USB firmware Development (mass storage device)

USB firmware Development (mass storage device)

The mass storage device, that is, a large-capacity storage device, is more typical than a USB flash disk. the USB flash disk is generally implemented in bulk only transmission mode.

1. USB mass storage device descriptor and enumeration process
The descriptor is the descriptor corresponding to the standard request. Unlike the HID device, the mass storage device does not have its own class descriptor. The descriptor is described one-to-one in the USB Mass Storage Class bulk-only transport document. So I will not go into details here. Here is only one example:

(Device descriptor omitted, general definition, irrelevant to the device class)
(Configuration descriptor omitted, general definition, irrelevant to the device class)

_ Interface_descriptor:
. Dw 0x09 // blength: 0x09 byte
. Dw 0x04 // bdescriptortype: Interface
. Dw 0x00 // binterfacenumber: interface 0
. Dw 0x00 // balternatesetting: Alternate setting 0
. Dw 0x02 // bnumendpoints: 3 endpoints (ep0, EP1, EP2)
. Dw 0x08 // binterfaceclass: mass storage devices Class
. Dw 0x06 // binterfacesubclass:
. Dw 0x50 // binterfaceprotocol
. Dw 0x02 // iinterface: Index of string
_ Interface_descriptor_end:

_ Endpoint1:
. Dw 0x07 // blength: 0x07 byte
. Dw 0x05 // bdescriptortype: endpoint
. Dw 0x81 // bendpointaddress: In endpoint 1
. Dw 0x02 // bmattributes: Bulk
. Dw 0x40, 0x00 // wmaxpacketsize: 64 bytes
. Dw 0x00 // binterval: ignored

_ Endpoint2:
// Endpoint 2 (0x07 byte)
. Dw 0x07 // blength: 0x07 byte
. Dw 0x05 // bdescriptortype: endpoint
. Dw 0x02 // bendpointaddress: Out endpoint 2
. Dw 0x02 // bmattributes: Bulk
. Dw 0x40, 0x00 // wmaxpacketsize: 64 bytes
. Dw 0x00 // binterval: ignored

Request:
First, the host sends a series of standard requests.
Second, after the standard request is complete, two class requests will be sent: bulk-only mass storage reset request and get Max Lun request. The request formats can be found in the USB Mass Storage Class bulk-only transport document.

Bulk-only mass storage reset does not have a data phase. It only tells the host device whether the reset process is completed in the status phase. If an ACK is returned in the status phase, the host determines that the device has been reset and is ready to receive the CBW.
The get Max Lun requires the device to return one byte of data to the host to indicate how many logical devices the USB device has. The returned data is the maximum logical unit number in the range of 0 to 15. For example, if 2 is returned, there are three logical devices: 0, 1, and 2.

2. bulk data exchange process of USB Mass Storage Device
Data transmission through the bulk endpoint follows this process, namely, three stages:
CBW-> data-> CSW
CBW is a data block that carries the SCSI commands sent from the host to the device. After receiving the CBW, the device can know what to do in the next data phase.
There are three situations in the data phase: In transmission (from a device to a host) or out transmission (from a host to a device ).
CSW stage feedback the results of this transmission to the host.

It is worth noting that:

-After the device enumeration is complete, the first bulk out transaction sent by the host is to send a CBW request to the device. Therefore, the device can determine the start of the first bulk data transmission through the first bulk out transaction. Subsequent bulk data transmission follows the three stages described above. That is to say, after the first transmission of CBW, if there is data to be transmitted, it will go through the data phase and enter the CSW phase; if there is no data to be transmitted, it will go directly to the CSW phase, this transfer ends. Next, if there is another transmission, then issue the CBW. Therefore, the device can assume that the next bulk out transaction received by CSWs is the new CBWs requested by the host.

-The CBW [12] (13th bytes of the CBW data block) indicates the transmission direction, and the CBW [8-11] indicates the Data Length. In fact, the SCSI command in CBW implies the direction and length of data to be transmitted, because the SCSI specification clearly specifies the data format corresponding to this command. (In a complete application, you must compare the transmission direction and Data Length in the CBW with the transmission direction and Data Length indicated by the SCSI command, if this parameter is not matched, error processing is required (the description in the mass storage bulk-only document). However, normally, the two are matched and can be ignored temporarily during the test ).

-CSW [12] (13th bytes of the CSW data block) is very important. If it is 0, the transfer is successful. If it is not 0, the transfer is unsuccessful. After data transmission is complete (or data transmission is not required), the host sends an in transaction request to the device to return CSW. If the CSW sends an unsuccessful message, the host sends another command to obtain the detailed information of the failure (that is, the requestsense command ).

3. scsi command set used by the Mass Storage Device
0x00 testunitready
0x03 requestsense
0x12 inquiry
0x1a modesense6
0x1b startstop
0x1e mediumremoval
0x23 readformatcapacity
0x25 readcapacity
0x28 read (10)
0x2a write (10)
0x2f verify
0x5a modesense10

Where,
-The host first issues the inquiry command. After responding to inquiry, the drive letter is displayed.
-After inquiry, the readformatcapacity command will be issued. This command is a "factory-defined command" in the SCSI specification. You can refer to the UFI command set documentation (in fact, all SCSI command sets used by the USB flash drive can be referred to the UFI documentation, which is simpler and clearer than the SCSI standard documentation ). Note that this command is not described in bushound. You must check the USB Mass Storage Device node corresponding to the USB flash disk on the device option page to view the data stream of this command.
-After readformatcapacity, The readcapacity command is issued.
-Read (10) is sent when the USB flash drive reads data (read sector ). After readcapacity is complete, it will send read (10) to read the first sector of the USB flash drive.
-When writing data on a USB flash drive (write sector), write (10) is sent ).
-Testunitready will be sent regularly when no other data is transmitted. If the device does not respond to a successful CSW to the host, the host considers that the device does not exist. If you double-click the disk icon again, Windows will prompt "please insert disk ".
-Verify is useful when writing data. Verify indicates data verification. Generally, a successful CSW is returned. Generally, data verification is performed when data is received and written to the media. If an error is found, the system will directly tell the host that the data transmission is incorrect and will not wait until the host verify. Of course, this is not an inevitable solution.
-Requestsense: If CSW indicates that the transfer is unsuccessful, the host sends this request.
-Currently, no major application is found in startstop. Generally, a successful CSW is returned.
-Mediumremoval is useful when the USB flash drive is eject. If the processing is incorrect, an error message is displayed in windows.
-The modesense6/10 commands are not supported (not supported does not mean that they do not respond. You must respond to any command. For unsupported commands, you can use the stall handshake to indicate to the host.) No exceptions have been encountered for the moment, and I have checked some USB flash drives. A considerable portion of the data is randomly returned to the host. These two Commands will only be sent once after the USB flash drive is inserted, and will not be sent later.

 

(Unfinished)