sys/dev/usb/storage/umass.c

   1 #include <sys/cdefs.h>
   2 __FBSDID("$FreeBSD$");
   3
   4 /*-
   5  * Copyright (c) 1999 MAEKAWA Masahide <bishop@rr.iij4u.or.jp>,
   6  *                    Nick Hibma <n_hibma@FreeBSD.org>
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  28  * SUCH DAMAGE.
  29  *
  30  *      $FreeBSD$
  31  *      $NetBSD: umass.c,v 1.28 2000/04/02 23:46:53 augustss Exp $
  32  */
  33
  34 /* Also already merged from NetBSD:
  35  *      $NetBSD: umass.c,v 1.67 2001/11/25 19:05:22 augustss Exp $
  36  *      $NetBSD: umass.c,v 1.90 2002/11/04 19:17:33 pooka Exp $
  37  *      $NetBSD: umass.c,v 1.108 2003/11/07 17:03:25 wiz Exp $
  38  *      $NetBSD: umass.c,v 1.109 2003/12/04 13:57:31 keihan Exp $
  39  */
  40
  41 /*
  42  * Universal Serial Bus Mass Storage Class specs:
  43  * http://www.usb.org/developers/devclass_docs/usb_msc_overview_1.2.pdf
  44  * http://www.usb.org/developers/devclass_docs/usbmassbulk_10.pdf
  45  * http://www.usb.org/developers/devclass_docs/usb_msc_cbi_1.1.pdf
  46  * http://www.usb.org/developers/devclass_docs/usbmass-ufi10.pdf
  47  */
  48
  49 /*
  50  * Ported to NetBSD by Lennart Augustsson <augustss@NetBSD.org>.
  51  * Parts of the code written by Jason R. Thorpe <thorpej@shagadelic.org>.
  52  */
  53
  54 /*
  55  * The driver handles 3 Wire Protocols
  56  * - Command/Bulk/Interrupt (CBI)
  57  * - Command/Bulk/Interrupt with Command Completion Interrupt (CBI with CCI)
  58  * - Mass Storage Bulk-Only (BBB)
  59  *   (BBB refers Bulk/Bulk/Bulk for Command/Data/Status phases)
  60  *
  61  * Over these wire protocols it handles the following command protocols
  62  * - SCSI
  63  * - UFI (floppy command set)
  64  * - 8070i (ATAPI)
  65  *
  66  * UFI and 8070i (ATAPI) are transformed versions of the SCSI command set. The
  67  * sc->sc_transform method is used to convert the commands into the appropriate
  68  * format (if at all necessary). For example, UFI requires all commands to be
  69  * 12 bytes in length amongst other things.
  70  *
  71  * The source code below is marked and can be split into a number of pieces
  72  * (in this order):
  73  *
  74  * - probe/attach/detach
  75  * - generic transfer routines
  76  * - BBB
  77  * - CBI
  78  * - CBI_I (in addition to functions from CBI)
  79  * - CAM (Common Access Method)
  80  * - SCSI
  81  * - UFI
  82  * - 8070i (ATAPI)
  83  *
  84  * The protocols are implemented using a state machine, for the transfers as
  85  * well as for the resets. The state machine is contained in umass_t_*_callback.
  86  * The state machine is started through either umass_command_start() or
  87  * umass_reset().
  88  *
  89  * The reason for doing this is a) CAM performs a lot better this way and b) it
  90  * avoids using tsleep from interrupt context (for example after a failed
  91  * transfer).
  92  */
  93
  94 /*
  95  * The SCSI related part of this driver has been derived from the
  96  * dev/ppbus/vpo.c driver, by Nicolas Souchu (nsouch@FreeBSD.org).
  97  *
  98  * The CAM layer uses so called actions which are messages sent to the host
  99  * adapter for completion. The actions come in through umass_cam_action. The
 100  * appropriate block of routines is called depending on the transport protocol
 101  * in use. When the transfer has finished, these routines call
 102  * umass_cam_cb again to complete the CAM command.
 103  */
 104
 105 #include <sys/stdint.h>
 106 #include <sys/stddef.h>
 107 #include <sys/param.h>
 108 #include <sys/queue.h>
 109 #include <sys/types.h>
 110 #include <sys/systm.h>
 111 #include <sys/kernel.h>
 112 #include <sys/bus.h>
 113 #include <sys/linker_set.h>
 114 #include <sys/module.h>
 115 #include <sys/lock.h>
 116 #include <sys/mutex.h>
 117 #include <sys/condvar.h>
 118 #include <sys/sysctl.h>
 119 #include <sys/sx.h>
 120 #include <sys/unistd.h>
 121 #include <sys/callout.h>
 122 #include <sys/malloc.h>
 123 #include <sys/priv.h>
 124
 125 #include <dev/usb/usb.h>
 126 #include <dev/usb/usbdi.h>
 127 #include <dev/usb/usb_device.h>
 128 #include "usbdevs.h"
 129
 130 #include <dev/usb/quirk/usb_quirk.h>
 131
 132 #include <cam/cam.h>
 133 #include <cam/cam_ccb.h>
 134 #include <cam/cam_sim.h>
 135 #include <cam/cam_xpt_sim.h>
 136 #include <cam/scsi/scsi_all.h>
 137 #include <cam/scsi/scsi_da.h>
 138
 139 #include <cam/cam_periph.h>
 140
 141 #define UMASS_EXT_BUFFER
 142 #ifdef UMASS_EXT_BUFFER
 143 /* this enables loading of virtual buffers into DMA */
 144 #define UMASS_USB_FLAGS .ext_buffer=1,
 145 #else
 146 #define UMASS_USB_FLAGS
 147 #endif
 148
 149 #ifdef USB_DEBUG
 150 #define DIF(m, x)                               \
 151   do {                                          \
 152     if (umass_debug & (m)) { x ; }              \
 153   } while (0)
 154
 155 #define DPRINTF(sc, m, fmt, ...)                        \
 156   do {                                                  \
 157     if (umass_debug & (m)) {                            \
 158         printf("%s:%s: " fmt,                           \
 159                (sc) ? (const char *)(sc)->sc_name :     \
 160                (const char *)"umassX",                  \
 161                 __FUNCTION__ ,## __VA_ARGS__);          \
 162     }                                                   \
 163   } while (0)
 164
 165 #define UDMASS_GEN      0x00010000      /* general */
 166 #define UDMASS_SCSI     0x00020000      /* scsi */
 167 #define UDMASS_UFI      0x00040000      /* ufi command set */
 168 #define UDMASS_ATAPI    0x00080000      /* 8070i command set */
 169 #define UDMASS_CMD      (UDMASS_SCSI|UDMASS_UFI|UDMASS_ATAPI)
 170 #define UDMASS_USB      0x00100000      /* USB general */
 171 #define UDMASS_BBB      0x00200000      /* Bulk-Only transfers */
 172 #define UDMASS_CBI      0x00400000      /* CBI transfers */
 173 #define UDMASS_WIRE     (UDMASS_BBB|UDMASS_CBI)
 174 #define UDMASS_ALL      0xffff0000      /* all of the above */
 175 static int umass_debug = 0;
 176
 177 SYSCTL_NODE(_hw_usb, OID_AUTO, umass, CTLFLAG_RW, 0, "USB umass");
 178 SYSCTL_INT(_hw_usb_umass, OID_AUTO, debug, CTLFLAG_RW,
 179     &umass_debug, 0, "umass debug level");
 180
 181 TUNABLE_INT("hw.usb.umass.debug", &umass_debug);
 182 #else
 183 #define DIF(...) do { } while (0)
 184 #define DPRINTF(...) do { } while (0)
 185 #endif
 186
 187 #define UMASS_GONE ((struct umass_softc *)1)
 188
 189 #define UMASS_BULK_SIZE (1 << 17)
 190 #define UMASS_CBI_DIAGNOSTIC_CMDLEN 12  /* bytes */
 191 #define UMASS_MAX_CMDLEN MAX(12, CAM_MAX_CDBLEN)        /* bytes */
 192
 193 /* USB transfer definitions */
 194
 195 #define UMASS_T_BBB_RESET1      0       /* Bulk-Only */
 196 #define UMASS_T_BBB_RESET2      1
 197 #define UMASS_T_BBB_RESET3      2
 198 #define UMASS_T_BBB_COMMAND     3
 199 #define UMASS_T_BBB_DATA_READ   4
 200 #define UMASS_T_BBB_DATA_RD_CS  5
 201 #define UMASS_T_BBB_DATA_WRITE  6
 202 #define UMASS_T_BBB_DATA_WR_CS  7
 203 #define UMASS_T_BBB_STATUS      8
 204 #define UMASS_T_BBB_MAX         9
 205
 206 #define UMASS_T_CBI_RESET1      0       /* CBI */
 207 #define UMASS_T_CBI_RESET2      1
 208 #define UMASS_T_CBI_RESET3      2
 209 #define UMASS_T_CBI_COMMAND     3
 210 #define UMASS_T_CBI_DATA_READ   4
 211 #define UMASS_T_CBI_DATA_RD_CS  5
 212 #define UMASS_T_CBI_DATA_WRITE  6
 213 #define UMASS_T_CBI_DATA_WR_CS  7
 214 #define UMASS_T_CBI_STATUS      8
 215 #define UMASS_T_CBI_RESET4      9
 216 #define UMASS_T_CBI_MAX        10
 217
 218 #define UMASS_T_MAX MAX(UMASS_T_CBI_MAX, UMASS_T_BBB_MAX)
 219
 220 /* Generic definitions */
 221
 222 /* Direction for transfer */
 223 #define DIR_NONE        0
 224 #define DIR_IN          1
 225 #define DIR_OUT         2
 226
 227 /* device name */
 228 #define DEVNAME         "umass"
 229 #define DEVNAME_SIM     "umass-sim"
 230
 231 /* Approximate maximum transfer speeds (assumes 33% overhead). */
 232 #define UMASS_FULL_TRANSFER_SPEED       1000
 233 #define UMASS_HIGH_TRANSFER_SPEED       40000
 234 #define UMASS_FLOPPY_TRANSFER_SPEED     20
 235
 236 #define UMASS_TIMEOUT                   5000    /* ms */
 237
 238 /* CAM specific definitions */
 239
 240 #define UMASS_SCSIID_MAX        1       /* maximum number of drives expected */
 241 #define UMASS_SCSIID_HOST       UMASS_SCSIID_MAX
 242
 243 /* Bulk-Only features */
 244
 245 #define UR_BBB_RESET            0xff    /* Bulk-Only reset */
 246 #define UR_BBB_GET_MAX_LUN      0xfe    /* Get maximum lun */
 247
 248 /* Command Block Wrapper */
 249 typedef struct {
 250         uDWord  dCBWSignature;
 251 #define CBWSIGNATURE    0x43425355
 252         uDWord  dCBWTag;
 253         uDWord  dCBWDataTransferLength;
 254         uByte   bCBWFlags;
 255 #define CBWFLAGS_OUT    0x00
 256 #define CBWFLAGS_IN     0x80
 257         uByte   bCBWLUN;
 258         uByte   bCDBLength;
 259 #define CBWCDBLENGTH    16
 260         uByte   CBWCDB[CBWCDBLENGTH];
 261 } __packed umass_bbb_cbw_t;
 262
 263 #define UMASS_BBB_CBW_SIZE      31
 264
 265 /* Command Status Wrapper */
 266 typedef struct {
 267         uDWord  dCSWSignature;
 268 #define CSWSIGNATURE    0x53425355
 269 #define CSWSIGNATURE_IMAGINATION_DBX1   0x43425355
 270 #define CSWSIGNATURE_OLYMPUS_C1 0x55425355
 271         uDWord  dCSWTag;
 272         uDWord  dCSWDataResidue;
 273         uByte   bCSWStatus;
 274 #define CSWSTATUS_GOOD  0x0
 275 #define CSWSTATUS_FAILED        0x1
 276 #define CSWSTATUS_PHASE 0x2
 277 } __packed umass_bbb_csw_t;
 278
 279 #define UMASS_BBB_CSW_SIZE      13
 280
 281 /* CBI features */
 282
 283 #define UR_CBI_ADSC     0x00
 284
 285 typedef union {
 286         struct {
 287                 uint8_t type;
 288 #define IDB_TYPE_CCI            0x00
 289                 uint8_t value;
 290 #define IDB_VALUE_PASS          0x00
 291 #define IDB_VALUE_FAIL          0x01
 292 #define IDB_VALUE_PHASE         0x02
 293 #define IDB_VALUE_PERSISTENT    0x03
 294 #define IDB_VALUE_STATUS_MASK   0x03
 295         } __packed common;
 296
 297         struct {
 298                 uint8_t asc;
 299                 uint8_t ascq;
 300         } __packed ufi;
 301 } __packed umass_cbi_sbl_t;
 302
 303 struct umass_softc;                     /* see below */
 304
 305 typedef void (umass_callback_t)(struct umass_softc *sc, union ccb *ccb,
 306         uint32_t residue, uint8_t status);
 307
 308 #define STATUS_CMD_OK           0       /* everything ok */
 309 #define STATUS_CMD_UNKNOWN      1       /* will have to fetch sense */
 310 #define STATUS_CMD_FAILED       2       /* transfer was ok, command failed */
 311 #define STATUS_WIRE_FAILED      3       /* couldn't even get command across */
 312
 313 typedef uint8_t (umass_transform_t)(struct umass_softc *sc, uint8_t *cmd_ptr,
 314         uint8_t cmd_len);
 315
 316 /* Wire and command protocol */
 317 #define UMASS_PROTO_BBB         0x0001  /* USB wire protocol */
 318 #define UMASS_PROTO_CBI         0x0002
 319 #define UMASS_PROTO_CBI_I       0x0004
 320 #define UMASS_PROTO_WIRE        0x00ff  /* USB wire protocol mask */
 321 #define UMASS_PROTO_SCSI        0x0100  /* command protocol */
 322 #define UMASS_PROTO_ATAPI       0x0200
 323 #define UMASS_PROTO_UFI         0x0400
 324 #define UMASS_PROTO_RBC         0x0800
 325 #define UMASS_PROTO_COMMAND     0xff00  /* command protocol mask */
 326
 327 /* Device specific quirks */
 328 #define NO_QUIRKS               0x0000
 329         /*
 330          * The drive does not support Test Unit Ready. Convert to Start Unit
 331          */
 332 #define NO_TEST_UNIT_READY      0x0001
 333         /*
 334          * The drive does not reset the Unit Attention state after REQUEST
 335          * SENSE has been sent. The INQUIRY command does not reset the UA
 336          * either, and so CAM runs in circles trying to retrieve the initial
 337          * INQUIRY data.
 338          */
 339 #define RS_NO_CLEAR_UA          0x0002
 340         /* The drive does not support START STOP.  */
 341 #define NO_START_STOP           0x0004
 342         /* Don't ask for full inquiry data (255b).  */
 343 #define FORCE_SHORT_INQUIRY     0x0008
 344         /* Needs to be initialised the Shuttle way */
 345 #define SHUTTLE_INIT            0x0010
 346         /* Drive needs to be switched to alternate iface 1 */
 347 #define ALT_IFACE_1             0x0020
 348         /* Drive does not do 1Mb/s, but just floppy speeds (20kb/s) */
 349 #define FLOPPY_SPEED            0x0040
 350         /* The device can't count and gets the residue of transfers wrong */
 351 #define IGNORE_RESIDUE          0x0080
 352         /* No GetMaxLun call */
 353 #define NO_GETMAXLUN            0x0100
 354         /* The device uses a weird CSWSIGNATURE. */
 355 #define WRONG_CSWSIG            0x0200
 356         /* Device cannot handle INQUIRY so fake a generic response */
 357 #define NO_INQUIRY              0x0400
 358         /* Device cannot handle INQUIRY EVPD, return CHECK CONDITION */
 359 #define NO_INQUIRY_EVPD         0x0800
 360         /* Pad all RBC requests to 12 bytes. */
 361 #define RBC_PAD_TO_12           0x1000
 362         /*
 363          * Device reports number of sectors from READ_CAPACITY, not max
 364          * sector number.
 365          */
 366 #define READ_CAPACITY_OFFBY1    0x2000
 367         /*
 368          * Device cannot handle a SCSI synchronize cache command.  Normally
 369          * this quirk would be handled in the cam layer, but for IDE bridges
 370          * we need to associate the quirk with the bridge and not the
 371          * underlying disk device.  This is handled by faking a success
 372          * result.
 373          */
 374 #define NO_SYNCHRONIZE_CACHE    0x4000
 375
 376 struct umass_softc {
 377
 378         struct scsi_sense cam_scsi_sense;
 379         struct scsi_test_unit_ready cam_scsi_test_unit_ready;
 380         struct mtx sc_mtx;
 381         struct {
 382                 uint8_t *data_ptr;
 383                 union ccb *ccb;
 384                 umass_callback_t *callback;
 385
 386                 uint32_t data_len;      /* bytes */
 387                 uint32_t data_rem;      /* bytes */
 388                 uint32_t data_timeout;  /* ms */
 389                 uint32_t actlen;        /* bytes */
 390
 391                 uint8_t cmd_data[UMASS_MAX_CMDLEN];
 392                 uint8_t cmd_len;        /* bytes */
 393                 uint8_t dir;
 394                 uint8_t lun;
 395         }       sc_transfer;
 396
 397         /* Bulk specific variables for transfers in progress */
 398         umass_bbb_cbw_t cbw;            /* command block wrapper */
 399         umass_bbb_csw_t csw;            /* command status wrapper */
 400
 401         /* CBI specific variables for transfers in progress */
 402         umass_cbi_sbl_t sbl;            /* status block */
 403
 404         device_t sc_dev;
 405         struct usb_device *sc_udev;
 406         struct cam_sim *sc_sim;         /* SCSI Interface Module */
 407         struct usb_xfer *sc_xfer[UMASS_T_MAX];
 408
 409         /*
 410          * The command transform function is used to convert the SCSI
 411          * commands into their derivatives, like UFI, ATAPI, and friends.
 412          */
 413         umass_transform_t *sc_transform;
 414
 415         uint32_t sc_unit;
 416         uint32_t sc_quirks;             /* they got it almost right */
 417         uint32_t sc_proto;              /* wire and cmd protocol */
 418
 419         uint8_t sc_name[16];
 420         uint8_t sc_iface_no;            /* interface number */
 421         uint8_t sc_maxlun;              /* maximum LUN number, inclusive */
 422         uint8_t sc_last_xfer_index;
 423         uint8_t sc_status_try;
 424 };
 425
 426 struct umass_probe_proto {
 427         uint32_t quirks;
 428         uint32_t proto;
 429
 430         int     error;
 431 };
 432
 433 /* prototypes */
 434
 435 static device_probe_t umass_probe;
 436 static device_attach_t umass_attach;
 437 static device_detach_t umass_detach;
 438
 439 static usb_callback_t umass_tr_error;
 440 static usb_callback_t umass_t_bbb_reset1_callback;
 441 static usb_callback_t umass_t_bbb_reset2_callback;
 442 static usb_callback_t umass_t_bbb_reset3_callback;
 443 static usb_callback_t umass_t_bbb_command_callback;
 444 static usb_callback_t umass_t_bbb_data_read_callback;
 445 static usb_callback_t umass_t_bbb_data_rd_cs_callback;
 446 static usb_callback_t umass_t_bbb_data_write_callback;
 447 static usb_callback_t umass_t_bbb_data_wr_cs_callback;
 448 static usb_callback_t umass_t_bbb_status_callback;
 449 static usb_callback_t umass_t_cbi_reset1_callback;
 450 static usb_callback_t umass_t_cbi_reset2_callback;
 451 static usb_callback_t umass_t_cbi_reset3_callback;
 452 static usb_callback_t umass_t_cbi_reset4_callback;
 453 static usb_callback_t umass_t_cbi_command_callback;
 454 static usb_callback_t umass_t_cbi_data_read_callback;
 455 static usb_callback_t umass_t_cbi_data_rd_cs_callback;
 456 static usb_callback_t umass_t_cbi_data_write_callback;
 457 static usb_callback_t umass_t_cbi_data_wr_cs_callback;
 458 static usb_callback_t umass_t_cbi_status_callback;
 459
 460 static void     umass_cancel_ccb(struct umass_softc *);
 461 static void     umass_init_shuttle(struct umass_softc *);
 462 static void     umass_reset(struct umass_softc *);
 463 static void     umass_t_bbb_data_clear_stall_callback(struct usb_xfer *,
 464                     uint8_t, uint8_t, usb_error_t);
 465 static void     umass_command_start(struct umass_softc *, uint8_t, void *,
 466                     uint32_t, uint32_t, umass_callback_t *, union ccb *);
 467 static uint8_t  umass_bbb_get_max_lun(struct umass_softc *);
 468 static void     umass_cbi_start_status(struct umass_softc *);
 469 static void     umass_t_cbi_data_clear_stall_callback(struct usb_xfer *,
 470                     uint8_t, uint8_t, usb_error_t);
 471 static int      umass_cam_attach_sim(struct umass_softc *);
 472 static void     umass_cam_attach(struct umass_softc *);
 473 static void     umass_cam_detach_sim(struct umass_softc *);
 474 static void     umass_cam_action(struct cam_sim *, union ccb *);
 475 static void     umass_cam_poll(struct cam_sim *);
 476 static void     umass_cam_cb(struct umass_softc *, union ccb *, uint32_t,
 477                     uint8_t);
 478 static void     umass_cam_sense_cb(struct umass_softc *, union ccb *, uint32_t,
 479                     uint8_t);
 480 static void     umass_cam_quirk_cb(struct umass_softc *, union ccb *, uint32_t,
 481                     uint8_t);
 482 static uint8_t  umass_scsi_transform(struct umass_softc *, uint8_t *, uint8_t);
 483 static uint8_t  umass_rbc_transform(struct umass_softc *, uint8_t *, uint8_t);
 484 static uint8_t  umass_ufi_transform(struct umass_softc *, uint8_t *, uint8_t);
 485 static uint8_t  umass_atapi_transform(struct umass_softc *, uint8_t *,
 486                     uint8_t);
 487 static uint8_t  umass_no_transform(struct umass_softc *, uint8_t *, uint8_t);
 488 static uint8_t  umass_std_transform(struct umass_softc *, union ccb *, uint8_t
 489                     *, uint8_t);
 490
 491 #ifdef USB_DEBUG
 492 static void     umass_bbb_dump_cbw(struct umass_softc *, umass_bbb_cbw_t *);
 493 static void     umass_bbb_dump_csw(struct umass_softc *, umass_bbb_csw_t *);
 494 static void     umass_cbi_dump_cmd(struct umass_softc *, void *, uint8_t);
 495 static void     umass_dump_buffer(struct umass_softc *, uint8_t *, uint32_t,
 496                     uint32_t);
 497 #endif
 498
 499 static struct usb_config umass_bbb_config[UMASS_T_BBB_MAX] = {
 500
 501         [UMASS_T_BBB_RESET1] = {
 502                 .type = UE_CONTROL,
 503                 .endpoint = 0x00,       /* Control pipe */
 504                 .direction = UE_DIR_ANY,
 505                 .bufsize = sizeof(struct usb_device_request),
 506                 .callback = &umass_t_bbb_reset1_callback,
 507                 .timeout = 5000,        /* 5 seconds */
 508                 .interval = 500,        /* 500 milliseconds */
 509         },
 510
 511         [UMASS_T_BBB_RESET2] = {
 512                 .type = UE_CONTROL,
 513                 .endpoint = 0x00,       /* Control pipe */
 514                 .direction = UE_DIR_ANY,
 515                 .bufsize = sizeof(struct usb_device_request),
 516                 .callback = &umass_t_bbb_reset2_callback,
 517                 .timeout = 5000,        /* 5 seconds */
 518                 .interval = 50, /* 50 milliseconds */
 519         },
 520
 521         [UMASS_T_BBB_RESET3] = {
 522                 .type = UE_CONTROL,
 523                 .endpoint = 0x00,       /* Control pipe */
 524                 .direction = UE_DIR_ANY,
 525                 .bufsize = sizeof(struct usb_device_request),
 526                 .callback = &umass_t_bbb_reset3_callback,
 527                 .timeout = 5000,        /* 5 seconds */
 528                 .interval = 50, /* 50 milliseconds */
 529         },
 530
 531         [UMASS_T_BBB_COMMAND] = {
 532                 .type = UE_BULK,
 533                 .endpoint = UE_ADDR_ANY,
 534                 .direction = UE_DIR_OUT,
 535                 .bufsize = sizeof(umass_bbb_cbw_t),
 536                 .callback = &umass_t_bbb_command_callback,
 537                 .timeout = 5000,        /* 5 seconds */
 538         },
 539
 540         [UMASS_T_BBB_DATA_READ] = {
 541                 .type = UE_BULK,
 542                 .endpoint = UE_ADDR_ANY,
 543                 .direction = UE_DIR_IN,
 544                 .bufsize = UMASS_BULK_SIZE,
 545                 .flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
 546                 .callback = &umass_t_bbb_data_read_callback,
 547                 .timeout = 0,   /* overwritten later */
 548         },
 549
 550         [UMASS_T_BBB_DATA_RD_CS] = {
 551                 .type = UE_CONTROL,
 552                 .endpoint = 0x00,       /* Control pipe */
 553                 .direction = UE_DIR_ANY,
 554                 .bufsize = sizeof(struct usb_device_request),
 555                 .callback = &umass_t_bbb_data_rd_cs_callback,
 556                 .timeout = 5000,        /* 5 seconds */
 557         },
 558
 559         [UMASS_T_BBB_DATA_WRITE] = {
 560                 .type = UE_BULK,
 561                 .endpoint = UE_ADDR_ANY,
 562                 .direction = UE_DIR_OUT,
 563                 .bufsize = UMASS_BULK_SIZE,
 564                 .flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
 565                 .callback = &umass_t_bbb_data_write_callback,
 566                 .timeout = 0,   /* overwritten later */
 567         },
 568
 569         [UMASS_T_BBB_DATA_WR_CS] = {
 570                 .type = UE_CONTROL,
 571                 .endpoint = 0x00,       /* Control pipe */
 572                 .direction = UE_DIR_ANY,
 573                 .bufsize = sizeof(struct usb_device_request),
 574                 .callback = &umass_t_bbb_data_wr_cs_callback,
 575                 .timeout = 5000,        /* 5 seconds */
 576         },
 577
 578         [UMASS_T_BBB_STATUS] = {
 579                 .type = UE_BULK,
 580                 .endpoint = UE_ADDR_ANY,
 581                 .direction = UE_DIR_IN,
 582                 .bufsize = sizeof(umass_bbb_csw_t),
 583                 .flags = {.short_xfer_ok = 1,},
 584                 .callback = &umass_t_bbb_status_callback,
 585                 .timeout = 5000,        /* ms */
 586         },
 587 };
 588
 589 static struct usb_config umass_cbi_config[UMASS_T_CBI_MAX] = {
 590
 591         [UMASS_T_CBI_RESET1] = {
 592                 .type = UE_CONTROL,
 593                 .endpoint = 0x00,       /* Control pipe */
 594                 .direction = UE_DIR_ANY,
 595                 .bufsize = (sizeof(struct usb_device_request) +
 596                     UMASS_CBI_DIAGNOSTIC_CMDLEN),
 597                 .callback = &umass_t_cbi_reset1_callback,
 598                 .timeout = 5000,        /* 5 seconds */
 599                 .interval = 500,        /* 500 milliseconds */
 600         },
 601
 602         [UMASS_T_CBI_RESET2] = {
 603                 .type = UE_CONTROL,
 604                 .endpoint = 0x00,       /* Control pipe */
 605                 .direction = UE_DIR_ANY,
 606                 .bufsize = sizeof(struct usb_device_request),
 607                 .callback = &umass_t_cbi_reset2_callback,
 608                 .timeout = 5000,        /* 5 seconds */
 609                 .interval = 50, /* 50 milliseconds */
 610         },
 611
 612         [UMASS_T_CBI_RESET3] = {
 613                 .type = UE_CONTROL,
 614                 .endpoint = 0x00,       /* Control pipe */
 615                 .direction = UE_DIR_ANY,
 616                 .bufsize = sizeof(struct usb_device_request),
 617                 .callback = &umass_t_cbi_reset3_callback,
 618                 .timeout = 5000,        /* 5 seconds */
 619                 .interval = 50, /* 50 milliseconds */
 620         },
 621
 622         [UMASS_T_CBI_COMMAND] = {
 623                 .type = UE_CONTROL,
 624                 .endpoint = 0x00,       /* Control pipe */
 625                 .direction = UE_DIR_ANY,
 626                 .bufsize = (sizeof(struct usb_device_request) +
 627                     UMASS_MAX_CMDLEN),
 628                 .callback = &umass_t_cbi_command_callback,
 629                 .timeout = 5000,        /* 5 seconds */
 630         },
 631
 632         [UMASS_T_CBI_DATA_READ] = {
 633                 .type = UE_BULK,
 634                 .endpoint = UE_ADDR_ANY,
 635                 .direction = UE_DIR_IN,
 636                 .bufsize = UMASS_BULK_SIZE,
 637                 .flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
 638                 .callback = &umass_t_cbi_data_read_callback,
 639                 .timeout = 0,   /* overwritten later */
 640         },
 641
 642         [UMASS_T_CBI_DATA_RD_CS] = {
 643                 .type = UE_CONTROL,
 644                 .endpoint = 0x00,       /* Control pipe */
 645                 .direction = UE_DIR_ANY,
 646                 .bufsize = sizeof(struct usb_device_request),
 647                 .callback = &umass_t_cbi_data_rd_cs_callback,
 648                 .timeout = 5000,        /* 5 seconds */
 649         },
 650
 651         [UMASS_T_CBI_DATA_WRITE] = {
 652                 .type = UE_BULK,
 653                 .endpoint = UE_ADDR_ANY,
 654                 .direction = UE_DIR_OUT,
 655                 .bufsize = UMASS_BULK_SIZE,
 656                 .flags = {.proxy_buffer = 1,.short_xfer_ok = 1, UMASS_USB_FLAGS},
 657                 .callback = &umass_t_cbi_data_write_callback,
 658                 .timeout = 0,   /* overwritten later */
 659         },
 660
 661         [UMASS_T_CBI_DATA_WR_CS] = {
 662                 .type = UE_CONTROL,
 663                 .endpoint = 0x00,       /* Control pipe */
 664                 .direction = UE_DIR_ANY,
 665                 .bufsize = sizeof(struct usb_device_request),
 666                 .callback = &umass_t_cbi_data_wr_cs_callback,
 667                 .timeout = 5000,        /* 5 seconds */
 668         },
 669
 670         [UMASS_T_CBI_STATUS] = {
 671                 .type = UE_INTERRUPT,
 672                 .endpoint = UE_ADDR_ANY,
 673                 .direction = UE_DIR_IN,
 674                 .flags = {.short_xfer_ok = 1,.no_pipe_ok = 1,},
 675                 .bufsize = sizeof(umass_cbi_sbl_t),
 676                 .callback = &umass_t_cbi_status_callback,
 677                 .timeout = 5000,        /* ms */
 678         },
 679
 680         [UMASS_T_CBI_RESET4] = {
 681                 .type = UE_CONTROL,
 682                 .endpoint = 0x00,       /* Control pipe */
 683                 .direction = UE_DIR_ANY,
 684                 .bufsize = sizeof(struct usb_device_request),
 685                 .callback = &umass_t_cbi_reset4_callback,
 686                 .timeout = 5000,        /* ms */
 687         },
 688 };
 689
 690 /* If device cannot return valid inquiry data, fake it */
 691 static const uint8_t fake_inq_data[SHORT_INQUIRY_LENGTH] = {
 692         0, /* removable */ 0x80, SCSI_REV_2, SCSI_REV_2,
 693          /* additional_length */ 31, 0, 0, 0
 694 };
 695
 696 #define UFI_COMMAND_LENGTH      12      /* UFI commands are always 12 bytes */
 697 #define ATAPI_COMMAND_LENGTH    12      /* ATAPI commands are always 12 bytes */
 698
 699 static devclass_t umass_devclass;
 700
 701 static device_method_t umass_methods[] = {
 702         /* Device interface */
 703         DEVMETHOD(device_probe, umass_probe),
 704         DEVMETHOD(device_attach, umass_attach),
 705         DEVMETHOD(device_detach, umass_detach),
 706         {0, 0}
 707 };
 708
 709 static driver_t umass_driver = {
 710         .name = "umass",
 711         .methods = umass_methods,
 712         .size = sizeof(struct umass_softc),
 713 };
 714
 715 DRIVER_MODULE(umass, uhub, umass_driver, umass_devclass, NULL, 0);
 716 MODULE_DEPEND(umass, usb, 1, 1, 1);
 717 MODULE_DEPEND(umass, cam, 1, 1, 1);
 718
 719 /*
 720  * USB device probe/attach/detach
 721  */
 722
 723 static uint16_t
 724 umass_get_proto(struct usb_interface *iface)
 725 {
 726         struct usb_interface_descriptor *id;
 727         uint16_t retval;
 728
 729         retval = 0;
 730
 731         /* Check for a standards compliant device */
 732         id = usbd_get_interface_descriptor(iface);
 733         if ((id == NULL) ||
 734             (id->bInterfaceClass != UICLASS_MASS)) {
 735                 goto done;
 736         }
 737         switch (id->bInterfaceSubClass) {
 738         case UISUBCLASS_SCSI:
 739                 retval |= UMASS_PROTO_SCSI;
 740                 break;
 741         case UISUBCLASS_UFI:
 742                 retval |= UMASS_PROTO_UFI;
 743                 break;
 744         case UISUBCLASS_RBC:
 745                 retval |= UMASS_PROTO_RBC;
 746                 break;
 747         case UISUBCLASS_SFF8020I:
 748         case UISUBCLASS_SFF8070I:
 749                 retval |= UMASS_PROTO_ATAPI;
 750                 break;
 751         default:
 752                 goto done;
 753         }
 754
 755         switch (id->bInterfaceProtocol) {
 756         case UIPROTO_MASS_CBI:
 757                 retval |= UMASS_PROTO_CBI;
 758                 break;
 759         case UIPROTO_MASS_CBI_I:
 760                 retval |= UMASS_PROTO_CBI_I;
 761                 break;
 762         case UIPROTO_MASS_BBB_OLD:
 763         case UIPROTO_MASS_BBB:
 764                 retval |= UMASS_PROTO_BBB;
 765                 break;
 766         default:
 767                 goto done;
 768         }
 769 done:
 770         return (retval);
 771 }
 772
 773 /*
 774  * Match the device we are seeing with the devices supported.
 775  */
 776 static struct umass_probe_proto
 777 umass_probe_proto(device_t dev, struct usb_attach_arg *uaa)
 778 {
 779         struct umass_probe_proto ret;
 780         uint32_t quirks = NO_QUIRKS;
 781         uint32_t proto = umass_get_proto(uaa->iface);
 782
 783         memset(&ret, 0, sizeof(ret));
 784
 785         /* Search for protocol enforcement */
 786
 787         if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_BBB)) {
 788                 proto &= ~UMASS_PROTO_WIRE;
 789                 proto |= UMASS_PROTO_BBB;
 790         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI)) {
 791                 proto &= ~UMASS_PROTO_WIRE;
 792                 proto |= UMASS_PROTO_CBI;
 793         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_WIRE_CBI_I)) {
 794                 proto &= ~UMASS_PROTO_WIRE;
 795                 proto |= UMASS_PROTO_CBI_I;
 796         }
 797
 798         if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_SCSI)) {
 799                 proto &= ~UMASS_PROTO_COMMAND;
 800                 proto |= UMASS_PROTO_SCSI;
 801         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_ATAPI)) {
 802                 proto &= ~UMASS_PROTO_COMMAND;
 803                 proto |= UMASS_PROTO_ATAPI;
 804         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_UFI)) {
 805                 proto &= ~UMASS_PROTO_COMMAND;
 806                 proto |= UMASS_PROTO_UFI;
 807         } else if (usb_test_quirk(uaa, UQ_MSC_FORCE_PROTO_RBC)) {
 808                 proto &= ~UMASS_PROTO_COMMAND;
 809                 proto |= UMASS_PROTO_RBC;
 810         }
 811
 812         /* Check if the protocol is invalid */
 813
 814         if ((proto & UMASS_PROTO_COMMAND) == 0) {
 815                 ret.error = ENXIO;
 816                 goto done;
 817         }
 818
 819         if ((proto & UMASS_PROTO_WIRE) == 0) {
 820                 ret.error = ENXIO;
 821                 goto done;
 822         }
 823
 824         /* Search for quirks */
 825
 826         if (usb_test_quirk(uaa, UQ_MSC_NO_TEST_UNIT_READY))
 827                 quirks |= NO_TEST_UNIT_READY;
 828         if (usb_test_quirk(uaa, UQ_MSC_NO_RS_CLEAR_UA))
 829                 quirks |= RS_NO_CLEAR_UA;
 830         if (usb_test_quirk(uaa, UQ_MSC_NO_START_STOP))
 831                 quirks |= NO_START_STOP;
 832         if (usb_test_quirk(uaa, UQ_MSC_NO_GETMAXLUN))
 833                 quirks |= NO_GETMAXLUN;
 834         if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY))
 835                 quirks |= NO_INQUIRY;
 836         if (usb_test_quirk(uaa, UQ_MSC_NO_INQUIRY_EVPD))
 837                 quirks |= NO_INQUIRY_EVPD;
 838         if (usb_test_quirk(uaa, UQ_MSC_NO_SYNC_CACHE))
 839                 quirks |= NO_SYNCHRONIZE_CACHE;
 840         if (usb_test_quirk(uaa, UQ_MSC_SHUTTLE_INIT))
 841                 quirks |= SHUTTLE_INIT;
 842         if (usb_test_quirk(uaa, UQ_MSC_ALT_IFACE_1))
 843                 quirks |= ALT_IFACE_1;
 844         if (usb_test_quirk(uaa, UQ_MSC_FLOPPY_SPEED))
 845                 quirks |= FLOPPY_SPEED;
 846         if (usb_test_quirk(uaa, UQ_MSC_IGNORE_RESIDUE))
 847                 quirks |= IGNORE_RESIDUE;
 848         if (usb_test_quirk(uaa, UQ_MSC_WRONG_CSWSIG))
 849                 quirks |= WRONG_CSWSIG;
 850         if (usb_test_quirk(uaa, UQ_MSC_RBC_PAD_TO_12))
 851                 quirks |= RBC_PAD_TO_12;
 852         if (usb_test_quirk(uaa, UQ_MSC_READ_CAP_OFFBY1))
 853                 quirks |= READ_CAPACITY_OFFBY1;
 854         if (usb_test_quirk(uaa, UQ_MSC_FORCE_SHORT_INQ))
 855                 quirks |= FORCE_SHORT_INQUIRY;
 856
 857 done:
 858         ret.quirks = quirks;
 859         ret.proto = proto;
 860         return (ret);
 861 }
 862
 863 static int
 864 umass_probe(device_t dev)
 865 {
 866         struct usb_attach_arg *uaa = device_get_ivars(dev);
 867         struct umass_probe_proto temp;
 868
 869         if (uaa->usb_mode != USB_MODE_HOST) {
 870                 return (ENXIO);
 871         }
 872         if (uaa->use_generic == 0) {
 873                 /* give other drivers a try first */
 874                 return (ENXIO);
 875         }
 876         temp = umass_probe_proto(dev, uaa);
 877
 878         return (temp.error);
 879 }
 880
 881 static int
 882 umass_attach(device_t dev)
 883 {
 884         struct umass_softc *sc = device_get_softc(dev);
 885         struct usb_attach_arg *uaa = device_get_ivars(dev);
 886         struct umass_probe_proto temp = umass_probe_proto(dev, uaa);
 887         struct usb_interface_descriptor *id;
 888         int32_t err;
 889
 890         /*
 891          * NOTE: the softc struct is bzero-ed in device_set_driver.
 892          * We can safely call umass_detach without specifically
 893          * initializing the struct.
 894          */
 895
 896         sc->sc_dev = dev;
 897         sc->sc_udev = uaa->device;
 898         sc->sc_proto = temp.proto;
 899         sc->sc_quirks = temp.quirks;
 900         sc->sc_unit = device_get_unit(dev);
 901
 902         snprintf(sc->sc_name, sizeof(sc->sc_name),
 903             "%s", device_get_nameunit(dev));
 904
 905         device_set_usb_desc(dev);
 906
 907         mtx_init(&sc->sc_mtx, device_get_nameunit(dev),
 908             NULL, MTX_DEF | MTX_RECURSE);
 909
 910         /* get interface index */
 911
 912         id = usbd_get_interface_descriptor(uaa->iface);
 913         if (id == NULL) {
 914                 device_printf(dev, "failed to get "
 915                     "interface number\n");
 916                 goto detach;
 917         }
 918         sc->sc_iface_no = id->bInterfaceNumber;
 919
 920 #ifdef USB_DEBUG
 921         device_printf(dev, " ");
 922
 923         switch (sc->sc_proto & UMASS_PROTO_COMMAND) {
 924         case UMASS_PROTO_SCSI:
 925                 printf("SCSI");
 926                 break;
 927         case UMASS_PROTO_ATAPI:
 928                 printf("8070i (ATAPI)");
 929                 break;
 930         case UMASS_PROTO_UFI:
 931                 printf("UFI");
 932                 break;
 933         case UMASS_PROTO_RBC:
 934                 printf("RBC");
 935                 break;
 936         default:
 937                 printf("(unknown 0x%02x)",
 938                     sc->sc_proto & UMASS_PROTO_COMMAND);
 939                 break;
 940         }
 941
 942         printf(" over ");
 943
 944         switch (sc->sc_proto & UMASS_PROTO_WIRE) {
 945         case UMASS_PROTO_BBB:
 946                 printf("Bulk-Only");
 947                 break;
 948         case UMASS_PROTO_CBI:           /* uses Comand/Bulk pipes */
 949                 printf("CBI");
 950                 break;
 951         case UMASS_PROTO_CBI_I: /* uses Comand/Bulk/Interrupt pipes */
 952                 printf("CBI with CCI");
 953                 break;
 954         default:
 955                 printf("(unknown 0x%02x)",
 956                     sc->sc_proto & UMASS_PROTO_WIRE);
 957         }
 958
 959         printf("; quirks = 0x%04x\n", sc->sc_quirks);
 960 #endif
 961
 962         if (sc->sc_quirks & ALT_IFACE_1) {
 963                 err = usbd_set_alt_interface_index
 964                     (uaa->device, uaa->info.bIfaceIndex, 1);
 965
 966                 if (err) {
 967                         DPRINTF(sc, UDMASS_USB, "could not switch to "
 968                             "Alt Interface 1\n");
 969                         goto detach;
 970                 }
 971         }
 972         /* allocate all required USB transfers */
 973
 974         if (sc->sc_proto & UMASS_PROTO_BBB) {
 975
 976                 err = usbd_transfer_setup(uaa->device,
 977                     &uaa->info.bIfaceIndex, sc->sc_xfer, umass_bbb_config,
 978                     UMASS_T_BBB_MAX, sc, &sc->sc_mtx);
 979
 980                 /* skip reset first time */
 981                 sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
 982
 983         } else if (sc->sc_proto & (UMASS_PROTO_CBI | UMASS_PROTO_CBI_I)) {
 984
 985                 err = usbd_transfer_setup(uaa->device,
 986                     &uaa->info.bIfaceIndex, sc->sc_xfer, umass_cbi_config,
 987                     UMASS_T_CBI_MAX, sc, &sc->sc_mtx);
 988
 989                 /* skip reset first time */
 990                 sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
 991
 992         } else {
 993                 err = USB_ERR_INVAL;
 994         }
 995
 996         if (err) {
 997                 device_printf(dev, "could not setup required "
 998                     "transfers, %s\n", usbd_errstr(err));
 999                 goto detach;
1000         }
1001         sc->sc_transform =
1002             (sc->sc_proto & UMASS_PROTO_SCSI) ? &umass_scsi_transform :
1003             (sc->sc_proto & UMASS_PROTO_UFI) ? &umass_ufi_transform :
1004             (sc->sc_proto & UMASS_PROTO_ATAPI) ? &umass_atapi_transform :
1005             (sc->sc_proto & UMASS_PROTO_RBC) ? &umass_rbc_transform :
1006             &umass_no_transform;
1007
1008         /* from here onwards the device can be used. */
1009
1010         if (sc->sc_quirks & SHUTTLE_INIT) {
1011                 umass_init_shuttle(sc);
1012         }
1013         /* get the maximum LUN supported by the device */
1014
1015         if (((sc->sc_proto & UMASS_PROTO_WIRE) == UMASS_PROTO_BBB) &&
1016             !(sc->sc_quirks & NO_GETMAXLUN))
1017                 sc->sc_maxlun = umass_bbb_get_max_lun(sc);
1018         else
1019                 sc->sc_maxlun = 0;
1020
1021         /* Prepare the SCSI command block */
1022         sc->cam_scsi_sense.opcode = REQUEST_SENSE;
1023         sc->cam_scsi_test_unit_ready.opcode = TEST_UNIT_READY;
1024
1025         /*
1026          * some devices need a delay after that the configuration value is
1027          * set to function properly:
1028          */
1029         usb_pause_mtx(NULL, hz);
1030
1031         /* register the SIM */
1032         err = umass_cam_attach_sim(sc);
1033         if (err) {
1034                 goto detach;
1035         }
1036         /* scan the SIM */
1037         umass_cam_attach(sc);
1038
1039         DPRINTF(sc, UDMASS_GEN, "Attach finished\n");
1040
1041         return (0);                     /* success */
1042
1043 detach:
1044         umass_detach(dev);
1045         return (ENXIO);                 /* failure */
1046 }
1047
1048 static int
1049 umass_detach(device_t dev)
1050 {
1051         struct umass_softc *sc = device_get_softc(dev);
1052
1053         DPRINTF(sc, UDMASS_USB, "\n");
1054
1055         /* teardown our statemachine */
1056
1057         usbd_transfer_unsetup(sc->sc_xfer, UMASS_T_MAX);
1058
1059 #if (__FreeBSD_version >= 700037)
1060         mtx_lock(&sc->sc_mtx);
1061 #endif
1062         umass_cam_detach_sim(sc);
1063
1064 #if (__FreeBSD_version >= 700037)
1065         mtx_unlock(&sc->sc_mtx);
1066 #endif
1067         mtx_destroy(&sc->sc_mtx);
1068
1069         return (0);                     /* success */
1070 }
1071
1072 static void
1073 umass_init_shuttle(struct umass_softc *sc)
1074 {
1075         struct usb_device_request req;
1076         usb_error_t err;
1077         uint8_t status[2] = {0, 0};
1078
1079         /*
1080          * The Linux driver does this, but no one can tell us what the
1081          * command does.
1082          */
1083         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1084         req.bRequest = 1;               /* XXX unknown command */
1085         USETW(req.wValue, 0);
1086         req.wIndex[0] = sc->sc_iface_no;
1087         req.wIndex[1] = 0;
1088         USETW(req.wLength, sizeof(status));
1089         err = usbd_do_request(sc->sc_udev, NULL, &req, &status);
1090
1091         DPRINTF(sc, UDMASS_GEN, "Shuttle init returned 0x%02x%02x\n",
1092             status[0], status[1]);
1093 }
1094
1095 /*
1096  * Generic functions to handle transfers
1097  */
1098
1099 static void
1100 umass_transfer_start(struct umass_softc *sc, uint8_t xfer_index)
1101 {
1102         DPRINTF(sc, UDMASS_GEN, "transfer index = "
1103             "%d\n", xfer_index);
1104
1105         if (sc->sc_xfer[xfer_index]) {
1106                 sc->sc_last_xfer_index = xfer_index;
1107                 usbd_transfer_start(sc->sc_xfer[xfer_index]);
1108         } else {
1109                 umass_cancel_ccb(sc);
1110         }
1111 }
1112
1113 static void
1114 umass_reset(struct umass_softc *sc)
1115 {
1116         DPRINTF(sc, UDMASS_GEN, "resetting device\n");
1117
1118         /*
1119          * stop the last transfer, if not already stopped:
1120          */
1121         usbd_transfer_stop(sc->sc_xfer[sc->sc_last_xfer_index]);
1122         umass_transfer_start(sc, 0);
1123 }
1124
1125 static void
1126 umass_cancel_ccb(struct umass_softc *sc)
1127 {
1128         union ccb *ccb;
1129
1130         mtx_assert(&sc->sc_mtx, MA_OWNED);
1131
1132         ccb = sc->sc_transfer.ccb;
1133         sc->sc_transfer.ccb = NULL;
1134         sc->sc_last_xfer_index = 0;
1135
1136         if (ccb) {
1137                 (sc->sc_transfer.callback)
1138                     (sc, ccb, (sc->sc_transfer.data_len -
1139                     sc->sc_transfer.actlen), STATUS_WIRE_FAILED);
1140         }
1141 }
1142
1143 static void
1144 umass_tr_error(struct usb_xfer *xfer, usb_error_t error)
1145 {
1146         struct umass_softc *sc = usbd_xfer_softc(xfer);
1147
1148         if (error != USB_ERR_CANCELLED) {
1149
1150                 DPRINTF(sc, UDMASS_GEN, "transfer error, %s -> "
1151                     "reset\n", usbd_errstr(error));
1152         }
1153         umass_cancel_ccb(sc);
1154 }
1155
1156 /*
1157  * BBB protocol specific functions
1158  */
1159
1160 static void
1161 umass_t_bbb_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1162 {
1163         struct umass_softc *sc = usbd_xfer_softc(xfer);
1164         struct usb_device_request req;
1165         struct usb_page_cache *pc;
1166
1167         switch (USB_GET_STATE(xfer)) {
1168         case USB_ST_TRANSFERRED:
1169                 umass_transfer_start(sc, UMASS_T_BBB_RESET2);
1170                 return;
1171
1172         case USB_ST_SETUP:
1173                 /*
1174                  * Reset recovery (5.3.4 in Universal Serial Bus Mass Storage Class)
1175                  *
1176                  * For Reset Recovery the host shall issue in the following order:
1177                  * a) a Bulk-Only Mass Storage Reset
1178                  * b) a Clear Feature HALT to the Bulk-In endpoint
1179                  * c) a Clear Feature HALT to the Bulk-Out endpoint
1180                  *
1181                  * This is done in 3 steps, using 3 transfers:
1182                  * UMASS_T_BBB_RESET1
1183                  * UMASS_T_BBB_RESET2
1184                  * UMASS_T_BBB_RESET3
1185                  */
1186
1187                 DPRINTF(sc, UDMASS_BBB, "BBB reset!\n");
1188
1189                 req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1190                 req.bRequest = UR_BBB_RESET;    /* bulk only reset */
1191                 USETW(req.wValue, 0);
1192                 req.wIndex[0] = sc->sc_iface_no;
1193                 req.wIndex[1] = 0;
1194                 USETW(req.wLength, 0);
1195
1196                 pc = usbd_xfer_get_frame(xfer, 0);
1197                 usbd_copy_in(pc, 0, &req, sizeof(req));
1198
1199                 usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1200                 usbd_xfer_set_frames(xfer, 1);
1201                 usbd_transfer_submit(xfer);
1202                 return;
1203
1204         default:                        /* Error */
1205                 umass_tr_error(xfer, error);
1206                 return;
1207
1208         }
1209 }
1210
1211 static void
1212 umass_t_bbb_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1213 {
1214         umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_RESET3,
1215             UMASS_T_BBB_DATA_READ, error);
1216 }
1217
1218 static void
1219 umass_t_bbb_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1220 {
1221         umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_COMMAND,
1222             UMASS_T_BBB_DATA_WRITE, error);
1223 }
1224
1225 static void
1226 umass_t_bbb_data_clear_stall_callback(struct usb_xfer *xfer,
1227     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1228 {
1229         struct umass_softc *sc = usbd_xfer_softc(xfer);
1230
1231         switch (USB_GET_STATE(xfer)) {
1232         case USB_ST_TRANSFERRED:
1233 tr_transferred:
1234                 umass_transfer_start(sc, next_xfer);
1235                 return;
1236
1237         case USB_ST_SETUP:
1238                 if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1239                         goto tr_transferred;
1240                 }
1241                 return;
1242
1243         default:                        /* Error */
1244                 umass_tr_error(xfer, error);
1245                 return;
1246
1247         }
1248 }
1249
1250 static void
1251 umass_t_bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
1252 {
1253         struct umass_softc *sc = usbd_xfer_softc(xfer);
1254         union ccb *ccb = sc->sc_transfer.ccb;
1255         struct usb_page_cache *pc;
1256         uint32_t tag;
1257
1258         switch (USB_GET_STATE(xfer)) {
1259         case USB_ST_TRANSFERRED:
1260                 umass_transfer_start
1261                     (sc, ((sc->sc_transfer.dir == DIR_IN) ? UMASS_T_BBB_DATA_READ :
1262                     (sc->sc_transfer.dir == DIR_OUT) ? UMASS_T_BBB_DATA_WRITE :
1263                     UMASS_T_BBB_STATUS));
1264                 return;
1265
1266         case USB_ST_SETUP:
1267
1268                 sc->sc_status_try = 0;
1269
1270                 if (ccb) {
1271
1272                         /*
1273                          * the initial value is not important,
1274                          * as long as the values are unique:
1275                          */
1276                         tag = UGETDW(sc->cbw.dCBWTag) + 1;
1277
1278                         USETDW(sc->cbw.dCBWSignature, CBWSIGNATURE);
1279                         USETDW(sc->cbw.dCBWTag, tag);
1280
1281                         /*
1282                          * dCBWDataTransferLength:
1283                          *   This field indicates the number of bytes of data that the host
1284                          *   intends to transfer on the IN or OUT Bulk endpoint(as indicated by
1285                          *   the Direction bit) during the execution of this command. If this
1286                          *   field is set to 0, the device will expect that no data will be
1287                          *   transferred IN or OUT during this command, regardless of the value
1288                          *   of the Direction bit defined in dCBWFlags.
1289                          */
1290                         USETDW(sc->cbw.dCBWDataTransferLength, sc->sc_transfer.data_len);
1291
1292                         /*
1293                          * dCBWFlags:
1294                          *   The bits of the Flags field are defined as follows:
1295                          *     Bits 0-6  reserved
1296                          *     Bit  7    Direction - this bit shall be ignored if the
1297                          *                           dCBWDataTransferLength field is zero.
1298                          *               0 = data Out from host to device
1299                          *               1 = data In from device to host
1300                          */
1301                         sc->cbw.bCBWFlags = ((sc->sc_transfer.dir == DIR_IN) ?
1302                             CBWFLAGS_IN : CBWFLAGS_OUT);
1303                         sc->cbw.bCBWLUN = sc->sc_transfer.lun;
1304
1305                         if (sc->sc_transfer.cmd_len > sizeof(sc->cbw.CBWCDB)) {
1306                                 sc->sc_transfer.cmd_len = sizeof(sc->cbw.CBWCDB);
1307                                 DPRINTF(sc, UDMASS_BBB, "Truncating long command!\n");
1308                         }
1309                         sc->cbw.bCDBLength = sc->sc_transfer.cmd_len;
1310
1311                         bcopy(sc->sc_transfer.cmd_data, sc->cbw.CBWCDB,
1312                             sc->sc_transfer.cmd_len);
1313
1314                         bzero(sc->sc_transfer.cmd_data + sc->sc_transfer.cmd_len,
1315                             sizeof(sc->cbw.CBWCDB) - sc->sc_transfer.cmd_len);
1316
1317                         DIF(UDMASS_BBB, umass_bbb_dump_cbw(sc, &sc->cbw));
1318
1319                         pc = usbd_xfer_get_frame(xfer, 0);
1320                         usbd_copy_in(pc, 0, &sc->cbw, sizeof(sc->cbw));
1321                         usbd_xfer_set_frame_len(xfer, 0, sizeof(sc->cbw));
1322
1323                         usbd_transfer_submit(xfer);
1324                 }
1325                 return;
1326
1327         default:                        /* Error */
1328                 umass_tr_error(xfer, error);
1329                 return;
1330
1331         }
1332 }
1333
1334 static void
1335 umass_t_bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1336 {
1337         struct umass_softc *sc = usbd_xfer_softc(xfer);
1338         uint32_t max_bulk = usbd_xfer_max_len(xfer);
1339 #ifndef UMASS_EXT_BUFFER
1340         struct usb_page_cache *pc;
1341 #endif
1342         int actlen, sumlen;
1343
1344         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1345
1346         switch (USB_GET_STATE(xfer)) {
1347         case USB_ST_TRANSFERRED:
1348 #ifndef UMASS_EXT_BUFFER
1349                 pc = usbd_xfer_get_frame(xfer, 0);
1350                 usbd_copy_out(pc, 0, sc->sc_transfer.data_ptr, actlen);
1351 #endif
1352                 sc->sc_transfer.data_rem -= actlen;
1353                 sc->sc_transfer.data_ptr += actlen;
1354                 sc->sc_transfer.actlen += actlen;
1355
1356                 if (actlen < sumlen) {
1357                         /* short transfer */
1358                         sc->sc_transfer.data_rem = 0;
1359                 }
1360         case USB_ST_SETUP:
1361                 DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1362                     max_bulk, sc->sc_transfer.data_rem);
1363
1364                 if (sc->sc_transfer.data_rem == 0) {
1365                         umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1366                         return;
1367                 }
1368                 if (max_bulk > sc->sc_transfer.data_rem) {
1369                         max_bulk = sc->sc_transfer.data_rem;
1370                 }
1371                 usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1372
1373 #ifdef UMASS_EXT_BUFFER
1374                 usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1375                     max_bulk);
1376 #else
1377                 usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1378 #endif
1379                 usbd_transfer_submit(xfer);
1380                 return;
1381
1382         default:                        /* Error */
1383                 if (error == USB_ERR_CANCELLED) {
1384                         umass_tr_error(xfer, error);
1385                 } else {
1386                         umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1387                 }
1388                 return;
1389
1390         }
1391 }
1392
1393 static void
1394 umass_t_bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1395 {
1396         umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1397             UMASS_T_BBB_DATA_READ, error);
1398 }
1399
1400 static void
1401 umass_t_bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1402 {
1403         struct umass_softc *sc = usbd_xfer_softc(xfer);
1404         uint32_t max_bulk = usbd_xfer_max_len(xfer);
1405 #ifndef UMASS_EXT_BUFFER
1406         struct usb_page_cache *pc;
1407 #endif
1408         int actlen, sumlen;
1409
1410         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1411
1412         switch (USB_GET_STATE(xfer)) {
1413         case USB_ST_TRANSFERRED:
1414                 sc->sc_transfer.data_rem -= actlen;
1415                 sc->sc_transfer.data_ptr += actlen;
1416                 sc->sc_transfer.actlen += actlen;
1417
1418                 if (actlen < sumlen) {
1419                         /* short transfer */
1420                         sc->sc_transfer.data_rem = 0;
1421                 }
1422         case USB_ST_SETUP:
1423                 DPRINTF(sc, UDMASS_BBB, "max_bulk=%d, data_rem=%d\n",
1424                     max_bulk, sc->sc_transfer.data_rem);
1425
1426                 if (sc->sc_transfer.data_rem == 0) {
1427                         umass_transfer_start(sc, UMASS_T_BBB_STATUS);
1428                         return;
1429                 }
1430                 if (max_bulk > sc->sc_transfer.data_rem) {
1431                         max_bulk = sc->sc_transfer.data_rem;
1432                 }
1433                 usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1434
1435 #ifdef UMASS_EXT_BUFFER
1436                 usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1437                     max_bulk);
1438 #else
1439                 pc = usbd_xfer_get_frame(xfer, 0);
1440                 usbd_copy_in(pc, 0, sc->sc_transfer.data_ptr, max_bulk);
1441                 usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1442 #endif
1443
1444                 usbd_transfer_submit(xfer);
1445                 return;
1446
1447         default:                        /* Error */
1448                 if (error == USB_ERR_CANCELLED) {
1449                         umass_tr_error(xfer, error);
1450                 } else {
1451                         umass_transfer_start(sc, UMASS_T_BBB_DATA_WR_CS);
1452                 }
1453                 return;
1454
1455         }
1456 }
1457
1458 static void
1459 umass_t_bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1460 {
1461         umass_t_bbb_data_clear_stall_callback(xfer, UMASS_T_BBB_STATUS,
1462             UMASS_T_BBB_DATA_WRITE, error);
1463 }
1464
1465 static void
1466 umass_t_bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
1467 {
1468         struct umass_softc *sc = usbd_xfer_softc(xfer);
1469         union ccb *ccb = sc->sc_transfer.ccb;
1470         struct usb_page_cache *pc;
1471         uint32_t residue;
1472         int actlen;
1473
1474         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
1475
1476         switch (USB_GET_STATE(xfer)) {
1477         case USB_ST_TRANSFERRED:
1478
1479                 /*
1480                  * Do a full reset if there is something wrong with the CSW:
1481                  */
1482                 sc->sc_status_try = 1;
1483
1484                 /* Zero missing parts of the CSW: */
1485
1486                 if (actlen < sizeof(sc->csw)) {
1487                         bzero(&sc->csw, sizeof(sc->csw));
1488                 }
1489                 pc = usbd_xfer_get_frame(xfer, 0);
1490                 usbd_copy_out(pc, 0, &sc->csw, actlen);
1491
1492                 DIF(UDMASS_BBB, umass_bbb_dump_csw(sc, &sc->csw));
1493
1494                 residue = UGETDW(sc->csw.dCSWDataResidue);
1495
1496                 if ((!residue) || (sc->sc_quirks & IGNORE_RESIDUE)) {
1497                         residue = (sc->sc_transfer.data_len -
1498                             sc->sc_transfer.actlen);
1499                 }
1500                 if (residue > sc->sc_transfer.data_len) {
1501                         DPRINTF(sc, UDMASS_BBB, "truncating residue from %d "
1502                             "to %d bytes\n", residue, sc->sc_transfer.data_len);
1503                         residue = sc->sc_transfer.data_len;
1504                 }
1505                 /* translate weird command-status signatures: */
1506                 if (sc->sc_quirks & WRONG_CSWSIG) {
1507
1508                         uint32_t temp = UGETDW(sc->csw.dCSWSignature);
1509
1510                         if ((temp == CSWSIGNATURE_OLYMPUS_C1) ||
1511                             (temp == CSWSIGNATURE_IMAGINATION_DBX1)) {
1512                                 USETDW(sc->csw.dCSWSignature, CSWSIGNATURE);
1513                         }
1514                 }
1515                 /* check CSW and handle eventual error */
1516                 if (UGETDW(sc->csw.dCSWSignature) != CSWSIGNATURE) {
1517                         DPRINTF(sc, UDMASS_BBB, "bad CSW signature 0x%08x != 0x%08x\n",
1518                             UGETDW(sc->csw.dCSWSignature), CSWSIGNATURE);
1519                         /*
1520                          * Invalid CSW: Wrong signature or wrong tag might
1521                          * indicate that we lost synchronization. Reset the
1522                          * device.
1523                          */
1524                         goto tr_error;
1525                 } else if (UGETDW(sc->csw.dCSWTag) != UGETDW(sc->cbw.dCBWTag)) {
1526                         DPRINTF(sc, UDMASS_BBB, "Invalid CSW: tag 0x%08x should be "
1527                             "0x%08x\n", UGETDW(sc->csw.dCSWTag),
1528                             UGETDW(sc->cbw.dCBWTag));
1529                         goto tr_error;
1530                 } else if (sc->csw.bCSWStatus > CSWSTATUS_PHASE) {
1531                         DPRINTF(sc, UDMASS_BBB, "Invalid CSW: status %d > %d\n",
1532                             sc->csw.bCSWStatus, CSWSTATUS_PHASE);
1533                         goto tr_error;
1534                 } else if (sc->csw.bCSWStatus == CSWSTATUS_PHASE) {
1535                         DPRINTF(sc, UDMASS_BBB, "Phase error, residue = "
1536                             "%d\n", residue);
1537                         goto tr_error;
1538                 } else if (sc->sc_transfer.actlen > sc->sc_transfer.data_len) {
1539                         DPRINTF(sc, UDMASS_BBB, "Buffer overrun %d > %d\n",
1540                             sc->sc_transfer.actlen, sc->sc_transfer.data_len);
1541                         goto tr_error;
1542                 } else if (sc->csw.bCSWStatus == CSWSTATUS_FAILED) {
1543                         DPRINTF(sc, UDMASS_BBB, "Command failed, residue = "
1544                             "%d\n", residue);
1545
1546                         sc->sc_transfer.ccb = NULL;
1547
1548                         sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1549
1550                         (sc->sc_transfer.callback)
1551                             (sc, ccb, residue, STATUS_CMD_FAILED);
1552                 } else {
1553                         sc->sc_transfer.ccb = NULL;
1554
1555                         sc->sc_last_xfer_index = UMASS_T_BBB_COMMAND;
1556
1557                         (sc->sc_transfer.callback)
1558                             (sc, ccb, residue, STATUS_CMD_OK);
1559                 }
1560                 return;
1561
1562         case USB_ST_SETUP:
1563                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
1564                 usbd_transfer_submit(xfer);
1565                 return;
1566
1567         default:
1568 tr_error:
1569                 DPRINTF(sc, UDMASS_BBB, "Failed to read CSW: %s, try %d\n",
1570                     usbd_errstr(error), sc->sc_status_try);
1571
1572                 if ((error == USB_ERR_CANCELLED) ||
1573                     (sc->sc_status_try)) {
1574                         umass_tr_error(xfer, error);
1575                 } else {
1576                         sc->sc_status_try = 1;
1577                         umass_transfer_start(sc, UMASS_T_BBB_DATA_RD_CS);
1578                 }
1579                 return;
1580
1581         }
1582 }
1583
1584 static void
1585 umass_command_start(struct umass_softc *sc, uint8_t dir,
1586     void *data_ptr, uint32_t data_len,
1587     uint32_t data_timeout, umass_callback_t *callback,
1588     union ccb *ccb)
1589 {
1590         sc->sc_transfer.lun = ccb->ccb_h.target_lun;
1591
1592         /*
1593          * NOTE: assumes that "sc->sc_transfer.cmd_data" and
1594          * "sc->sc_transfer.cmd_len" has been properly
1595          * initialized.
1596          */
1597
1598         sc->sc_transfer.dir = data_len ? dir : DIR_NONE;
1599         sc->sc_transfer.data_ptr = data_ptr;
1600         sc->sc_transfer.data_len = data_len;
1601         sc->sc_transfer.data_rem = data_len;
1602         sc->sc_transfer.data_timeout = (data_timeout + UMASS_TIMEOUT);
1603
1604         sc->sc_transfer.actlen = 0;
1605         sc->sc_transfer.callback = callback;
1606         sc->sc_transfer.ccb = ccb;
1607
1608         if (sc->sc_xfer[sc->sc_last_xfer_index]) {
1609                 usbd_transfer_start(sc->sc_xfer[sc->sc_last_xfer_index]);
1610         } else {
1611                 ccb->ccb_h.status = CAM_TID_INVALID;
1612                 xpt_done(ccb);
1613         }
1614 }
1615
1616 static uint8_t
1617 umass_bbb_get_max_lun(struct umass_softc *sc)
1618 {
1619         struct usb_device_request req;
1620         usb_error_t err;
1621         uint8_t buf = 0;
1622
1623         /* The Get Max Lun command is a class-specific request. */
1624         req.bmRequestType = UT_READ_CLASS_INTERFACE;
1625         req.bRequest = UR_BBB_GET_MAX_LUN;
1626         USETW(req.wValue, 0);
1627         req.wIndex[0] = sc->sc_iface_no;
1628         req.wIndex[1] = 0;
1629         USETW(req.wLength, 1);
1630
1631         err = usbd_do_request(sc->sc_udev, NULL, &req, &buf);
1632         if (err) {
1633                 buf = 0;
1634
1635                 /* Device doesn't support Get Max Lun request. */
1636                 printf("%s: Get Max Lun not supported (%s)\n",
1637                     sc->sc_name, usbd_errstr(err));
1638         }
1639         return (buf);
1640 }
1641
1642 /*
1643  * Command/Bulk/Interrupt (CBI) specific functions
1644  */
1645
1646 static void
1647 umass_cbi_start_status(struct umass_softc *sc)
1648 {
1649         if (sc->sc_xfer[UMASS_T_CBI_STATUS]) {
1650                 umass_transfer_start(sc, UMASS_T_CBI_STATUS);
1651         } else {
1652                 union ccb *ccb = sc->sc_transfer.ccb;
1653
1654                 sc->sc_transfer.ccb = NULL;
1655
1656                 sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1657
1658                 (sc->sc_transfer.callback)
1659                     (sc, ccb, (sc->sc_transfer.data_len -
1660                     sc->sc_transfer.actlen), STATUS_CMD_UNKNOWN);
1661         }
1662 }
1663
1664 static void
1665 umass_t_cbi_reset1_callback(struct usb_xfer *xfer, usb_error_t error)
1666 {
1667         struct umass_softc *sc = usbd_xfer_softc(xfer);
1668         struct usb_device_request req;
1669         struct usb_page_cache *pc;
1670         uint8_t buf[UMASS_CBI_DIAGNOSTIC_CMDLEN];
1671
1672         uint8_t i;
1673
1674         switch (USB_GET_STATE(xfer)) {
1675         case USB_ST_TRANSFERRED:
1676                 umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1677                 break;
1678
1679         case USB_ST_SETUP:
1680                 /*
1681                  * Command Block Reset Protocol
1682                  *
1683                  * First send a reset request to the device. Then clear
1684                  * any possibly stalled bulk endpoints.
1685                  *
1686                  * This is done in 3 steps, using 3 transfers:
1687                  * UMASS_T_CBI_RESET1
1688                  * UMASS_T_CBI_RESET2
1689                  * UMASS_T_CBI_RESET3
1690                  * UMASS_T_CBI_RESET4 (only if there is an interrupt endpoint)
1691                  */
1692
1693                 DPRINTF(sc, UDMASS_CBI, "CBI reset!\n");
1694
1695                 req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1696                 req.bRequest = UR_CBI_ADSC;
1697                 USETW(req.wValue, 0);
1698                 req.wIndex[0] = sc->sc_iface_no;
1699                 req.wIndex[1] = 0;
1700                 USETW(req.wLength, UMASS_CBI_DIAGNOSTIC_CMDLEN);
1701
1702                 /*
1703                  * The 0x1d code is the SEND DIAGNOSTIC command. To
1704                  * distinguish between the two, the last 10 bytes of the CBL
1705                  * is filled with 0xff (section 2.2 of the CBI
1706                  * specification)
1707                  */
1708                 buf[0] = 0x1d;          /* Command Block Reset */
1709                 buf[1] = 0x04;
1710
1711                 for (i = 2; i < UMASS_CBI_DIAGNOSTIC_CMDLEN; i++) {
1712                         buf[i] = 0xff;
1713                 }
1714
1715                 pc = usbd_xfer_get_frame(xfer, 0);
1716                 usbd_copy_in(pc, 0, &req, sizeof(req));
1717                 pc = usbd_xfer_get_frame(xfer, 1);
1718                 usbd_copy_in(pc, 0, buf, sizeof(buf));
1719
1720                 usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1721                 usbd_xfer_set_frame_len(xfer, 1, sizeof(buf));
1722                 usbd_xfer_set_frames(xfer, 2);
1723                 usbd_transfer_submit(xfer);
1724                 break;
1725
1726         default:                        /* Error */
1727                 if (error == USB_ERR_CANCELLED)
1728                         umass_tr_error(xfer, error);
1729                 else
1730                         umass_transfer_start(sc, UMASS_T_CBI_RESET2);
1731                 break;
1732
1733         }
1734 }
1735
1736 static void
1737 umass_t_cbi_reset2_callback(struct usb_xfer *xfer, usb_error_t error)
1738 {
1739         umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_RESET3,
1740             UMASS_T_CBI_DATA_READ, error);
1741 }
1742
1743 static void
1744 umass_t_cbi_reset3_callback(struct usb_xfer *xfer, usb_error_t error)
1745 {
1746         struct umass_softc *sc = usbd_xfer_softc(xfer);
1747
1748         umass_t_cbi_data_clear_stall_callback
1749             (xfer, (sc->sc_xfer[UMASS_T_CBI_RESET4] &&
1750             sc->sc_xfer[UMASS_T_CBI_STATUS]) ?
1751             UMASS_T_CBI_RESET4 : UMASS_T_CBI_COMMAND,
1752             UMASS_T_CBI_DATA_WRITE, error);
1753 }
1754
1755 static void
1756 umass_t_cbi_reset4_callback(struct usb_xfer *xfer, usb_error_t error)
1757 {
1758         umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_COMMAND,
1759             UMASS_T_CBI_STATUS, error);
1760 }
1761
1762 static void
1763 umass_t_cbi_data_clear_stall_callback(struct usb_xfer *xfer,
1764     uint8_t next_xfer, uint8_t stall_xfer, usb_error_t error)
1765 {
1766         struct umass_softc *sc = usbd_xfer_softc(xfer);
1767
1768         switch (USB_GET_STATE(xfer)) {
1769         case USB_ST_TRANSFERRED:
1770 tr_transferred:
1771                 if (next_xfer == UMASS_T_CBI_STATUS) {
1772                         umass_cbi_start_status(sc);
1773                 } else {
1774                         umass_transfer_start(sc, next_xfer);
1775                 }
1776                 break;
1777
1778         case USB_ST_SETUP:
1779                 if (usbd_clear_stall_callback(xfer, sc->sc_xfer[stall_xfer])) {
1780                         goto tr_transferred;    /* should not happen */
1781                 }
1782                 break;
1783
1784         default:                        /* Error */
1785                 umass_tr_error(xfer, error);
1786                 break;
1787
1788         }
1789 }
1790
1791 static void
1792 umass_t_cbi_command_callback(struct usb_xfer *xfer, usb_error_t error)
1793 {
1794         struct umass_softc *sc = usbd_xfer_softc(xfer);
1795         union ccb *ccb = sc->sc_transfer.ccb;
1796         struct usb_device_request req;
1797         struct usb_page_cache *pc;
1798
1799         switch (USB_GET_STATE(xfer)) {
1800         case USB_ST_TRANSFERRED:
1801
1802                 if (sc->sc_transfer.dir == DIR_NONE) {
1803                         umass_cbi_start_status(sc);
1804                 } else {
1805                         umass_transfer_start
1806                             (sc, (sc->sc_transfer.dir == DIR_IN) ?
1807                             UMASS_T_CBI_DATA_READ : UMASS_T_CBI_DATA_WRITE);
1808                 }
1809                 break;
1810
1811         case USB_ST_SETUP:
1812
1813                 if (ccb) {
1814
1815                         /*
1816                          * do a CBI transfer with cmd_len bytes from
1817                          * cmd_data, possibly a data phase of data_len
1818                          * bytes from/to the device and finally a status
1819                          * read phase.
1820                          */
1821
1822                         req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
1823                         req.bRequest = UR_CBI_ADSC;
1824                         USETW(req.wValue, 0);
1825                         req.wIndex[0] = sc->sc_iface_no;
1826                         req.wIndex[1] = 0;
1827                         req.wLength[0] = sc->sc_transfer.cmd_len;
1828                         req.wLength[1] = 0;
1829
1830                         pc = usbd_xfer_get_frame(xfer, 0);
1831                         usbd_copy_in(pc, 0, &req, sizeof(req));
1832                         pc = usbd_xfer_get_frame(xfer, 1);
1833                         usbd_copy_in(pc, 0, sc->sc_transfer.cmd_data,
1834                             sc->sc_transfer.cmd_len);
1835
1836                         usbd_xfer_set_frame_len(xfer, 0, sizeof(req));
1837                         usbd_xfer_set_frame_len(xfer, 1, sc->sc_transfer.cmd_len);
1838                         usbd_xfer_set_frames(xfer,
1839                             sc->sc_transfer.cmd_len ? 2 : 1);
1840
1841                         DIF(UDMASS_CBI,
1842                             umass_cbi_dump_cmd(sc,
1843                             sc->sc_transfer.cmd_data,
1844                             sc->sc_transfer.cmd_len));
1845
1846                         usbd_transfer_submit(xfer);
1847                 }
1848                 break;
1849
1850         default:                        /* Error */
1851                 umass_tr_error(xfer, error);
1852                 /* skip reset */
1853                 sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
1854                 break;
1855         }
1856 }
1857
1858 static void
1859 umass_t_cbi_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
1860 {
1861         struct umass_softc *sc = usbd_xfer_softc(xfer);
1862         uint32_t max_bulk = usbd_xfer_max_len(xfer);
1863 #ifndef UMASS_EXT_BUFFER
1864         struct usb_page_cache *pc;
1865 #endif
1866         int actlen, sumlen;
1867
1868         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1869
1870         switch (USB_GET_STATE(xfer)) {
1871         case USB_ST_TRANSFERRED:
1872 #ifndef UMASS_EXT_BUFFER
1873                 pc = usbd_xfer_get_frame(xfer, 0);
1874                 usbd_copy_out(pc, 0, sc->sc_transfer.data_ptr, actlen);
1875 #endif
1876                 sc->sc_transfer.data_rem -= actlen;
1877                 sc->sc_transfer.data_ptr += actlen;
1878                 sc->sc_transfer.actlen += actlen;
1879
1880                 if (actlen < sumlen) {
1881                         /* short transfer */
1882                         sc->sc_transfer.data_rem = 0;
1883                 }
1884         case USB_ST_SETUP:
1885                 DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1886                     max_bulk, sc->sc_transfer.data_rem);
1887
1888                 if (sc->sc_transfer.data_rem == 0) {
1889                         umass_cbi_start_status(sc);
1890                         break;
1891                 }
1892                 if (max_bulk > sc->sc_transfer.data_rem) {
1893                         max_bulk = sc->sc_transfer.data_rem;
1894                 }
1895                 usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1896
1897 #ifdef UMASS_EXT_BUFFER
1898                 usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1899                     max_bulk);
1900 #else
1901                 usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1902 #endif
1903                 usbd_transfer_submit(xfer);
1904                 break;
1905
1906         default:                        /* Error */
1907                 if ((error == USB_ERR_CANCELLED) ||
1908                     (sc->sc_transfer.callback != &umass_cam_cb)) {
1909                         umass_tr_error(xfer, error);
1910                 } else {
1911                         umass_transfer_start(sc, UMASS_T_CBI_DATA_RD_CS);
1912                 }
1913                 break;
1914
1915         }
1916 }
1917
1918 static void
1919 umass_t_cbi_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1920 {
1921         umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1922             UMASS_T_CBI_DATA_READ, error);
1923 }
1924
1925 static void
1926 umass_t_cbi_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
1927 {
1928         struct umass_softc *sc = usbd_xfer_softc(xfer);
1929         uint32_t max_bulk = usbd_xfer_max_len(xfer);
1930 #ifndef UMASS_EXT_BUFFER
1931         struct usb_page_cache *pc;
1932 #endif
1933         int actlen, sumlen;
1934
1935         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
1936
1937         switch (USB_GET_STATE(xfer)) {
1938         case USB_ST_TRANSFERRED:
1939                 sc->sc_transfer.data_rem -= actlen;
1940                 sc->sc_transfer.data_ptr += actlen;
1941                 sc->sc_transfer.actlen += actlen;
1942
1943                 if (actlen < sumlen) {
1944                         /* short transfer */
1945                         sc->sc_transfer.data_rem = 0;
1946                 }
1947         case USB_ST_SETUP:
1948                 DPRINTF(sc, UDMASS_CBI, "max_bulk=%d, data_rem=%d\n",
1949                     max_bulk, sc->sc_transfer.data_rem);
1950
1951                 if (sc->sc_transfer.data_rem == 0) {
1952                         umass_cbi_start_status(sc);
1953                         break;
1954                 }
1955                 if (max_bulk > sc->sc_transfer.data_rem) {
1956                         max_bulk = sc->sc_transfer.data_rem;
1957                 }
1958                 usbd_xfer_set_timeout(xfer, sc->sc_transfer.data_timeout);
1959
1960 #ifdef UMASS_EXT_BUFFER
1961                 usbd_xfer_set_frame_data(xfer, 0, sc->sc_transfer.data_ptr,
1962                     max_bulk);
1963 #else
1964                 pc = usbd_xfer_get_frame(xfer, 0);
1965                 usbd_copy_in(pc, 0, sc->sc_transfer.data_ptr, max_bulk);
1966                 usbd_xfer_set_frame_len(xfer, 0, max_bulk);
1967 #endif
1968
1969                 usbd_transfer_submit(xfer);
1970                 break;
1971
1972         default:                        /* Error */
1973                 if ((error == USB_ERR_CANCELLED) ||
1974                     (sc->sc_transfer.callback != &umass_cam_cb)) {
1975                         umass_tr_error(xfer, error);
1976                 } else {
1977                         umass_transfer_start(sc, UMASS_T_CBI_DATA_WR_CS);
1978                 }
1979                 break;
1980
1981         }
1982 }
1983
1984 static void
1985 umass_t_cbi_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
1986 {
1987         umass_t_cbi_data_clear_stall_callback(xfer, UMASS_T_CBI_STATUS,
1988             UMASS_T_CBI_DATA_WRITE, error);
1989 }
1990
1991 static void
1992 umass_t_cbi_status_callback(struct usb_xfer *xfer, usb_error_t error)
1993 {
1994         struct umass_softc *sc = usbd_xfer_softc(xfer);
1995         union ccb *ccb = sc->sc_transfer.ccb;
1996         struct usb_page_cache *pc;
1997         uint32_t residue;
1998         uint8_t status;
1999         int actlen;
2000
2001         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
2002
2003         switch (USB_GET_STATE(xfer)) {
2004         case USB_ST_TRANSFERRED:
2005
2006                 if (actlen < sizeof(sc->sbl)) {
2007                         goto tr_setup;
2008                 }
2009                 pc = usbd_xfer_get_frame(xfer, 0);
2010                 usbd_copy_out(pc, 0, &sc->sbl, sizeof(sc->sbl));
2011
2012                 residue = (sc->sc_transfer.data_len -
2013                     sc->sc_transfer.actlen);
2014
2015                 /* dissect the information in the buffer */
2016
2017                 if (sc->sc_proto & UMASS_PROTO_UFI) {
2018
2019                         /*
2020                          * Section 3.4.3.1.3 specifies that the UFI command
2021                          * protocol returns an ASC and ASCQ in the interrupt
2022                          * data block.
2023                          */
2024
2025                         DPRINTF(sc, UDMASS_CBI, "UFI CCI, ASC = 0x%02x, "
2026                             "ASCQ = 0x%02x\n", sc->sbl.ufi.asc,
2027                             sc->sbl.ufi.ascq);
2028
2029                         status = (((sc->sbl.ufi.asc == 0) &&
2030                             (sc->sbl.ufi.ascq == 0)) ?
2031                             STATUS_CMD_OK : STATUS_CMD_FAILED);
2032
2033                         sc->sc_transfer.ccb = NULL;
2034
2035                         sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2036
2037                         (sc->sc_transfer.callback)
2038                             (sc, ccb, residue, status);
2039
2040                         break;
2041
2042                 } else {
2043
2044                         /* Command Interrupt Data Block */
2045
2046                         DPRINTF(sc, UDMASS_CBI, "type=0x%02x, value=0x%02x\n",
2047                             sc->sbl.common.type, sc->sbl.common.value);
2048
2049                         if (sc->sbl.common.type == IDB_TYPE_CCI) {
2050
2051                                 status = (sc->sbl.common.value & IDB_VALUE_STATUS_MASK);
2052
2053                                 status = ((status == IDB_VALUE_PASS) ? STATUS_CMD_OK :
2054                                     (status == IDB_VALUE_FAIL) ? STATUS_CMD_FAILED :
2055                                     (status == IDB_VALUE_PERSISTENT) ? STATUS_CMD_FAILED :
2056                                     STATUS_WIRE_FAILED);
2057
2058                                 sc->sc_transfer.ccb = NULL;
2059
2060                                 sc->sc_last_xfer_index = UMASS_T_CBI_COMMAND;
2061
2062                                 (sc->sc_transfer.callback)
2063                                     (sc, ccb, residue, status);
2064
2065                                 break;
2066                         }
2067                 }
2068
2069                 /* fallthrough */
2070
2071         case USB_ST_SETUP:
2072 tr_setup:
2073                 usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2074                 usbd_transfer_submit(xfer);
2075                 break;
2076
2077         default:                        /* Error */
2078                 DPRINTF(sc, UDMASS_CBI, "Failed to read CSW: %s\n",
2079                     usbd_errstr(error));
2080                 umass_tr_error(xfer, error);
2081                 break;
2082
2083         }
2084 }
2085
2086 /*
2087  * CAM specific functions (used by SCSI, UFI, 8070i (ATAPI))
2088  */
2089
2090 static int
2091 umass_cam_attach_sim(struct umass_softc *sc)
2092 {
2093         struct cam_devq *devq;          /* Per device Queue */
2094
2095         /*
2096          * A HBA is attached to the CAM layer.
2097          *
2098          * The CAM layer will then after a while start probing for devices on
2099          * the bus. The number of SIMs is limited to one.
2100          */
2101
2102         devq = cam_simq_alloc(1 /* maximum openings */ );
2103         if (devq == NULL) {
2104                 return (ENOMEM);
2105         }
2106         sc->sc_sim = cam_sim_alloc
2107             (&umass_cam_action, &umass_cam_poll,
2108             DEVNAME_SIM,
2109             sc /* priv */ ,
2110             sc->sc_unit /* unit number */ ,
2111 #if (__FreeBSD_version >= 700037)
2112             &sc->sc_mtx /* mutex */ ,
2113 #endif
2114             1 /* maximum device openings */ ,
2115             0 /* maximum tagged device openings */ ,
2116             devq);
2117
2118         if (sc->sc_sim == NULL) {
2119                 cam_simq_free(devq);
2120                 return (ENOMEM);
2121         }
2122
2123 #if (__FreeBSD_version >= 700037)
2124         mtx_lock(&sc->sc_mtx);
2125 #endif
2126
2127 #if (__FreeBSD_version >= 700048)
2128         if (xpt_bus_register(sc->sc_sim, sc->sc_dev, sc->sc_unit) != CAM_SUCCESS) {
2129                 mtx_unlock(&sc->sc_mtx);
2130                 return (ENOMEM);
2131         }
2132 #else
2133         if (xpt_bus_register(sc->sc_sim, sc->sc_unit) != CAM_SUCCESS) {
2134 #if (__FreeBSD_version >= 700037)
2135                 mtx_unlock(&sc->sc_mtx);
2136 #endif
2137                 return (ENOMEM);
2138         }
2139 #endif
2140
2141 #if (__FreeBSD_version >= 700037)
2142         mtx_unlock(&sc->sc_mtx);
2143 #endif
2144         return (0);
2145 }
2146
2147 static void
2148 umass_cam_attach(struct umass_softc *sc)
2149 {
2150 #ifndef USB_DEBUG
2151         if (bootverbose)
2152 #endif
2153                 printf("%s:%d:%d:%d: Attached to scbus%d\n",
2154                     sc->sc_name, cam_sim_path(sc->sc_sim),
2155                     sc->sc_unit, CAM_LUN_WILDCARD,
2156                     cam_sim_path(sc->sc_sim));
2157 }
2158
2159 /* umass_cam_detach
2160  *      detach from the CAM layer
2161  */
2162
2163 static void
2164 umass_cam_detach_sim(struct umass_softc *sc)
2165 {
2166         if (sc->sc_sim != NULL) {
2167                 if (xpt_bus_deregister(cam_sim_path(sc->sc_sim))) {
2168                         /* accessing the softc is not possible after this */
2169                         sc->sc_sim->softc = UMASS_GONE;
2170                         cam_sim_free(sc->sc_sim, /* free_devq */ TRUE);
2171                 } else {
2172                         panic("%s: CAM layer is busy\n",
2173                             sc->sc_name);
2174                 }
2175                 sc->sc_sim = NULL;
2176         }
2177 }
2178
2179 /* umass_cam_action
2180  *      CAM requests for action come through here
2181  */
2182
2183 static void
2184 umass_cam_action(struct cam_sim *sim, union ccb *ccb)
2185 {
2186         struct umass_softc *sc = (struct umass_softc *)sim->softc;
2187
2188         if (sc == UMASS_GONE ||
2189             (sc != NULL && !usbd_device_attached(sc->sc_udev))) {
2190                 ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2191                 xpt_done(ccb);
2192                 return;
2193         }
2194         if (sc) {
2195 #if (__FreeBSD_version < 700037)
2196                 mtx_lock(&sc->sc_mtx);
2197 #endif
2198         }
2199         /*
2200          * Verify, depending on the operation to perform, that we either got
2201          * a valid sc, because an existing target was referenced, or
2202          * otherwise the SIM is addressed.
2203          *
2204          * This avoids bombing out at a printf and does give the CAM layer some
2205          * sensible feedback on errors.
2206          */
2207         switch (ccb->ccb_h.func_code) {
2208         case XPT_SCSI_IO:
2209         case XPT_RESET_DEV:
2210         case XPT_GET_TRAN_SETTINGS:
2211         case XPT_SET_TRAN_SETTINGS:
2212         case XPT_CALC_GEOMETRY:
2213                 /* the opcodes requiring a target. These should never occur. */
2214                 if (sc == NULL) {
2215                         DPRINTF(sc, UDMASS_GEN, "%s:%d:%d:%d:func_code 0x%04x: "
2216                             "Invalid target (target needed)\n",
2217                             DEVNAME_SIM, cam_sim_path(sc->sc_sim),
2218                             ccb->ccb_h.target_id, ccb->ccb_h.target_lun,
2219                             ccb->ccb_h.func_code);
2220
2221                         ccb->ccb_h.status = CAM_TID_INVALID;
2222                         xpt_done(ccb);
2223                         goto done;
2224                 }
2225                 break;
2226         case XPT_PATH_INQ:
2227         case XPT_NOOP:
2228                 /*
2229                  * The opcodes sometimes aimed at a target (sc is valid),
2230                  * sometimes aimed at the SIM (sc is invalid and target is
2231                  * CAM_TARGET_WILDCARD)
2232                  */
2233                 if ((sc == NULL) &&
2234                     (ccb->ccb_h.target_id != CAM_TARGET_WILDCARD)) {
2235                         DPRINTF(sc, UDMASS_SCSI, "%s:%d:%d:%d:func_code 0x%04x: "
2236                             "Invalid target (no wildcard)\n",
2237                             DEVNAME_SIM, cam_sim_path(sc->sc_sim),
2238                             ccb->ccb_h.target_id, ccb->ccb_h.target_lun,
2239                             ccb->ccb_h.func_code);
2240
2241                         ccb->ccb_h.status = CAM_TID_INVALID;
2242                         xpt_done(ccb);
2243                         goto done;
2244                 }
2245                 break;
2246         default:
2247                 /* XXX Hm, we should check the input parameters */
2248                 break;
2249         }
2250
2251         /* Perform the requested action */
2252         switch (ccb->ccb_h.func_code) {
2253         case XPT_SCSI_IO:
2254                 {
2255                         uint8_t *cmd;
2256                         uint8_t dir;
2257
2258                         if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2259                                 cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2260                         } else {
2261                                 cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2262                         }
2263
2264                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2265                             "cmd: 0x%02x, flags: 0x%02x, "
2266                             "%db cmd/%db data/%db sense\n",
2267                             cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2268                             ccb->ccb_h.target_lun, cmd[0],
2269                             ccb->ccb_h.flags & CAM_DIR_MASK, ccb->csio.cdb_len,
2270                             ccb->csio.dxfer_len, ccb->csio.sense_len);
2271
2272                         if (sc->sc_transfer.ccb) {
2273                                 DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SCSI_IO: "
2274                                     "I/O in progress, deferring\n",
2275                                     cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2276                                     ccb->ccb_h.target_lun);
2277                                 ccb->ccb_h.status = CAM_SCSI_BUSY;
2278                                 xpt_done(ccb);
2279                                 goto done;
2280                         }
2281                         switch (ccb->ccb_h.flags & CAM_DIR_MASK) {
2282                         case CAM_DIR_IN:
2283                                 dir = DIR_IN;
2284                                 break;
2285                         case CAM_DIR_OUT:
2286                                 dir = DIR_OUT;
2287                                 DIF(UDMASS_SCSI,
2288                                     umass_dump_buffer(sc, ccb->csio.data_ptr,
2289                                     ccb->csio.dxfer_len, 48));
2290                                 break;
2291                         default:
2292                                 dir = DIR_NONE;
2293                         }
2294
2295                         ccb->ccb_h.status = CAM_REQ_INPROG | CAM_SIM_QUEUED;
2296
2297                         /*
2298                          * sc->sc_transform will convert the command to the
2299                          * command format needed by the specific command set
2300                          * and return the converted command in
2301                          * "sc->sc_transfer.cmd_data"
2302                          */
2303                         if (umass_std_transform(sc, ccb, cmd, ccb->csio.cdb_len)) {
2304
2305                                 if (sc->sc_transfer.cmd_data[0] == INQUIRY) {
2306
2307                                         /*
2308                                          * Umass devices don't generally report their serial numbers
2309                                          * in the usual SCSI way.  Emulate it here.
2310                                          */
2311                                         if ((sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2312                                             sc->sc_transfer.cmd_data[2] == SVPD_UNIT_SERIAL_NUMBER &&
2313                                             sc->sc_udev != NULL &&
2314                                             sc->sc_udev->serial != NULL &&
2315                                             sc->sc_udev->serial[0] != '\0') {
2316                                                 struct scsi_vpd_unit_serial_number *vpd_serial;
2317
2318                                                 vpd_serial = (struct scsi_vpd_unit_serial_number *)ccb->csio.data_ptr;
2319                                                 vpd_serial->length = strlen(sc->sc_udev->serial);
2320                                                 if (vpd_serial->length > sizeof(vpd_serial->serial_num))
2321                                                         vpd_serial->length = sizeof(vpd_serial->serial_num);
2322                                                 memcpy(vpd_serial->serial_num, sc->sc_udev->serial, vpd_serial->length);
2323                                                 ccb->csio.scsi_status = SCSI_STATUS_OK;
2324                                                 ccb->ccb_h.status = CAM_REQ_CMP;
2325                                                 xpt_done(ccb);
2326                                                 goto done;
2327                                         }
2328
2329                                         /*
2330                                          * Handle EVPD inquiry for broken devices first
2331                                          * NO_INQUIRY also implies NO_INQUIRY_EVPD
2332                                          */
2333                                         if ((sc->sc_quirks & (NO_INQUIRY_EVPD | NO_INQUIRY)) &&
2334                                             (sc->sc_transfer.cmd_data[1] & SI_EVPD)) {
2335                                                 struct scsi_sense_data *sense;
2336
2337                                                 sense = &ccb->csio.sense_data;
2338                                                 bzero(sense, sizeof(*sense));
2339                                                 sense->error_code = SSD_CURRENT_ERROR;
2340                                                 sense->flags = SSD_KEY_ILLEGAL_REQUEST;
2341                                                 sense->add_sense_code = 0x24;
2342                                                 sense->extra_len = 10;
2343                                                 ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2344                                                 ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR |
2345                                                     CAM_AUTOSNS_VALID;
2346                                                 xpt_done(ccb);
2347                                                 goto done;
2348                                         }
2349                                         /*
2350                                          * Return fake inquiry data for
2351                                          * broken devices
2352                                          */
2353                                         if (sc->sc_quirks & NO_INQUIRY) {
2354                                                 memcpy(ccb->csio.data_ptr, &fake_inq_data,
2355                                                     sizeof(fake_inq_data));
2356                                                 ccb->csio.scsi_status = SCSI_STATUS_OK;
2357                                                 ccb->ccb_h.status = CAM_REQ_CMP;
2358                                                 xpt_done(ccb);
2359                                                 goto done;
2360                                         }
2361                                         if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2362                                                 ccb->csio.dxfer_len = SHORT_INQUIRY_LENGTH;
2363                                         }
2364                                 } else if (sc->sc_transfer.cmd_data[0] == SYNCHRONIZE_CACHE) {
2365                                         if (sc->sc_quirks & NO_SYNCHRONIZE_CACHE) {
2366                                                 ccb->csio.scsi_status = SCSI_STATUS_OK;
2367                                                 ccb->ccb_h.status = CAM_REQ_CMP;
2368                                                 xpt_done(ccb);
2369                                                 goto done;
2370                                         }
2371                                 }
2372                                 umass_command_start(sc, dir, ccb->csio.data_ptr,
2373                                     ccb->csio.dxfer_len,
2374                                     ccb->ccb_h.timeout,
2375                                     &umass_cam_cb, ccb);
2376                         }
2377                         break;
2378                 }
2379         case XPT_PATH_INQ:
2380                 {
2381                         struct ccb_pathinq *cpi = &ccb->cpi;
2382
2383                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_PATH_INQ:.\n",
2384                             sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2385                             ccb->ccb_h.target_lun);
2386
2387                         /* host specific information */
2388                         cpi->version_num = 1;
2389                         cpi->hba_inquiry = 0;
2390                         cpi->target_sprt = 0;
2391                         cpi->hba_misc = PIM_NO_6_BYTE;
2392                         cpi->hba_eng_cnt = 0;
2393                         cpi->max_target = UMASS_SCSIID_MAX;     /* one target */
2394                         cpi->initiator_id = UMASS_SCSIID_HOST;
2395                         strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2396                         strlcpy(cpi->hba_vid, "USB SCSI", HBA_IDLEN);
2397                         strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2398                         cpi->unit_number = cam_sim_unit(sim);
2399                         cpi->bus_id = sc->sc_unit;
2400 #if (__FreeBSD_version >= 700025)
2401                         cpi->protocol = PROTO_SCSI;
2402                         cpi->protocol_version = SCSI_REV_2;
2403                         cpi->transport = XPORT_USB;
2404                         cpi->transport_version = 0;
2405 #endif
2406                         if (sc == NULL) {
2407                                 cpi->base_transfer_speed = 0;
2408                                 cpi->max_lun = 0;
2409                         } else {
2410                                 if (sc->sc_quirks & FLOPPY_SPEED) {
2411                                         cpi->base_transfer_speed =
2412                                             UMASS_FLOPPY_TRANSFER_SPEED;
2413                                 } else if (usbd_get_speed(sc->sc_udev) ==
2414                                     USB_SPEED_HIGH) {
2415                                         cpi->base_transfer_speed =
2416                                             UMASS_HIGH_TRANSFER_SPEED;
2417                                 } else {
2418                                         cpi->base_transfer_speed =
2419                                             UMASS_FULL_TRANSFER_SPEED;
2420                                 }
2421                                 cpi->max_lun = sc->sc_maxlun;
2422                         }
2423
2424                         cpi->ccb_h.status = CAM_REQ_CMP;
2425                         xpt_done(ccb);
2426                         break;
2427                 }
2428         case XPT_RESET_DEV:
2429                 {
2430                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_RESET_DEV:.\n",
2431                             cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2432                             ccb->ccb_h.target_lun);
2433
2434                         umass_reset(sc);
2435
2436                         ccb->ccb_h.status = CAM_REQ_CMP;
2437                         xpt_done(ccb);
2438                         break;
2439                 }
2440         case XPT_GET_TRAN_SETTINGS:
2441                 {
2442                         struct ccb_trans_settings *cts = &ccb->cts;
2443
2444                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_GET_TRAN_SETTINGS:.\n",
2445                             cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2446                             ccb->ccb_h.target_lun);
2447
2448 #if (__FreeBSD_version >= 700025)
2449                         cts->protocol = PROTO_SCSI;
2450                         cts->protocol_version = SCSI_REV_2;
2451                         cts->transport = XPORT_USB;
2452                         cts->transport_version = 0;
2453                         cts->xport_specific.valid = 0;
2454 #else
2455                         cts->valid = 0;
2456                         cts->flags = 0; /* no disconnection, tagging */
2457 #endif
2458                         ccb->ccb_h.status = CAM_REQ_CMP;
2459                         xpt_done(ccb);
2460                         break;
2461                 }
2462         case XPT_SET_TRAN_SETTINGS:
2463                 {
2464                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_SET_TRAN_SETTINGS:.\n",
2465                             cam_sim_path(sc->sc_sim), ccb->ccb_h.target_id,
2466                             ccb->ccb_h.target_lun);
2467
2468                         ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2469                         xpt_done(ccb);
2470                         break;
2471                 }
2472         case XPT_CALC_GEOMETRY:
2473                 {
2474                         cam_calc_geometry(&ccb->ccg, /* extended */ 1);
2475                         xpt_done(ccb);
2476                         break;
2477                 }
2478         case XPT_NOOP:
2479                 {
2480                         DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:XPT_NOOP:.\n",
2481                             sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2482                             ccb->ccb_h.target_lun);
2483
2484                         ccb->ccb_h.status = CAM_REQ_CMP;
2485                         xpt_done(ccb);
2486                         break;
2487                 }
2488         default:
2489                 DPRINTF(sc, UDMASS_SCSI, "%d:%d:%d:func_code 0x%04x: "
2490                     "Not implemented\n",
2491                     sc ? cam_sim_path(sc->sc_sim) : -1, ccb->ccb_h.target_id,
2492                     ccb->ccb_h.target_lun, ccb->ccb_h.func_code);
2493
2494                 ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
2495                 xpt_done(ccb);
2496                 break;
2497         }
2498
2499 done:
2500 #if (__FreeBSD_version < 700037)
2501         if (sc) {
2502                 mtx_unlock(&sc->sc_mtx);
2503         }
2504 #endif
2505         return;
2506 }
2507
2508 static void
2509 umass_cam_poll(struct cam_sim *sim)
2510 {
2511         struct umass_softc *sc = (struct umass_softc *)sim->softc;
2512
2513         if (sc == UMASS_GONE)
2514                 return;
2515
2516         DPRINTF(sc, UDMASS_SCSI, "CAM poll\n");
2517
2518         usbd_transfer_poll(sc->sc_xfer, UMASS_T_MAX);
2519 }
2520
2521
2522 /* umass_cam_cb
2523  *      finalise a completed CAM command
2524  */
2525
2526 static void
2527 umass_cam_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2528     uint8_t status)
2529 {
2530         ccb->csio.resid = residue;
2531
2532         switch (status) {
2533         case STATUS_CMD_OK:
2534                 ccb->ccb_h.status = CAM_REQ_CMP;
2535                 if ((sc->sc_quirks & READ_CAPACITY_OFFBY1) &&
2536                     (ccb->ccb_h.func_code == XPT_SCSI_IO) &&
2537                     (ccb->csio.cdb_io.cdb_bytes[0] == READ_CAPACITY)) {
2538                         struct scsi_read_capacity_data *rcap;
2539                         uint32_t maxsector;
2540
2541                         rcap = (void *)(ccb->csio.data_ptr);
2542                         maxsector = scsi_4btoul(rcap->addr) - 1;
2543                         scsi_ulto4b(maxsector, rcap->addr);
2544                 }
2545                 /*
2546                  * We have to add SVPD_UNIT_SERIAL_NUMBER to the list
2547                  * of pages supported by the device - otherwise, CAM
2548                  * will never ask us for the serial number if the
2549                  * device cannot handle that by itself.
2550                  */
2551                 if (ccb->ccb_h.func_code == XPT_SCSI_IO &&
2552                     sc->sc_transfer.cmd_data[0] == INQUIRY &&
2553                     (sc->sc_transfer.cmd_data[1] & SI_EVPD) &&
2554                     sc->sc_transfer.cmd_data[2] == SVPD_SUPPORTED_PAGE_LIST &&
2555                     sc->sc_udev != NULL &&
2556                     sc->sc_udev->serial != NULL &&
2557                     sc->sc_udev->serial[0] != '\0') {
2558                         struct ccb_scsiio *csio;
2559                         struct scsi_vpd_supported_page_list *page_list;
2560
2561                         csio = &ccb->csio;
2562                         page_list = (struct scsi_vpd_supported_page_list *)csio->data_ptr;
2563                         if (page_list->length + 1 < SVPD_SUPPORTED_PAGES_SIZE) {
2564                                 page_list->list[page_list->length] = SVPD_UNIT_SERIAL_NUMBER;
2565                                 page_list->length++;
2566                         }
2567                 }
2568                 xpt_done(ccb);
2569                 break;
2570
2571         case STATUS_CMD_UNKNOWN:
2572         case STATUS_CMD_FAILED:
2573
2574                 /* fetch sense data */
2575
2576                 /* the rest of the command was filled in at attach */
2577                 sc->cam_scsi_sense.length = ccb->csio.sense_len;
2578
2579                 DPRINTF(sc, UDMASS_SCSI, "Fetching %d bytes of "
2580                     "sense data\n", ccb->csio.sense_len);
2581
2582                 if (umass_std_transform(sc, ccb, &sc->cam_scsi_sense.opcode,
2583                     sizeof(sc->cam_scsi_sense))) {
2584
2585                         if ((sc->sc_quirks & FORCE_SHORT_INQUIRY) &&
2586                             (sc->sc_transfer.cmd_data[0] == INQUIRY)) {
2587                                 ccb->csio.sense_len = SHORT_INQUIRY_LENGTH;
2588                         }
2589                         umass_command_start(sc, DIR_IN, &ccb->csio.sense_data.error_code,
2590                             ccb->csio.sense_len, ccb->ccb_h.timeout,
2591                             &umass_cam_sense_cb, ccb);
2592                 }
2593                 break;
2594
2595         default:
2596                 /*
2597                  * The wire protocol failed and will hopefully have
2598                  * recovered. We return an error to CAM and let CAM
2599                  * retry the command if necessary. In case of SCSI IO
2600                  * commands we ask the CAM layer to check the
2601                  * condition first. This is a quick hack to make
2602                  * certain devices work.
2603                  */
2604                 if (ccb->ccb_h.func_code == XPT_SCSI_IO) {
2605                         ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR;
2606                         ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2607                 } else {
2608                         ccb->ccb_h.status = CAM_REQ_CMP_ERR;
2609                 }
2610                 xpt_done(ccb);
2611                 break;
2612         }
2613 }
2614
2615 /*
2616  * Finalise a completed autosense operation
2617  */
2618 static void
2619 umass_cam_sense_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2620     uint8_t status)
2621 {
2622         uint8_t *cmd;
2623         uint8_t key;
2624
2625         switch (status) {
2626         case STATUS_CMD_OK:
2627         case STATUS_CMD_UNKNOWN:
2628         case STATUS_CMD_FAILED:
2629
2630                 if (ccb->csio.ccb_h.flags & CAM_CDB_POINTER) {
2631                         cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_ptr);
2632                 } else {
2633                         cmd = (uint8_t *)(ccb->csio.cdb_io.cdb_bytes);
2634                 }
2635
2636                 key = (ccb->csio.sense_data.flags & SSD_KEY);
2637
2638                 /*
2639                  * Getting sense data always succeeds (apart from wire
2640                  * failures):
2641                  */
2642                 if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2643                     (cmd[0] == INQUIRY) &&
2644                     (key == SSD_KEY_UNIT_ATTENTION)) {
2645                         /*
2646                          * Ignore unit attention errors in the case where
2647                          * the Unit Attention state is not cleared on
2648                          * REQUEST SENSE. They will appear again at the next
2649                          * command.
2650                          */
2651                         ccb->ccb_h.status = CAM_REQ_CMP;
2652                 } else if (key == SSD_KEY_NO_SENSE) {
2653                         /*
2654                          * No problem after all (in the case of CBI without
2655                          * CCI)
2656                          */
2657                         ccb->ccb_h.status = CAM_REQ_CMP;
2658                 } else if ((sc->sc_quirks & RS_NO_CLEAR_UA) &&
2659                             (cmd[0] == READ_CAPACITY) &&
2660                     (key == SSD_KEY_UNIT_ATTENTION)) {
2661                         /*
2662                          * Some devices do not clear the unit attention error
2663                          * on request sense. We insert a test unit ready
2664                          * command to make sure we clear the unit attention
2665                          * condition, then allow the retry to proceed as
2666                          * usual.
2667                          */
2668
2669                         ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2670                             | CAM_AUTOSNS_VALID;
2671                         ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2672
2673 #if 0
2674                         DELAY(300000);
2675 #endif
2676                         DPRINTF(sc, UDMASS_SCSI, "Doing a sneaky"
2677                             "TEST_UNIT_READY\n");
2678
2679                         /* the rest of the command was filled in at attach */
2680
2681                         if (umass_std_transform(sc, ccb,
2682                             &sc->cam_scsi_test_unit_ready.opcode,
2683                             sizeof(sc->cam_scsi_test_unit_ready))) {
2684                                 umass_command_start(sc, DIR_NONE, NULL, 0,
2685                                     ccb->ccb_h.timeout,
2686                                     &umass_cam_quirk_cb, ccb);
2687                         }
2688                         break;
2689                 } else {
2690                         ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2691                             | CAM_AUTOSNS_VALID;
2692                         ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2693                 }
2694                 xpt_done(ccb);
2695                 break;
2696
2697         default:
2698                 DPRINTF(sc, UDMASS_SCSI, "Autosense failed, "
2699                     "status %d\n", status);
2700                 ccb->ccb_h.status = CAM_AUTOSENSE_FAIL;
2701                 xpt_done(ccb);
2702         }
2703 }
2704
2705 /*
2706  * This completion code just handles the fact that we sent a test-unit-ready
2707  * after having previously failed a READ CAPACITY with CHECK_COND.  Even
2708  * though this command succeeded, we have to tell CAM to retry.
2709  */
2710 static void
2711 umass_cam_quirk_cb(struct umass_softc *sc, union ccb *ccb, uint32_t residue,
2712     uint8_t status)
2713 {
2714         DPRINTF(sc, UDMASS_SCSI, "Test unit ready "
2715             "returned status %d\n", status);
2716
2717         ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
2718             | CAM_AUTOSNS_VALID;
2719         ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
2720         xpt_done(ccb);
2721 }
2722
2723 /*
2724  * SCSI specific functions
2725  */
2726
2727 static uint8_t
2728 umass_scsi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2729     uint8_t cmd_len)
2730 {
2731         if ((cmd_len == 0) ||
2732             (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2733                 DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2734                     "length: %d bytes\n", cmd_len);
2735                 return (0);             /* failure */
2736         }
2737         sc->sc_transfer.cmd_len = cmd_len;
2738
2739         switch (cmd_ptr[0]) {
2740         case TEST_UNIT_READY:
2741                 if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2742                         DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2743                             "to START_UNIT\n");
2744                         bzero(sc->sc_transfer.cmd_data, cmd_len);
2745                         sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2746                         sc->sc_transfer.cmd_data[4] = SSS_START;
2747                         return (1);
2748                 }
2749                 break;
2750
2751         case INQUIRY:
2752                 /*
2753                  * some drives wedge when asked for full inquiry
2754                  * information.
2755                  */
2756                 if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2757                         bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2758                         sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2759                         return (1);
2760                 }
2761                 break;
2762         }
2763
2764         bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2765         return (1);
2766 }
2767
2768 static uint8_t
2769 umass_rbc_transform(struct umass_softc *sc, uint8_t *cmd_ptr, uint8_t cmd_len)
2770 {
2771         if ((cmd_len == 0) ||
2772             (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2773                 DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2774                     "length: %d bytes\n", cmd_len);
2775                 return (0);             /* failure */
2776         }
2777         switch (cmd_ptr[0]) {
2778                 /* these commands are defined in RBC: */
2779         case READ_10:
2780         case READ_CAPACITY:
2781         case START_STOP_UNIT:
2782         case SYNCHRONIZE_CACHE:
2783         case WRITE_10:
2784         case 0x2f:                      /* VERIFY_10 is absent from
2785                                          * scsi_all.h??? */
2786         case INQUIRY:
2787         case MODE_SELECT_10:
2788         case MODE_SENSE_10:
2789         case TEST_UNIT_READY:
2790         case WRITE_BUFFER:
2791                 /*
2792                  * The following commands are not listed in my copy of the
2793                  * RBC specs. CAM however seems to want those, and at least
2794                  * the Sony DSC device appears to support those as well
2795                  */
2796         case REQUEST_SENSE:
2797         case PREVENT_ALLOW:
2798
2799                 bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2800
2801                 if ((sc->sc_quirks & RBC_PAD_TO_12) && (cmd_len < 12)) {
2802                         bzero(sc->sc_transfer.cmd_data + cmd_len, 12 - cmd_len);
2803                         cmd_len = 12;
2804                 }
2805                 sc->sc_transfer.cmd_len = cmd_len;
2806                 return (1);             /* sucess */
2807
2808                 /* All other commands are not legal in RBC */
2809         default:
2810                 DPRINTF(sc, UDMASS_SCSI, "Unsupported RBC "
2811                     "command 0x%02x\n", cmd_ptr[0]);
2812                 return (0);             /* failure */
2813         }
2814 }
2815
2816 static uint8_t
2817 umass_ufi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2818     uint8_t cmd_len)
2819 {
2820         if ((cmd_len == 0) ||
2821             (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2822                 DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2823                     "length: %d bytes\n", cmd_len);
2824                 return (0);             /* failure */
2825         }
2826         /* An UFI command is always 12 bytes in length */
2827         sc->sc_transfer.cmd_len = UFI_COMMAND_LENGTH;
2828
2829         /* Zero the command data */
2830         bzero(sc->sc_transfer.cmd_data, UFI_COMMAND_LENGTH);
2831
2832         switch (cmd_ptr[0]) {
2833                 /*
2834                  * Commands of which the format has been verified. They
2835                  * should work. Copy the command into the (zeroed out)
2836                  * destination buffer.
2837                  */
2838         case TEST_UNIT_READY:
2839                 if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2840                         /*
2841                          * Some devices do not support this command. Start
2842                          * Stop Unit should give the same results
2843                          */
2844                         DPRINTF(sc, UDMASS_UFI, "Converted TEST_UNIT_READY "
2845                             "to START_UNIT\n");
2846
2847                         sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2848                         sc->sc_transfer.cmd_data[4] = SSS_START;
2849                         return (1);
2850                 }
2851                 break;
2852
2853         case REZERO_UNIT:
2854         case REQUEST_SENSE:
2855         case FORMAT_UNIT:
2856         case INQUIRY:
2857         case START_STOP_UNIT:
2858         case SEND_DIAGNOSTIC:
2859         case PREVENT_ALLOW:
2860         case READ_CAPACITY:
2861         case READ_10:
2862         case WRITE_10:
2863         case POSITION_TO_ELEMENT:       /* SEEK_10 */
2864         case WRITE_AND_VERIFY:
2865         case VERIFY:
2866         case MODE_SELECT_10:
2867         case MODE_SENSE_10:
2868         case READ_12:
2869         case WRITE_12:
2870         case READ_FORMAT_CAPACITIES:
2871                 break;
2872
2873                 /*
2874                  * SYNCHRONIZE_CACHE isn't supported by UFI, nor should it be
2875                  * required for UFI devices, so it is appropriate to fake
2876                  * success.
2877                  */
2878         case SYNCHRONIZE_CACHE:
2879                 return (2);
2880
2881         default:
2882                 DPRINTF(sc, UDMASS_SCSI, "Unsupported UFI "
2883                     "command 0x%02x\n", cmd_ptr[0]);
2884                 return (0);             /* failure */
2885         }
2886
2887         bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2888         return (1);                     /* success */
2889 }
2890
2891 /*
2892  * 8070i (ATAPI) specific functions
2893  */
2894 static uint8_t
2895 umass_atapi_transform(struct umass_softc *sc, uint8_t *cmd_ptr,
2896     uint8_t cmd_len)
2897 {
2898         if ((cmd_len == 0) ||
2899             (cmd_len > sizeof(sc->sc_transfer.cmd_data))) {
2900                 DPRINTF(sc, UDMASS_SCSI, "Invalid command "
2901                     "length: %d bytes\n", cmd_len);
2902                 return (0);             /* failure */
2903         }
2904         /* An ATAPI command is always 12 bytes in length. */
2905         sc->sc_transfer.cmd_len = ATAPI_COMMAND_LENGTH;
2906
2907         /* Zero the command data */
2908         bzero(sc->sc_transfer.cmd_data, ATAPI_COMMAND_LENGTH);
2909
2910         switch (cmd_ptr[0]) {
2911                 /*
2912                  * Commands of which the format has been verified. They
2913                  * should work. Copy the command into the destination
2914                  * buffer.
2915                  */
2916         case INQUIRY:
2917                 /*
2918                  * some drives wedge when asked for full inquiry
2919                  * information.
2920                  */
2921                 if (sc->sc_quirks & FORCE_SHORT_INQUIRY) {
2922                         bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2923
2924                         sc->sc_transfer.cmd_data[4] = SHORT_INQUIRY_LENGTH;
2925                         return (1);
2926                 }
2927                 break;
2928
2929         case TEST_UNIT_READY:
2930                 if (sc->sc_quirks & NO_TEST_UNIT_READY) {
2931                         DPRINTF(sc, UDMASS_SCSI, "Converted TEST_UNIT_READY "
2932                             "to START_UNIT\n");
2933                         sc->sc_transfer.cmd_data[0] = START_STOP_UNIT;
2934                         sc->sc_transfer.cmd_data[4] = SSS_START;
2935                         return (1);
2936                 }
2937                 break;
2938
2939         case REZERO_UNIT:
2940         case REQUEST_SENSE:
2941         case START_STOP_UNIT:
2942         case SEND_DIAGNOSTIC:
2943         case PREVENT_ALLOW:
2944         case READ_CAPACITY:
2945         case READ_10:
2946         case WRITE_10:
2947         case POSITION_TO_ELEMENT:       /* SEEK_10 */
2948         case SYNCHRONIZE_CACHE:
2949         case MODE_SELECT_10:
2950         case MODE_SENSE_10:
2951         case READ_BUFFER:
2952         case 0x42:                      /* READ_SUBCHANNEL */
2953         case 0x43:                      /* READ_TOC */
2954         case 0x44:                      /* READ_HEADER */
2955         case 0x47:                      /* PLAY_MSF (Play Minute/Second/Frame) */
2956         case 0x48:                      /* PLAY_TRACK */
2957         case 0x49:                      /* PLAY_TRACK_REL */
2958         case 0x4b:                      /* PAUSE */
2959         case 0x51:                      /* READ_DISK_INFO */
2960         case 0x52:                      /* READ_TRACK_INFO */
2961         case 0x54:                      /* SEND_OPC */
2962         case 0x59:                      /* READ_MASTER_CUE */
2963         case 0x5b:                      /* CLOSE_TR_SESSION */
2964         case 0x5c:                      /* READ_BUFFER_CAP */
2965         case 0x5d:                      /* SEND_CUE_SHEET */
2966         case 0xa1:                      /* BLANK */
2967         case 0xa5:                      /* PLAY_12 */
2968         case 0xa6:                      /* EXCHANGE_MEDIUM */
2969         case 0xad:                      /* READ_DVD_STRUCTURE */
2970         case 0xbb:                      /* SET_CD_SPEED */
2971         case 0xe5:                      /* READ_TRACK_INFO_PHILIPS */
2972                 break;
2973
2974         case READ_12:
2975         case WRITE_12:
2976         default:
2977                 DPRINTF(sc, UDMASS_SCSI, "Unsupported ATAPI "
2978                     "command 0x%02x - trying anyway\n",
2979                     cmd_ptr[0]);
2980                 break;
2981         }
2982
2983         bcopy(cmd_ptr, sc->sc_transfer.cmd_data, cmd_len);
2984         return (1);                     /* success */
2985 }
2986
2987 static uint8_t
2988 umass_no_transform(struct umass_softc *sc, uint8_t *cmd,
2989     uint8_t cmdlen)
2990 {
2991         return (0);                     /* failure */
2992 }
2993
2994 static uint8_t
2995 umass_std_transform(struct umass_softc *sc, union ccb *ccb,
2996     uint8_t *cmd, uint8_t cmdlen)
2997 {
2998         uint8_t retval;
2999
3000         retval = (sc->sc_transform) (sc, cmd, cmdlen);
3001
3002         if (retval == 2) {
3003                 ccb->ccb_h.status = CAM_REQ_CMP;
3004                 xpt_done(ccb);
3005                 return (0);
3006         } else if (retval == 0) {
3007                 ccb->ccb_h.status = CAM_REQ_INVALID;
3008                 xpt_done(ccb);
3009                 return (0);
3010         }
3011         /* Command should be executed */
3012         return (1);
3013 }
3014
3015 #ifdef USB_DEBUG
3016 static void
3017 umass_bbb_dump_cbw(struct umass_softc *sc, umass_bbb_cbw_t *cbw)
3018 {
3019         uint8_t *c = cbw->CBWCDB;
3020
3021         uint32_t dlen = UGETDW(cbw->dCBWDataTransferLength);
3022         uint32_t tag = UGETDW(cbw->dCBWTag);
3023
3024         uint8_t clen = cbw->bCDBLength;
3025         uint8_t flags = cbw->bCBWFlags;
3026         uint8_t lun = cbw->bCBWLUN;
3027
3028         DPRINTF(sc, UDMASS_BBB, "CBW %d: cmd = %db "
3029             "(0x%02x%02x%02x%02x%02x%02x%s), "
3030             "data = %db, lun = %d, dir = %s\n",
3031             tag, clen,
3032             c[0], c[1], c[2], c[3], c[4], c[5], (clen > 6 ? "..." : ""),
3033             dlen, lun, (flags == CBWFLAGS_IN ? "in" :
3034             (flags == CBWFLAGS_OUT ? "out" : "<invalid>")));
3035 }
3036
3037 static void
3038 umass_bbb_dump_csw(struct umass_softc *sc, umass_bbb_csw_t *csw)
3039 {
3040         uint32_t sig = UGETDW(csw->dCSWSignature);
3041         uint32_t tag = UGETDW(csw->dCSWTag);
3042         uint32_t res = UGETDW(csw->dCSWDataResidue);
3043         uint8_t status = csw->bCSWStatus;
3044
3045         DPRINTF(sc, UDMASS_BBB, "CSW %d: sig = 0x%08x (%s), tag = 0x%08x, "
3046             "res = %d, status = 0x%02x (%s)\n",
3047             tag, sig, (sig == CSWSIGNATURE ? "valid" : "invalid"),
3048             tag, res,
3049             status, (status == CSWSTATUS_GOOD ? "good" :
3050             (status == CSWSTATUS_FAILED ? "failed" :
3051             (status == CSWSTATUS_PHASE ? "phase" : "<invalid>"))));
3052 }
3053
3054 static void
3055 umass_cbi_dump_cmd(struct umass_softc *sc, void *cmd, uint8_t cmdlen)
3056 {
3057         uint8_t *c = cmd;
3058         uint8_t dir = sc->sc_transfer.dir;
3059
3060         DPRINTF(sc, UDMASS_BBB, "cmd = %db "
3061             "(0x%02x%02x%02x%02x%02x%02x%s), "
3062             "data = %db, dir = %s\n",
3063             cmdlen,
3064             c[0], c[1], c[2], c[3], c[4], c[5], (cmdlen > 6 ? "..." : ""),
3065             sc->sc_transfer.data_len,
3066             (dir == DIR_IN ? "in" :
3067             (dir == DIR_OUT ? "out" :
3068             (dir == DIR_NONE ? "no data phase" : "<invalid>"))));
3069 }
3070
3071 static void
3072 umass_dump_buffer(struct umass_softc *sc, uint8_t *buffer, uint32_t buflen,
3073     uint32_t printlen)
3074 {
3075         uint32_t i, j;
3076         char s1[40];
3077         char s2[40];
3078         char s3[5];
3079
3080         s1[0] = '\0';
3081         s3[0] = '\0';
3082
3083         sprintf(s2, " buffer=%p, buflen=%d", buffer, buflen);
3084         for (i = 0; (i < buflen) && (i < printlen); i++) {
3085                 j = i % 16;
3086                 if (j == 0 && i != 0) {
3087                         DPRINTF(sc, UDMASS_GEN, "0x %s%s\n",
3088                             s1, s2);
3089                         s2[0] = '\0';
3090                 }
3091                 sprintf(&s1[j * 2], "%02x", buffer[i] & 0xff);
3092         }
3093         if (buflen > printlen)
3094                 sprintf(s3, " ...");
3095         DPRINTF(sc, UDMASS_GEN, "0x %s%s%s\n",
3096             s1, s2, s3);
3097 }
3098
3099 #endif