简介
USB Mass storage Device协议即海量存储设备协议适用于硬盘,U盘等大容量存储设备。协议使用的接口端点有BulkIn、BulkOut和Interrupt端点。该设备类又包含6个独立的子类以及3种传输协议。
bInterfaceSubClass | 命令集 | 描述 |
---|---|---|
01h | RBC | 通常,FlashDevice使用RBC,事实上所有大容量存储设备都可使用RBC |
02h | SFF-8020i,MMC-2(ATAPI) | 适用硬盘,C/DVD |
03h | QIC-157 | 适用磁盘 |
04h | UFI | 适用软盘 |
05h | SFF-8070i | 适用移动存储设备 |
06h | SCSI | 目前绝大多数USB Mass Storage设备都使用SCSI指令集 |
bInterfaceProtocol | 协议实现 | 描述 |
00h | Control/Bulk/Interrupt protocol(含命令完成中断) | USB海量存储类CBI传输,只适用于全速 |
01h | Control/Bulk/Interrupt protocol(不含命令完成中断) | USB海量存储类CBI传输,只适用于全速 |
50h | Bulk-Only传输 | Bulk-Only传输 |
本文仅介绍SCSI子类下Bulk-Only的传输协议,我们手中的U盘就是遵循SCSI协议的。要知道U盘不仅仅是USB设备,它还是一种存储设备,类似硬盘,USB协议本身没有定义对存储设备操作的指令,所以需要通过SCSI来完成读写等操作。关于此类设备的描述符不再赘述,需要注意的是在interface描述符中:
-
bInterfaceClass = 0x08
-
bInterfaceSubClass = 0x06
-
bInterfaceProtocol = 0x50
指令、数据和状态协议
CBW指令格式
CBW(Command Block Wrapper)的长度为31个字节,具体定义如下图:
-
dCBWSignature:
CBW的标识,固定值:43425355h (little endian)。 -
dCBWTag:
主机发送的一个命令块标识,设备需要原样作为dCSWTag(CSW中的一部分)再发送给Host;主要用于关联CSW到对应的CBW。 -
dCBWDataTransferLength:
本次CBW命令要求在命令与回应之间传输的字节数。如果为0,则不传输数据。 -
bmCBWFlags:
反映数据传输的方向,0x00 表示来自Host,0x80 表示发至Host; -
bCBWLUN:
对于有多个LUN逻辑单元的设备,用来选择具体目标。如果没有多个LUN,则写0。 -
bCBWCBLength:
命令的长度,范围在0~16. -
CBWCB:
传输的具体命令,符合bInterfaceSubClass.中定义的命令规范,此处是SCSI指令集
CSW(Command Status Wrapper)状态格式
CSW的长度为13个字节,是对应CBW指令的状态返回,它指示了上一条指令执行是否成功,具体定义如下:
-
dCSWSignature:
CSW的标识,固定值:53425355h (little endian) -
dCSWTag:
设置这个标识和CBW中的dCBWTag一致,参照上面关于dCBWTag的解释 -
dCSWDataResidue:
还需要传送的数据,此数据根据dCBWDataTransferLength-本次已经传送的数据得到 -
bCSWStatus:
指示命令的执行状态。如果命令正确执行,bCSWStatus 返回0 ,不正确返回1,phase错返回2(当HOST收到此错误时需要对Device复位)
SCSI命令集
SCSI(Small Computer System Interface)的指令集有很多,参考http://en.wikipedia.org/wiki/SCSI_command ,其中USB Mass Storage主要用到的指令有:
- 04H Format Unit:格式化存储设备
- 12H Inquiry:获取设备信息
- 55H Mode Select:HOST用来设置外设参数
- 5AH Mode Sense:返回参数
- 28H/A8H Read(10)/Read(12):从设备读取数据
- 25H Read Capacity:读取设备容量
- 23H Read Format Capacity:读取当前设备容量和可格式化的容量
- 1EH Prevent/Allow Medium Removal:写保护
- 03H Request Sense:获取状态信息
- 2BH Seek(10):为设备分配地址
- 1DH Send Diagnostic:硬件复位并执行诊断
- 00H Test Unit Ready:查询设备是否ready
- 2AH/AA Write(10)/Write(12):写数据到存储设备
- 2EH Write and Verify:写数据到存储设备并校验
Format Unit
Bit Byte | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
0 | 04H | |||||||
1 | LUN | FmtData | CmpList | Defect List Format | ||||
2 | Vendor-specific | |||||||
3 | Interleave (MSB) | |||||||
4 | Interleave (LSB) | |||||||
5—6 | 保留 | |||||||
7 | Parameter List Length (MSB) | |||||||
8 | Parameter List Length (LSB) | |||||||
|
|
- Interleave:默认为0,对于USB-FDU此值为1
- Parameter List Length:参数列表长度,典型值为12bytes,Host发出Format命令后紧接着发参数
Parameter List
Bit Byte | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
0 | Reserved | |||||||
1 | FOV | Extend(0) | DCRT(1) | SingleTrack | Reserved | Immediate | Side | |
2 | Defect List Length (MSB) (0) | |||||||
3 | Defect List Length (LSB) (8) | |||||||
4—7 | MSB Number of Blocks | |||||||
8 | Reserved | |||||||
9—11 | MSB Block Length |
- FOV:当DCRT或Immediate置1时,此位也须置1
- DCRT:置1表示无需对盘符进行认证,须置1
- SingleTrack:置1表示只对指定Format Unit命令指定的Track格式化
- Immediate:置1时,device必须立刻返回状态信息,不支持UFI设备
- Side:对SingleTrack有效,置1从顶部开始格式化,置0从底部开始格式化
注意:Number of Block和Block Length的值要与Read Format Capacity的返回相匹配
Inquiry
Bit Byte | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
0 | 12H | |||||||
1 | LUN | Reserved | EVPD(0) | |||||
2 | Page Code | |||||||
3 | Reserved | |||||||
4 | MSB Allocation Length | |||||||
5—11 | Reserved |
- Page Code:需要查询的页码,对于UFI设备仅支持00H
- Allocation Length:定义了需要查询和返回的最大字节数
标准INQUIRY返回数据
Bit Byte | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
0 | Reserved | Peripheral Device Type | ||||||
1 | RMB | Reserved | ||||||
2 | ISO Version(00h) | ECMA Version(00h) | ANSI Version (00h) | |||||
3 | Reserved | Response Data Format | ||||||
4 | Additional Length (31) | |||||||
5—7 | Reserved | |||||||
8—15 | Vendor Information | |||||||
16—31 | Product Identification | |||||||
32—35 | Product Revision Level |
- Peripheral Device Type:标识当前连接逻辑单元的类型,00H为直接存储设备,05H为光盘
- RMB(Removable Media Bit):置1表示是可移除设备
- Response Data Format:UFI设备置1
- Additional Length:参数长度,UFI设备此值为1FH
MODE SELECT
Bit Byte | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | |||
0 | 55H | ||||||||||
1 | LUN | PF | Reserved | SP | |||||||
2—6 | Reserved | ||||||||||
7—8 | MSB Parameter List Length | ||||||||||
9—11 | Reserved |
- PF:UFI设备置1
- SP(Save Pages):UFI设备不支持
- Parameter List Length:参数长度
MODE SENSE
Bit Byte | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
0 | 5AH | |||||||
1 | LUN | Reserved | DBD | Reserved | ||||
2 | PC | Page Code | ||||||
3—6 | Reserved | |||||||
7—8 | MSB Parameter List Length | |||||||
9—11 | Reserved |
- DBD - Disable Block Descriptors - if "1" then the target must not return any block descriptors
- PC - Page control -
- 00 - return current values
- 01 - return changeable values
- 10 - return default values
- 11 - return saved values
- Page Code - 参考 SCSI mode pages
PREVENT-ALLOW MEDIUM REMOVAL
Bit
Byte
7
6
5
4
3
2
1
0
0
1EH
1
LUN
Reserved
2-3
Reserved
4
Reserved
Prevent
5-11
Reserved
Prevent:置1表示禁止移除设备
READ(10)
Bit
Byte
7
6
5
4
3
2
1
0
0
28H
1
LUN
DPO(0)
FUA(0)
Reserved
RelAdr(0)
2-5
Logical Block Address
6
Reserved
7—8
MSB Transfer Length
9—11
Reserved
READ(12) A8H的Transfer Length为32位,从6-9字节
READ CAPACITY
Bit
Byte
7
6
5
4
3
2
1
0
0
25H
1
LUN
Reserved
RelAdr(0)
2-5
Logical Block Address(0)
6-7
Reserved
8
Reserved
PMI(0)
9—11
Reserved
此命令返回8个字节,0-3表示最后一个逻辑块的地址,4-7表示每个逻辑块的长度
READ FORMAT CAPACITIES
Bit
Byte
7
6
5
4
3
2
1
0
0
23H
1
LUN
Reserved
2-6
Reserved
7-8
Allocation Length
9-11
Reserved
Allocation Length:定义了HOST能够接收的最大格式化数据长度
REQUEST SENSE
Bit
Byte
7
6
5
4
3
2
1
0
0
03H
1
LUN
Reserved
2-3
Reserved
4
Allocation Length
5-11
Reserved
Allocation Length:定义了HOST能够接收的最大格式化数据长度
HOST每发送完一个命令,device都会通过REQUEST SENSE返回该条指令的执行结果,sense data的长度为18字节。
标准sense data
Bit Byte
7
6
5
4
3
2
1
0
0
Valid
Error Code (70h)
1
Reserved
2
Reserved
Sense Key
3-6
Information
7
Additional Sense Length (0AH)
8-11
Reserved
12
Additional Sense Code (Mandatory)
13
Additional Sense Code Qualifier (Mandatory)
14-17
Reserved
Valid:表示Information域是否有效
Information:表示出错的逻辑块地址
SEEK
Bit
Byte
7
6
5
4
3
2
1
0
0
2BH
1
LUN
Reserved
2-5
Logical Block Address
6-11
Reserved
SEND DIAGNOSTIC
Bit
Byte
7
6
5
4
3
2
1
0
0
1DH
1
LUN
PF
Reserved
SelfTest
DefOfl
UnitOfl
2-11
Reserved
SelfTest:置1表示执行默认的自检,置0表示执行特殊的自检
TEST UNIT READY
Bit
Byte
7
6
5
4
3
2
1
0
0
00H
1
LUN
Reserved
2-11
Reserved
VERIFY
Bit
Byte
7
6
5
4
3
2
1
0
0
2FH
1
LUN
DPO(0)
Reserved
ByteChk(0)
RelAdr(0)
2-5
Logical Block Address
6
Reserved
7-8
Verification Length
9-11
Reserved
Logical Block Address:验证的起始地址
Verification Length:验证数据的长度
WRITE(10)
Bit
Byte
7
6
5
4
3
2
1
0
0
2AH
1
LUN
DPO(0)
FUA(0)
Reserved
RelAdr(0)
2-5
Logical Block Address
6
Reserved
7-8
Transfer Length
9-11
Reserved
WRITE(12) AAH的Transfer Length为32位,从6-9字节
WRITE AND VERIFY
Bit
Byte
7
6
5
4
3
2
1
0
0
2EH
1
LUN
DPO(0)
Reserved
ByteChk
(0)
RelAdr(0)
2-5
Logical Block Address
6
Reserved
7-8
Transfer Length
9-11
Reserved