1 // SPDX-License-Identifier: GPL-2.0+ 2 /* 3 * Driver for USB Mass Storage compliant devices 4 * SCSI layer glue code 5 * 6 * Current development and maintenance by: 7 * (c) 1999-2002 Matthew Dharm (mdharm-usb@one-eyed-alien.net) 8 * 9 * Developed with the assistance of: 10 * (c) 2000 David L. Brown, Jr. (usb-storage@davidb.org) 11 * (c) 2000 Stephen J. Gowdy (SGowdy@lbl.gov) 12 * 13 * Initial work by: 14 * (c) 1999 Michael Gee (michael@linuxspecific.com) 15 * 16 * This driver is based on the 'USB Mass Storage Class' document. This 17 * describes in detail the protocol used to communicate with such 18 * devices. Clearly, the designers had SCSI and ATAPI commands in 19 * mind when they created this document. The commands are all very 20 * similar to commands in the SCSI-II and ATAPI specifications. 21 * 22 * It is important to note that in a number of cases this class 23 * exhibits class-specific exemptions from the USB specification. 24 * Notably the usage of NAK, STALL and ACK differs from the norm, in 25 * that they are used to communicate wait, failed and OK on commands. 26 * 27 * Also, for certain devices, the interrupt endpoint is used to convey 28 * status of a command. 29 */ 30 31 #include <linux/module.h> 32 #include <linux/mutex.h> 33 34 #include <scsi/scsi.h> 35 #include <scsi/scsi_cmnd.h> 36 #include <scsi/scsi_devinfo.h> 37 #include <scsi/scsi_device.h> 38 #include <scsi/scsi_eh.h> 39 40 #include "usb.h" 41 #include "scsiglue.h" 42 #include "debug.h" 43 #include "transport.h" 44 #include "protocol.h" 45 46 /* 47 * Vendor IDs for companies that seem to include the READ CAPACITY bug 48 * in all their devices 49 */ 50 #define VENDOR_ID_NOKIA 0x0421 51 #define VENDOR_ID_NIKON 0x04b0 52 #define VENDOR_ID_PENTAX 0x0a17 53 #define VENDOR_ID_MOTOROLA 0x22b8 54 55 /*********************************************************************** 56 * Host functions 57 ***********************************************************************/ 58 59 static const char* host_info(struct Scsi_Host *host) 60 { 61 struct us_data *us = host_to_us(host); 62 return us->scsi_name; 63 } 64 65 static int slave_alloc (struct scsi_device *sdev) 66 { 67 struct us_data *us = host_to_us(sdev->host); 68 69 /* 70 * Set the INQUIRY transfer length to 36. We don't use any of 71 * the extra data and many devices choke if asked for more or 72 * less than 36 bytes. 73 */ 74 sdev->inquiry_len = 36; 75 76 /* 77 * USB has unusual DMA-alignment requirements: Although the 78 * starting address of each scatter-gather element doesn't matter, 79 * the length of each element except the last must be divisible 80 * by the Bulk maxpacket value. There's currently no way to 81 * express this by block-layer constraints, so we'll cop out 82 * and simply require addresses to be aligned at 512-byte 83 * boundaries. This is okay since most block I/O involves 84 * hardware sectors that are multiples of 512 bytes in length, 85 * and since host controllers up through USB 2.0 have maxpacket 86 * values no larger than 512. 87 * 88 * But it doesn't suffice for Wireless USB, where Bulk maxpacket 89 * values can be as large as 2048. To make that work properly 90 * will require changes to the block layer. 91 */ 92 blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1)); 93 94 /* Tell the SCSI layer if we know there is more than one LUN */ 95 if (us->protocol == USB_PR_BULK && us->max_lun > 0) 96 sdev->sdev_bflags |= BLIST_FORCELUN; 97 98 return 0; 99 } 100 101 static int slave_configure(struct scsi_device *sdev) 102 { 103 struct us_data *us = host_to_us(sdev->host); 104 105 /* 106 * Many devices have trouble transferring more than 32KB at a time, 107 * while others have trouble with more than 64K. At this time we 108 * are limiting both to 32K (64 sectores). 109 */ 110 if (us->fflags & (US_FL_MAX_SECTORS_64 | US_FL_MAX_SECTORS_MIN)) { 111 unsigned int max_sectors = 64; 112 113 if (us->fflags & US_FL_MAX_SECTORS_MIN) 114 max_sectors = PAGE_SIZE >> 9; 115 if (queue_max_hw_sectors(sdev->request_queue) > max_sectors) 116 blk_queue_max_hw_sectors(sdev->request_queue, 117 max_sectors); 118 } else if (sdev->type == TYPE_TAPE) { 119 /* 120 * Tapes need much higher max_sector limits, so just 121 * raise it to the maximum possible (4 GB / 512) and 122 * let the queue segment size sort out the real limit. 123 */ 124 blk_queue_max_hw_sectors(sdev->request_queue, 0x7FFFFF); 125 } else if (us->pusb_dev->speed >= USB_SPEED_SUPER) { 126 /* 127 * USB3 devices will be limited to 2048 sectors. This gives us 128 * better throughput on most devices. 129 */ 130 blk_queue_max_hw_sectors(sdev->request_queue, 2048); 131 } 132 133 /* 134 * Some USB host controllers can't do DMA; they have to use PIO. 135 * They indicate this by setting their dma_mask to NULL. For 136 * such controllers we need to make sure the block layer sets 137 * up bounce buffers in addressable memory. 138 */ 139 if (!us->pusb_dev->bus->controller->dma_mask) 140 blk_queue_bounce_limit(sdev->request_queue, BLK_BOUNCE_HIGH); 141 142 /* 143 * We can't put these settings in slave_alloc() because that gets 144 * called before the device type is known. Consequently these 145 * settings can't be overridden via the scsi devinfo mechanism. 146 */ 147 if (sdev->type == TYPE_DISK) { 148 149 /* 150 * Some vendors seem to put the READ CAPACITY bug into 151 * all their devices -- primarily makers of cell phones 152 * and digital cameras. Since these devices always use 153 * flash media and can be expected to have an even number 154 * of sectors, we will always enable the CAPACITY_HEURISTICS 155 * flag unless told otherwise. 156 */ 157 switch (le16_to_cpu(us->pusb_dev->descriptor.idVendor)) { 158 case VENDOR_ID_NOKIA: 159 case VENDOR_ID_NIKON: 160 case VENDOR_ID_PENTAX: 161 case VENDOR_ID_MOTOROLA: 162 if (!(us->fflags & (US_FL_FIX_CAPACITY | 163 US_FL_CAPACITY_OK))) 164 us->fflags |= US_FL_CAPACITY_HEURISTICS; 165 break; 166 } 167 168 /* 169 * Disk-type devices use MODE SENSE(6) if the protocol 170 * (SubClass) is Transparent SCSI, otherwise they use 171 * MODE SENSE(10). 172 */ 173 if (us->subclass != USB_SC_SCSI && us->subclass != USB_SC_CYP_ATACB) 174 sdev->use_10_for_ms = 1; 175 176 /* 177 *Many disks only accept MODE SENSE transfer lengths of 178 * 192 bytes (that's what Windows uses). 179 */ 180 sdev->use_192_bytes_for_3f = 1; 181 182 /* 183 * Some devices don't like MODE SENSE with page=0x3f, 184 * which is the command used for checking if a device 185 * is write-protected. Now that we tell the sd driver 186 * to do a 192-byte transfer with this command the 187 * majority of devices work fine, but a few still can't 188 * handle it. The sd driver will simply assume those 189 * devices are write-enabled. 190 */ 191 if (us->fflags & US_FL_NO_WP_DETECT) 192 sdev->skip_ms_page_3f = 1; 193 194 /* 195 * A number of devices have problems with MODE SENSE for 196 * page x08, so we will skip it. 197 */ 198 sdev->skip_ms_page_8 = 1; 199 200 /* Some devices don't handle VPD pages correctly */ 201 sdev->skip_vpd_pages = 1; 202 203 /* Do not attempt to use REPORT SUPPORTED OPERATION CODES */ 204 sdev->no_report_opcodes = 1; 205 206 /* Do not attempt to use WRITE SAME */ 207 sdev->no_write_same = 1; 208 209 /* 210 * Some disks return the total number of blocks in response 211 * to READ CAPACITY rather than the highest block number. 212 * If this device makes that mistake, tell the sd driver. 213 */ 214 if (us->fflags & US_FL_FIX_CAPACITY) 215 sdev->fix_capacity = 1; 216 217 /* 218 * A few disks have two indistinguishable version, one of 219 * which reports the correct capacity and the other does not. 220 * The sd driver has to guess which is the case. 221 */ 222 if (us->fflags & US_FL_CAPACITY_HEURISTICS) 223 sdev->guess_capacity = 1; 224 225 /* Some devices cannot handle READ_CAPACITY_16 */ 226 if (us->fflags & US_FL_NO_READ_CAPACITY_16) 227 sdev->no_read_capacity_16 = 1; 228 229 /* 230 * Many devices do not respond properly to READ_CAPACITY_16. 231 * Tell the SCSI layer to try READ_CAPACITY_10 first. 232 * However some USB 3.0 drive enclosures return capacity 233 * modulo 2TB. Those must use READ_CAPACITY_16 234 */ 235 if (!(us->fflags & US_FL_NEEDS_CAP16)) 236 sdev->try_rc_10_first = 1; 237 238 /* 239 * assume SPC3 or latter devices support sense size > 18 240 * unless US_FL_BAD_SENSE quirk is specified. 241 */ 242 if (sdev->scsi_level > SCSI_SPC_2 && 243 !(us->fflags & US_FL_BAD_SENSE)) 244 us->fflags |= US_FL_SANE_SENSE; 245 246 /* 247 * USB-IDE bridges tend to report SK = 0x04 (Non-recoverable 248 * Hardware Error) when any low-level error occurs, 249 * recoverable or not. Setting this flag tells the SCSI 250 * midlayer to retry such commands, which frequently will 251 * succeed and fix the error. The worst this can lead to 252 * is an occasional series of retries that will all fail. 253 */ 254 sdev->retry_hwerror = 1; 255 256 /* 257 * USB disks should allow restart. Some drives spin down 258 * automatically, requiring a START-STOP UNIT command. 259 */ 260 sdev->allow_restart = 1; 261 262 /* 263 * Some USB cardreaders have trouble reading an sdcard's last 264 * sector in a larger then 1 sector read, since the performance 265 * impact is negligible we set this flag for all USB disks 266 */ 267 sdev->last_sector_bug = 1; 268 269 /* 270 * Enable last-sector hacks for single-target devices using 271 * the Bulk-only transport, unless we already know the 272 * capacity will be decremented or is correct. 273 */ 274 if (!(us->fflags & (US_FL_FIX_CAPACITY | US_FL_CAPACITY_OK | 275 US_FL_SCM_MULT_TARG)) && 276 us->protocol == USB_PR_BULK) 277 us->use_last_sector_hacks = 1; 278 279 /* Check if write cache default on flag is set or not */ 280 if (us->fflags & US_FL_WRITE_CACHE) 281 sdev->wce_default_on = 1; 282 283 /* A few buggy USB-ATA bridges don't understand FUA */ 284 if (us->fflags & US_FL_BROKEN_FUA) 285 sdev->broken_fua = 1; 286 287 /* Some even totally fail to indicate a cache */ 288 if (us->fflags & US_FL_ALWAYS_SYNC) { 289 /* don't read caching information */ 290 sdev->skip_ms_page_8 = 1; 291 sdev->skip_ms_page_3f = 1; 292 /* assume sync is needed */ 293 sdev->wce_default_on = 1; 294 } 295 } else { 296 297 /* 298 * Non-disk-type devices don't need to blacklist any pages 299 * or to force 192-byte transfer lengths for MODE SENSE. 300 * But they do need to use MODE SENSE(10). 301 */ 302 sdev->use_10_for_ms = 1; 303 304 /* Some (fake) usb cdrom devices don't like READ_DISC_INFO */ 305 if (us->fflags & US_FL_NO_READ_DISC_INFO) 306 sdev->no_read_disc_info = 1; 307 } 308 309 /* 310 * The CB and CBI transports have no way to pass LUN values 311 * other than the bits in the second byte of a CDB. But those 312 * bits don't get set to the LUN value if the device reports 313 * scsi_level == 0 (UNKNOWN). Hence such devices must necessarily 314 * be single-LUN. 315 */ 316 if ((us->protocol == USB_PR_CB || us->protocol == USB_PR_CBI) && 317 sdev->scsi_level == SCSI_UNKNOWN) 318 us->max_lun = 0; 319 320 /* 321 * Some devices choke when they receive a PREVENT-ALLOW MEDIUM 322 * REMOVAL command, so suppress those commands. 323 */ 324 if (us->fflags & US_FL_NOT_LOCKABLE) 325 sdev->lockable = 0; 326 327 /* 328 * this is to satisfy the compiler, tho I don't think the 329 * return code is ever checked anywhere. 330 */ 331 return 0; 332 } 333 334 static int target_alloc(struct scsi_target *starget) 335 { 336 struct us_data *us = host_to_us(dev_to_shost(starget->dev.parent)); 337 338 /* 339 * Some USB drives don't support REPORT LUNS, even though they 340 * report a SCSI revision level above 2. Tell the SCSI layer 341 * not to issue that command; it will perform a normal sequential 342 * scan instead. 343 */ 344 starget->no_report_luns = 1; 345 346 /* 347 * The UFI spec treats the Peripheral Qualifier bits in an 348 * INQUIRY result as reserved and requires devices to set them 349 * to 0. However the SCSI spec requires these bits to be set 350 * to 3 to indicate when a LUN is not present. 351 * 352 * Let the scanning code know if this target merely sets 353 * Peripheral Device Type to 0x1f to indicate no LUN. 354 */ 355 if (us->subclass == USB_SC_UFI) 356 starget->pdt_1f_for_no_lun = 1; 357 358 return 0; 359 } 360 361 /* queue a command */ 362 /* This is always called with scsi_lock(host) held */ 363 static int queuecommand_lck(struct scsi_cmnd *srb, 364 void (*done)(struct scsi_cmnd *)) 365 { 366 struct us_data *us = host_to_us(srb->device->host); 367 368 /* check for state-transition errors */ 369 if (us->srb != NULL) { 370 printk(KERN_ERR USB_STORAGE "Error in %s: us->srb = %p\n", 371 __func__, us->srb); 372 return SCSI_MLQUEUE_HOST_BUSY; 373 } 374 375 /* fail the command if we are disconnecting */ 376 if (test_bit(US_FLIDX_DISCONNECTING, &us->dflags)) { 377 usb_stor_dbg(us, "Fail command during disconnect\n"); 378 srb->result = DID_NO_CONNECT << 16; 379 done(srb); 380 return 0; 381 } 382 383 if ((us->fflags & US_FL_NO_ATA_1X) && 384 (srb->cmnd[0] == ATA_12 || srb->cmnd[0] == ATA_16)) { 385 memcpy(srb->sense_buffer, usb_stor_sense_invalidCDB, 386 sizeof(usb_stor_sense_invalidCDB)); 387 srb->result = SAM_STAT_CHECK_CONDITION; 388 done(srb); 389 return 0; 390 } 391 392 /* enqueue the command and wake up the control thread */ 393 srb->scsi_done = done; 394 us->srb = srb; 395 complete(&us->cmnd_ready); 396 397 return 0; 398 } 399 400 static DEF_SCSI_QCMD(queuecommand) 401 402 /*********************************************************************** 403 * Error handling functions 404 ***********************************************************************/ 405 406 /* Command timeout and abort */ 407 static int command_abort(struct scsi_cmnd *srb) 408 { 409 struct us_data *us = host_to_us(srb->device->host); 410 411 usb_stor_dbg(us, "%s called\n", __func__); 412 413 /* 414 * us->srb together with the TIMED_OUT, RESETTING, and ABORTING 415 * bits are protected by the host lock. 416 */ 417 scsi_lock(us_to_host(us)); 418 419 /* Is this command still active? */ 420 if (us->srb != srb) { 421 scsi_unlock(us_to_host(us)); 422 usb_stor_dbg(us, "-- nothing to abort\n"); 423 return FAILED; 424 } 425 426 /* 427 * Set the TIMED_OUT bit. Also set the ABORTING bit, but only if 428 * a device reset isn't already in progress (to avoid interfering 429 * with the reset). Note that we must retain the host lock while 430 * calling usb_stor_stop_transport(); otherwise it might interfere 431 * with an auto-reset that begins as soon as we release the lock. 432 */ 433 set_bit(US_FLIDX_TIMED_OUT, &us->dflags); 434 if (!test_bit(US_FLIDX_RESETTING, &us->dflags)) { 435 set_bit(US_FLIDX_ABORTING, &us->dflags); 436 usb_stor_stop_transport(us); 437 } 438 scsi_unlock(us_to_host(us)); 439 440 /* Wait for the aborted command to finish */ 441 wait_for_completion(&us->notify); 442 return SUCCESS; 443 } 444 445 /* 446 * This invokes the transport reset mechanism to reset the state of the 447 * device 448 */ 449 static int device_reset(struct scsi_cmnd *srb) 450 { 451 struct us_data *us = host_to_us(srb->device->host); 452 int result; 453 454 usb_stor_dbg(us, "%s called\n", __func__); 455 456 /* lock the device pointers and do the reset */ 457 mutex_lock(&(us->dev_mutex)); 458 result = us->transport_reset(us); 459 mutex_unlock(&us->dev_mutex); 460 461 return result < 0 ? FAILED : SUCCESS; 462 } 463 464 /* Simulate a SCSI bus reset by resetting the device's USB port. */ 465 static int bus_reset(struct scsi_cmnd *srb) 466 { 467 struct us_data *us = host_to_us(srb->device->host); 468 int result; 469 470 usb_stor_dbg(us, "%s called\n", __func__); 471 472 result = usb_stor_port_reset(us); 473 return result < 0 ? FAILED : SUCCESS; 474 } 475 476 /* 477 * Report a driver-initiated device reset to the SCSI layer. 478 * Calling this for a SCSI-initiated reset is unnecessary but harmless. 479 * The caller must own the SCSI host lock. 480 */ 481 void usb_stor_report_device_reset(struct us_data *us) 482 { 483 int i; 484 struct Scsi_Host *host = us_to_host(us); 485 486 scsi_report_device_reset(host, 0, 0); 487 if (us->fflags & US_FL_SCM_MULT_TARG) { 488 for (i = 1; i < host->max_id; ++i) 489 scsi_report_device_reset(host, 0, i); 490 } 491 } 492 493 /* 494 * Report a driver-initiated bus reset to the SCSI layer. 495 * Calling this for a SCSI-initiated reset is unnecessary but harmless. 496 * The caller must not own the SCSI host lock. 497 */ 498 void usb_stor_report_bus_reset(struct us_data *us) 499 { 500 struct Scsi_Host *host = us_to_host(us); 501 502 scsi_lock(host); 503 scsi_report_bus_reset(host, 0); 504 scsi_unlock(host); 505 } 506 507 /*********************************************************************** 508 * /proc/scsi/ functions 509 ***********************************************************************/ 510 511 static int write_info(struct Scsi_Host *host, char *buffer, int length) 512 { 513 /* if someone is sending us data, just throw it away */ 514 return length; 515 } 516 517 static int show_info (struct seq_file *m, struct Scsi_Host *host) 518 { 519 struct us_data *us = host_to_us(host); 520 const char *string; 521 522 /* print the controller name */ 523 seq_printf(m, " Host scsi%d: usb-storage\n", host->host_no); 524 525 /* print product, vendor, and serial number strings */ 526 if (us->pusb_dev->manufacturer) 527 string = us->pusb_dev->manufacturer; 528 else if (us->unusual_dev->vendorName) 529 string = us->unusual_dev->vendorName; 530 else 531 string = "Unknown"; 532 seq_printf(m, " Vendor: %s\n", string); 533 if (us->pusb_dev->product) 534 string = us->pusb_dev->product; 535 else if (us->unusual_dev->productName) 536 string = us->unusual_dev->productName; 537 else 538 string = "Unknown"; 539 seq_printf(m, " Product: %s\n", string); 540 if (us->pusb_dev->serial) 541 string = us->pusb_dev->serial; 542 else 543 string = "None"; 544 seq_printf(m, "Serial Number: %s\n", string); 545 546 /* show the protocol and transport */ 547 seq_printf(m, " Protocol: %s\n", us->protocol_name); 548 seq_printf(m, " Transport: %s\n", us->transport_name); 549 550 /* show the device flags */ 551 seq_printf(m, " Quirks:"); 552 553 #define US_FLAG(name, value) \ 554 if (us->fflags & value) seq_printf(m, " " #name); 555 US_DO_ALL_FLAGS 556 #undef US_FLAG 557 seq_putc(m, '\n'); 558 return 0; 559 } 560 561 /*********************************************************************** 562 * Sysfs interface 563 ***********************************************************************/ 564 565 /* Output routine for the sysfs max_sectors file */ 566 static ssize_t max_sectors_show(struct device *dev, struct device_attribute *attr, char *buf) 567 { 568 struct scsi_device *sdev = to_scsi_device(dev); 569 570 return sprintf(buf, "%u\n", queue_max_hw_sectors(sdev->request_queue)); 571 } 572 573 /* Input routine for the sysfs max_sectors file */ 574 static ssize_t max_sectors_store(struct device *dev, struct device_attribute *attr, const char *buf, 575 size_t count) 576 { 577 struct scsi_device *sdev = to_scsi_device(dev); 578 unsigned short ms; 579 580 if (sscanf(buf, "%hu", &ms) > 0) { 581 blk_queue_max_hw_sectors(sdev->request_queue, ms); 582 return count; 583 } 584 return -EINVAL; 585 } 586 static DEVICE_ATTR_RW(max_sectors); 587 588 static struct device_attribute *sysfs_device_attr_list[] = { 589 &dev_attr_max_sectors, 590 NULL, 591 }; 592 593 /* 594 * this defines our host template, with which we'll allocate hosts 595 */ 596 597 static const struct scsi_host_template usb_stor_host_template = { 598 /* basic userland interface stuff */ 599 .name = "usb-storage", 600 .proc_name = "usb-storage", 601 .show_info = show_info, 602 .write_info = write_info, 603 .info = host_info, 604 605 /* command interface -- queued only */ 606 .queuecommand = queuecommand, 607 608 /* error and abort handlers */ 609 .eh_abort_handler = command_abort, 610 .eh_device_reset_handler = device_reset, 611 .eh_bus_reset_handler = bus_reset, 612 613 /* queue commands only, only one command per LUN */ 614 .can_queue = 1, 615 616 /* unknown initiator id */ 617 .this_id = -1, 618 619 .slave_alloc = slave_alloc, 620 .slave_configure = slave_configure, 621 .target_alloc = target_alloc, 622 623 /* lots of sg segments can be handled */ 624 .sg_tablesize = SG_MAX_SEGMENTS, 625 626 627 /* 628 * Limit the total size of a transfer to 120 KB. 629 * 630 * Some devices are known to choke with anything larger. It seems like 631 * the problem stems from the fact that original IDE controllers had 632 * only an 8-bit register to hold the number of sectors in one transfer 633 * and even those couldn't handle a full 256 sectors. 634 * 635 * Because we want to make sure we interoperate with as many devices as 636 * possible, we will maintain a 240 sector transfer size limit for USB 637 * Mass Storage devices. 638 * 639 * Tests show that other operating have similar limits with Microsoft 640 * Windows 7 limiting transfers to 128 sectors for both USB2 and USB3 641 * and Apple Mac OS X 10.11 limiting transfers to 256 sectors for USB2 642 * and 2048 for USB3 devices. 643 */ 644 .max_sectors = 240, 645 646 /* emulated HBA */ 647 .emulated = 1, 648 649 /* we do our own delay after a device or bus reset */ 650 .skip_settle_delay = 1, 651 652 /* sysfs device attributes */ 653 .sdev_attrs = sysfs_device_attr_list, 654 655 /* module management */ 656 .module = THIS_MODULE 657 }; 658 659 void usb_stor_host_template_init(struct scsi_host_template *sht, 660 const char *name, struct module *owner) 661 { 662 *sht = usb_stor_host_template; 663 sht->name = name; 664 sht->proc_name = name; 665 sht->module = owner; 666 } 667 EXPORT_SYMBOL_GPL(usb_stor_host_template_init); 668 669 /* To Report "Illegal Request: Invalid Field in CDB */ 670 unsigned char usb_stor_sense_invalidCDB[18] = { 671 [0] = 0x70, /* current error */ 672 [2] = ILLEGAL_REQUEST, /* Illegal Request = 0x05 */ 673 [7] = 0x0a, /* additional length */ 674 [12] = 0x24 /* Invalid Field in CDB */ 675 }; 676 EXPORT_SYMBOL_GPL(usb_stor_sense_invalidCDB); 677