USB Mass Storage协议
简介
USB Mass storage Device协议即海量存储设备协议适用于硬盘，U盘等大容量存储设备。协议使用的接口端点有BulkIn、BulkOut和Interrupt端点。该设备类又包含6个独立的子类以及3种传输协议。
| bInterfaceSubClass | 命令集 | 描述 |
|---|---|---|
| 01h | RBC | 通常，FlashDevice使用RBC，事实上所有大容量存储设备都可使用RBC |
| 02h | SFF-8020i,MMC-2(ATAPI) | 适用硬盘，C/DVD |
| 03h | QIC-157 | 适用磁盘 |
| 04h | UFI | 适用软盘 |
| 05h | SFF-8070i | 适用移动存储设备 |
| 06h | SCSI | 目前绝大多数USB Mass Storage设备都使用SCSI指令集 |
| bInterfaceProtocol | 协议实现 | 描述 |
| 00h | Control/Bulk/Interrupt protocol（含命令完成中断） | USB海量存储类CBI传输，只适用于全速 |
| 01h | Control/Bulk/Interrupt protocol（不含命令完成中断） | USB海量存储类CBI传输，只适用于全速 |
| 50h | Bulk-Only传输 | Bulk-Only传输 |
本文仅介绍SCSI子类下Bulk-Only的传输协议，我们手中的U盘就是遵循SCSI协议的。要知道U盘不仅仅是USB设备，它还是一种存储设备，类似硬盘，USB协议本身没有定义对存储设备操作的指令，所以需要通过SCSI来完成读写等操作。关于此类设备的描述符不再赘述，需要注意的是在interface描述符中：
-
bInterfaceClass = 0x08
-
bInterfaceSubClass = 0x06
-
bInterfaceProtocol = 0x50
指令、数据和状态协议
CBW指令格式
CBW（Command Block Wrapper）的长度为31个字节，具体定义如下图：
-
dCBWSignature:
CBW的标识，固定值：43425355h (little endian)。 -
dCBWTag:
主机发送的一个命令块标识，设备需要原样作为dCSWTag（CSW中的一部分）再发送给Host;主要用于关联CSW到对应的CBW。 -
dCBWDataTransferLength:
本次CBW命令要求在命令与回应之间传输的字节数。如果为0，则不传输数据。 -
bmCBWFlags:
反映数据传输的方向，0x00 表示来自Host，0x80 表示发至Host； -
bCBWLUN:
对于有多个LUN逻辑单元的设备，用来选择具体目标。如果没有多个LUN，则写0。 -
bCBWCBLength:
命令的长度，范围在0~16. -
CBWCB:
传输的具体命令，符合bInterfaceSubClass.中定义的命令规范，此处是SCSI指令集
CSW（Command Status Wrapper）状态格式
CSW的长度为13个字节，是对应CBW指令的状态返回，它指示了上一条指令执行是否成功，具体定义如下：
-
dCSWSignature:
CSW的标识，固定值：53425355h (little endian) -
dCSWTag:
设置这个标识和CBW中的dCBWTag一致，参照上面关于dCBWTag的解释 -
dCSWDataResidue:
还需要传送的数据，此数据根据dCBWDataTransferLength－本次已经传送的数据得到 -
bCSWStatus:
指示命令的执行状态。如果命令正确执行，bCSWStatus 返回0 ，不正确返回1，phase错返回2（当HOST收到此错误时需要对Device复位）
SCSI命令集
SCSI（Small Computer System Interface）的指令集有很多，参考http://en.wikipedia.org/wiki/SCSI_command ，其中USB Mass Storage主要用到的指令有：
- 04H Format Unit：格式化存储设备
- 12H Inquiry：获取设备信息
- 55H Mode Select：HOST用来设置外设参数
- 5AH Mode Sense：返回参数
- 28H/A8H Read(10)/Read(12)：从设备读取数据
- 25H Read Capacity：读取设备容量
- 23H Read Format Capacity：读取当前设备容量和可格式化的容量
- 1EH Prevent/Allow Medium Removal：写保护
- 03H Request Sense：获取状态信息
- 2BH Seek(10)：为设备分配地址
- 1DH Send Diagnostic：硬件复位并执行诊断
- 00H Test Unit Ready：查询设备是否ready
- 2AH/AA Write(10)/Write(12)：写数据到存储设备
- 2EH Write and Verify：写数据到存储设备并校验
Format Unit
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| 0 |
04H |
|||||||
| 1 |
LUN |
FmtData |
CmpList |
Defect List Format |
||||
| 2 |
Vendor-specific |
|||||||
| 3 |
Interleave (MSB) |
|||||||
| 4 |
Interleave (LSB) |
|||||||
| 5—6 |
保留 |
|||||||
| 7 |
Parameter List Length (MSB) |
|||||||
| 8 |
Parameter List Length (LSB) |
|||||||
|
|
|
|||||||
- Interleave:默认为0，对于USB-FDU此值为1
- Parameter List Length:参数列表长度，典型值为12bytes,Host发出Format命令后紧接着发参数
Parameter List
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| 0 |
Reserved |
|||||||
| 1 |
FOV |
Extend(0) |
DCRT(1) |
SingleTrack |
Reserved |
Immediate |
Side |
|
| 2 |
Defect List Length (MSB) (0) |
|||||||
| 3 |
Defect List Length (LSB) (8) |
|||||||
| 4—7 |
MSB Number of Blocks |
|||||||
| 8 |
Reserved |
|||||||
| 9—11 |
MSB Block Length |
|||||||
- FOV：当DCRT或Immediate置1时，此位也须置1
- DCRT：置1表示无需对盘符进行认证，须置1
- SingleTrack：置1表示只对指定Format Unit命令指定的Track格式化
- Immediate：置1时，device必须立刻返回状态信息，不支持UFI设备
- Side：对SingleTrack有效，置1从顶部开始格式化，置0从底部开始格式化
注意：Number of Block和Block Length的值要与Read Format Capacity的返回相匹配
Inquiry
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| 0 |
12H |
|||||||
| 1 |
LUN |
Reserved |
EVPD(0) |
|||||
| 2 |
Page Code |
|||||||
| 3 |
Reserved |
|||||||
| 4 |
MSB Allocation Length |
|||||||
| 5—11 |
Reserved |
|||||||
- Page Code:需要查询的页码，对于UFI设备仅支持00H
- Allocation Length：定义了需要查询和返回的最大字节数
标准INQUIRY返回数据
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| 0 |
Reserved |
Peripheral Device Type |
||||||
| 1 |
RMB |
Reserved |
||||||
| 2 |
ISO Version(00h) |
ECMA Version(00h) |
ANSI Version (00h) |
|||||
| 3 |
Reserved |
Response Data Format |
||||||
| 4 |
Additional Length (31) |
|||||||
| 5—7 |
Reserved |
|||||||
| 8—15 |
Vendor Information |
|||||||
| 16—31 |
Product Identification |
|||||||
| 32—35 |
Product Revision Level |
|||||||
- Peripheral Device Type：标识当前连接逻辑单元的类型，00H为直接存储设备，05H为光盘
- RMB(Removable Media Bit)：置1表示是可移除设备
- Response Data Format：UFI设备置1
- Additional Length：参数长度，UFI设备此值为1FH
MODE SELECT
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
|||
| 0 |
55H |
||||||||||
| 1 |
LUN |
PF |
Reserved |
SP |
|||||||
| 2—6 |
Reserved |
||||||||||
| 7—8 |
MSB Parameter List Length |
||||||||||
| 9—11 |
Reserved |
||||||||||
- PF：UFI设备置1
- SP(Save Pages)：UFI设备不支持
- Parameter List Length：参数长度
MODE SENSE
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| 0 |
5AH |
|||||||
| 1 |
LUN |
Reserved |
DBD |
Reserved |
||||
| 2 |
PC |
Page Code |
||||||
| 3—6 |
Reserved |
|||||||
| 7—8 |
MSB Parameter List Length |
|||||||
| 9—11 |
Reserved |
|||||||
- 00 - return current values
- 01 - return changeable values
- 10 - return default values
- 11 - return saved values
PREVENT-ALLOW MEDIUM REMOVAL
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
|
| 0 |
1EH |
||||||||
| 1 |
LUN |
Reserved |
|||||||
| 2-3 |
Reserved |
||||||||
| 4 |
Reserved |
Prevent |
|||||||
| 5-11 |
Reserved |
||||||||
Prevent：置1表示禁止移除设备
READ(10)
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| 0 |
28H |
|||||||
| 1 |
LUN |
DPO(0) |
FUA(0) |
Reserved |
RelAdr(0) |
|||
| 2-5 |
Logical Block Address |
|||||||
| 6 |
Reserved |
|||||||
| 7—8 |
MSB Transfer Length |
|||||||
| 9—11 |
Reserved |
|||||||
READ(12) A8H的Transfer Length为32位，从6-9字节
READ CAPACITY
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
|
| 0 |
25H |
||||||||
| 1 |
LUN |
Reserved |
RelAdr(0) |
||||||
| 2-5 |
Logical Block Address(0) |
||||||||
| 6-7 |
Reserved |
||||||||
| 8 |
Reserved |
PMI(0) |
|||||||
| 9—11 |
Reserved |
||||||||
此命令返回8个字节，0-3表示最后一个逻辑块的地址，4-7表示每个逻辑块的长度
READ FORMAT CAPACITIES
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| 0 |
23H |
|||||||
| 1 |
LUN |
Reserved |
||||||
| 2-6 |
Reserved |
|||||||
| 7-8 |
Allocation Length |
|||||||
| 9-11 |
Reserved |
|||||||
Allocation Length：定义了HOST能够接收的最大格式化数据长度
REQUEST SENSE
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| 0 |
03H |
|||||||
| 1 |
LUN |
Reserved |
||||||
| 2-3 |
Reserved |
|||||||
| 4 |
Allocation Length |
|||||||
| 5-11 |
Reserved |
|||||||
Allocation Length：定义了HOST能够接收的最大格式化数据长度
HOST每发送完一个命令，device都会通过REQUEST SENSE返回该条指令的执行结果，sense data的长度为18字节。
标准sense data
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
|
| 0 |
Valid |
Error Code (70h) |
|||||||
| 1 |
Reserved |
||||||||
| 2 |
Reserved |
Sense Key |
|||||||
| 3-6 |
Information |
||||||||
| 7 |
Additional Sense Length (0AH) |
||||||||
| 8-11 |
Reserved |
||||||||
| 12 |
Additional Sense Code (Mandatory) |
||||||||
| 13 |
Additional Sense Code Qualifier (Mandatory) |
||||||||
| 14-17 |
Reserved |
||||||||
Valid：表示Information域是否有效
Information：表示出错的逻辑块地址
SEEK
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| 0 |
2BH |
|||||||
| 1 |
LUN |
Reserved |
||||||
| 2-5 |
Logical Block Address |
|||||||
| 6-11 |
Reserved |
|||||||
SEND DIAGNOSTIC
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| 0 |
1DH |
|||||||
| 1 |
LUN |
PF |
Reserved |
SelfTest |
DefOfl |
UnitOfl |
||
| 2-11 |
Reserved |
|||||||
SelfTest：置1表示执行默认的自检，置0表示执行特殊的自检
TEST UNIT READY
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| 0 |
00H |
|||||||
| 1 |
LUN |
Reserved |
||||||
| 2-11 |
Reserved |
|||||||
VERIFY
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| 0 |
2FH |
|||||||
| 1 |
LUN |
DPO(0) |
Reserved |
ByteChk(0) |
RelAdr(0) |
|||
| 2-5 |
Logical Block Address |
|||||||
| 6 |
Reserved |
|||||||
| 7-8 |
Verification Length |
|||||||
| 9-11 |
Reserved |
|||||||
Logical Block Address：验证的起始地址
Verification Length：验证数据的长度
WRITE(10)
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| 0 |
2AH |
|||||||
| 1 |
LUN |
DPO(0) |
FUA(0) |
Reserved |
RelAdr(0) |
|||
| 2-5 |
Logical Block Address |
|||||||
| 6 |
Reserved |
|||||||
| 7-8 |
Transfer Length |
|||||||
| 9-11 |
Reserved |
|||||||
WRITE(12) AAH的Transfer Length为32位，从6-9字节
WRITE AND VERIFY
| Bit Byte |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| 0 |
2EH |
|||||||
| 1 |
LUN |
DPO(0) |
Reserved |
ByteChk (0) |
RelAdr(0) |
|||
| 2-5 |
Logical Block Address |
|||||||
| 6 |
Reserved |
|||||||
| 7-8 |
Transfer Length |
|||||||
| 9-11 |
Reserved |
|||||||