {
2530         uint8_t *cmd;
2531
2532         switch (status) {
2533         case STATUS_CMD_OK:
2534         case STATUS_CMD_UNKNOWN:
2535         case STATUS_CMD_FAILED: {
2536                 int key, sense_len;
2537
2538                 ccb->csio.sense_resid = residue;
2539                 sense_len = ccb->csio.sense_len - ccb->csio.sense_resid;
2540                 key = scsi_get_sense_key(&ccb->csio.sense_data, sense_len,
2541                                          /*show_errors*/ 1);
2542
2543                 if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2544                         cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2545                 } else {
2546                         cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2547                 }
2548
2549                 /*
2550                  * Getting sense data always succeeds (apart from wire
2551                  * failures):
2552                  */
2553                 if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2554                     (cmd[0] == INQUIRY) &&
2555                     (key == SSD_KEY_UNIT_ATTENTION)) {
2556                         /*
2557                          * Ignore unit attention errors in the case where
2558                          * the Unit Attention state is not cleared on
2559                          * REQUEST SENSE. They will appear again at the next
2560                          * command.
2561                          */
2562                         ccb->ccb_h.status = CAM_REQ_CMP;
2563                 } else if (key == SSD_KEY_NO_SENSE) {
2564                         /*
2565                          * No problem after all (in the case of CBI without
2566                          * CCI)
2567                          */
2568                         ccb->ccb_h.status = CAM_REQ_CMP;
2569                 } else if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2570                             (cmd[0] == READ_CAPACITY) &&
2571                     (key == SSD_KEY_UNIT_ATTENTION)) {
2572                         /*
2573                          * Some devices do not clear the unit attention error
2574                          * on request sense. We insert a test unit ready
2575                          * command to make sure we clear the unit attention
2576                          * condition, then allow the retry to proceed as
2577                          * usual.
2578                          */
2579
2580                         xpt_freeze_devq(ccb->ccb_h.path, 1);
2581                         ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2582                             | CAM_AUTOSNS_VALID | CAM_DEV_QFRZN;
2583                         ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2584
2585 #if 0
2586                         DELAY(300000);
2587 #endif
2588                         DPRINTF(sc, UDMASS_SCSI, "Doing a sneaky"
2589                             "TEST_UNIT_READY\n");
2590
2591                         /* the rest of the command was filled in at attach */
2592
2593                         if ((sc->sc_transform)(sc,
2594                             &sc->cam_scsi_test_unit_ready.opcode,
2595                             sizeof(sc->cam_scsi_test_unit_ready)) == 1) {
2596                                 umass_command_start(sc, DIR_NONE, NULL, 0,
2597                                     ccb->ccb_h.timeout,
2598                                     &umass_cam_quirk_cb, ccb);
2599                                 break;
2600                         }
2601                 } else {
2602                         xpt_freeze_devq(ccb->ccb_h.path, 1);
2603                         if (key >= 0) {
2604                                 ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2605                                     | CAM_AUTOSNS_VALID | CAM_DEV_QFRZN;
2606                                 ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2607                         } else
2608                                 ccb->ccb_h.status = CAM_AUTOSENSE_FAIL
2609                                     | CAM_DEV_QFRZN;
2610                 }
2611                 xpt_done(ccb);
2612                 break;
2613         }
2614         default:
2615                 DPRINTF(sc, UDMASS_SCSI, "Autosense failed, "
2616                     "status %d\n", status);
2617                 xpt_freeze_devq(ccb->ccb_h.path, 1);
2618                 ccb->ccb_h.status = CAM_AUTOSENSE_FAIL | CAM_DEV_QFRZN;
2619                 xpt_done(ccb);
2620         }
2621 }
2622
2623 /*
2624  * This completion code just handles the fact that we sent a test-unit-ready
2625  * after having previously failed a READ CAPACITY with CHECK_COND.  The CCB
2626  * status for CAM is already set earlier.
2627  */
2628 static void
2629 umass_cam_quirk_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2630     uint8_t status)
2631 {
2632         DPRINTF(sc, UDMASS_SCSI, "Test unit ready "
2633             "returned status %d\n", status);
2634
2635         xpt_done(ccb);
2636 }
2637
2638 /*
2639  * SCSI specific functions
2640  */
2641
2642 static uint8_t
2643 umass_scsi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2644     uint8_t cmd_len)
2645 {
2646         if ((cmd_len == 0) ||
2647             (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2648                 DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2649                     "length: %d bytes\n", cmd_len);
2650                 return (0);             /* failure */
2651         }
2652         sc->sc_transfer.cmd_len = cmd_len;
2653
2654         switch (cmd_ptr[0]) {
2655         case TEST_UNIT_READY:
2656                 if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2657                         DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2658                             "to START_UNIT\n");
2659                         memset(sc->sc_transfer.cmd_data, 0, cmd_len);
2660                         sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2661                         sc->sc_transfer.cmd_data[4] = SSS_START;
2662                         return (1);
2663                 }
2664                 break;
2665
2666         case INQUIRY:
2667                 /*
2668                  * some drives wedge when asked for full inquiry
2669                  * information.
2670                  */
2671                 if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2672                         memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2673                         sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2674                         return (1);
2675                 }
2676                 break;
2677         }
2678
2679         memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2680         return (1);
2681 }
2682
2683 static uint8_t
2684 umass_rbc_transform(struct umass_softc *sc, uint8_t *cmd_ptr, uint8_t cmd_len)
2685 {
2686         if ((cmd_len == 0) ||
2687             (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2688                 DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2689                     "length: %d bytes\n", cmd_len);
2690                 return (0);             /* failure */
2691         }
2692         switch (cmd_ptr[0]) {
2693                 /* these commands are defined in RBC: */
2694         case READ_10:
2695         case READ_CAPACITY:
2696         case START_STOP_UNIT:
2697         case SYNCHRONIZE_CACHE:
2698         case WRITE_10:
2699         case VERIFY_10:
2700         case INQUIRY:
2701         case MODE_SELECT_10:
2702         case MODE_SENSE_10:
2703         case TEST_UNIT_READY:
2704         case WRITE_BUFFER:
2705                 /*
2706                  * The following commands are not listed in my copy of the
2707                  * RBC specs. CAM however seems to want those, and at least
2708                  * the Sony DSC device appears to support those as well
2709                  */
2710         case REQUEST_SENSE:
2711         case PREVENT_ALLOW:
2712
2713                 memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2714
2715                 if ((sc->sc_quirks & RBC_PAD_TO_12) && (cmd_len < 12)) {
2716                         memset(sc->sc_transfer.cmd_data + cmd_len,
2717                             0, 12 - cmd_len);
2718                         cmd_len = 12;
2719                 }
2720                 sc->sc_transfer.cmd_len = cmd_len;
2721                 return (1);             /* success */
2722
2723                 /* All other commands are not legal in RBC */
2724         default:
2725                 DPRINTF(sc, UDMASS_SCSI, "Unsupported RBC "
2726                     "command 0x%02x\n", cmd_ptr[0]);
2727                 return (0);             /* failure */
2728         }
2729 }
2730
2731 static uint8_t
2732 umass_ufi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2733     uint8_t cmd_len)
2734 {
2735         if ((cmd_len == 0) ||
2736             (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2737                 DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2738                     "length: %d bytes\n", cmd_len);
2739                 return (0);             /* failure */
2740         }
2741         /* An UFI command is always 12 bytes in length */
2742         sc->sc_transfer.cmd_len = UFI_COMMAND_LENGTH;
2743
2744         /* Zero the command data */
2745         memset(sc->sc_transfer.cmd_data, 0, UFI_COMMAND_LENGTH);
2746
2747         switch (cmd_ptr[0]) {
2748                 /*
2749                  * Commands of which the format has been verified. They
2750                  * should work. Copy the command into the (zeroed out)
2751                  * destination buffer.
2752                  */
2753         case TEST_UNIT_READY:
2754                 if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2755                         /*
2756                          * Some devices do not support this command. Start
2757                          * Stop Unit should give the same results
2758                          */
2759                         DPRINTF(sc, UDMASS_UFI, "Converted TEST_UNIT_READY "
2760                             "to START_UNIT\n");
2761
2762                         sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2763                         sc->sc_transfer.cmd_data[4] = SSS_START;
2764                         return (1);
2765                 }
2766                 break;
2767
2768         case REZERO_UNIT:
2769         case REQUEST_SENSE:
2770         case FORMAT_UNIT:
2771         case INQUIRY:
2772         case START_STOP_UNIT:
2773         case SEND_DIAGNOSTIC:
2774         case PREVENT_ALLOW:
2775         case READ_CAPACITY:
2776         case READ_10:
2777         case WRITE_10:
2778         case POSITION_TO_ELEMENT:       /* SEEK_10 */
2779         case WRITE_AND_VERIFY:
2780         case VERIFY:
2781         case MODE_SELECT_10:
2782         case MODE_SENSE_10:
2783         case READ_12:
2784         case WRITE_12:
2785         case READ_FORMAT_CAPACITIES:
2786                 break;
2787
2788                 /*
2789                  * SYNCHRONIZE_CACHE isn't supported by UFI, nor should it be
2790                  * required for UFI devices, so it is appropriate to fake
2791                  * success.
2792                  */
2793         case SYNCHRONIZE_CACHE:
2794                 return (2);
2795
2796         default:
2797                 DPRINTF(sc, UDMASS_SCSI, "Unsupported UFI "
2798                     "command 0x%02x\n", cmd_ptr[0]);
2799                 return (0);             /* failure */
2800         }
2801
2802         memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2803         return (1);                     /* success */
2804 }
2805
2806 /*
2807  * 8070i (ATAPI) specific functions
2808  */
2809 static uint8_t
2810 umass_atapi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2811     uint8_t cmd_len)
2812 {
2813         if ((cmd_len == 0) ||
2814             (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2815                 DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2816                     "length: %d bytes\n", cmd_len);
2817                 return (0);             /* failure */
2818         }
2819         /* An ATAPI command is always 12 bytes in length. */
2820         sc->sc_transfer.cmd_len = ATAPI_COMMAND_LENGTH;
2821
2822         /* Zero the command data */
2823         memset(sc->sc_transfer.cmd_data, 0, ATAPI_COMMAND_LENGTH);
2824
2825         switch (cmd_ptr[0]) {
2826                 /*
2827                  * Commands of which the format has been verified. They
2828                  * should work. Copy the command into the destination
2829                  * buffer.
2830                  */
2831         case INQUIRY:
2832                 /*
2833                  * some drives wedge when asked for full inquiry
2834                  * information.
2835                  */
2836                 if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2837                         memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2838
2839                         sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2840                         return (1);
2841                 }
2842                 break;
2843
2844         case TEST_UNIT_READY:
2845                 if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2846                         DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2847                             "to START_UNIT\n");
2848                         sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2849                         sc->sc_transfer.cmd_data[4] = SSS_START;
2850                         return (1);
2851                 }
2852                 break;
2853
2854         case REZERO_UNIT:
2855         case REQUEST_SENSE:
2856         case START_STOP_UNIT:
2857         case SEND_DIAGNOSTIC:
2858         case PREVENT_ALLOW:
2859         case READ_CAPACITY:
2860         case READ_10:
2861         case WRITE_10:
2862         case POSITION_TO_ELEMENT:       /* SEEK_10 */
2863         case SYNCHRONIZE_CACHE:
2864         case MODE_SELECT_10:
2865         case MODE_SENSE_10:
2866         case READ_BUFFER:
2867         case 0x42:                      /* READ_SUBCHANNEL */
2868         case 0x43:                      /* READ_TOC */
2869         case 0x44:                      /* READ_HEADER */
2870         case 0x47:                      /* PLAY_MSF (Play Minute/Second/Frame) */
2871         case 0x48:                      /* PLAY_TRACK */
2872         case 0x49:                      /* PLAY_TRACK_REL */
2873         case 0x4b:                      /* PAUSE */
2874         case 0x51:                      /* READ_DISK_INFO */
2875         case 0x52:                      /* READ_TRACK_INFO */
2876         case 0x54:                      /* SEND_OPC */
2877         case 0x59:                      /* READ_MASTER_CUE */
2878         case 0x5b:                      /* CLOSE_TR_SESSION */
2879         case 0x5c:                      /* READ_BUFFER_CAP */
2880         case 0x5d:                      /* SEND_CUE_SHEET */
2881         case 0xa1:                      /* BLANK */
2882         case 0xa5:                      /* PLAY_12 */
2883         case 0xa6:                      /* EXCHANGE_MEDIUM */
2884         case 0xad:                      /* READ_DVD_STRUCTURE */
2885         case 0xbb:                      /* SET_CD_SPEED */
2886         case 0xe5:                      /* READ_TRACK_INFO_PHILIPS */
2887                 break;
2888
2889         case READ_12:
2890         case WRITE_12:
2891         default:
2892                 DPRINTF(sc, UDMASS_SCSI, "Unsupported ATAPI "
2893                     "command 0x%02x - trying anyway\n",
2894                     cmd_ptr[0]);
2895                 break;
2896         }
2897
2898         memcpy(sc->sc_transfer.cmd_data, cmd_ptr, cmd_len);
2899         return (1);                     /* success */
2900 }
2901
2902 static uint8_t
2903 umass_no_transform(struct umass_softc *sc, uint8_t *cmd,
2904     uint8_t cmdlen)
2905 {
2906         return (0);                     /* failure */
2907 }
2908
2909 static uint8_t
2910 umass_std_transform(struct umass_softc *sc, union ccb *ccb,
2911     uint8_t *cmd, uint8_t cmdlen)
2912 {
2913         uint8_t retval;
2914
2915         retval = (sc->sc_transform) (sc, cmd, cmdlen);
2916
2917         if (retval == 2) {
2918                 ccb->ccb_h.status = CAM_REQ_CMP;
2919                 xpt_done(ccb);
2920                 return (0);
2921         } else if (retval == 0) {
2922                 xpt_freeze_devq(ccb->ccb_h.path, 1);
2923                 ccb->ccb_h.status = CAM_REQ_INVALID | CAM_DEV_QFRZN;
2924                 xpt_done(ccb);
2925                 return (0);
2926         }
2927         /* Command should be executed */
2928         return (1);
2929 }
2930
2931 #ifdef USB_DEBUG
2932 static void
2933 umass_bbb_dump_cbw(struct umass_softc *sc, umass_bbb_cbw_t *cbw)
2934 {
2935         uint8_t *c = cbw->CBWCDB;
2936
2937         uint32_t dlen = UGETDW(cbw->dCBWDataTransferLength);
2938         uint32_t tag = UGETDW(cbw->dCBWTag);
2939
2940         uint8_t clen = cbw->bCDBLength;
2941         uint8_t flags = cbw->bCBWFlags;
2942         uint8_t lun = cbw->bCBWLUN;
2943
2944         DPRINTF(sc, UDMASS_BBB, "CBW %d: cmd = %db "
2945             "(0x%02x%02x%02x%02x%02x%02x%s), "
2946             "data = %db, lun = %d, dir = %s\n",
2947             tag, clen,
2948             c[0], c[1], c[2], c[3], c[4], c[5], (clen > 6 ? "..." : ""),
2949             dlen, lun, (flags == CBWFLAGS_IN ? "in" :
2950             (flags == CBWFLAGS_OUT ? "out" : "<invalid>")));
2951 }
2952
2953 static void
2954 umass_bbb_dump_csw(struct umass_softc *sc, umass_bbb_csw_t *csw)
2955 {
2956         uint32_t sig = UGETDW(csw->dCSWSignature);
2957         uint32_t tag = UGETDW(csw->dCSWTag);
2958         uint32_t res = UGETDW(csw->dCSWDataResidue);
2959         uint8_t status = csw->bCSWStatus;
2960
2961         DPRINTF(sc, UDMASS_BBB, "CSW %d: sig = 0x%08x (%s), tag = 0x%08x, "
2962             "res = %d, status = 0x%02x (%s)\n",
2963             tag, sig, (sig == CSWSIGNATURE ? "valid" : "invalid"),
2964             tag, res,
2965             status, (status == CSWSTATUS_GOOD ? "good" :
2966             (status == CSWSTATUS_FAILED ? "failed" :
2967             (status == CSWSTATUS_PHASE ? "phase" : "<invalid>"))));
2968 }
2969
2970 static void
2971 umass_cbi_dump_cmd(struct umass_softc *sc, void *cmd, uint8_t cmdlen)
2972 {
2973         uint8_t *c = cmd;
2974         uint8_t dir = sc->sc_transfer.dir;
2975
2976         DPRINTF(sc, UDMASS_BBB, "cmd = %db "
2977             "(0x%02x%02x%02x%02x%02x%02x%s), "
2978             "data = %db, dir = %s\n",
2979             cmdlen,
2980             c[0], c[1], c[2], c[3], c[4], c[5], (cmdlen > 6 ? "..." : ""),
2981             sc->sc_transfer.data_len,
2982             (dir == DIR_IN ? "in" :
2983             (dir == DIR_OUT ? "out" :
2984             (dir == DIR_NONE ? "no data phase" : "<invalid>"))));
2985 }
2986
2987 static void
2988 umass_dump_buffer(struct umass_softc *sc, uint8_t *buffer, uint32_t buflen,
2989     uint32_t printlen)
2990 {
2991         uint32_t i, j;
2992         char s1[40];
2993         char s2[40];
2994         char s3[5];
2995
2996         s1[0] = '\0';
2997         s3[0] = '\0';
2998
2999         sprintf(s2, " buffer=%p, buflen=%d", buffer, buflen);
3000         for (i = 0; (i < buflen) && (i < printlen); i++) {
3001                 j = i % 16;
3002                 if (j == 0 && i != 0) {
3003                         DPRINTF(sc, UDMASS_GEN, "0x %s%s\n",
3004                             s1, s2);
3005                         s2[0] = '\0';
3006                 }
3007                 sprintf(&s1[j * 2], "%02x", buffer[i] & 0xff);
3008         }
3009         if (buflen > printlen)
3010                 sprintf(s3, " ...");
3011         DPRINTF(sc, UDMASS_GEN, "0x %s%s%s\n",
3012             s1, s2, s3);
3013 }
3014
3015 #endif