1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2008-2022 Hans Petter Selasky.
5 * Copyright (c) 2021-2022 Idwer Vollering.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 /*
30 * The following file contains code that will detect USB autoinstall
31 * disks.
32 */
33
34 #ifdef USB_GLOBAL_INCLUDE_FILE
35 #include USB_GLOBAL_INCLUDE_FILE
36 #else
37 #include <sys/stdint.h>
38 #include <sys/stddef.h>
39 #include <sys/param.h>
40 #include <sys/queue.h>
41 #include <sys/types.h>
42 #include <sys/systm.h>
43 #include <sys/kernel.h>
44 #include <sys/bus.h>
45 #include <sys/module.h>
46 #include <sys/lock.h>
47 #include <sys/mutex.h>
48 #include <sys/condvar.h>
49 #include <sys/sysctl.h>
50 #include <sys/sx.h>
51 #include <sys/unistd.h>
52 #include <sys/callout.h>
53 #include <sys/malloc.h>
54 #include <sys/priv.h>
55
56 #include <dev/usb/usb.h>
57 #include <dev/usb/usbdi.h>
58 #include <dev/usb/usbdi_util.h>
59
60 #define USB_DEBUG_VAR usb_debug
61
62 #include <dev/usb/usb_busdma.h>
63 #include <dev/usb/usb_process.h>
64 #include <dev/usb/usb_transfer.h>
65 #include <dev/usb/usb_msctest.h>
66 #include <dev/usb/usb_debug.h>
67 #include <dev/usb/usb_device.h>
68 #include <dev/usb/usb_request.h>
69 #include <dev/usb/usb_util.h>
70 #include <dev/usb/quirk/usb_quirk.h>
71 #endif /* USB_GLOBAL_INCLUDE_FILE */
72
73 enum {
74 ST_COMMAND,
75 ST_DATA_RD,
76 ST_DATA_RD_CS,
77 ST_DATA_WR,
78 ST_DATA_WR_CS,
79 ST_STATUS,
80 ST_MAX,
81 };
82
83 enum {
84 DIR_IN,
85 DIR_OUT,
86 DIR_NONE,
87 };
88
89 #define SCSI_MAX_LEN MAX(SCSI_FIXED_BLOCK_SIZE, USB_MSCTEST_BULK_SIZE)
90 #define SCSI_INQ_LEN 0x24
91 #define SCSI_SENSE_LEN 0xFF
92 #define SCSI_FIXED_BLOCK_SIZE 512 /* bytes */
93
94 static uint8_t scsi_test_unit_ready[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
95 static uint8_t scsi_inquiry[] = { 0x12, 0x00, 0x00, 0x00, SCSI_INQ_LEN, 0x00 };
96 static uint8_t scsi_rezero_init[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00 };
97 static uint8_t scsi_start_unit[] = { 0x1b, 0x00, 0x00, 0x00, 0x01, 0x00 };
98 static uint8_t scsi_stop_unit[] = { 0x1b, 0x00, 0x00, 0x00, 0x02, 0x00 };
99 static uint8_t scsi_ztestor_eject[] = { 0x85, 0x01, 0x01, 0x01, 0x18, 0x01,
100 0x01, 0x01, 0x01, 0x01, 0x00, 0x00 };
101 static uint8_t scsi_cmotech_eject[] = { 0xff, 0x52, 0x44, 0x45, 0x56, 0x43,
102 0x48, 0x47 };
103 static uint8_t scsi_huawei_eject[] = { 0x11, 0x06, 0x00, 0x00, 0x00, 0x00,
104 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
105 0x00, 0x00, 0x00, 0x00 };
106 static uint8_t scsi_huawei_eject2[] = { 0x11, 0x06, 0x20, 0x00, 0x00, 0x01,
107 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
108 0x00, 0x00, 0x00, 0x00 };
109 static uint8_t scsi_huawei_eject3[] = { 0x11, 0x06, 0x20, 0x00, 0x00, 0x01,
110 0x01, 0x00, 0x01, 0x00, 0x00, 0x00,
111 0x00, 0x00, 0x00, 0x00 };
112 static uint8_t scsi_huawei_eject4[] = { 0x11, 0x06, 0x30, 0x00, 0x00, 0x00,
113 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
114 0x00, 0x00, 0x00, 0x00 };
115 static uint8_t scsi_tct_eject[] = { 0x06, 0xf5, 0x04, 0x02, 0x52, 0x70 };
116 static uint8_t scsi_sync_cache[] = { 0x35, 0x00, 0x00, 0x00, 0x00, 0x00,
117 0x00, 0x00, 0x00, 0x00 };
118 static uint8_t scsi_request_sense[] = { 0x03, 0x00, 0x00, 0x00, 0x12, 0x00,
119 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
120 static uint8_t scsi_read_capacity[] = { 0x25, 0x00, 0x00, 0x00, 0x00, 0x00,
121 0x00, 0x00, 0x00, 0x00 };
122 static uint8_t scsi_prevent_removal[] = { 0x1e, 0, 0, 0, 1, 0 };
123 static uint8_t scsi_allow_removal[] = { 0x1e, 0, 0, 0, 0, 0 };
124
125 #ifndef USB_MSCTEST_BULK_SIZE
126 #define USB_MSCTEST_BULK_SIZE 64 /* dummy */
127 #endif
128
129 #define ERR_CSW_FAILED -1
130
131 /* Command Block Wrapper */
132 struct bbb_cbw {
133 uDWord dCBWSignature;
134 #define CBWSIGNATURE 0x43425355
135 uDWord dCBWTag;
136 uDWord dCBWDataTransferLength;
137 uByte bCBWFlags;
138 #define CBWFLAGS_OUT 0x00
139 #define CBWFLAGS_IN 0x80
140 uByte bCBWLUN;
141 uByte bCDBLength;
142 #define CBWCDBLENGTH 16
143 uByte CBWCDB[CBWCDBLENGTH];
144 } __packed;
145
146 /* Command Status Wrapper */
147 struct bbb_csw {
148 uDWord dCSWSignature;
149 #define CSWSIGNATURE 0x53425355
150 uDWord dCSWTag;
151 uDWord dCSWDataResidue;
152 uByte bCSWStatus;
153 #define CSWSTATUS_GOOD 0x0
154 #define CSWSTATUS_FAILED 0x1
155 #define CSWSTATUS_PHASE 0x2
156 } __packed;
157
158 struct bbb_transfer {
159 struct mtx mtx;
160 struct cv cv;
161 struct bbb_cbw *cbw;
162 struct bbb_csw *csw;
163
164 struct usb_xfer *xfer[ST_MAX];
165
166 uint8_t *data_ptr;
167
168 usb_size_t data_len; /* bytes */
169 usb_size_t data_rem; /* bytes */
170 usb_timeout_t data_timeout; /* ms */
171 usb_frlength_t actlen; /* bytes */
172 usb_frlength_t buffer_size; /* bytes */
173
174 uint8_t cmd_len; /* bytes */
175 uint8_t dir;
176 uint8_t lun;
177 uint8_t state;
178 uint8_t status_try;
179 int error;
180
181 uint8_t *buffer;
182 };
183
184 static usb_callback_t bbb_command_callback;
185 static usb_callback_t bbb_data_read_callback;
186 static usb_callback_t bbb_data_rd_cs_callback;
187 static usb_callback_t bbb_data_write_callback;
188 static usb_callback_t bbb_data_wr_cs_callback;
189 static usb_callback_t bbb_status_callback;
190 static usb_callback_t bbb_raw_write_callback;
191
192 static void bbb_done(struct bbb_transfer *, int);
193 static void bbb_transfer_start(struct bbb_transfer *, uint8_t);
194 static void bbb_data_clear_stall_callback(struct usb_xfer *, uint8_t,
195 uint8_t);
196 static int bbb_command_start(struct bbb_transfer *, uint8_t, uint8_t,
197 void *, size_t, void *, size_t, usb_timeout_t);
198 static struct bbb_transfer *bbb_attach(struct usb_device *, uint8_t, uint8_t);
199 static void bbb_detach(struct bbb_transfer *);
200
201 static const struct usb_config bbb_config[ST_MAX] = {
202 [ST_COMMAND] = {
203 .type = UE_BULK,
204 .endpoint = UE_ADDR_ANY,
205 .direction = UE_DIR_OUT,
206 .bufsize = sizeof(struct bbb_cbw),
207 .callback = &bbb_command_callback,
208 .timeout = 4 * USB_MS_HZ, /* 4 seconds */
209 },
210
211 [ST_DATA_RD] = {
212 .type = UE_BULK,
213 .endpoint = UE_ADDR_ANY,
214 .direction = UE_DIR_IN,
215 .bufsize = SCSI_MAX_LEN,
216 .flags = {.proxy_buffer = 1,.short_xfer_ok = 1,},
217 .callback = &bbb_data_read_callback,
218 .timeout = 4 * USB_MS_HZ, /* 4 seconds */
219 },
220
221 [ST_DATA_RD_CS] = {
222 .type = UE_CONTROL,
223 .endpoint = 0x00, /* Control pipe */
224 .direction = UE_DIR_ANY,
225 .bufsize = sizeof(struct usb_device_request),
226 .callback = &bbb_data_rd_cs_callback,
227 .timeout = 1 * USB_MS_HZ, /* 1 second */
228 },
229
230 [ST_DATA_WR] = {
231 .type = UE_BULK,
232 .endpoint = UE_ADDR_ANY,
233 .direction = UE_DIR_OUT,
234 .bufsize = SCSI_MAX_LEN,
235 .flags = {.ext_buffer = 1,.proxy_buffer = 1,},
236 .callback = &bbb_data_write_callback,
237 .timeout = 4 * USB_MS_HZ, /* 4 seconds */
238 },
239
240 [ST_DATA_WR_CS] = {
241 .type = UE_CONTROL,
242 .endpoint = 0x00, /* Control pipe */
243 .direction = UE_DIR_ANY,
244 .bufsize = sizeof(struct usb_device_request),
245 .callback = &bbb_data_wr_cs_callback,
246 .timeout = 1 * USB_MS_HZ, /* 1 second */
247 },
248
249 [ST_STATUS] = {
250 .type = UE_BULK,
251 .endpoint = UE_ADDR_ANY,
252 .direction = UE_DIR_IN,
253 .bufsize = sizeof(struct bbb_csw),
254 .flags = {.short_xfer_ok = 1,},
255 .callback = &bbb_status_callback,
256 .timeout = 1 * USB_MS_HZ, /* 1 second */
257 },
258 };
259
260 static const struct usb_config bbb_raw_config[1] = {
261 [0] = {
262 .type = UE_BULK_INTR,
263 .endpoint = UE_ADDR_ANY,
264 .direction = UE_DIR_OUT,
265 .bufsize = SCSI_MAX_LEN,
266 .flags = {.ext_buffer = 1,.proxy_buffer = 1,},
267 .callback = &bbb_raw_write_callback,
268 .timeout = 1 * USB_MS_HZ, /* 1 second */
269 },
270 };
271
272 static void
bbb_done(struct bbb_transfer * sc,int error)273 bbb_done(struct bbb_transfer *sc, int error)
274 {
275 sc->error = error;
276 sc->state = ST_COMMAND;
277 sc->status_try = 1;
278 cv_signal(&sc->cv);
279 }
280
281 static void
bbb_transfer_start(struct bbb_transfer * sc,uint8_t xfer_index)282 bbb_transfer_start(struct bbb_transfer *sc, uint8_t xfer_index)
283 {
284 sc->state = xfer_index;
285 usbd_transfer_start(sc->xfer[xfer_index]);
286 }
287
288 static void
bbb_data_clear_stall_callback(struct usb_xfer * xfer,uint8_t next_xfer,uint8_t stall_xfer)289 bbb_data_clear_stall_callback(struct usb_xfer *xfer,
290 uint8_t next_xfer, uint8_t stall_xfer)
291 {
292 struct bbb_transfer *sc = usbd_xfer_softc(xfer);
293
294 if (usbd_clear_stall_callback(xfer, sc->xfer[stall_xfer])) {
295 switch (USB_GET_STATE(xfer)) {
296 case USB_ST_SETUP:
297 case USB_ST_TRANSFERRED:
298 bbb_transfer_start(sc, next_xfer);
299 break;
300 default:
301 bbb_done(sc, USB_ERR_STALLED);
302 break;
303 }
304 }
305 }
306
307 static void
bbb_command_callback(struct usb_xfer * xfer,usb_error_t error)308 bbb_command_callback(struct usb_xfer *xfer, usb_error_t error)
309 {
310 struct bbb_transfer *sc = usbd_xfer_softc(xfer);
311 uint32_t tag;
312
313 switch (USB_GET_STATE(xfer)) {
314 case USB_ST_TRANSFERRED:
315 bbb_transfer_start
316 (sc, ((sc->dir == DIR_IN) ? ST_DATA_RD :
317 (sc->dir == DIR_OUT) ? ST_DATA_WR :
318 ST_STATUS));
319 break;
320
321 case USB_ST_SETUP:
322 sc->status_try = 0;
323 tag = UGETDW(sc->cbw->dCBWTag) + 1;
324 USETDW(sc->cbw->dCBWSignature, CBWSIGNATURE);
325 USETDW(sc->cbw->dCBWTag, tag);
326 USETDW(sc->cbw->dCBWDataTransferLength, (uint32_t)sc->data_len);
327 sc->cbw->bCBWFlags = ((sc->dir == DIR_IN) ? CBWFLAGS_IN : CBWFLAGS_OUT);
328 sc->cbw->bCBWLUN = sc->lun;
329 sc->cbw->bCDBLength = sc->cmd_len;
330 if (sc->cbw->bCDBLength > sizeof(sc->cbw->CBWCDB)) {
331 sc->cbw->bCDBLength = sizeof(sc->cbw->CBWCDB);
332 DPRINTFN(0, "Truncating long command\n");
333 }
334 usbd_xfer_set_frame_len(xfer, 0,
335 sizeof(struct bbb_cbw));
336 usbd_transfer_submit(xfer);
337 break;
338
339 default: /* Error */
340 bbb_done(sc, error);
341 break;
342 }
343 }
344
345 static void
bbb_data_read_callback(struct usb_xfer * xfer,usb_error_t error)346 bbb_data_read_callback(struct usb_xfer *xfer, usb_error_t error)
347 {
348 struct bbb_transfer *sc = usbd_xfer_softc(xfer);
349 usb_frlength_t max_bulk = usbd_xfer_max_len(xfer);
350 int actlen, sumlen;
351
352 usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
353
354 switch (USB_GET_STATE(xfer)) {
355 case USB_ST_TRANSFERRED:
356 sc->data_rem -= actlen;
357 sc->data_ptr += actlen;
358 sc->actlen += actlen;
359
360 if (actlen < sumlen) {
361 /* short transfer */
362 sc->data_rem = 0;
363 }
364 case USB_ST_SETUP:
365 DPRINTF("max_bulk=%d, data_rem=%d\n",
366 max_bulk, sc->data_rem);
367
368 if (sc->data_rem == 0) {
369 bbb_transfer_start(sc, ST_STATUS);
370 break;
371 }
372 if (max_bulk > sc->data_rem) {
373 max_bulk = sc->data_rem;
374 }
375 usbd_xfer_set_timeout(xfer, sc->data_timeout);
376 usbd_xfer_set_frame_data(xfer, 0, sc->data_ptr, max_bulk);
377 usbd_transfer_submit(xfer);
378 break;
379
380 default: /* Error */
381 if (error == USB_ERR_CANCELLED) {
382 bbb_done(sc, error);
383 } else {
384 bbb_transfer_start(sc, ST_DATA_RD_CS);
385 }
386 break;
387 }
388 }
389
390 static void
bbb_data_rd_cs_callback(struct usb_xfer * xfer,usb_error_t error)391 bbb_data_rd_cs_callback(struct usb_xfer *xfer, usb_error_t error)
392 {
393 bbb_data_clear_stall_callback(xfer, ST_STATUS,
394 ST_DATA_RD);
395 }
396
397 static void
bbb_data_write_callback(struct usb_xfer * xfer,usb_error_t error)398 bbb_data_write_callback(struct usb_xfer *xfer, usb_error_t error)
399 {
400 struct bbb_transfer *sc = usbd_xfer_softc(xfer);
401 usb_frlength_t max_bulk = usbd_xfer_max_len(xfer);
402 int actlen, sumlen;
403
404 usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
405
406 switch (USB_GET_STATE(xfer)) {
407 case USB_ST_TRANSFERRED:
408 sc->data_rem -= actlen;
409 sc->data_ptr += actlen;
410 sc->actlen += actlen;
411
412 if (actlen < sumlen) {
413 /* short transfer */
414 sc->data_rem = 0;
415 }
416 case USB_ST_SETUP:
417 DPRINTF("max_bulk=%d, data_rem=%d\n",
418 max_bulk, sc->data_rem);
419
420 if (sc->data_rem == 0) {
421 bbb_transfer_start(sc, ST_STATUS);
422 break;
423 }
424 if (max_bulk > sc->data_rem) {
425 max_bulk = sc->data_rem;
426 }
427 usbd_xfer_set_timeout(xfer, sc->data_timeout);
428 usbd_xfer_set_frame_data(xfer, 0, sc->data_ptr, max_bulk);
429 usbd_transfer_submit(xfer);
430 break;
431
432 default: /* Error */
433 if (error == USB_ERR_CANCELLED) {
434 bbb_done(sc, error);
435 } else {
436 bbb_transfer_start(sc, ST_DATA_WR_CS);
437 }
438 break;
439 }
440 }
441
442 static void
bbb_data_wr_cs_callback(struct usb_xfer * xfer,usb_error_t error)443 bbb_data_wr_cs_callback(struct usb_xfer *xfer, usb_error_t error)
444 {
445 bbb_data_clear_stall_callback(xfer, ST_STATUS,
446 ST_DATA_WR);
447 }
448
449 static void
bbb_status_callback(struct usb_xfer * xfer,usb_error_t error)450 bbb_status_callback(struct usb_xfer *xfer, usb_error_t error)
451 {
452 struct bbb_transfer *sc = usbd_xfer_softc(xfer);
453 int actlen;
454 int sumlen;
455
456 usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
457
458 switch (USB_GET_STATE(xfer)) {
459 case USB_ST_TRANSFERRED:
460
461 /* very simple status check */
462
463 if (actlen < (int)sizeof(struct bbb_csw)) {
464 bbb_done(sc, USB_ERR_SHORT_XFER);
465 } else if (sc->csw->bCSWStatus == CSWSTATUS_GOOD) {
466 bbb_done(sc, 0); /* success */
467 } else {
468 bbb_done(sc, ERR_CSW_FAILED); /* error */
469 }
470 break;
471
472 case USB_ST_SETUP:
473 usbd_xfer_set_frame_len(xfer, 0,
474 sizeof(struct bbb_csw));
475 usbd_transfer_submit(xfer);
476 break;
477
478 default:
479 DPRINTF("Failed to read CSW: %s, try %d\n",
480 usbd_errstr(error), sc->status_try);
481
482 if (error == USB_ERR_CANCELLED || sc->status_try) {
483 bbb_done(sc, error);
484 } else {
485 sc->status_try = 1;
486 bbb_transfer_start(sc, ST_DATA_RD_CS);
487 }
488 break;
489 }
490 }
491
492 static void
bbb_raw_write_callback(struct usb_xfer * xfer,usb_error_t error)493 bbb_raw_write_callback(struct usb_xfer *xfer, usb_error_t error)
494 {
495 struct bbb_transfer *sc = usbd_xfer_softc(xfer);
496 usb_frlength_t max_bulk = usbd_xfer_max_len(xfer);
497 int actlen, sumlen;
498
499 usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
500
501 switch (USB_GET_STATE(xfer)) {
502 case USB_ST_TRANSFERRED:
503 sc->data_rem -= actlen;
504 sc->data_ptr += actlen;
505 sc->actlen += actlen;
506
507 if (actlen < sumlen) {
508 /* short transfer */
509 sc->data_rem = 0;
510 }
511 case USB_ST_SETUP:
512 DPRINTF("max_bulk=%d, data_rem=%d\n",
513 max_bulk, sc->data_rem);
514
515 if (sc->data_rem == 0) {
516 bbb_done(sc, 0);
517 break;
518 }
519 if (max_bulk > sc->data_rem) {
520 max_bulk = sc->data_rem;
521 }
522 usbd_xfer_set_timeout(xfer, sc->data_timeout);
523 usbd_xfer_set_frame_data(xfer, 0, sc->data_ptr, max_bulk);
524 usbd_transfer_submit(xfer);
525 break;
526
527 default: /* Error */
528 bbb_done(sc, error);
529 break;
530 }
531 }
532
533 /*------------------------------------------------------------------------*
534 * bbb_command_start - execute a SCSI command synchronously
535 *
536 * Return values
537 * 0: Success
538 * Else: Failure
539 *------------------------------------------------------------------------*/
540 static int
bbb_command_start(struct bbb_transfer * sc,uint8_t dir,uint8_t lun,void * data_ptr,size_t data_len,void * cmd_ptr,size_t cmd_len,usb_timeout_t data_timeout)541 bbb_command_start(struct bbb_transfer *sc, uint8_t dir, uint8_t lun,
542 void *data_ptr, size_t data_len, void *cmd_ptr, size_t cmd_len,
543 usb_timeout_t data_timeout)
544 {
545 sc->lun = lun;
546 sc->dir = data_len ? dir : DIR_NONE;
547 sc->data_ptr = data_ptr;
548 sc->data_len = data_len;
549 sc->data_rem = data_len;
550 sc->data_timeout = (data_timeout + USB_MS_HZ);
551 sc->actlen = 0;
552 sc->error = 0;
553 sc->cmd_len = cmd_len;
554 memset(&sc->cbw->CBWCDB, 0, sizeof(sc->cbw->CBWCDB));
555 memcpy(&sc->cbw->CBWCDB, cmd_ptr, cmd_len);
556 DPRINTFN(1, "SCSI cmd = %*D\n", (int)cmd_len, (char *)sc->cbw->CBWCDB, ":");
557
558 USB_MTX_LOCK(&sc->mtx);
559 usbd_transfer_start(sc->xfer[sc->state]);
560
561 while (usbd_transfer_pending(sc->xfer[sc->state])) {
562 cv_wait(&sc->cv, &sc->mtx);
563 }
564 USB_MTX_UNLOCK(&sc->mtx);
565 return (sc->error);
566 }
567
568 /*------------------------------------------------------------------------*
569 * bbb_raw_write - write a raw BULK message synchronously
570 *
571 * Return values
572 * 0: Success
573 * Else: Failure
574 *------------------------------------------------------------------------*/
575 static int
bbb_raw_write(struct bbb_transfer * sc,const void * data_ptr,size_t data_len,usb_timeout_t data_timeout)576 bbb_raw_write(struct bbb_transfer *sc, const void *data_ptr, size_t data_len,
577 usb_timeout_t data_timeout)
578 {
579 sc->data_ptr = __DECONST(void *, data_ptr);
580 sc->data_len = data_len;
581 sc->data_rem = data_len;
582 sc->data_timeout = (data_timeout + USB_MS_HZ);
583 sc->actlen = 0;
584 sc->error = 0;
585
586 DPRINTFN(1, "BULK DATA = %*D\n", (int)data_len,
587 (const char *)data_ptr, ":");
588
589 USB_MTX_LOCK(&sc->mtx);
590 usbd_transfer_start(sc->xfer[0]);
591 while (usbd_transfer_pending(sc->xfer[0]))
592 cv_wait(&sc->cv, &sc->mtx);
593 USB_MTX_UNLOCK(&sc->mtx);
594 return (sc->error);
595 }
596
597 static struct bbb_transfer *
bbb_attach(struct usb_device * udev,uint8_t iface_index,uint8_t bInterfaceClass)598 bbb_attach(struct usb_device *udev, uint8_t iface_index,
599 uint8_t bInterfaceClass)
600 {
601 struct usb_interface *iface;
602 struct usb_interface_descriptor *id;
603 const struct usb_config *pconfig;
604 struct bbb_transfer *sc;
605 usb_error_t err;
606 int nconfig;
607
608 #if USB_HAVE_MSCTEST_DETACH
609 uint8_t do_unlock;
610
611 /* Prevent re-enumeration */
612 do_unlock = usbd_enum_lock(udev);
613
614 /*
615 * Make sure any driver which is hooked up to this interface,
616 * like umass is gone:
617 */
618 usb_detach_device(udev, iface_index, 0);
619
620 if (do_unlock)
621 usbd_enum_unlock(udev);
622 #endif
623
624 iface = usbd_get_iface(udev, iface_index);
625 if (iface == NULL)
626 return (NULL);
627
628 id = iface->idesc;
629 if (id == NULL || id->bInterfaceClass != bInterfaceClass)
630 return (NULL);
631
632 switch (id->bInterfaceClass) {
633 case UICLASS_MASS:
634 switch (id->bInterfaceSubClass) {
635 case UISUBCLASS_SCSI:
636 case UISUBCLASS_UFI:
637 case UISUBCLASS_SFF8020I:
638 case UISUBCLASS_SFF8070I:
639 break;
640 default:
641 return (NULL);
642 }
643 switch (id->bInterfaceProtocol) {
644 case UIPROTO_MASS_BBB_OLD:
645 case UIPROTO_MASS_BBB:
646 break;
647 default:
648 return (NULL);
649 }
650 pconfig = bbb_config;
651 nconfig = ST_MAX;
652 break;
653 case UICLASS_HID:
654 switch (id->bInterfaceSubClass) {
655 case 0:
656 break;
657 default:
658 return (NULL);
659 }
660 pconfig = bbb_raw_config;
661 nconfig = 1;
662 break;
663 default:
664 return (NULL);
665 }
666
667 sc = malloc(sizeof(*sc), M_USB, M_WAITOK | M_ZERO);
668 mtx_init(&sc->mtx, "USB autoinstall", NULL, MTX_DEF);
669 cv_init(&sc->cv, "WBBB");
670
671 err = usbd_transfer_setup(udev, &iface_index, sc->xfer, pconfig,
672 nconfig, sc, &sc->mtx);
673 if (err) {
674 bbb_detach(sc);
675 return (NULL);
676 }
677 switch (id->bInterfaceClass) {
678 case UICLASS_MASS:
679 /* store pointer to DMA buffers */
680 sc->buffer = usbd_xfer_get_frame_buffer(
681 sc->xfer[ST_DATA_RD], 0);
682 sc->buffer_size =
683 usbd_xfer_max_len(sc->xfer[ST_DATA_RD]);
684 sc->cbw = usbd_xfer_get_frame_buffer(
685 sc->xfer[ST_COMMAND], 0);
686 sc->csw = usbd_xfer_get_frame_buffer(
687 sc->xfer[ST_STATUS], 0);
688 break;
689 default:
690 break;
691 }
692 return (sc);
693 }
694
695 static void
bbb_detach(struct bbb_transfer * sc)696 bbb_detach(struct bbb_transfer *sc)
697 {
698 usbd_transfer_unsetup(sc->xfer, ST_MAX);
699 mtx_destroy(&sc->mtx);
700 cv_destroy(&sc->cv);
701 free(sc, M_USB);
702 }
703
704 /*------------------------------------------------------------------------*
705 * usb_iface_is_cdrom
706 *
707 * Return values:
708 * 1: This interface is an auto install disk (CD-ROM)
709 * 0: Not an auto install disk.
710 *------------------------------------------------------------------------*/
711 int
usb_iface_is_cdrom(struct usb_device * udev,uint8_t iface_index)712 usb_iface_is_cdrom(struct usb_device *udev, uint8_t iface_index)
713 {
714 struct bbb_transfer *sc;
715 uint8_t timeout;
716 uint8_t is_cdrom;
717 uint8_t sid_type;
718 int err;
719
720 sc = bbb_attach(udev, iface_index, UICLASS_MASS);
721 if (sc == NULL)
722 return (0);
723
724 is_cdrom = 0;
725 timeout = 4; /* tries */
726 while (--timeout) {
727 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer,
728 SCSI_INQ_LEN, &scsi_inquiry, sizeof(scsi_inquiry),
729 USB_MS_HZ);
730
731 if (err == 0 && sc->actlen > 0) {
732 sid_type = sc->buffer[0] & 0x1F;
733 if (sid_type == 0x05)
734 is_cdrom = 1;
735 break;
736 } else if (err != ERR_CSW_FAILED)
737 break; /* non retryable error */
738 usb_pause_mtx(NULL, hz);
739 }
740 bbb_detach(sc);
741 return (is_cdrom);
742 }
743
744 static uint8_t
usb_msc_get_max_lun(struct usb_device * udev,uint8_t iface_index)745 usb_msc_get_max_lun(struct usb_device *udev, uint8_t iface_index)
746 {
747 struct usb_device_request req;
748 usb_error_t err;
749 uint8_t buf = 0;
750
751 /* The Get Max Lun command is a class-specific request. */
752 req.bmRequestType = UT_READ_CLASS_INTERFACE;
753 req.bRequest = 0xFE; /* GET_MAX_LUN */
754 USETW(req.wValue, 0);
755 req.wIndex[0] = iface_index;
756 req.wIndex[1] = 0;
757 USETW(req.wLength, 1);
758
759 err = usbd_do_request(udev, NULL, &req, &buf);
760 if (err)
761 buf = 0;
762
763 return (buf);
764 }
765
766 #define USB_ADD_QUIRK(udev, any, which) do { \
767 if (usb_get_manufacturer(udev) != NULL && usb_get_product(udev) != NULL) { \
768 DPRINTFN(0, #which " set for USB mass storage device %s %s (0x%04x:0x%04x)\n", \
769 usb_get_manufacturer(udev), \
770 usb_get_product(udev), \
771 UGETW(udev->ddesc.idVendor), \
772 UGETW(udev->ddesc.idProduct)); \
773 } else { \
774 DPRINTFN(0, #which " set for USB mass storage device, 0x%04x:0x%04x\n", \
775 UGETW(udev->ddesc.idVendor), \
776 UGETW(udev->ddesc.idProduct)); \
777 } \
778 usbd_add_dynamic_quirk(udev, which); \
779 any = 1; \
780 } while (0)
781
782 usb_error_t
usb_msc_auto_quirk(struct usb_device * udev,uint8_t iface_index,const struct usb_attach_arg * uaa)783 usb_msc_auto_quirk(struct usb_device *udev, uint8_t iface_index,
784 const struct usb_attach_arg *uaa)
785 {
786 struct bbb_transfer *sc;
787 uint8_t timeout;
788 uint8_t is_no_direct;
789 uint8_t sid_type;
790 uint8_t any_quirk;
791 int err;
792
793 sc = bbb_attach(udev, iface_index, UICLASS_MASS);
794 if (sc == NULL)
795 return (0);
796
797 any_quirk = 0;
798
799 /*
800 * Some devices need a delay after that the configuration
801 * value is set to function properly:
802 */
803 usb_pause_mtx(NULL, hz);
804
805 if (usb_test_quirk(uaa, UQ_MSC_NO_GETMAXLUN) == 0 &&
806 usb_msc_get_max_lun(udev, iface_index) == 0) {
807 DPRINTF("Device has only got one LUN.\n");
808 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_GETMAXLUN);
809 }
810
811 is_no_direct = 1;
812 for (timeout = 4; timeout != 0; timeout--) {
813 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer,
814 SCSI_INQ_LEN, &scsi_inquiry, sizeof(scsi_inquiry),
815 USB_MS_HZ);
816
817 if (err == 0 && sc->actlen > 0) {
818 sid_type = sc->buffer[0] & 0x1F;
819 if (sid_type == 0x00)
820 is_no_direct = 0;
821 break;
822 } else if (err != ERR_CSW_FAILED) {
823 DPRINTF("Device is not responding "
824 "properly to SCSI INQUIRY command.\n");
825 goto error; /* non retryable error */
826 }
827 usb_pause_mtx(NULL, hz);
828 }
829
830 if (is_no_direct) {
831 DPRINTF("Device is not direct access.\n");
832 goto done;
833 }
834
835 if (usb_test_quirk(uaa, UQ_MSC_NO_TEST_UNIT_READY) == 0) {
836 err = bbb_command_start(sc, DIR_NONE, 0, NULL, 0,
837 &scsi_test_unit_ready, sizeof(scsi_test_unit_ready),
838 USB_MS_HZ);
839
840 if (err != 0) {
841 if (err != ERR_CSW_FAILED)
842 goto error;
843 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_TEST_UNIT_READY);
844 }
845 }
846
847 if (usb_test_quirk(uaa, UQ_MSC_NO_PREVENT_ALLOW) == 0) {
848 err = bbb_command_start(sc, DIR_NONE, 0, NULL, 0,
849 &scsi_prevent_removal, sizeof(scsi_prevent_removal),
850 USB_MS_HZ);
851
852 if (err == 0) {
853 err = bbb_command_start(sc, DIR_NONE, 0, NULL, 0,
854 &scsi_allow_removal, sizeof(scsi_allow_removal),
855 USB_MS_HZ);
856 }
857
858 if (err != 0) {
859 if (err != ERR_CSW_FAILED)
860 goto error;
861 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_PREVENT_ALLOW);
862 }
863 }
864
865 timeout = 1;
866
867 retry_sync_cache:
868 err = bbb_command_start(sc, DIR_NONE, 0, NULL, 0,
869 &scsi_sync_cache, sizeof(scsi_sync_cache),
870 USB_MS_HZ);
871
872 if (err != 0) {
873 if (err != ERR_CSW_FAILED)
874 goto error;
875
876 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_SYNC_CACHE);
877 } else {
878 /*
879 * Certain Kingston memory sticks fail the first
880 * read capacity after a synchronize cache command
881 * has been issued. Disable the synchronize cache
882 * command for such devices.
883 */
884
885 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer, 8,
886 &scsi_read_capacity, sizeof(scsi_read_capacity),
887 USB_MS_HZ);
888
889 if (err != 0) {
890 if (err != ERR_CSW_FAILED)
891 goto error;
892
893 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer, 8,
894 &scsi_read_capacity, sizeof(scsi_read_capacity),
895 USB_MS_HZ);
896
897 if (err == 0) {
898 if (timeout--)
899 goto retry_sync_cache;
900
901 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_SYNC_CACHE);
902 } else {
903 if (err != ERR_CSW_FAILED)
904 goto error;
905 }
906 }
907 }
908
909 if (usb_test_quirk(uaa, UQ_MSC_NO_START_STOP) == 0) {
910 err = bbb_command_start(sc, DIR_NONE, 0, NULL, 0,
911 &scsi_start_unit, sizeof(scsi_start_unit),
912 USB_MS_HZ);
913
914 if (err != 0) {
915 if (err != ERR_CSW_FAILED)
916 goto error;
917 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_START_STOP);
918 }
919 }
920
921 /* clear sense status of any failed commands on the device */
922
923 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer,
924 SCSI_INQ_LEN, &scsi_inquiry, sizeof(scsi_inquiry),
925 USB_MS_HZ);
926
927 DPRINTF("Inquiry = %d\n", err);
928
929 if (err != 0) {
930 if (err != ERR_CSW_FAILED)
931 goto error;
932 }
933
934 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer,
935 SCSI_SENSE_LEN, &scsi_request_sense,
936 sizeof(scsi_request_sense), USB_MS_HZ);
937
938 DPRINTF("Request sense = %d\n", err);
939
940 if (err != 0) {
941 if (err != ERR_CSW_FAILED)
942 goto error;
943 }
944 goto done;
945
946 error:
947 /* Apply most quirks */
948 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_SYNC_CACHE);
949 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_PREVENT_ALLOW);
950 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_TEST_UNIT_READY);
951 USB_ADD_QUIRK(udev, any_quirk, UQ_MSC_NO_START_STOP);
952 done:
953 bbb_detach(sc);
954
955 if (any_quirk) {
956 /* Unconfigure device, to clear software data toggle. */
957 usbd_set_config_index(udev, USB_UNCONFIG_INDEX);
958
959 /* Need to re-enumerate the device to clear its state. */
960 usbd_req_re_enumerate(udev, NULL);
961 return (USB_ERR_STALLED);
962 }
963
964 /* No quirks were added, continue as usual. */
965 return (0);
966 }
967
968 usb_error_t
usb_msc_eject(struct usb_device * udev,uint8_t iface_index,int method)969 usb_msc_eject(struct usb_device *udev, uint8_t iface_index, int method)
970 {
971 struct bbb_transfer *sc;
972 usb_error_t err __usbdebug_used;
973
974 sc = bbb_attach(udev, iface_index, UICLASS_MASS);
975 if (sc == NULL)
976 return (USB_ERR_INVAL);
977
978 switch (method) {
979 case MSC_EJECT_STOPUNIT:
980 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
981 &scsi_test_unit_ready, sizeof(scsi_test_unit_ready),
982 USB_MS_HZ);
983 DPRINTF("Test unit ready status: %s\n", usbd_errstr(err));
984 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
985 &scsi_stop_unit, sizeof(scsi_stop_unit),
986 USB_MS_HZ);
987 break;
988 case MSC_EJECT_REZERO:
989 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
990 &scsi_rezero_init, sizeof(scsi_rezero_init),
991 USB_MS_HZ);
992 break;
993 case MSC_EJECT_ZTESTOR:
994 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
995 &scsi_ztestor_eject, sizeof(scsi_ztestor_eject),
996 USB_MS_HZ);
997 break;
998 case MSC_EJECT_CMOTECH:
999 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
1000 &scsi_cmotech_eject, sizeof(scsi_cmotech_eject),
1001 USB_MS_HZ);
1002 break;
1003 case MSC_EJECT_HUAWEI:
1004 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
1005 &scsi_huawei_eject, sizeof(scsi_huawei_eject),
1006 USB_MS_HZ);
1007 break;
1008 case MSC_EJECT_HUAWEI2:
1009 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
1010 &scsi_huawei_eject2, sizeof(scsi_huawei_eject2),
1011 USB_MS_HZ);
1012 break;
1013 case MSC_EJECT_HUAWEI3:
1014 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
1015 &scsi_huawei_eject3, sizeof(scsi_huawei_eject3),
1016 USB_MS_HZ);
1017 break;
1018 case MSC_EJECT_HUAWEI4:
1019 err = bbb_command_start(sc, DIR_IN, 0, NULL, 0,
1020 &scsi_huawei_eject4, sizeof(scsi_huawei_eject4),
1021 USB_MS_HZ);
1022 break;
1023 case MSC_EJECT_TCT:
1024 /*
1025 * TCTMobile needs DIR_IN flag. To get it, we
1026 * supply a dummy data with the command.
1027 */
1028 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer,
1029 sc->buffer_size, &scsi_tct_eject,
1030 sizeof(scsi_tct_eject), USB_MS_HZ);
1031 break;
1032 default:
1033 DPRINTF("Unknown eject method (%d)\n", method);
1034 bbb_detach(sc);
1035 return (USB_ERR_INVAL);
1036 }
1037
1038 DPRINTF("Eject CD command status: %s\n", usbd_errstr(err));
1039
1040 bbb_detach(sc);
1041 return (0);
1042 }
1043
1044 usb_error_t
usb_dymo_eject(struct usb_device * udev,uint8_t iface_index)1045 usb_dymo_eject(struct usb_device *udev, uint8_t iface_index)
1046 {
1047 static const uint8_t data[3] = { 0x1b, 0x5a, 0x01 };
1048 struct bbb_transfer *sc;
1049 usb_error_t err;
1050
1051 sc = bbb_attach(udev, iface_index, UICLASS_HID);
1052 if (sc == NULL)
1053 return (USB_ERR_INVAL);
1054 err = bbb_raw_write(sc, data, sizeof(data), USB_MS_HZ);
1055 bbb_detach(sc);
1056 return (err);
1057 }
1058
1059 usb_error_t
usb_msc_read_10(struct usb_device * udev,uint8_t iface_index,uint32_t lba,uint32_t blocks,void * buffer)1060 usb_msc_read_10(struct usb_device *udev, uint8_t iface_index,
1061 uint32_t lba, uint32_t blocks, void *buffer)
1062 {
1063 struct bbb_transfer *sc;
1064 uint8_t cmd[10];
1065 usb_error_t err;
1066
1067 cmd[0] = 0x28; /* READ_10 */
1068 cmd[1] = 0;
1069 cmd[2] = lba >> 24;
1070 cmd[3] = lba >> 16;
1071 cmd[4] = lba >> 8;
1072 cmd[5] = lba >> 0;
1073 cmd[6] = 0;
1074 cmd[7] = blocks >> 8;
1075 cmd[8] = blocks;
1076 cmd[9] = 0;
1077
1078 sc = bbb_attach(udev, iface_index, UICLASS_MASS);
1079 if (sc == NULL)
1080 return (USB_ERR_INVAL);
1081
1082 err = bbb_command_start(sc, DIR_IN, 0, buffer,
1083 blocks * SCSI_FIXED_BLOCK_SIZE, cmd, 10, USB_MS_HZ);
1084
1085 bbb_detach(sc);
1086
1087 return (err);
1088 }
1089
1090 usb_error_t
usb_msc_write_10(struct usb_device * udev,uint8_t iface_index,uint32_t lba,uint32_t blocks,void * buffer)1091 usb_msc_write_10(struct usb_device *udev, uint8_t iface_index,
1092 uint32_t lba, uint32_t blocks, void *buffer)
1093 {
1094 struct bbb_transfer *sc;
1095 uint8_t cmd[10];
1096 usb_error_t err;
1097
1098 cmd[0] = 0x2a; /* WRITE_10 */
1099 cmd[1] = 0;
1100 cmd[2] = lba >> 24;
1101 cmd[3] = lba >> 16;
1102 cmd[4] = lba >> 8;
1103 cmd[5] = lba >> 0;
1104 cmd[6] = 0;
1105 cmd[7] = blocks >> 8;
1106 cmd[8] = blocks;
1107 cmd[9] = 0;
1108
1109 sc = bbb_attach(udev, iface_index, UICLASS_MASS);
1110 if (sc == NULL)
1111 return (USB_ERR_INVAL);
1112
1113 err = bbb_command_start(sc, DIR_OUT, 0, buffer,
1114 blocks * SCSI_FIXED_BLOCK_SIZE, cmd, 10, USB_MS_HZ);
1115
1116 bbb_detach(sc);
1117
1118 return (err);
1119 }
1120
1121 usb_error_t
usb_msc_read_capacity(struct usb_device * udev,uint8_t iface_index,uint32_t * lba_last,uint32_t * block_size)1122 usb_msc_read_capacity(struct usb_device *udev, uint8_t iface_index,
1123 uint32_t *lba_last, uint32_t *block_size)
1124 {
1125 struct bbb_transfer *sc;
1126 usb_error_t err;
1127
1128 sc = bbb_attach(udev, iface_index, UICLASS_MASS);
1129 if (sc == NULL)
1130 return (USB_ERR_INVAL);
1131
1132 err = bbb_command_start(sc, DIR_IN, 0, sc->buffer, 8,
1133 &scsi_read_capacity, sizeof(scsi_read_capacity),
1134 USB_MS_HZ);
1135
1136 *lba_last =
1137 (sc->buffer[0] << 24) |
1138 (sc->buffer[1] << 16) |
1139 (sc->buffer[2] << 8) |
1140 (sc->buffer[3]);
1141
1142 *block_size =
1143 (sc->buffer[4] << 24) |
1144 (sc->buffer[5] << 16) |
1145 (sc->buffer[6] << 8) |
1146 (sc->buffer[7]);
1147
1148 /* we currently only support one block size */
1149 if (*block_size != SCSI_FIXED_BLOCK_SIZE)
1150 err = USB_ERR_INVAL;
1151
1152 bbb_detach(sc);
1153
1154 return (err);
1155 }
1156