Use array index 'i' only -after- bounds check
[maemo-rb.git] / firmware / usbstack / usb_storage.c
blobc5fa47fa510a0b9f7f0140b1f6fa571e3fd6cb90
1 /***************************************************************************
2 * __________ __ ___.
3 * Open \______ \ ____ ____ | | _\_ |__ _______ ___
4 * Source | _// _ \_/ ___\| |/ /| __ \ / _ \ \/ /
5 * Jukebox | | ( <_> ) \___| < | \_\ ( <_> > < <
6 * Firmware |____|_ /\____/ \___ >__|_ \|___ /\____/__/\_ \
7 * \/ \/ \/ \/ \/
8 * $Id$
10 * Copyright (C) 2007 by Björn Stenberg
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version 2
15 * of the License, or (at your option) any later version.
17 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
18 * KIND, either express or implied.
20 ****************************************************************************/
21 #include "string.h"
22 #include "system.h"
23 #include "usb_core.h"
24 #include "usb_drv.h"
25 #include "usb_class_driver.h"
26 /*#define LOGF_ENABLE*/
27 #include "logf.h"
28 #include "storage.h"
29 #include "disk.h"
30 #include "fat.h"
31 /* Needed to get at the audio buffer */
32 #include "audio.h"
33 #include "usb_storage.h"
34 #include "timefuncs.h"
36 /* For sector filter macro definitions */
37 #include "usb-target.h"
39 #ifdef USB_USE_RAMDISK
40 #define RAMDISK_SIZE 2048
41 #endif
43 #ifndef SECTOR_SIZE
44 #define SECTOR_SIZE 512
45 #endif
47 /* These defaults allow the operation */
48 #ifndef USBSTOR_READ_SECTORS_FILTER
49 #define USBSTOR_READ_SECTORS_FILTER() ({ 0; })
50 #endif
52 #ifndef USBSTOR_WRITE_SECTORS_FILTER
53 #define USBSTOR_WRITE_SECTORS_FILTER() ({ 0; })
54 #endif
56 /* the ARC driver currently supports up to 64k USB transfers. This is
57 * enough for efficient mass storage support, as commonly host OSes
58 * don't do larger SCSI transfers anyway, so larger USB transfers
59 * wouldn't buy us anything.
60 * Due to being the double-buffering system used, using a smaller write buffer
61 * ends up being more efficient. Measurements have shown that 24k to 28k is
62 * optimal, except for sd devices that apparently don't gain anything from
63 * double-buffering
65 #ifdef USB_READ_BUFFER_SIZE
66 #define READ_BUFFER_SIZE USB_READ_BUFFER_SIZE
67 #else
68 #if CONFIG_CPU == AS3525
69 /* We'd need to implement multidescriptor dma for sizes >65535 */
70 #define READ_BUFFER_SIZE (1024*63)
71 #else
72 #define READ_BUFFER_SIZE (1024*64)
73 #endif /* CONFIG_CPU == AS3525 */
74 #endif /* USB_READ_BUFFER_SIZE */
76 #define MAX_CBW_SIZE 1024
78 #ifdef USB_WRITE_BUFFER_SIZE
79 #define WRITE_BUFFER_SIZE USB_WRITE_BUFFER_SIZE
80 #else
81 #if (CONFIG_STORAGE & STORAGE_SD)
82 #if CONFIG_CPU == AS3525
83 /* We'd need to implement multidescriptor dma for sizes >65535 */
84 #define WRITE_BUFFER_SIZE (1024*63)
85 #else
86 #define WRITE_BUFFER_SIZE (1024*64)
87 #endif /* CONFIG_CPU == AS3525 */
88 #else
89 #define WRITE_BUFFER_SIZE (1024*24)
90 #endif /* (CONFIG_STORAGE & STORAGE_SD) */
91 #endif /* USB_WRITE_BUFFER_SIZE */
93 #define ALLOCATE_BUFFER_SIZE (2*MAX(READ_BUFFER_SIZE,WRITE_BUFFER_SIZE))
95 /* bulk-only class specific requests */
96 #define USB_BULK_RESET_REQUEST 0xff
97 #define USB_BULK_GET_MAX_LUN 0xfe
99 #define DIRECT_ACCESS_DEVICE 0x00 /* disks */
100 #define DEVICE_REMOVABLE 0x80
102 #define CBW_SIGNATURE 0x43425355
103 #define CSW_SIGNATURE 0x53425355
105 #define SCSI_TEST_UNIT_READY 0x00
106 #define SCSI_INQUIRY 0x12
107 #define SCSI_MODE_SENSE_6 0x1a
108 #define SCSI_MODE_SENSE_10 0x5a
109 #define SCSI_REQUEST_SENSE 0x03
110 #define SCSI_ALLOW_MEDIUM_REMOVAL 0x1e
111 #define SCSI_READ_CAPACITY 0x25
112 #define SCSI_READ_FORMAT_CAPACITY 0x23
113 #define SCSI_READ_10 0x28
114 #define SCSI_WRITE_10 0x2a
115 #define SCSI_START_STOP_UNIT 0x1b
116 #define SCSI_REPORT_LUNS 0xa0
117 #define SCSI_WRITE_BUFFER 0x3b
119 #define UMS_STATUS_GOOD 0x00
120 #define UMS_STATUS_FAIL 0x01
122 #define SENSE_NOT_READY 0x02
123 #define SENSE_MEDIUM_ERROR 0x03
124 #define SENSE_ILLEGAL_REQUEST 0x05
125 #define SENSE_UNIT_ATTENTION 0x06
127 #define ASC_MEDIUM_NOT_PRESENT 0x3a
128 #define ASC_INVALID_FIELD_IN_CBD 0x24
129 #define ASC_LBA_OUT_OF_RANGE 0x21
130 #define ASC_WRITE_ERROR 0x0C
131 #define ASC_READ_ERROR 0x11
132 #define ASC_NOT_READY 0x04
133 #define ASC_INVALID_COMMAND 0x20
135 #define ASCQ_BECOMING_READY 0x01
137 #define SCSI_FORMAT_CAPACITY_FORMATTED_MEDIA 0x02000000
139 /* storage interface */
141 #define USB_SC_SCSI 0x06 /* Transparent */
142 #define USB_PROT_BULK 0x50 /* bulk only */
144 static struct usb_interface_descriptor __attribute__((aligned(2)))
145 interface_descriptor =
147 .bLength = sizeof(struct usb_interface_descriptor),
148 .bDescriptorType = USB_DT_INTERFACE,
149 .bInterfaceNumber = 0,
150 .bAlternateSetting = 0,
151 .bNumEndpoints = 2,
152 .bInterfaceClass = USB_CLASS_MASS_STORAGE,
153 .bInterfaceSubClass = USB_SC_SCSI,
154 .bInterfaceProtocol = USB_PROT_BULK,
155 .iInterface = 0
158 static struct usb_endpoint_descriptor __attribute__((aligned(2)))
159 endpoint_descriptor =
161 .bLength = sizeof(struct usb_endpoint_descriptor),
162 .bDescriptorType = USB_DT_ENDPOINT,
163 .bEndpointAddress = 0,
164 .bmAttributes = USB_ENDPOINT_XFER_BULK,
165 .wMaxPacketSize = 0,
166 .bInterval = 0
169 struct inquiry_data {
170 unsigned char DeviceType;
171 unsigned char DeviceTypeModifier;
172 unsigned char Versions;
173 unsigned char Format;
174 unsigned char AdditionalLength;
175 unsigned char Reserved[2];
176 unsigned char Capability;
177 unsigned char VendorId[8];
178 unsigned char ProductId[16];
179 unsigned char ProductRevisionLevel[4];
180 } __attribute__ ((packed));
182 struct report_lun_data {
183 unsigned int lun_list_length;
184 unsigned int reserved1;
185 unsigned char luns[NUM_DRIVES][8];
186 } __attribute__ ((packed));
188 struct sense_data {
189 unsigned char ResponseCode;
190 unsigned char Obsolete;
191 unsigned char fei_sensekey;
192 unsigned int Information;
193 unsigned char AdditionalSenseLength;
194 unsigned int CommandSpecificInformation;
195 unsigned char AdditionalSenseCode;
196 unsigned char AdditionalSenseCodeQualifier;
197 unsigned char FieldReplaceableUnitCode;
198 unsigned char SKSV;
199 unsigned short SenseKeySpecific;
200 } __attribute__ ((packed));
202 struct mode_sense_bdesc_longlba {
203 unsigned char num_blocks[8];
204 unsigned char reserved[4];
205 unsigned char block_size[4];
206 } __attribute__ ((packed));
208 struct mode_sense_bdesc_shortlba {
209 unsigned char density_code;
210 unsigned char num_blocks[3];
211 unsigned char reserved;
212 unsigned char block_size[3];
213 } __attribute__ ((packed));
215 struct mode_sense_data_10 {
216 unsigned short mode_data_length;
217 unsigned char medium_type;
218 unsigned char device_specific;
219 unsigned char longlba;
220 unsigned char reserved;
221 unsigned short block_descriptor_length;
222 struct mode_sense_bdesc_longlba block_descriptor;
223 } __attribute__ ((packed));
225 struct mode_sense_data_6 {
226 unsigned char mode_data_length;
227 unsigned char medium_type;
228 unsigned char device_specific;
229 unsigned char block_descriptor_length;
230 struct mode_sense_bdesc_shortlba block_descriptor;
231 } __attribute__ ((packed));
233 struct command_block_wrapper {
234 unsigned int signature;
235 unsigned int tag;
236 unsigned int data_transfer_length;
237 unsigned char flags;
238 unsigned char lun;
239 unsigned char command_length;
240 unsigned char command_block[16];
241 } __attribute__ ((packed));
243 struct command_status_wrapper {
244 unsigned int signature;
245 unsigned int tag;
246 unsigned int data_residue;
247 unsigned char status;
248 } __attribute__ ((packed));
250 struct capacity {
251 unsigned int block_count;
252 unsigned int block_size;
253 } __attribute__ ((packed));
255 struct format_capacity {
256 unsigned int following_length;
257 unsigned int block_count;
258 unsigned int block_size;
259 } __attribute__ ((packed));
262 static union {
263 unsigned char* transfer_buffer;
264 struct inquiry_data* inquiry;
265 struct capacity* capacity_data;
266 struct format_capacity* format_capacity_data;
267 struct sense_data *sense_data;
268 struct mode_sense_data_6 *ms_data_6;
269 struct mode_sense_data_10 *ms_data_10;
270 struct report_lun_data *lun_data;
271 struct command_status_wrapper* csw;
272 char *max_lun;
273 } tb;
275 static char *cbw_buffer;
277 static struct {
278 unsigned int sector;
279 unsigned int count;
280 unsigned int orig_count;
281 unsigned int cur_cmd;
282 unsigned int tag;
283 unsigned int lun;
284 unsigned char *data[2];
285 unsigned char data_select;
286 unsigned int last_result;
287 } cur_cmd;
289 static struct {
290 unsigned char sense_key;
291 unsigned char information;
292 unsigned char asc;
293 unsigned char ascq;
294 } cur_sense_data;
296 static void handle_scsi(struct command_block_wrapper* cbw);
297 static void send_csw(int status);
298 static void send_command_result(void *data,int size);
299 static void send_command_failed_result(void);
300 static void send_block_data(void *data,int size);
301 static void receive_block_data(void *data,int size);
302 static void receive_time(void);
303 static void fill_inquiry(IF_MD_NONVOID(int lun));
304 static void send_and_read_next(void);
305 static bool ejected[NUM_DRIVES];
306 static bool locked[NUM_DRIVES];
308 static int usb_interface;
309 static int ep_in, ep_out;
311 #if defined(HAVE_MULTIDRIVE)
312 static bool skip_first = 0;
313 #endif
315 #ifdef USB_USE_RAMDISK
316 static unsigned char* ramdisk_buffer;
317 #endif
319 static enum {
320 WAITING_FOR_COMMAND,
321 SENDING_BLOCKS,
322 SENDING_RESULT,
323 SENDING_FAILED_RESULT,
324 RECEIVING_BLOCKS,
325 RECEIVING_TIME,
326 WAITING_FOR_CSW_COMPLETION_OR_COMMAND,
327 WAITING_FOR_CSW_COMPLETION
328 } state = WAITING_FOR_COMMAND;
330 static void yearday_to_daymonth(int yd, int y, int *d, int *m)
332 static const char tnl[] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
333 static const char tl[] = { 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
334 const char *t;
335 int i=0;
337 if((y%4 == 0 && y%100 != 0) || y%400 == 0)
339 t=tl;
341 else
343 t=tnl;
346 while(i<12 && yd >= t[i])
348 yd-=t[i];
349 i++;
351 *d = yd+1;
352 *m = i;
355 static bool check_disk_present(IF_MD_NONVOID(int volume))
357 #ifdef USB_USE_RAMDISK
358 return true;
359 #else
360 unsigned char* sector = fat_get_sector_buffer();
361 bool success = storage_read_sectors(IF_MD2(volume,)0,1,sector) == 0;
362 fat_release_sector_buffer();
363 return success;
364 #endif
367 void usb_storage_try_release_storage(void)
369 /* Check if there is a connected drive left. If not,
370 release excusive access */
371 bool canrelease=true;
372 int i;
373 for(i=0;i<storage_num_drives();i++) {
374 if(!ejected[i] && locked[i]) {
375 canrelease=false;
376 break;
379 if(canrelease) {
380 logf("scsi release ata");
381 usb_release_exclusive_storage();
385 #ifdef HAVE_HOTSWAP
386 void usb_storage_notify_hotswap(int volume,bool inserted)
388 logf("notify %d",inserted);
389 if(inserted && check_disk_present(IF_MD(volume))) {
390 ejected[volume] = false;
392 else {
393 ejected[volume] = true;
394 /* If this happens while the device is locked, weird things may happen.
395 At least try to keep our state consistent */
396 locked[volume]=false;
399 #endif
401 #ifdef HAVE_MULTIDRIVE
402 void usb_set_skip_first_drive(bool skip)
404 skip_first = skip;
406 #endif
408 /* called by usb_core_init() */
409 void usb_storage_init(void)
411 logf("usb_storage_init done");
414 int usb_storage_request_endpoints(struct usb_class_driver *drv)
416 ep_in = usb_core_request_endpoint(USB_ENDPOINT_XFER_BULK, USB_DIR_IN, drv);
418 if(ep_in<0)
419 return -1;
421 ep_out = usb_core_request_endpoint(USB_ENDPOINT_XFER_BULK, USB_DIR_OUT,
422 drv);
424 if(ep_out<0) {
425 usb_core_release_endpoint(ep_in);
426 return -1;
429 return 0;
432 int usb_storage_set_first_interface(int interface)
434 usb_interface = interface;
435 return interface + 1;
438 int usb_storage_get_config_descriptor(unsigned char *dest,int max_packet_size)
440 unsigned char *orig_dest = dest;
442 interface_descriptor.bInterfaceNumber = usb_interface;
443 PACK_DATA(dest, interface_descriptor);
445 endpoint_descriptor.wMaxPacketSize = max_packet_size;
447 endpoint_descriptor.bEndpointAddress = ep_in;
448 PACK_DATA(dest, endpoint_descriptor);
450 endpoint_descriptor.bEndpointAddress = ep_out;
451 PACK_DATA(dest, endpoint_descriptor);
453 return (dest - orig_dest);
456 void usb_storage_init_connection(void)
458 logf("ums: set config");
459 /* prime rx endpoint. We only need room for commands */
460 state = WAITING_FOR_COMMAND;
462 #if (CONFIG_CPU == IMX31L || defined(CPU_TCC77X) || defined(CPU_TCC780X) || \
463 defined(BOOTLOADER) || CONFIG_CPU == DM320) && !defined(CPU_PP502x)
464 static unsigned char _cbw_buffer[MAX_CBW_SIZE]
465 USB_DEVBSS_ATTR __attribute__((aligned(32)));
466 cbw_buffer = (void *)_cbw_buffer;
468 static unsigned char _transfer_buffer[ALLOCATE_BUFFER_SIZE]
469 USB_DEVBSS_ATTR __attribute__((aligned(32)));
470 tb.transfer_buffer = (void *)_transfer_buffer;
471 #ifdef USB_USE_RAMDISK
472 static unsigned char _ramdisk_buffer[RAMDISK_SIZE*SECTOR_SIZE];
473 ramdisk_buffer = _ramdisk_buffer;
474 #endif
475 #else
476 /* TODO : check if bufsize is at least 32K ? */
477 size_t bufsize;
478 unsigned char * audio_buffer;
480 audio_buffer = audio_get_buffer(false,&bufsize);
481 #if defined(UNCACHED_ADDR) && CONFIG_CPU != AS3525
482 cbw_buffer = (void *)UNCACHED_ADDR((unsigned int)(audio_buffer+31) & 0xffffffe0);
483 #else
484 cbw_buffer = (void *)((unsigned int)(audio_buffer+31) & 0xffffffe0);
485 #endif
486 tb.transfer_buffer = cbw_buffer + MAX_CBW_SIZE;
487 cpucache_invalidate();
488 #ifdef USB_USE_RAMDISK
489 ramdisk_buffer = tb.transfer_buffer + ALLOCATE_BUFFER_SIZE;
490 #endif
491 #endif
492 usb_drv_recv(ep_out, cbw_buffer, MAX_CBW_SIZE);
494 int i;
495 for(i=0;i<storage_num_drives();i++) {
496 locked[i] = false;
497 ejected[i] = !check_disk_present(IF_MD(i));
498 queue_broadcast(SYS_USB_LUN_LOCKED, (i<<16)+0);
502 void usb_storage_disconnect(void)
504 /* Empty for now */
507 /* called by usb_core_transfer_complete() */
508 void usb_storage_transfer_complete(int ep,int dir,int status,int length)
510 (void)ep;
511 struct command_block_wrapper* cbw = (void*)cbw_buffer;
512 struct tm tm;
514 logf("transfer result for ep %d/%d %X %d", ep,dir,status, length);
515 switch(state) {
516 case RECEIVING_BLOCKS:
517 if(dir==USB_DIR_IN) {
518 logf("IN received in RECEIVING");
520 logf("scsi write %d %d", cur_cmd.sector, cur_cmd.count);
521 if(status==0) {
522 if((unsigned int)length!=(SECTOR_SIZE* cur_cmd.count)
523 && (unsigned int)length!=WRITE_BUFFER_SIZE) {
524 logf("unexpected length :%d",length);
525 break;
528 unsigned int next_sector = cur_cmd.sector +
529 (WRITE_BUFFER_SIZE/SECTOR_SIZE);
530 unsigned int next_count = cur_cmd.count -
531 MIN(cur_cmd.count,WRITE_BUFFER_SIZE/SECTOR_SIZE);
532 int next_select = !cur_cmd.data_select;
534 if(next_count!=0) {
535 /* Ask the host to send more, to the other buffer */
536 receive_block_data(cur_cmd.data[next_select],
537 MIN(WRITE_BUFFER_SIZE,next_count*SECTOR_SIZE));
540 /* Now write the data that just came in, while the host is
541 sending the next bit */
542 #ifdef USB_USE_RAMDISK
543 memcpy(ramdisk_buffer + cur_cmd.sector*SECTOR_SIZE,
544 cur_cmd.data[cur_cmd.data_select],
545 MIN(WRITE_BUFFER_SIZE/SECTOR_SIZE, cur_cmd.count)*SECTOR_SIZE);
546 #else
547 int result = USBSTOR_WRITE_SECTORS_FILTER();
549 if (result == 0) {
550 result = storage_write_sectors(IF_MD2(cur_cmd.lun,)
551 cur_cmd.sector,
552 MIN(WRITE_BUFFER_SIZE/SECTOR_SIZE, cur_cmd.count),
553 cur_cmd.data[cur_cmd.data_select]);
556 if(result != 0) {
557 send_csw(UMS_STATUS_FAIL);
558 cur_sense_data.sense_key=SENSE_MEDIUM_ERROR;
559 cur_sense_data.asc=ASC_WRITE_ERROR;
560 cur_sense_data.ascq=0;
561 break;
563 #endif
564 if(next_count==0) {
565 send_csw(UMS_STATUS_GOOD);
568 /* Switch buffers for the next one */
569 cur_cmd.data_select=!cur_cmd.data_select;
571 cur_cmd.sector = next_sector;
572 cur_cmd.count = next_count;
574 else {
575 logf("Transfer failed %X",status);
576 send_csw(UMS_STATUS_FAIL);
577 /* TODO fill in cur_sense_data */
578 cur_sense_data.sense_key=0;
579 cur_sense_data.information=0;
580 cur_sense_data.asc=0;
581 cur_sense_data.ascq=0;
583 break;
584 case WAITING_FOR_CSW_COMPLETION_OR_COMMAND:
585 if(dir==USB_DIR_IN) {
586 /* This was the CSW */
587 state = WAITING_FOR_COMMAND;
589 else {
590 /* This was the command */
591 state = WAITING_FOR_CSW_COMPLETION;
592 /* We now have the CBW, but we won't execute it yet to avoid
593 * issues with the still-pending CSW */
595 break;
596 case WAITING_FOR_COMMAND:
597 if(dir==USB_DIR_IN) {
598 logf("IN received in WAITING_FOR_COMMAND");
600 handle_scsi(cbw);
601 break;
602 case WAITING_FOR_CSW_COMPLETION:
603 if(dir==USB_DIR_OUT) {
604 logf("OUT received in WAITING_FOR_CSW_COMPLETION");
606 handle_scsi(cbw);
607 break;
608 #if 0
609 if(cur_cmd.cur_cmd == SCSI_WRITE_10)
611 queue_broadcast(SYS_USB_WRITE_DATA, (cur_cmd.lun<<16)+cur_cmd.orig_count);
613 else if(cur_cmd.cur_cmd == SCSI_READ_10)
615 queue_broadcast(SYS_USB_READ_DATA, (cur_cmd.lun<<16)+cur_cmd.orig_count);
617 #endif
618 break;
619 case SENDING_RESULT:
620 if(dir==USB_DIR_OUT) {
621 logf("OUT received in SENDING");
623 if(status==0) {
624 //logf("data sent, now send csw");
625 send_csw(UMS_STATUS_GOOD);
627 else {
628 logf("Transfer failed %X",status);
629 send_csw(UMS_STATUS_FAIL);
630 /* TODO fill in cur_sense_data */
631 cur_sense_data.sense_key=0;
632 cur_sense_data.information=0;
633 cur_sense_data.asc=0;
634 cur_sense_data.ascq=0;
636 break;
637 case SENDING_FAILED_RESULT:
638 if(dir==USB_DIR_OUT) {
639 logf("OUT received in SENDING");
641 send_csw(UMS_STATUS_FAIL);
642 break;
643 case SENDING_BLOCKS:
644 if(dir==USB_DIR_OUT) {
645 logf("OUT received in SENDING");
647 if(status==0) {
648 if(cur_cmd.count==0) {
649 //logf("data sent, now send csw");
650 if(cur_cmd.last_result!=0) {
651 /* The last read failed. */
652 send_csw(UMS_STATUS_FAIL);
653 cur_sense_data.sense_key=SENSE_MEDIUM_ERROR;
654 cur_sense_data.asc=ASC_READ_ERROR;
655 cur_sense_data.ascq=0;
656 return;
658 else
659 send_csw(UMS_STATUS_GOOD);
661 else {
662 send_and_read_next();
665 else {
666 logf("Transfer failed %X",status);
667 send_csw(UMS_STATUS_FAIL);
668 /* TODO fill in cur_sense_data */
669 cur_sense_data.sense_key=0;
670 cur_sense_data.information=0;
671 cur_sense_data.asc=0;
672 cur_sense_data.ascq=0;
674 break;
675 case RECEIVING_TIME:
676 tm.tm_year=(tb.transfer_buffer[0]<<8)+tb.transfer_buffer[1] - 1900;
677 tm.tm_yday=(tb.transfer_buffer[2]<<8)+tb.transfer_buffer[3];
678 tm.tm_hour=tb.transfer_buffer[5];
679 tm.tm_min=tb.transfer_buffer[6];
680 tm.tm_sec=tb.transfer_buffer[7];
681 yearday_to_daymonth(tm.tm_yday,tm.tm_year + 1900,&tm.tm_mday,&tm.tm_mon);
682 set_day_of_week(&tm);
683 set_time(&tm);
684 send_csw(UMS_STATUS_GOOD);
685 break;
689 /* called by usb_core_control_request() */
690 bool usb_storage_control_request(struct usb_ctrlrequest* req, unsigned char* dest)
692 bool handled = false;
694 (void)dest;
695 switch (req->bRequest) {
696 case USB_BULK_GET_MAX_LUN: {
697 *tb.max_lun = storage_num_drives() - 1;
698 #if defined(HAVE_MULTIDRIVE)
699 if(skip_first) (*tb.max_lun) --;
700 #endif
701 logf("ums: getmaxlun");
702 usb_drv_recv(EP_CONTROL, NULL, 0); /* ack */
703 usb_drv_send(EP_CONTROL, tb.max_lun, 1);
704 handled = true;
705 break;
708 case USB_BULK_RESET_REQUEST:
709 logf("ums: bulk reset");
710 state = WAITING_FOR_COMMAND;
711 /* UMS BOT 3.1 says The device shall preserve the value of its bulk
712 data toggle bits and endpoint STALL conditions despite
713 the Bulk-Only Mass Storage Reset. */
714 #if 0
715 usb_drv_reset_endpoint(ep_in, false);
716 usb_drv_reset_endpoint(ep_out, true);
717 #endif
718 usb_drv_send(EP_CONTROL, NULL, 0); /* ack */
719 handled = true;
720 break;
723 return handled;
726 static void send_and_read_next(void)
728 int result = USBSTOR_READ_SECTORS_FILTER();
730 if(result != 0 && cur_cmd.last_result == 0)
731 cur_cmd.last_result = result;
733 send_block_data(cur_cmd.data[cur_cmd.data_select],
734 MIN(READ_BUFFER_SIZE,cur_cmd.count*SECTOR_SIZE));
736 /* Switch buffers for the next one */
737 cur_cmd.data_select=!cur_cmd.data_select;
739 cur_cmd.sector+=(READ_BUFFER_SIZE/SECTOR_SIZE);
740 cur_cmd.count-=MIN(cur_cmd.count,READ_BUFFER_SIZE/SECTOR_SIZE);
742 if(cur_cmd.count!=0) {
743 /* already read the next bit, so we can send it out immediately when the
744 * current transfer completes. */
745 #ifdef USB_USE_RAMDISK
746 memcpy(cur_cmd.data[cur_cmd.data_select],
747 ramdisk_buffer + cur_cmd.sector*SECTOR_SIZE,
748 MIN(READ_BUFFER_SIZE/SECTOR_SIZE, cur_cmd.count)*SECTOR_SIZE);
749 #else
750 result = storage_read_sectors(IF_MD2(cur_cmd.lun,)
751 cur_cmd.sector,
752 MIN(READ_BUFFER_SIZE/SECTOR_SIZE, cur_cmd.count),
753 cur_cmd.data[cur_cmd.data_select]);
754 if(cur_cmd.last_result == 0)
755 cur_cmd.last_result = result;
757 #endif
760 /****************************************************************************/
762 static void handle_scsi(struct command_block_wrapper* cbw)
764 /* USB Mass Storage assumes LBA capability.
765 TODO: support 48-bit LBA */
767 struct storage_info info;
768 unsigned int length = cbw->data_transfer_length;
769 unsigned int block_size = 0;
770 unsigned int block_count = 0;
771 bool lun_present=true;
772 unsigned char lun = cbw->lun;
773 unsigned int block_size_mult = 1;
775 if(letoh32(cbw->signature) != CBW_SIGNATURE) {
776 usb_drv_stall(ep_in, true,true);
777 usb_drv_stall(ep_out, true,false);
778 return;
780 /* Clear the signature to prevent possible bugs elsewhere
781 * to trigger a second execution of the same command with
782 * bogus data */
783 cbw->signature=0;
785 #if defined(HAVE_MULTIDRIVE)
786 if(skip_first) lun++;
787 #endif
789 storage_get_info(lun,&info);
790 #ifdef USB_USE_RAMDISK
791 block_size = SECTOR_SIZE;
792 block_count = RAMDISK_SIZE;
793 #else
794 block_size=info.sector_size;
795 block_count=info.num_sectors;
796 #endif
798 #ifdef HAVE_HOTSWAP
799 if(storage_removable(lun) && !storage_present(lun)) {
800 ejected[lun] = true;
802 #endif
804 if(ejected[lun])
805 lun_present = false;
807 #ifdef MAX_LOG_SECTOR_SIZE
808 block_size_mult = disk_sector_multiplier;
809 #endif
811 cur_cmd.tag = cbw->tag;
812 cur_cmd.lun = lun;
813 cur_cmd.cur_cmd = cbw->command_block[0];
815 switch (cbw->command_block[0]) {
816 case SCSI_TEST_UNIT_READY:
817 logf("scsi test_unit_ready %d",lun);
818 if(!usb_exclusive_storage()) {
819 send_csw(UMS_STATUS_FAIL);
820 cur_sense_data.sense_key=SENSE_NOT_READY;
821 cur_sense_data.asc=ASC_MEDIUM_NOT_PRESENT;
822 cur_sense_data.ascq=0;
823 break;
825 if(lun_present) {
826 send_csw(UMS_STATUS_GOOD);
828 else {
829 send_csw(UMS_STATUS_FAIL);
830 cur_sense_data.sense_key=SENSE_NOT_READY;
831 cur_sense_data.asc=ASC_MEDIUM_NOT_PRESENT;
832 cur_sense_data.ascq=0;
834 break;
836 case SCSI_REPORT_LUNS: {
837 logf("scsi report luns %d",lun);
838 int allocation_length=0;
839 int i;
840 unsigned int response_length = 8+8*storage_num_drives();
841 allocation_length|=(cbw->command_block[6]<<24);
842 allocation_length|=(cbw->command_block[7]<<16);
843 allocation_length|=(cbw->command_block[8]<<8);
844 allocation_length|=(cbw->command_block[9]);
845 memset(tb.lun_data,0,sizeof(struct report_lun_data));
846 tb.lun_data->lun_list_length=htobe32(8*storage_num_drives());
847 for(i=0;i<storage_num_drives();i++)
849 #ifdef HAVE_HOTSWAP
850 if(storage_removable(i))
851 tb.lun_data->luns[i][1]=1;
852 else
853 #endif
854 tb.lun_data->luns[i][1]=0;
856 send_command_result(tb.lun_data,
857 MIN(response_length, length));
858 break;
861 case SCSI_INQUIRY:
862 logf("scsi inquiry %d",lun);
863 fill_inquiry(IF_MD(lun));
864 length = MIN(length, cbw->command_block[4]);
865 send_command_result(tb.inquiry,
866 MIN(sizeof(struct inquiry_data), length));
867 break;
869 case SCSI_REQUEST_SENSE: {
870 tb.sense_data->ResponseCode=0x70;/*current error*/
871 tb.sense_data->Obsolete=0;
872 tb.sense_data->fei_sensekey=cur_sense_data.sense_key&0x0f;
873 tb.sense_data->Information=cur_sense_data.information;
874 tb.sense_data->AdditionalSenseLength=10;
875 tb.sense_data->CommandSpecificInformation=0;
876 tb.sense_data->AdditionalSenseCode=cur_sense_data.asc;
877 tb.sense_data->AdditionalSenseCodeQualifier=cur_sense_data.ascq;
878 tb.sense_data->FieldReplaceableUnitCode=0;
879 tb.sense_data->SKSV=0;
880 tb.sense_data->SenseKeySpecific=0;
881 logf("scsi request_sense %d",lun);
882 send_command_result(tb.sense_data,
883 MIN(sizeof(struct sense_data), length));
884 break;
887 case SCSI_MODE_SENSE_10: {
888 if(!lun_present) {
889 send_command_failed_result();
890 cur_sense_data.sense_key=SENSE_NOT_READY;
891 cur_sense_data.asc=ASC_MEDIUM_NOT_PRESENT;
892 cur_sense_data.ascq=0;
893 break;
895 /*unsigned char pc = (cbw->command_block[2] & 0xc0) >>6;*/
896 unsigned char page_code = cbw->command_block[2] & 0x3f;
897 logf("scsi mode_sense_10 %d %X",lun,page_code);
898 switch(page_code) {
899 case 0x3f:
900 tb.ms_data_10->mode_data_length =
901 htobe16(sizeof(struct mode_sense_data_10)-2);
902 tb.ms_data_10->medium_type = 0;
903 tb.ms_data_10->device_specific = 0;
904 tb.ms_data_10->reserved = 0;
905 tb.ms_data_10->longlba = 1;
906 tb.ms_data_10->block_descriptor_length =
907 htobe16(sizeof(struct mode_sense_bdesc_longlba));
909 memset(tb.ms_data_10->block_descriptor.reserved,0,4);
910 memset(tb.ms_data_10->block_descriptor.num_blocks,0,8);
912 tb.ms_data_10->block_descriptor.num_blocks[4] =
913 ((block_count/block_size_mult) & 0xff000000)>>24;
914 tb.ms_data_10->block_descriptor.num_blocks[5] =
915 ((block_count/block_size_mult) & 0x00ff0000)>>16;
916 tb.ms_data_10->block_descriptor.num_blocks[6] =
917 ((block_count/block_size_mult) & 0x0000ff00)>>8;
918 tb.ms_data_10->block_descriptor.num_blocks[7] =
919 ((block_count/block_size_mult) & 0x000000ff);
921 tb.ms_data_10->block_descriptor.block_size[0] =
922 ((block_size*block_size_mult) & 0xff000000)>>24;
923 tb.ms_data_10->block_descriptor.block_size[1] =
924 ((block_size*block_size_mult) & 0x00ff0000)>>16;
925 tb.ms_data_10->block_descriptor.block_size[2] =
926 ((block_size*block_size_mult) & 0x0000ff00)>>8;
927 tb.ms_data_10->block_descriptor.block_size[3] =
928 ((block_size*block_size_mult) & 0x000000ff);
929 send_command_result(tb.ms_data_10,
930 MIN(sizeof(struct mode_sense_data_10), length));
931 break;
932 default:
933 send_command_failed_result();
934 cur_sense_data.sense_key=SENSE_ILLEGAL_REQUEST;
935 cur_sense_data.asc=ASC_INVALID_FIELD_IN_CBD;
936 cur_sense_data.ascq=0;
937 break;
939 break;
942 case SCSI_MODE_SENSE_6: {
943 if(!lun_present) {
944 send_command_failed_result();
945 cur_sense_data.sense_key=SENSE_NOT_READY;
946 cur_sense_data.asc=ASC_MEDIUM_NOT_PRESENT;
947 cur_sense_data.ascq=0;
948 break;
950 /*unsigned char pc = (cbw->command_block[2] & 0xc0) >>6;*/
951 unsigned char page_code = cbw->command_block[2] & 0x3f;
952 logf("scsi mode_sense_6 %d %X",lun,page_code);
953 switch(page_code) {
954 case 0x3f:
955 /* All supported pages. */
956 tb.ms_data_6->mode_data_length =
957 sizeof(struct mode_sense_data_6)-1;
958 tb.ms_data_6->medium_type = 0;
959 tb.ms_data_6->device_specific = 0;
960 tb.ms_data_6->block_descriptor_length =
961 sizeof(struct mode_sense_bdesc_shortlba);
962 tb.ms_data_6->block_descriptor.density_code = 0;
963 tb.ms_data_6->block_descriptor.reserved = 0;
964 if(block_count/block_size_mult > 0xffffff) {
965 tb.ms_data_6->block_descriptor.num_blocks[0] = 0xff;
966 tb.ms_data_6->block_descriptor.num_blocks[1] = 0xff;
967 tb.ms_data_6->block_descriptor.num_blocks[2] = 0xff;
969 else {
970 tb.ms_data_6->block_descriptor.num_blocks[0] =
971 ((block_count/block_size_mult) & 0xff0000)>>16;
972 tb.ms_data_6->block_descriptor.num_blocks[1] =
973 ((block_count/block_size_mult) & 0x00ff00)>>8;
974 tb.ms_data_6->block_descriptor.num_blocks[2] =
975 ((block_count/block_size_mult) & 0x0000ff);
977 tb.ms_data_6->block_descriptor.block_size[0] =
978 ((block_size*block_size_mult) & 0xff0000)>>16;
979 tb.ms_data_6->block_descriptor.block_size[1] =
980 ((block_size*block_size_mult) & 0x00ff00)>>8;
981 tb.ms_data_6->block_descriptor.block_size[2] =
982 ((block_size*block_size_mult) & 0x0000ff);
983 send_command_result(tb.ms_data_6,
984 MIN(sizeof(struct mode_sense_data_6), length));
985 break;
986 default:
987 send_command_failed_result();
988 cur_sense_data.sense_key=SENSE_ILLEGAL_REQUEST;
989 cur_sense_data.asc=ASC_INVALID_FIELD_IN_CBD;
990 cur_sense_data.ascq=0;
991 break;
993 break;
996 case SCSI_START_STOP_UNIT:
997 logf("scsi start_stop unit %d",lun);
998 if((cbw->command_block[4] & 0xf0) == 0) /*load/eject bit is valid*/
999 { /* Process start and eject bits */
1000 logf("scsi load/eject");
1001 if((cbw->command_block[4] & 0x01) == 0) /* Don't start */
1003 if((cbw->command_block[4] & 0x02) != 0) /* eject */
1005 logf("scsi eject");
1006 ejected[lun]=true;
1010 send_csw(UMS_STATUS_GOOD);
1011 break;
1013 case SCSI_ALLOW_MEDIUM_REMOVAL:
1014 logf("scsi allow_medium_removal %d",lun);
1015 if((cbw->command_block[4] & 0x03) == 0) {
1016 locked[lun]=false;
1017 queue_broadcast(SYS_USB_LUN_LOCKED, (lun<<16)+0);
1019 else {
1020 locked[lun]=true;
1021 queue_broadcast(SYS_USB_LUN_LOCKED, (lun<<16)+1);
1023 send_csw(UMS_STATUS_GOOD);
1024 break;
1026 case SCSI_READ_FORMAT_CAPACITY: {
1027 logf("scsi read_format_capacity %d",lun);
1028 if(lun_present) {
1029 tb.format_capacity_data->following_length=htobe32(8);
1030 /* "block count" actually means "number of last block" */
1031 tb.format_capacity_data->block_count =
1032 htobe32(block_count/block_size_mult - 1);
1033 tb.format_capacity_data->block_size =
1034 htobe32(block_size*block_size_mult);
1035 tb.format_capacity_data->block_size |=
1036 htobe32(SCSI_FORMAT_CAPACITY_FORMATTED_MEDIA);
1038 send_command_result(tb.format_capacity_data,
1039 MIN(sizeof(struct format_capacity), length));
1041 else {
1042 send_command_failed_result();
1043 cur_sense_data.sense_key=SENSE_NOT_READY;
1044 cur_sense_data.asc=ASC_MEDIUM_NOT_PRESENT;
1045 cur_sense_data.ascq=0;
1047 break;
1050 case SCSI_READ_CAPACITY: {
1051 logf("scsi read_capacity %d",lun);
1053 if(lun_present) {
1054 /* "block count" actually means "number of last block" */
1055 tb.capacity_data->block_count =
1056 htobe32(block_count/block_size_mult - 1);
1057 tb.capacity_data->block_size =
1058 htobe32(block_size*block_size_mult);
1060 send_command_result(tb.capacity_data,
1061 MIN(sizeof(struct capacity), length));
1063 else {
1064 send_command_failed_result();
1065 cur_sense_data.sense_key=SENSE_NOT_READY;
1066 cur_sense_data.asc=ASC_MEDIUM_NOT_PRESENT;
1067 cur_sense_data.ascq=0;
1069 break;
1072 case SCSI_READ_10:
1073 logf("scsi read10 %d",lun);
1074 if(!lun_present) {
1075 send_command_failed_result();
1076 cur_sense_data.sense_key=SENSE_NOT_READY;
1077 cur_sense_data.asc=ASC_MEDIUM_NOT_PRESENT;
1078 cur_sense_data.ascq=0;
1079 break;
1081 cur_cmd.data[0] = tb.transfer_buffer;
1082 cur_cmd.data[1] = &tb.transfer_buffer[READ_BUFFER_SIZE];
1083 cur_cmd.data_select=0;
1084 cur_cmd.sector = block_size_mult *
1085 (cbw->command_block[2] << 24 |
1086 cbw->command_block[3] << 16 |
1087 cbw->command_block[4] << 8 |
1088 cbw->command_block[5] );
1089 cur_cmd.count = block_size_mult *
1090 (cbw->command_block[7] << 8 |
1091 cbw->command_block[8]);
1092 cur_cmd.orig_count = cur_cmd.count;
1094 //logf("scsi read %d %d", cur_cmd.sector, cur_cmd.count);
1096 if((cur_cmd.sector + cur_cmd.count) > block_count) {
1097 send_csw(UMS_STATUS_FAIL);
1098 cur_sense_data.sense_key=SENSE_ILLEGAL_REQUEST;
1099 cur_sense_data.asc=ASC_LBA_OUT_OF_RANGE;
1100 cur_sense_data.ascq=0;
1102 else {
1103 #ifdef USB_USE_RAMDISK
1104 memcpy(cur_cmd.data[cur_cmd.data_select],
1105 ramdisk_buffer + cur_cmd.sector*SECTOR_SIZE,
1106 MIN(READ_BUFFER_SIZE/SECTOR_SIZE,cur_cmd.count)*SECTOR_SIZE);
1107 #else
1108 cur_cmd.last_result = storage_read_sectors(IF_MD2(cur_cmd.lun,)
1109 cur_cmd.sector,
1110 MIN(READ_BUFFER_SIZE/SECTOR_SIZE, cur_cmd.count),
1111 cur_cmd.data[cur_cmd.data_select]);
1112 #endif
1113 send_and_read_next();
1115 break;
1117 case SCSI_WRITE_10:
1118 logf("scsi write10 %d",lun);
1119 if(!lun_present) {
1120 send_csw(UMS_STATUS_FAIL);
1121 cur_sense_data.sense_key=SENSE_NOT_READY;
1122 cur_sense_data.asc=ASC_MEDIUM_NOT_PRESENT;
1123 cur_sense_data.ascq=0;
1124 break;
1126 cur_cmd.data[0] = tb.transfer_buffer;
1127 cur_cmd.data[1] = &tb.transfer_buffer[WRITE_BUFFER_SIZE];
1128 cur_cmd.data_select=0;
1129 cur_cmd.sector = block_size_mult *
1130 (cbw->command_block[2] << 24 |
1131 cbw->command_block[3] << 16 |
1132 cbw->command_block[4] << 8 |
1133 cbw->command_block[5] );
1134 cur_cmd.count = block_size_mult *
1135 (cbw->command_block[7] << 8 |
1136 cbw->command_block[8]);
1137 cur_cmd.orig_count = cur_cmd.count;
1139 /* expect data */
1140 if((cur_cmd.sector + cur_cmd.count) > block_count) {
1141 send_csw(UMS_STATUS_FAIL);
1142 cur_sense_data.sense_key=SENSE_ILLEGAL_REQUEST;
1143 cur_sense_data.asc=ASC_LBA_OUT_OF_RANGE;
1144 cur_sense_data.ascq=0;
1146 else {
1147 receive_block_data(cur_cmd.data[0],
1148 MIN(WRITE_BUFFER_SIZE, cur_cmd.count*SECTOR_SIZE));
1150 break;
1152 case SCSI_WRITE_BUFFER:
1153 if(cbw->command_block[1]==1 /* mode = vendor specific */
1154 && cbw->command_block[2]==0 /* buffer id = 0 */
1156 && cbw->command_block[3]==0x0c /* offset (3 bytes) */
1157 && cbw->command_block[4]==0
1158 && cbw->command_block[5]==0
1160 /* Some versions of itunes set the parameter list length to 0.
1161 * Technically it should be 0x0c, which is what libgpod sends */
1162 && cbw->command_block[6]==0 /* parameter list (3 bytes) */
1163 && cbw->command_block[7]==0
1164 && (cbw->command_block[8]==0 || cbw->command_block[8]==0x0c)
1166 && cbw->command_block[9]==0)
1167 receive_time();
1168 break;
1170 default:
1171 logf("scsi unknown cmd %x",cbw->command_block[0x0]);
1172 send_csw(UMS_STATUS_FAIL);
1173 cur_sense_data.sense_key=SENSE_ILLEGAL_REQUEST;
1174 cur_sense_data.asc=ASC_INVALID_COMMAND;
1175 cur_sense_data.ascq=0;
1176 break;
1180 static void send_block_data(void *data,int size)
1182 usb_drv_send_nonblocking(ep_in, data,size);
1183 state = SENDING_BLOCKS;
1186 static void send_command_result(void *data,int size)
1188 usb_drv_send_nonblocking(ep_in, data,size);
1189 state = SENDING_RESULT;
1192 static void send_command_failed_result(void)
1194 usb_drv_send_nonblocking(ep_in, NULL, 0);
1195 state = SENDING_FAILED_RESULT;
1198 static void receive_time(void)
1200 usb_drv_recv(ep_out, tb.transfer_buffer, 12);
1201 state = RECEIVING_TIME;
1203 static void receive_block_data(void *data,int size)
1205 usb_drv_recv(ep_out, data, size);
1206 state = RECEIVING_BLOCKS;
1209 static void send_csw(int status)
1211 tb.csw->signature = htole32(CSW_SIGNATURE);
1212 tb.csw->tag = cur_cmd.tag;
1213 tb.csw->data_residue = 0;
1214 tb.csw->status = status;
1216 usb_drv_send_nonblocking(ep_in, tb.csw,
1217 sizeof(struct command_status_wrapper));
1218 state = WAITING_FOR_CSW_COMPLETION_OR_COMMAND;
1219 //logf("CSW: %X",status);
1220 /* Already start waiting for the next command */
1221 usb_drv_recv(ep_out, cbw_buffer, MAX_CBW_SIZE);
1222 /* The next completed transfer will be either the CSW one
1223 * or the new command */
1225 if(status == UMS_STATUS_GOOD) {
1226 cur_sense_data.sense_key=0;
1227 cur_sense_data.information=0;
1228 cur_sense_data.asc=0;
1229 cur_sense_data.ascq=0;
1233 static void copy_padded(char *dest, char *src, int len)
1235 int i=0;
1236 while(i<len && src[i]!=0)
1238 dest[i]=src[i];
1239 i++;
1241 while(i<len)
1243 dest[i]=' ';
1244 i++;
1248 /* build SCSI INQUIRY */
1249 static void fill_inquiry(IF_MD_NONVOID(int lun))
1251 struct storage_info info;
1252 memset(tb.inquiry, 0, sizeof(struct inquiry_data));
1253 storage_get_info(lun,&info);
1254 copy_padded(tb.inquiry->VendorId,info.vendor,sizeof(tb.inquiry->VendorId));
1255 copy_padded(tb.inquiry->ProductId,info.product,sizeof(tb.inquiry->ProductId));
1256 copy_padded(tb.inquiry->ProductRevisionLevel,info.revision,sizeof(tb.inquiry->ProductRevisionLevel));
1258 tb.inquiry->DeviceType = DIRECT_ACCESS_DEVICE;
1259 tb.inquiry->AdditionalLength = 0x1f;
1260 memset(tb.inquiry->Reserved, 0, 3);
1261 tb.inquiry->Versions = 4; /* SPC-2 */
1262 tb.inquiry->Format = 2; /* SPC-2/3 inquiry format */
1264 tb.inquiry->DeviceTypeModifier = DEVICE_REMOVABLE;