3 * Copyright (c) 2008,2011 Hans Petter Selasky. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * The following file contains code that will detect USB autoinstall
31 * TODO: Potentially we could add code to automatically detect USB
32 * mass storage quirks for not supported SCSI commands!
35 #include <sys/stdint.h>
36 #include <sys/stddef.h>
37 #include <sys/param.h>
38 #include <sys/queue.h>
39 #include <sys/types.h>
40 #include <sys/systm.h>
41 #include <sys/kernel.h>
43 #include <sys/module.h>
45 #include <sys/mutex.h>
46 #include <sys/condvar.h>
47 #include <sys/sysctl.h>
49 #include <sys/unistd.h>
50 #include <sys/callout.h>
51 #include <sys/malloc.h>
54 #include <dev/usb/usb.h>
55 #include <dev/usb/usbdi.h>
56 #include <dev/usb/usbdi_util.h>
58 #define USB_DEBUG_VAR usb_debug
60 #include <dev/usb/usb_busdma.h>
61 #include <dev/usb/usb_process.h>
62 #include <dev/usb/usb_transfer.h>
63 #include <dev/usb/usb_msctest.h>
64 #include <dev/usb/usb_debug.h>
65 #include <dev/usb/usb_busdma.h>
66 #include <dev/usb/usb_device.h>
67 #include <dev/usb/usb_request.h>
68 #include <dev/usb/usb_util.h>
69 #include <dev/usb/quirk/usb_quirk.h>
87 #define SCSI_MAX_LEN 0x100
88 #define SCSI_INQ_LEN 0x24
89 #define SCSI_SENSE_LEN 0xFF
91 static uint8_t scsi_test_unit_ready[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
92 static uint8_t scsi_inquiry[] = { 0x12, 0x00, 0x00, 0x00, SCSI_INQ_LEN, 0x00 };
93 static uint8_t scsi_rezero_init[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00 };
94 static uint8_t scsi_start_stop_unit[] = { 0x1b, 0x00, 0x00, 0x00, 0x02, 0x00 };
95 static uint8_t scsi_ztestor_eject[] = { 0x85, 0x01, 0x01, 0x01, 0x18, 0x01,
96 0x01, 0x01, 0x01, 0x01, 0x00, 0x00 };
97 static uint8_t scsi_cmotech_eject[] = { 0xff, 0x52, 0x44, 0x45, 0x56, 0x43,
99 static uint8_t scsi_huawei_eject[] = { 0x11, 0x06, 0x00, 0x00, 0x00, 0x00,
100 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
101 0x00, 0x00, 0x00, 0x00 };
102 static uint8_t scsi_tct_eject[] = { 0x06, 0xf5, 0x04, 0x02, 0x52, 0x70 };
103 static uint8_t scsi_sync_cache[] = { 0x35, 0x00, 0x00, 0x00, 0x00, 0x00,
104 0x00, 0x00, 0x00, 0x00 };
105 static uint8_t scsi_request_sense[] = { 0x03, 0x00, 0x00, 0x00, 0x12, 0x00,
106 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
108 #define BULK_SIZE 64 /* dummy */
109 #define ERR_CSW_FAILED -1
111 /* Command Block Wrapper */
113 uDWord dCBWSignature;
114 #define CBWSIGNATURE 0x43425355
116 uDWord dCBWDataTransferLength;
118 #define CBWFLAGS_OUT 0x00
119 #define CBWFLAGS_IN 0x80
122 #define CBWCDBLENGTH 16
123 uByte CBWCDB[CBWCDBLENGTH];
126 /* Command Status Wrapper */
128 uDWord dCSWSignature;
129 #define CSWSIGNATURE 0x53425355
131 uDWord dCSWDataResidue;
133 #define CSWSTATUS_GOOD 0x0
134 #define CSWSTATUS_FAILED 0x1
135 #define CSWSTATUS_PHASE 0x2
138 struct bbb_transfer {
144 struct usb_xfer *xfer[ST_MAX];
148 usb_size_t data_len; /* bytes */
149 usb_size_t data_rem; /* bytes */
150 usb_timeout_t data_timeout; /* ms */
151 usb_frlength_t actlen; /* bytes */
153 uint8_t cmd_len; /* bytes */
160 uint8_t buffer[SCSI_MAX_LEN] __aligned(4);
163 static usb_callback_t bbb_command_callback;
164 static usb_callback_t bbb_data_read_callback;
165 static usb_callback_t bbb_data_rd_cs_callback;
166 static usb_callback_t bbb_data_write_callback;
167 static usb_callback_t bbb_data_wr_cs_callback;
168 static usb_callback_t bbb_status_callback;
170 static void bbb_done(struct bbb_transfer *, int);
171 static void bbb_transfer_start(struct bbb_transfer *, uint8_t);
172 static void bbb_data_clear_stall_callback(struct usb_xfer *, uint8_t,
174 static int bbb_command_start(struct bbb_transfer *, uint8_t, uint8_t,
175 void *, size_t, void *, size_t, usb_timeout_t);
176 static struct bbb_transfer *bbb_attach(struct usb_device *, uint8_t);
177 static void bbb_detach(struct bbb_transfer *);
179 static const struct usb_config bbb_config[ST_MAX] = {
183 .endpoint = UE_ADDR_ANY,
184 .direction = UE_DIR_OUT,
185 .bufsize = sizeof(struct bbb_cbw),
186 .flags = {.ext_buffer = 1,},
187 .callback = &bbb_command_callback,
188 .timeout = 4 * USB_MS_HZ, /* 4 seconds */
193 .endpoint = UE_ADDR_ANY,
194 .direction = UE_DIR_IN,
195 .bufsize = BULK_SIZE,
196 .flags = {.ext_buffer = 1,.proxy_buffer = 1,.short_xfer_ok = 1,},
197 .callback = &bbb_data_read_callback,
198 .timeout = 4 * USB_MS_HZ, /* 4 seconds */
203 .endpoint = 0x00, /* Control pipe */
204 .direction = UE_DIR_ANY,
205 .bufsize = sizeof(struct usb_device_request),
206 .callback = &bbb_data_rd_cs_callback,
207 .timeout = 1 * USB_MS_HZ, /* 1 second */
212 .endpoint = UE_ADDR_ANY,
213 .direction = UE_DIR_OUT,
214 .bufsize = BULK_SIZE,
215 .flags = {.ext_buffer = 1,.proxy_buffer = 1,},
216 .callback = &bbb_data_write_callback,
217 .timeout = 4 * USB_MS_HZ, /* 4 seconds */
222 .endpoint = 0x00, /* Control pipe */
223 .direction = UE_DIR_ANY,
224 .bufsize = sizeof(struct usb_device_request),
225 .callback = &bbb_data_wr_cs_callback,
226 .timeout = 1 * USB_MS_HZ, /* 1 second */
231 .endpoint = UE_ADDR_ANY,
232 .direction = UE_DIR_IN,
233 .bufsize = sizeof(struct bbb_csw),
234 .flags = {.ext_buffer = 1,.short_xfer_ok = 1,},
235 .callback = &bbb_status_callback,
236 .timeout = 1 * USB_MS_HZ, /* 1 second */
241 bbb_done(struct bbb_transfer *sc, int error)
245 sc->state = ST_COMMAND;
251 bbb_transfer_start(struct bbb_transfer *sc, uint8_t xfer_index)
253 sc->state = xfer_index;
254 usbd_transfer_start(sc->xfer[xfer_index]);
258 bbb_data_clear_stall_callback(struct usb_xfer *xfer,
259 uint8_t next_xfer, uint8_t stall_xfer)
261 struct bbb_transfer *sc = usbd_xfer_softc(xfer);
263 if (usbd_clear_stall_callback(xfer, sc->xfer[stall_xfer])) {
264 switch (USB_GET_STATE(xfer)) {
266 case USB_ST_TRANSFERRED:
267 bbb_transfer_start(sc, next_xfer);
270 bbb_done(sc, USB_ERR_STALLED);
277 bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
279 struct bbb_transfer *sc = usbd_xfer_softc(xfer);
282 switch (USB_GET_STATE(xfer)) {
283 case USB_ST_TRANSFERRED:
285 (sc, ((sc->dir == DIR_IN) ? ST_DATA_RD :
286 (sc->dir == DIR_OUT) ? ST_DATA_WR :
292 tag = UGETDW(sc->cbw.dCBWTag) + 1;
293 USETDW(sc->cbw.dCBWSignature, CBWSIGNATURE);
294 USETDW(sc->cbw.dCBWTag, tag);
295 USETDW(sc->cbw.dCBWDataTransferLength, (uint32_t)sc->data_len);
296 sc->cbw.bCBWFlags = ((sc->dir == DIR_IN) ? CBWFLAGS_IN : CBWFLAGS_OUT);
297 sc->cbw.bCBWLUN = sc->lun;
298 sc->cbw.bCDBLength = sc->cmd_len;
299 if (sc->cbw.bCDBLength > sizeof(sc->cbw.CBWCDB)) {
300 sc->cbw.bCDBLength = sizeof(sc->cbw.CBWCDB);
301 DPRINTFN(0, "Truncating long command\n");
303 usbd_xfer_set_frame_data(xfer, 0, &sc->cbw, sizeof(sc->cbw));
304 usbd_transfer_submit(xfer);
314 bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
316 struct bbb_transfer *sc = usbd_xfer_softc(xfer);
317 usb_frlength_t max_bulk = usbd_xfer_max_len(xfer);
320 usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
322 switch (USB_GET_STATE(xfer)) {
323 case USB_ST_TRANSFERRED:
324 sc->data_rem -= actlen;
325 sc->data_ptr += actlen;
326 sc->actlen += actlen;
328 if (actlen < sumlen) {
333 DPRINTF("max_bulk=%d, data_rem=%d\n",
334 max_bulk, sc->data_rem);
336 if (sc->data_rem == 0) {
337 bbb_transfer_start(sc, ST_STATUS);
340 if (max_bulk > sc->data_rem) {
341 max_bulk = sc->data_rem;
343 usbd_xfer_set_timeout(xfer, sc->data_timeout);
344 usbd_xfer_set_frame_data(xfer, 0, sc->data_ptr, max_bulk);
345 usbd_transfer_submit(xfer);
349 if (error == USB_ERR_CANCELLED) {
352 bbb_transfer_start(sc, ST_DATA_RD_CS);
359 bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
361 bbb_data_clear_stall_callback(xfer, ST_STATUS,
366 bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
368 struct bbb_transfer *sc = usbd_xfer_softc(xfer);
369 usb_frlength_t max_bulk = usbd_xfer_max_len(xfer);
372 usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
374 switch (USB_GET_STATE(xfer)) {
375 case USB_ST_TRANSFERRED:
376 sc->data_rem -= actlen;
377 sc->data_ptr += actlen;
378 sc->actlen += actlen;
380 if (actlen < sumlen) {
385 DPRINTF("max_bulk=%d, data_rem=%d\n",
386 max_bulk, sc->data_rem);
388 if (sc->data_rem == 0) {
389 bbb_transfer_start(sc, ST_STATUS);
392 if (max_bulk > sc->data_rem) {
393 max_bulk = sc->data_rem;
395 usbd_xfer_set_timeout(xfer, sc->data_timeout);
396 usbd_xfer_set_frame_data(xfer, 0, sc->data_ptr, max_bulk);
397 usbd_transfer_submit(xfer);
401 if (error == USB_ERR_CANCELLED) {
404 bbb_transfer_start(sc, ST_DATA_WR_CS);
412 bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
414 bbb_data_clear_stall_callback(xfer, ST_STATUS,
419 bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
421 struct bbb_transfer *sc = usbd_xfer_softc(xfer);
424 usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
426 switch (USB_GET_STATE(xfer)) {
427 case USB_ST_TRANSFERRED:
429 /* very simple status check */
431 if (actlen < sizeof(sc->csw)) {
432 bbb_done(sc, USB_ERR_SHORT_XFER);
433 } else if (sc->csw.bCSWStatus == CSWSTATUS_GOOD) {
434 bbb_done(sc, 0); /* success */
436 bbb_done(sc, ERR_CSW_FAILED); /* error */
441 usbd_xfer_set_frame_data(xfer, 0, &sc->csw, sizeof(sc->csw));
442 usbd_transfer_submit(xfer);
446 DPRINTF("Failed to read CSW: %s, try %d\n",
447 usbd_errstr(error), sc->status_try);
449 if (error == USB_ERR_CANCELLED || sc->status_try) {
453 bbb_transfer_start(sc, ST_DATA_RD_CS);
459 /*------------------------------------------------------------------------*
460 * bbb_command_start - execute a SCSI command synchronously
465 *------------------------------------------------------------------------*/
467 bbb_command_start(struct bbb_transfer *sc, uint8_t dir, uint8_t lun,
468 void *data_ptr, size_t data_len, void *cmd_ptr, size_t cmd_len,
469 usb_timeout_t data_timeout)
472 sc->dir = data_len ? dir : DIR_NONE;
473 sc->data_ptr = data_ptr;
474 sc->data_len = data_len;
475 sc->data_rem = data_len;
476 sc->data_timeout = (data_timeout + USB_MS_HZ);
478 sc->cmd_len = cmd_len;
479 bzero(&sc->cbw.CBWCDB, sizeof(sc->cbw.CBWCDB));
480 bcopy(cmd_ptr, &sc->cbw.CBWCDB, cmd_len);
481 DPRINTFN(1, "SCSI cmd = %*D\n", (int)cmd_len, &sc->cbw.CBWCDB, ":");
484 usbd_transfer_start(sc->xfer[sc->state]);
486 while (usbd_transfer_pending(sc->xfer[sc->state])) {
487 cv_wait(&sc->cv, &sc->mtx);
489 mtx_unlock(&sc->mtx);
493 static struct bbb_transfer *
494 bbb_attach(struct usb_device *udev, uint8_t iface_index)
496 struct usb_interface *iface;
497 struct usb_interface_descriptor *id;
498 struct bbb_transfer *sc;
502 /* automatic locking */
503 if (usbd_enum_is_locked(udev)) {
507 usbd_enum_lock(udev);
511 * Make sure any driver which is hooked up to this interface,
512 * like umass is gone:
514 usb_detach_device(udev, iface_index, 0);
517 usbd_enum_unlock(udev);
519 iface = usbd_get_iface(udev, iface_index);
524 if (id == NULL || id->bInterfaceClass != UICLASS_MASS)
527 switch (id->bInterfaceSubClass) {
528 case UISUBCLASS_SCSI:
530 case UISUBCLASS_SFF8020I:
531 case UISUBCLASS_SFF8070I:
537 switch (id->bInterfaceProtocol) {
538 case UIPROTO_MASS_BBB_OLD:
539 case UIPROTO_MASS_BBB:
545 sc = malloc(sizeof(*sc), M_USB, M_WAITOK | M_ZERO);
546 mtx_init(&sc->mtx, "USB autoinstall", NULL, MTX_DEF);
547 cv_init(&sc->cv, "WBBB");
549 err = usbd_transfer_setup(udev, &iface_index, sc->xfer, bbb_config,
550 ST_MAX, sc, &sc->mtx);
559 bbb_detach(struct bbb_transfer *sc)
561 usbd_transfer_unsetup(sc->xfer, ST_MAX);
562 mtx_destroy(&sc->mtx);
567 /*------------------------------------------------------------------------*
571 * 1: This interface is an auto install disk (CD-ROM)
572 * 0: Not an auto install disk.
573 *------------------------------------------------------------------------*/
575 usb_iface_is_cdrom(struct usb_device *udev, uint8_t iface_index)
577 struct bbb_transfer *sc;
583 sc = bbb_attach(udev, iface_index);
588 timeout = 4; /* tries */
590 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer,
591 SCSI_INQ_LEN, &scsi_inquiry, sizeof(scsi_inquiry),
594 if (err == 0 && sc->actlen > 0) {
595 sid_type = sc->buffer[0] & 0x1F;
596 if (sid_type == 0x05)
599 } else if (err != ERR_CSW_FAILED)
600 break; /* non retryable error */
601 usb_pause_mtx(NULL, hz);
608 usb_msc_get_max_lun(struct usb_device *udev, uint8_t iface_index)
610 struct usb_device_request req;
615 /* The Get Max Lun command is a class-specific request. */
616 req.bmRequestType = UT_READ_CLASS_INTERFACE;
617 req.bRequest = 0xFE; /* GET_MAX_LUN */
618 USETW(req.wValue, 0);
619 req.wIndex[0] = iface_index;
621 USETW(req.wLength, 1);
623 err = usbd_do_request(udev, NULL, &req, &buf);
631 usb_msc_auto_quirk(struct usb_device *udev, uint8_t iface_index)
633 struct bbb_transfer *sc;
635 uint8_t is_no_direct;
639 sc = bbb_attach(udev, iface_index);
644 * Some devices need a delay after that the configuration
645 * value is set to function properly:
647 usb_pause_mtx(NULL, hz);
649 if (usb_msc_get_max_lun(udev, iface_index) == 0) {
650 DPRINTF("Device has only got one LUN.\n");
651 usbd_add_dynamic_quirk(udev, UQ_MSC_NO_GETMAXLUN);
655 for (timeout = 4; timeout; timeout--) {
656 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer,
657 SCSI_INQ_LEN, &scsi_inquiry, sizeof(scsi_inquiry),
660 if (err == 0 && sc->actlen > 0) {
661 sid_type = sc->buffer[0] & 0x1F;
662 if (sid_type == 0x00)
665 } else if (err != ERR_CSW_FAILED)
666 break; /* non retryable error */
667 usb_pause_mtx(NULL, hz);
671 DPRINTF("Device is not direct access.\n");
675 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
676 &scsi_test_unit_ready, sizeof(scsi_test_unit_ready),
681 if (err != ERR_CSW_FAILED)
685 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
686 &scsi_sync_cache, sizeof(scsi_sync_cache),
691 if (err != ERR_CSW_FAILED)
694 DPRINTF("Device doesn't handle synchronize cache\n");
696 usbd_add_dynamic_quirk(udev, UQ_MSC_NO_SYNC_CACHE);
699 /* clear sense status of any failed commands on the device */
701 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer,
702 SCSI_INQ_LEN, &scsi_inquiry, sizeof(scsi_inquiry),
705 DPRINTF("Inquiry = %d\n", err);
709 if (err != ERR_CSW_FAILED)
713 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer,
714 SCSI_SENSE_LEN, &scsi_request_sense,
715 sizeof(scsi_request_sense), USB_MS_HZ);
717 DPRINTF("Request sense = %d\n", err);
721 if (err != ERR_CSW_FAILED)
732 DPRINTF("Device did not respond, enabling all quirks\n");
734 usbd_add_dynamic_quirk(udev, UQ_MSC_NO_SYNC_CACHE);
735 usbd_add_dynamic_quirk(udev, UQ_MSC_NO_TEST_UNIT_READY);
737 /* Need to re-enumerate the device */
738 usbd_req_re_enumerate(udev, NULL);
740 return (USB_ERR_STALLED);
744 usb_msc_eject(struct usb_device *udev, uint8_t iface_index, int method)
746 struct bbb_transfer *sc;
749 sc = bbb_attach(udev, iface_index);
751 return (USB_ERR_INVAL);
755 case MSC_EJECT_STOPUNIT:
756 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
757 &scsi_test_unit_ready, sizeof(scsi_test_unit_ready),
759 DPRINTF("Test unit ready status: %s\n", usbd_errstr(err));
760 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
761 &scsi_start_stop_unit, sizeof(scsi_start_stop_unit),
764 case MSC_EJECT_REZERO:
765 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
766 &scsi_rezero_init, sizeof(scsi_rezero_init),
769 case MSC_EJECT_ZTESTOR:
770 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
771 &scsi_ztestor_eject, sizeof(scsi_ztestor_eject),
774 case MSC_EJECT_CMOTECH:
775 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
776 &scsi_cmotech_eject, sizeof(scsi_cmotech_eject),
779 case MSC_EJECT_HUAWEI:
780 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
781 &scsi_huawei_eject, sizeof(scsi_huawei_eject),
786 * TCTMobile needs DIR_IN flag. To get it, we
787 * supply a dummy data with the command.
789 err = bbb_command_start(sc, DIR_IN, 0, &sc->buffer,
790 sizeof(sc->buffer), &scsi_tct_eject,
791 sizeof(scsi_tct_eject), USB_MS_HZ);
794 printf("usb_msc_eject: unknown eject method (%d)\n", method);
797 DPRINTF("Eject CD command status: %s\n", usbd_errstr(err));