1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2008-2022 Hans Petter Selasky. 5 * Copyright (c) 2021-2022 Idwer Vollering. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 /* 30 * The following file contains code that will detect USB autoinstall 31 * disks. 32 */ 33 34 #ifdef USB_GLOBAL_INCLUDE_FILE 35 #include USB_GLOBAL_INCLUDE_FILE 36 #else 37 #include <sys/stdint.h> 38 #include <sys/stddef.h> 39 #include <sys/param.h> 40 #include <sys/queue.h> 41 #include <sys/types.h> 42 #include <sys/systm.h> 43 #include <sys/kernel.h> 44 #include <sys/bus.h> 45 #include <sys/module.h> 46 #include <sys/lock.h> 47 #include <sys/mutex.h> 48 #include <sys/condvar.h> 49 #include <sys/sysctl.h> 50 #include <sys/sx.h> 51 #include <sys/unistd.h> 52 #include <sys/callout.h> 53 #include <sys/malloc.h> 54 #include <sys/priv.h> 55 56 #include <dev/usb/usb.h> 57 #include <dev/usb/usbdi.h> 58 #include <dev/usb/usbdi_util.h> 59 60 #define USB_DEBUG_VAR usb_debug 61 62 #include <dev/usb/usb_busdma.h> 63 #include <dev/usb/usb_process.h> 64 #include <dev/usb/usb_transfer.h> 65 #include <dev/usb/usb_msctest.h> 66 #include <dev/usb/usb_debug.h> 67 #include <dev/usb/usb_device.h> 68 #include <dev/usb/usb_request.h> 69 #include <dev/usb/usb_util.h> 70 #include <dev/usb/quirk/usb_quirk.h> 71 #endif /* USB_GLOBAL_INCLUDE_FILE */ 72 73 enum { 74 ST_COMMAND, 75 ST_DATA_RD, 76 ST_DATA_RD_CS, 77 ST_DATA_WR, 78 ST_DATA_WR_CS, 79 ST_STATUS, 80 ST_MAX, 81 }; 82 83 enum { 84 DIR_IN, 85 DIR_OUT, 86 DIR_NONE, 87 }; 88 89 #define SCSI_MAX_LEN MAX(SCSI_FIXED_BLOCK_SIZE, USB_MSCTEST_BULK_SIZE) 90 #define SCSI_INQ_LEN 0x24 91 #define SCSI_SENSE_LEN 0xFF 92 #define SCSI_FIXED_BLOCK_SIZE 512 /* bytes */ 93 94 static uint8_t scsi_test_unit_ready[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 95 static uint8_t scsi_inquiry[] = { 0x12, 0x00, 0x00, 0x00, SCSI_INQ_LEN, 0x00 }; 96 static uint8_t scsi_rezero_init[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00 }; 97 static uint8_t scsi_start_unit[] = { 0x1b, 0x00, 0x00, 0x00, 0x01, 0x00 }; 98 static uint8_t scsi_stop_unit[] = { 0x1b, 0x00, 0x00, 0x00, 0x02, 0x00 }; 99 static uint8_t scsi_ztestor_eject[] = { 0x85, 0x01, 0x01, 0x01, 0x18, 0x01, 100 0x01, 0x01, 0x01, 0x01, 0x00, 0x00 }; 101 static uint8_t scsi_cmotech_eject[] = { 0xff, 0x52, 0x44, 0x45, 0x56, 0x43, 102 0x48, 0x47 }; 103 static uint8_t scsi_huawei_eject[] = { 0x11, 0x06, 0x00, 0x00, 0x00, 0x00, 104 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 105 0x00, 0x00, 0x00, 0x00 }; 106 static uint8_t scsi_huawei_eject2[] = { 0x11, 0x06, 0x20, 0x00, 0x00, 0x01, 107 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 108 0x00, 0x00, 0x00, 0x00 }; 109 static uint8_t scsi_huawei_eject3[] = { 0x11, 0x06, 0x20, 0x00, 0x00, 0x01, 110 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 111 0x00, 0x00, 0x00, 0x00 }; 112 static uint8_t scsi_huawei_eject4[] = { 0x11, 0x06, 0x30, 0x00, 0x00, 0x00, 113 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 114 0x00, 0x00, 0x00, 0x00 }; 115 static uint8_t scsi_tct_eject[] = { 0x06, 0xf5, 0x04, 0x02, 0x52, 0x70 }; 116 static uint8_t scsi_sync_cache[] = { 0x35, 0x00, 0x00, 0x00, 0x00, 0x00, 117 0x00, 0x00, 0x00, 0x00 }; 118 static uint8_t scsi_request_sense[] = { 0x03, 0x00, 0x00, 0x00, 0x12, 0x00, 119 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 120 static uint8_t scsi_read_capacity[] = { 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 121 0x00, 0x00, 0x00, 0x00 }; 122 static uint8_t scsi_prevent_removal[] = { 0x1e, 0, 0, 0, 1, 0 }; 123 static uint8_t scsi_allow_removal[] = { 0x1e, 0, 0, 0, 0, 0 }; 124 125 #ifndef USB_MSCTEST_BULK_SIZE 126 #define USB_MSCTEST_BULK_SIZE 64 /* dummy */ 127 #endif 128 129 #define ERR_CSW_FAILED -1 130 131 /* Command Block Wrapper */ 132 struct bbb_cbw { 133 uDWord dCBWSignature; 134 #define CBWSIGNATURE 0x43425355 135 uDWord dCBWTag; 136 uDWord dCBWDataTransferLength; 137 uByte bCBWFlags; 138 #define CBWFLAGS_OUT 0x00 139 #define CBWFLAGS_IN 0x80 140 uByte bCBWLUN; 141 uByte bCDBLength; 142 #define CBWCDBLENGTH 16 143 uByte CBWCDB[CBWCDBLENGTH]; 144 } __packed; 145 146 /* Command Status Wrapper */ 147 struct bbb_csw { 148 uDWord dCSWSignature; 149 #define CSWSIGNATURE 0x53425355 150 uDWord dCSWTag; 151 uDWord dCSWDataResidue; 152 uByte bCSWStatus; 153 #define CSWSTATUS_GOOD 0x0 154 #define CSWSTATUS_FAILED 0x1 155 #define CSWSTATUS_PHASE 0x2 156 } __packed; 157 158 struct bbb_transfer { 159 struct mtx mtx; 160 struct cv cv; 161 struct bbb_cbw *cbw; 162 struct bbb_csw *csw; 163 164 struct usb_xfer *xfer[ST_MAX]; 165 166 uint8_t *data_ptr; 167 168 usb_size_t data_len; /* bytes */ 169 usb_size_t data_rem; /* bytes */ 170 usb_timeout_t data_timeout; /* ms */ 171 usb_frlength_t actlen; /* bytes */ 172 usb_frlength_t buffer_size; /* bytes */ 173 174 uint8_t cmd_len; /* bytes */ 175 uint8_t dir; 176 uint8_t lun; 177 uint8_t state; 178 uint8_t status_try; 179 int error; 180 181 uint8_t *buffer; 182 }; 183 184 static usb_callback_t bbb_command_callback; 185 static usb_callback_t bbb_data_read_callback; 186 static usb_callback_t bbb_data_rd_cs_callback; 187 static usb_callback_t bbb_data_write_callback; 188 static usb_callback_t bbb_data_wr_cs_callback; 189 static usb_callback_t bbb_status_callback; 190 static usb_callback_t bbb_raw_write_callback; 191 192 static void bbb_done(struct bbb_transfer *, int); 193 static void bbb_transfer_start(struct bbb_transfer *, uint8_t); 194 static void bbb_data_clear_stall_callback(struct usb_xfer *, uint8_t, 195 uint8_t); 196 static int bbb_command_start(struct bbb_transfer *, uint8_t, uint8_t, 197 void *, size_t, void *, size_t, usb_timeout_t); 198 static struct bbb_transfer *bbb_attach(struct usb_device *, uint8_t, uint8_t); 199 static void bbb_detach(struct bbb_transfer *); 200 201 static const struct usb_config bbb_config[ST_MAX] = { 202 [ST_COMMAND] = { 203 .type = UE_BULK, 204 .endpoint = UE_ADDR_ANY, 205 .direction = UE_DIR_OUT, 206 .bufsize = sizeof(struct bbb_cbw), 207 .callback = &bbb_command_callback, 208 .timeout = 4 * USB_MS_HZ, /* 4 seconds */ 209 }, 210 211 [ST_DATA_RD] = { 212 .type = UE_BULK, 213 .endpoint = UE_ADDR_ANY, 214 .direction = UE_DIR_IN, 215 .bufsize = SCSI_MAX_LEN, 216 .flags = {.proxy_buffer = 1,.short_xfer_ok = 1,}, 217 .callback = &bbb_data_read_callback, 218 .timeout = 4 * USB_MS_HZ, /* 4 seconds */ 219 }, 220 221 [ST_DATA_RD_CS] = { 222 .type = UE_CONTROL, 223 .endpoint = 0x00, /* Control pipe */ 224 .direction = UE_DIR_ANY, 225 .bufsize = sizeof(struct usb_device_request), 226 .callback = &bbb_data_rd_cs_callback, 227 .timeout = 1 * USB_MS_HZ, /* 1 second */ 228 }, 229 230 [ST_DATA_WR] = { 231 .type = UE_BULK, 232 .endpoint = UE_ADDR_ANY, 233 .direction = UE_DIR_OUT, 234 .bufsize = SCSI_MAX_LEN, 235 .flags = {.ext_buffer = 1,.proxy_buffer = 1,}, 236 .callback = &bbb_data_write_callback, 237 .timeout = 4 * USB_MS_HZ, /* 4 seconds */ 238 }, 239 240 [ST_DATA_WR_CS] = { 241 .type = UE_CONTROL, 242 .endpoint = 0x00, /* Control pipe */ 243 .direction = UE_DIR_ANY, 244 .bufsize = sizeof(struct usb_device_request), 245 .callback = &bbb_data_wr_cs_callback, 246 .timeout = 1 * USB_MS_HZ, /* 1 second */ 247 }, 248 249 [ST_STATUS] = { 250 .type = UE_BULK, 251 .endpoint = UE_ADDR_ANY, 252 .direction = UE_DIR_IN, 253 .bufsize = sizeof(struct bbb_csw), 254 .flags = {.short_xfer_ok = 1,}, 255 .callback = &bbb_status_callback, 256 .timeout = 1 * USB_MS_HZ, /* 1 second */ 257 }, 258 }; 259 260 static const struct usb_config bbb_raw_config[1] = { 261 [0] = { 262 .type = UE_BULK_INTR, 263 .endpoint = UE_ADDR_ANY, 264 .direction = UE_DIR_OUT, 265 .bufsize = SCSI_MAX_LEN, 266 .flags = {.ext_buffer = 1,.proxy_buffer = 1,}, 267 .callback = &bbb_raw_write_callback, 268 .timeout = 1 * USB_MS_HZ, /* 1 second */ 269 }, 270 }; 271 272 static void 273 bbb_done(struct bbb_transfer *sc, int error) 274 { 275 sc->error = error; 276 sc->state = ST_COMMAND; 277 sc->status_try = 1; 278 cv_signal(&sc->cv); 279 } 280 281 static void 282 bbb_transfer_start(struct bbb_transfer *sc, uint8_t xfer_index) 283 { 284 sc->state = xfer_index; 285 usbd_transfer_start(sc->xfer[xfer_index]); 286 } 287 288 static void 289 bbb_data_clear_stall_callback(struct usb_xfer *xfer, 290 uint8_t next_xfer, uint8_t stall_xfer) 291 { 292 struct bbb_transfer *sc = usbd_xfer_softc(xfer); 293 294 if (usbd_clear_stall_callback(xfer, sc->xfer[stall_xfer])) { 295 switch (USB_GET_STATE(xfer)) { 296 case USB_ST_SETUP: 297 case USB_ST_TRANSFERRED: 298 bbb_transfer_start(sc, next_xfer); 299 break; 300 default: 301 bbb_done(sc, USB_ERR_STALLED); 302 break; 303 } 304 } 305 } 306 307 static void 308 bbb_command_callback(struct usb_xfer *xfer, usb_error_t error) 309 { 310 struct bbb_transfer *sc = usbd_xfer_softc(xfer); 311 uint32_t tag; 312 313 switch (USB_GET_STATE(xfer)) { 314 case USB_ST_TRANSFERRED: 315 bbb_transfer_start 316 (sc, ((sc->dir == DIR_IN) ? ST_DATA_RD : 317 (sc->dir == DIR_OUT) ? ST_DATA_WR : 318 ST_STATUS)); 319 break; 320 321 case USB_ST_SETUP: 322 sc->status_try = 0; 323 tag = UGETDW(sc->cbw->dCBWTag) + 1; 324 USETDW(sc->cbw->dCBWSignature, CBWSIGNATURE); 325 USETDW(sc->cbw->dCBWTag, tag); 326 USETDW(sc->cbw->dCBWDataTransferLength, (uint32_t)sc->data_len); 327 sc->cbw->bCBWFlags = ((sc->dir == DIR_IN) ? CBWFLAGS_IN : CBWFLAGS_OUT); 328 sc->cbw->bCBWLUN = sc->lun; 329 sc->cbw->bCDBLength = sc->cmd_len; 330 if (sc->cbw->bCDBLength > sizeof(sc->cbw->CBWCDB)) { 331 sc->cbw->bCDBLength = sizeof(sc->cbw->CBWCDB); 332 DPRINTFN(0, "Truncating long command\n"); 333 } 334 usbd_xfer_set_frame_len(xfer, 0, 335 sizeof(struct bbb_cbw)); 336 usbd_transfer_submit(xfer); 337 break; 338 339 default: /* Error */ 340 bbb_done(sc, error); 341 break; 342 } 343 } 344 345 static void 346 bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error) 347 { 348 struct bbb_transfer *sc = usbd_xfer_softc(xfer); 349 usb_frlength_t max_bulk = usbd_xfer_max_len(xfer); 350 int actlen, sumlen; 351 352 usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL); 353 354 switch (USB_GET_STATE(xfer)) { 355 case USB_ST_TRANSFERRED: 356 sc->data_rem -= actlen; 357 sc->data_ptr += actlen; 358 sc->actlen += actlen; 359 360 if (actlen < sumlen) { 361 /* short transfer */ 362 sc->data_rem = 0; 363 } 364 case USB_ST_SETUP: 365 DPRINTF("max_bulk=%d, data_rem=%d\n", 366 max_bulk, sc->data_rem); 367 368 if (sc->data_rem == 0) { 369 bbb_transfer_start(sc, ST_STATUS); 370 break; 371 } 372 if (max_bulk > sc->data_rem) { 373 max_bulk = sc->data_rem; 374 } 375 usbd_xfer_set_timeout(xfer, sc->data_timeout); 376 usbd_xfer_set_frame_data(xfer, 0, sc->data_ptr, max_bulk); 377 usbd_transfer_submit(xfer); 378 break; 379 380 default: /* Error */ 381 if (error == USB_ERR_CANCELLED) { 382 bbb_done(sc, error); 383 } else { 384 bbb_transfer_start(sc, ST_DATA_RD_CS); 385 } 386 break; 387 } 388 } 389 390 static void 391 bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error) 392 { 393 bbb_data_clear_stall_callback(xfer, ST_STATUS, 394 ST_DATA_RD); 395 } 396 397 static void 398 bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error) 399 { 400 struct bbb_transfer *sc = usbd_xfer_softc(xfer); 401 usb_frlength_t max_bulk = usbd_xfer_max_len(xfer); 402 int actlen, sumlen; 403 404 usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL); 405 406 switch (USB_GET_STATE(xfer)) { 407 case USB_ST_TRANSFERRED: 408 sc->data_rem -= actlen; 409 sc->data_ptr += actlen; 410 sc->actlen += actlen; 411 412 if (actlen < sumlen) { 413 /* short transfer */ 414 sc->data_rem = 0; 415 } 416 case USB_ST_SETUP: 417 DPRINTF("max_bulk=%d, data_rem=%d\n", 418 max_bulk, sc->data_rem); 419 420 if (sc->data_rem == 0) { 421 bbb_transfer_start(sc, ST_STATUS); 422 break; 423 } 424 if (max_bulk > sc->data_rem) { 425 max_bulk = sc->data_rem; 426 } 427 usbd_xfer_set_timeout(xfer, sc->data_timeout); 428 usbd_xfer_set_frame_data(xfer, 0, sc->data_ptr, max_bulk); 429 usbd_transfer_submit(xfer); 430 break; 431 432 default: /* Error */ 433 if (error == USB_ERR_CANCELLED) { 434 bbb_done(sc, error); 435 } else { 436 bbb_transfer_start(sc, ST_DATA_WR_CS); 437 } 438 break; 439 } 440 } 441 442 static void 443 bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error) 444 { 445 bbb_data_clear_stall_callback(xfer, ST_STATUS, 446 ST_DATA_WR); 447 } 448 449 static void 450 bbb_status_callback(struct usb_xfer *xfer, usb_error_t error) 451 { 452 struct bbb_transfer *sc = usbd_xfer_softc(xfer); 453 int actlen; 454 int sumlen; 455 456 usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL); 457 458 switch (USB_GET_STATE(xfer)) { 459 case USB_ST_TRANSFERRED: 460 461 /* very simple status check */ 462 463 if (actlen < (int)sizeof(struct bbb_csw)) { 464 bbb_done(sc, USB_ERR_SHORT_XFER); 465 } else if (sc->csw->bCSWStatus == CSWSTATUS_GOOD) { 466 bbb_done(sc, 0); /* success */ 467 } else { 468 bbb_done(sc, ERR_CSW_FAILED); /* error */ 469 } 470 break; 471 472 case USB_ST_SETUP: 473 usbd_xfer_set_frame_len(xfer, 0, 474 sizeof(struct bbb_csw)); 475 usbd_transfer_submit(xfer); 476 break; 477 478 default: 479 DPRINTF("Failed to read CSW: %s, try %d\n", 480 usbd_errstr(error), sc->status_try); 481 482 if (error == USB_ERR_CANCELLED || sc->status_try) { 483 bbb_done(sc, error); 484 } else { 485 sc->status_try = 1; 486 bbb_transfer_start(sc, ST_DATA_RD_CS); 487 } 488 break; 489 } 490 } 491 492 static void 493 bbb_raw_write_callback(struct usb_xfer *xfer, usb_error_t error) 494 { 495 struct bbb_transfer *sc = usbd_xfer_softc(xfer); 496 usb_frlength_t max_bulk = usbd_xfer_max_len(xfer); 497 int actlen, sumlen; 498 499 usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL); 500 501 switch (USB_GET_STATE(xfer)) { 502 case USB_ST_TRANSFERRED: 503 sc->data_rem -= actlen; 504 sc->data_ptr += actlen; 505 sc->actlen += actlen; 506 507 if (actlen < sumlen) { 508 /* short transfer */ 509 sc->data_rem = 0; 510 } 511 case USB_ST_SETUP: 512 DPRINTF("max_bulk=%d, data_rem=%d\n", 513 max_bulk, sc->data_rem); 514 515 if (sc->data_rem == 0) { 516 bbb_done(sc, 0); 517 break; 518 } 519 if (max_bulk > sc->data_rem) { 520 max_bulk = sc->data_rem; 521 } 522 usbd_xfer_set_timeout(xfer, sc->data_timeout); 523 usbd_xfer_set_frame_data(xfer, 0, sc->data_ptr, max_bulk); 524 usbd_transfer_submit(xfer); 525 break; 526 527 default: /* Error */ 528 bbb_done(sc, error); 529 break; 530 } 531 } 532 533 /*------------------------------------------------------------------------* 534 * bbb_command_start - execute a SCSI command synchronously 535 * 536 * Return values 537 * 0: Success 538 * Else: Failure 539 *------------------------------------------------------------------------*/ 540 static int 541 bbb_command_start(struct bbb_transfer *sc, uint8_t dir, uint8_t lun, 542 void *data_ptr, size_t data_len, void *cmd_ptr, size_t cmd_len, 543 usb_timeout_t data_timeout) 544 { 545 sc->lun = lun; 546 sc->dir = data_len ? dir : DIR_NONE; 547 sc->data_ptr = data_ptr; 548 sc->data_len = data_len; 549 sc->data_rem = data_len; 550 sc->data_timeout = (data_timeout + USB_MS_HZ); 551 sc->actlen = 0; 552 sc->error = 0; 553 sc->cmd_len = cmd_len; 554 memset(&sc->cbw->CBWCDB, 0, sizeof(sc->cbw->CBWCDB)); 555 memcpy(&sc->cbw->CBWCDB, cmd_ptr, cmd_len); 556 DPRINTFN(1, "SCSI cmd = %*D\n", (int)cmd_len, (char *)sc->cbw->CBWCDB, ":"); 557 558 USB_MTX_LOCK(&sc->mtx); 559 usbd_transfer_start(sc->xfer[sc->state]); 560 561 while (usbd_transfer_pending(sc->xfer[sc->state])) { 562 cv_wait(&sc->cv, &sc->mtx); 563 } 564 USB_MTX_UNLOCK(&sc->mtx); 565 return (sc->error); 566 } 567 568 /*------------------------------------------------------------------------* 569 * bbb_raw_write - write a raw BULK message synchronously 570 * 571 * Return values 572 * 0: Success 573 * Else: Failure 574 *------------------------------------------------------------------------*/ 575 static int 576 bbb_raw_write(struct bbb_transfer *sc, const void *data_ptr, size_t data_len, 577 usb_timeout_t data_timeout) 578 { 579 sc->data_ptr = __DECONST(void *, data_ptr); 580 sc->data_len = data_len; 581 sc->data_rem = data_len; 582 sc->data_timeout = (data_timeout + USB_MS_HZ); 583 sc->actlen = 0; 584 sc->error = 0; 585 586 DPRINTFN(1, "BULK DATA = %*D\n", (int)data_len, 587 (const char *)data_ptr, ":"); 588 589 USB_MTX_LOCK(&sc->mtx); 590 usbd_transfer_start(sc->xfer[0]); 591 while (usbd_transfer_pending(sc->xfer[0])) 592 cv_wait(&sc->cv, &sc->mtx); 593 USB_MTX_UNLOCK(&sc->mtx); 594 return (sc->error); 595 } 596 597 static struct bbb_transfer * 598 bbb_attach(struct usb_device *udev, uint8_t iface_index, 599 uint8_t bInterfaceClass) 600 { 601 struct usb_interface *iface; 602 struct usb_interface_descriptor *id; 603 const struct usb_config *pconfig; 604 struct bbb_transfer *sc; 605 usb_error_t err; 606 int nconfig; 607 608 #if USB_HAVE_MSCTEST_DETACH 609 uint8_t do_unlock; 610 611 /* Prevent re-enumeration */ 612 do_unlock = usbd_enum_lock(udev); 613 614 /* 615 * Make sure any driver which is hooked up to this interface, 616 * like umass is gone: 617 */ 618 usb_detach_device(udev, iface_index, 0); 619 620 if (do_unlock) 621 usbd_enum_unlock(udev); 622 #endif 623 624 iface = usbd_get_iface(udev, iface_index); 625 if (iface == NULL) 626 return (NULL); 627 628 id = iface->idesc; 629 if (id == NULL || id->bInterfaceClass != bInterfaceClass) 630 return (NULL); 631 632 switch (id->bInterfaceClass) { 633 case UICLASS_MASS: 634 switch (id->bInterfaceSubClass) { 635 case UISUBCLASS_SCSI: 636 case UISUBCLASS_UFI: 637 case UISUBCLASS_SFF8020I: 638 case UISUBCLASS_SFF8070I: 639 break; 640 default: 641 return (NULL); 642 } 643 switch (id->bInterfaceProtocol) { 644 case UIPROTO_MASS_BBB_OLD: 645 case UIPROTO_MASS_BBB: 646 break; 647 default: 648 return (NULL); 649 } 650 pconfig = bbb_config; 651 nconfig = ST_MAX; 652 break; 653 case UICLASS_HID: 654 switch (id->bInterfaceSubClass) { 655 case 0: 656 break; 657 default: 658 return (NULL); 659 } 660 pconfig = bbb_raw_config; 661 nconfig = 1; 662 break; 663 default: 664 return (NULL); 665 } 666 667 sc = malloc(sizeof(*sc), M_USB, M_WAITOK | M_ZERO); 668 mtx_init(&sc->mtx, "USB autoinstall", NULL, MTX_DEF); 669 cv_init(&sc->cv, "WBBB"); 670 671 err = usbd_transfer_setup(udev, &iface_index, sc->xfer, pconfig, 672 nconfig, sc, &sc->mtx); 673 if (err) { 674 bbb_detach(sc); 675 return (NULL); 676 } 677 switch (id->bInterfaceClass) { 678 case UICLASS_MASS: 679 /* store pointer to DMA buffers */ 680 sc->buffer = usbd_xfer_get_frame_buffer( 681 sc->xfer[ST_DATA_RD], 0); 682 sc->buffer_size = 683 usbd_xfer_max_len(sc->xfer[ST_DATA_RD]); 684 sc->cbw = usbd_xfer_get_frame_buffer( 685 sc->xfer[ST_COMMAND], 0); 686 sc->csw = usbd_xfer_get_frame_buffer( 687 sc->xfer[ST_STATUS], 0); 688 break; 689 default: 690 break; 691 } 692 return (sc); 693 } 694 695 static void 696 bbb_detach(struct bbb_transfer *sc) 697 { 698 usbd_transfer_unsetup(sc->xfer, ST_MAX); 699 mtx_destroy(&sc->mtx); 700 cv_destroy(&sc->cv); 701 free(sc, M_USB); 702 } 703 704 /*------------------------------------------------------------------------* 705 * usb_iface_is_cdrom 706 * 707 * Return values: 708 * 1: This interface is an auto install disk (CD-ROM) 709 * 0: Not an auto install disk. 710 *------------------------------------------------------------------------*/ 711 int 712 usb_iface_is_cdrom(struct usb_device *udev, uint8_t iface_index) 713 { 714 struct bbb_transfer *sc; 715 uint8_t timeout; 716 uint8_t is_cdrom; 717 uint8_t sid_type; 718 int err; 719 720 sc = bbb_attach(udev, iface_index, UICLASS_MASS); 721 if (sc == NULL) 722 return (0); 723 724 is_cdrom = 0; 725 timeout = 4; /* tries */ 726 while (--timeout) { 727 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer, 728 SCSI_INQ_LEN, &scsi_inquiry, sizeof(scsi_inquiry), 729 USB_MS_HZ); 730 731 if (err == 0 && sc->actlen > 0) { 732 sid_type = sc->buffer[0] & 0x1F; 733 if (sid_type == 0x05) 734 is_cdrom = 1; 735 break; 736 } else if (err != ERR_CSW_FAILED) 737 break; /* non retryable error */ 738 usb_pause_mtx(NULL, hz); 739 } 740 bbb_detach(sc); 741 return (is_cdrom); 742 } 743 744 static int 745 usb_msc_get_max_lun(struct usb_device *udev, uint8_t iface_index) 746 { 747 struct usb_device_request req; 748 uint8_t buf = 0; 749 750 /* The Get Max Lun command is a class-specific request. */ 751 req.bmRequestType = UT_READ_CLASS_INTERFACE; 752 req.bRequest = 0xFE; /* GET_MAX_LUN */ 753 USETW(req.wValue, 0); 754 req.wIndex[0] = iface_index; 755 req.wIndex[1] = 0; 756 USETW(req.wLength, 1); 757 758 return usbd_do_request(udev, NULL, &req, &buf); 759 } 760 761 #define USB_ADD_QUIRK(udev, any, which) do { \ 762 if (usb_get_manufacturer(udev) != NULL && usb_get_product(udev) != NULL) { \ 763 DPRINTFN(0, #which " set for USB mass storage device %s %s (0x%04x:0x%04x)\n", \ 764 usb_get_manufacturer(udev), \ 765 usb_get_product(udev), \ 766 UGETW(udev->ddesc.idVendor), \ 767 UGETW(udev->ddesc.idProduct)); \ 768 } else { \ 769 DPRINTFN(0, #which " set for USB mass storage device, 0x%04x:0x%04x\n", \ 770 UGETW(udev->ddesc.idVendor), \ 771 UGETW(udev->ddesc.idProduct)); \ 772 } \ 773 usbd_add_dynamic_quirk(udev, which); \ 774 any = 1; \ 775 } while (0) 776 777 usb_error_t 778 usb_msc_auto_quirk(struct usb_device *udev, uint8_t iface_index, 779 const struct usb_attach_arg *uaa) 780 { 781 struct bbb_transfer *sc; 782 uint8_t timeout; 783 uint8_t is_no_direct; 784 uint8_t sid_type; 785 uint8_t any_quirk; 786 int err; 787 788 sc = bbb_attach(udev, iface_index, UICLASS_MASS); 789 if (sc == NULL) 790 return (0); 791 792 any_quirk = 0; 793 794 /* 795 * Some devices need a delay after that the configuration 796 * value is set to function properly: 797 */ 798 usb_pause_mtx(NULL, hz); 799 800 if (usb_test_quirk(uaa, UQ_MSC_NO_GETMAXLUN) == 0 && 801 usb_msc_get_max_lun(udev, iface_index) != 0) { 802 DPRINTF("Device can't handle GETMAXLUN\n"); 803 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_GETMAXLUN); 804 } 805 806 is_no_direct = 1; 807 for (timeout = 4; timeout != 0; timeout--) { 808 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer, 809 SCSI_INQ_LEN, &scsi_inquiry, sizeof(scsi_inquiry), 810 USB_MS_HZ); 811 812 if (err == 0 && sc->actlen > 0) { 813 sid_type = sc->buffer[0] & 0x1F; 814 if (sid_type == 0x00) 815 is_no_direct = 0; 816 break; 817 } else if (err != ERR_CSW_FAILED) { 818 DPRINTF("Device is not responding " 819 "properly to SCSI INQUIRY command.\n"); 820 goto error; /* non retryable error */ 821 } 822 usb_pause_mtx(NULL, hz); 823 } 824 825 if (is_no_direct) { 826 DPRINTF("Device is not direct access.\n"); 827 goto done; 828 } 829 830 if (usb_test_quirk(uaa, UQ_MSC_NO_TEST_UNIT_READY) == 0) { 831 err = bbb_command_start(sc, DIR_NONE, 0, NULL, 0, 832 &scsi_test_unit_ready, sizeof(scsi_test_unit_ready), 833 USB_MS_HZ); 834 835 if (err != 0) { 836 if (err != ERR_CSW_FAILED) 837 goto error; 838 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_TEST_UNIT_READY); 839 } 840 } 841 842 if (usb_test_quirk(uaa, UQ_MSC_NO_PREVENT_ALLOW) == 0) { 843 err = bbb_command_start(sc, DIR_NONE, 0, NULL, 0, 844 &scsi_prevent_removal, sizeof(scsi_prevent_removal), 845 USB_MS_HZ); 846 847 if (err == 0) { 848 err = bbb_command_start(sc, DIR_NONE, 0, NULL, 0, 849 &scsi_allow_removal, sizeof(scsi_allow_removal), 850 USB_MS_HZ); 851 } 852 853 if (err != 0) { 854 if (err != ERR_CSW_FAILED) 855 goto error; 856 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_PREVENT_ALLOW); 857 } 858 } 859 860 timeout = 1; 861 862 retry_sync_cache: 863 err = bbb_command_start(sc, DIR_NONE, 0, NULL, 0, 864 &scsi_sync_cache, sizeof(scsi_sync_cache), 865 USB_MS_HZ); 866 867 if (err != 0) { 868 if (err != ERR_CSW_FAILED) 869 goto error; 870 871 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_SYNC_CACHE); 872 } else { 873 /* 874 * Certain Kingston memory sticks fail the first 875 * read capacity after a synchronize cache command 876 * has been issued. Disable the synchronize cache 877 * command for such devices. 878 */ 879 880 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer, 8, 881 &scsi_read_capacity, sizeof(scsi_read_capacity), 882 USB_MS_HZ); 883 884 if (err != 0) { 885 if (err != ERR_CSW_FAILED) 886 goto error; 887 888 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer, 8, 889 &scsi_read_capacity, sizeof(scsi_read_capacity), 890 USB_MS_HZ); 891 892 if (err == 0) { 893 if (timeout--) 894 goto retry_sync_cache; 895 896 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_SYNC_CACHE); 897 } else { 898 if (err != ERR_CSW_FAILED) 899 goto error; 900 } 901 } 902 } 903 904 if (usb_test_quirk(uaa, UQ_MSC_NO_START_STOP) == 0) { 905 err = bbb_command_start(sc, DIR_NONE, 0, NULL, 0, 906 &scsi_start_unit, sizeof(scsi_start_unit), 907 USB_MS_HZ); 908 909 if (err != 0) { 910 if (err != ERR_CSW_FAILED) 911 goto error; 912 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_START_STOP); 913 } 914 } 915 916 /* clear sense status of any failed commands on the device */ 917 918 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer, 919 SCSI_INQ_LEN, &scsi_inquiry, sizeof(scsi_inquiry), 920 USB_MS_HZ); 921 922 DPRINTF("Inquiry = %d\n", err); 923 924 if (err != 0) { 925 if (err != ERR_CSW_FAILED) 926 goto error; 927 } 928 929 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer, 930 SCSI_SENSE_LEN, &scsi_request_sense, 931 sizeof(scsi_request_sense), USB_MS_HZ); 932 933 DPRINTF("Request sense = %d\n", err); 934 935 if (err != 0) { 936 if (err != ERR_CSW_FAILED) 937 goto error; 938 } 939 goto done; 940 941 error: 942 /* Apply most quirks */ 943 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_SYNC_CACHE); 944 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_PREVENT_ALLOW); 945 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_TEST_UNIT_READY); 946 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_START_STOP); 947 done: 948 bbb_detach(sc); 949 950 if (any_quirk) { 951 /* Unconfigure device, to clear software data toggle. */ 952 usbd_set_config_index(udev, USB_UNCONFIG_INDEX); 953 954 /* Need to re-enumerate the device to clear its state. */ 955 usbd_req_re_enumerate(udev, NULL); 956 return (USB_ERR_STALLED); 957 } 958 959 /* No quirks were added, continue as usual. */ 960 return (0); 961 } 962 963 usb_error_t 964 usb_msc_eject(struct usb_device *udev, uint8_t iface_index, int method) 965 { 966 struct bbb_transfer *sc; 967 usb_error_t err __usbdebug_used; 968 969 sc = bbb_attach(udev, iface_index, UICLASS_MASS); 970 if (sc == NULL) 971 return (USB_ERR_INVAL); 972 973 switch (method) { 974 case MSC_EJECT_STOPUNIT: 975 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0, 976 &scsi_test_unit_ready, sizeof(scsi_test_unit_ready), 977 USB_MS_HZ); 978 DPRINTF("Test unit ready status: %s\n", usbd_errstr(err)); 979 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0, 980 &scsi_stop_unit, sizeof(scsi_stop_unit), 981 USB_MS_HZ); 982 break; 983 case MSC_EJECT_REZERO: 984 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0, 985 &scsi_rezero_init, sizeof(scsi_rezero_init), 986 USB_MS_HZ); 987 break; 988 case MSC_EJECT_ZTESTOR: 989 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0, 990 &scsi_ztestor_eject, sizeof(scsi_ztestor_eject), 991 USB_MS_HZ); 992 break; 993 case MSC_EJECT_CMOTECH: 994 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0, 995 &scsi_cmotech_eject, sizeof(scsi_cmotech_eject), 996 USB_MS_HZ); 997 break; 998 case MSC_EJECT_HUAWEI: 999 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0, 1000 &scsi_huawei_eject, sizeof(scsi_huawei_eject), 1001 USB_MS_HZ); 1002 break; 1003 case MSC_EJECT_HUAWEI2: 1004 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0, 1005 &scsi_huawei_eject2, sizeof(scsi_huawei_eject2), 1006 USB_MS_HZ); 1007 break; 1008 case MSC_EJECT_HUAWEI3: 1009 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0, 1010 &scsi_huawei_eject3, sizeof(scsi_huawei_eject3), 1011 USB_MS_HZ); 1012 break; 1013 case MSC_EJECT_HUAWEI4: 1014 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0, 1015 &scsi_huawei_eject4, sizeof(scsi_huawei_eject4), 1016 USB_MS_HZ); 1017 break; 1018 case MSC_EJECT_TCT: 1019 /* 1020 * TCTMobile needs DIR_IN flag. To get it, we 1021 * supply a dummy data with the command. 1022 */ 1023 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer, 1024 sc->buffer_size, &scsi_tct_eject, 1025 sizeof(scsi_tct_eject), USB_MS_HZ); 1026 break; 1027 default: 1028 DPRINTF("Unknown eject method (%d)\n", method); 1029 bbb_detach(sc); 1030 return (USB_ERR_INVAL); 1031 } 1032 1033 DPRINTF("Eject CD command status: %s\n", usbd_errstr(err)); 1034 1035 bbb_detach(sc); 1036 return (0); 1037 } 1038 1039 usb_error_t 1040 usb_dymo_eject(struct usb_device *udev, uint8_t iface_index) 1041 { 1042 static const uint8_t data[3] = { 0x1b, 0x5a, 0x01 }; 1043 struct bbb_transfer *sc; 1044 usb_error_t err; 1045 1046 sc = bbb_attach(udev, iface_index, UICLASS_HID); 1047 if (sc == NULL) 1048 return (USB_ERR_INVAL); 1049 err = bbb_raw_write(sc, data, sizeof(data), USB_MS_HZ); 1050 bbb_detach(sc); 1051 return (err); 1052 } 1053 1054 usb_error_t 1055 usb_msc_read_10(struct usb_device *udev, uint8_t iface_index, 1056 uint32_t lba, uint32_t blocks, void *buffer) 1057 { 1058 struct bbb_transfer *sc; 1059 uint8_t cmd[10]; 1060 usb_error_t err; 1061 1062 cmd[0] = 0x28; /* READ_10 */ 1063 cmd[1] = 0; 1064 cmd[2] = lba >> 24; 1065 cmd[3] = lba >> 16; 1066 cmd[4] = lba >> 8; 1067 cmd[5] = lba >> 0; 1068 cmd[6] = 0; 1069 cmd[7] = blocks >> 8; 1070 cmd[8] = blocks; 1071 cmd[9] = 0; 1072 1073 sc = bbb_attach(udev, iface_index, UICLASS_MASS); 1074 if (sc == NULL) 1075 return (USB_ERR_INVAL); 1076 1077 err = bbb_command_start(sc, DIR_IN, 0, buffer, 1078 blocks * SCSI_FIXED_BLOCK_SIZE, cmd, 10, USB_MS_HZ); 1079 1080 bbb_detach(sc); 1081 1082 return (err); 1083 } 1084 1085 usb_error_t 1086 usb_msc_write_10(struct usb_device *udev, uint8_t iface_index, 1087 uint32_t lba, uint32_t blocks, void *buffer) 1088 { 1089 struct bbb_transfer *sc; 1090 uint8_t cmd[10]; 1091 usb_error_t err; 1092 1093 cmd[0] = 0x2a; /* WRITE_10 */ 1094 cmd[1] = 0; 1095 cmd[2] = lba >> 24; 1096 cmd[3] = lba >> 16; 1097 cmd[4] = lba >> 8; 1098 cmd[5] = lba >> 0; 1099 cmd[6] = 0; 1100 cmd[7] = blocks >> 8; 1101 cmd[8] = blocks; 1102 cmd[9] = 0; 1103 1104 sc = bbb_attach(udev, iface_index, UICLASS_MASS); 1105 if (sc == NULL) 1106 return (USB_ERR_INVAL); 1107 1108 err = bbb_command_start(sc, DIR_OUT, 0, buffer, 1109 blocks * SCSI_FIXED_BLOCK_SIZE, cmd, 10, USB_MS_HZ); 1110 1111 bbb_detach(sc); 1112 1113 return (err); 1114 } 1115 1116 usb_error_t 1117 usb_msc_read_capacity(struct usb_device *udev, uint8_t iface_index, 1118 uint32_t *lba_last, uint32_t *block_size) 1119 { 1120 struct bbb_transfer *sc; 1121 usb_error_t err; 1122 1123 sc = bbb_attach(udev, iface_index, UICLASS_MASS); 1124 if (sc == NULL) 1125 return (USB_ERR_INVAL); 1126 1127 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer, 8, 1128 &scsi_read_capacity, sizeof(scsi_read_capacity), 1129 USB_MS_HZ); 1130 1131 *lba_last = 1132 (sc->buffer[0] << 24) | 1133 (sc->buffer[1] << 16) | 1134 (sc->buffer[2] << 8) | 1135 (sc->buffer[3]); 1136 1137 *block_size = 1138 (sc->buffer[4] << 24) | 1139 (sc->buffer[5] << 16) | 1140 (sc->buffer[6] << 8) | 1141 (sc->buffer[7]); 1142 1143 /* we currently only support one block size */ 1144 if (*block_size != SCSI_FIXED_BLOCK_SIZE) 1145 err = USB_ERR_INVAL; 1146 1147 bbb_detach(sc); 1148 1149 return (err); 1150 } 1151