danos/system/drivers/usb-storage/usb-storage.zig

//! USB mass-storage class driver (Bulk-Only Transport + transparent SCSI).
//!
//! Spawned by the device manager when the xHCI bus driver reports a mass-storage
//! / SCSI / bulk-only interface (class 8, subclass 6, protocol 0x50); its device
//! id arrives as argv[1]. It owns no hardware: it opens its device through the
//! USB transfer protocol (`usb`), then drives it with the BOT command
//! cycle — CBW out, an optional data stage, CSW in — carrying SCSI commands
//! (READ CAPACITY, READ(10), WRITE(10)). Upward it is a block device: it serves
//! the block protocol under `.block`, the storage a FAT filesystem sits on.
//!
//! Block data never crosses IPC: read/write name a caller-owned DMA buffer by
//! physical address, which the data stage DMAs straight to/from.

const std = @import("std");
const ipc = @import("ipc");
const process = @import("process");
const service = @import("service");
const time = @import("time");
const device_manager = @import("driver");
const memory = @import("memory");
const logging = @import("logging");
const usb = @import("usb");
const scsi = @import("scsi.zig");
const bot = @import("bulk-only-transport.zig");
const block_protocol = @import("block-protocol");

var device_id: u64 = 0;
var device: usb.Device = undefined;
var bulk_in: usb.Endpoint = undefined;
var bulk_out: usb.Endpoint = undefined;

// DMA buffers for the transport: the 31-byte CBW, the 13-byte CSW, and a page
// for the small command data (INQUIRY / READ CAPACITY / the self-check sector).
var command_wrapper: memory.DmaRegion = undefined;
var status_wrapper: memory.DmaRegion = undefined;
var command_data: memory.DmaRegion = undefined;

var next_tag: u32 = 1;
var block_size: u32 = 512;
var block_count: u64 = 0;

/// One Bulk-Only-Transport command: send the CBW, run the data stage (to/from
/// `data_physical`), read and validate the CSW. Returns true on a passed status.
fn transact(cdb: []const u8, direction_in: bool, data_physical: u64, data_length: u32) bool {
    const tag = next_tag;
    next_tag +%= 1;

    const wrapper: *bot.CommandBlockWrapper = @ptrFromInt(command_wrapper.virtual);
    wrapper.* = .{
        .tag = tag,
        .data_transfer_length = data_length,
        .flags = if (direction_in) bot.flag_data_in else 0,
        .lun = 0,
        .cdb_length = @intCast(cdb.len),
    };
    @memcpy(wrapper.cdb[0..cdb.len], cdb);

    if (device.bulk(bulk_out.address, command_wrapper.physical, @sizeOf(bot.CommandBlockWrapper)) == null) return false;
    if (data_length > 0) {
        const endpoint = if (direction_in) bulk_in.address else bulk_out.address;
        if (device.bulk(endpoint, data_physical, data_length) == null) return false;
    }
    if (device.bulk(bulk_in.address, status_wrapper.physical, @sizeOf(bot.CommandStatusWrapper)) == null) return false;

    const status: *const bot.CommandStatusWrapper = @ptrFromInt(status_wrapper.virtual);
    if (status.signature != bot.csw_signature or status.tag != tag) return false;
    return status.status == @intFromEnum(bot.CommandStatus.passed);
}

/// Set when bring-up failed with the device PRESENT (an opened device that then
/// failed a step): main exits nonzero, and the device manager restarts us with
/// backoff — a transient failure heals instead of leaving storage down forever.
/// Device-absent paths stay clean exits: nothing to serve, nothing to retry.
var bring_up_failed = false;

fn initialise(endpoint: ipc.Handle) bool {
    _ = endpoint;
    if (device_manager.hello(.device, device_id) == null) return false;
    device = usb.open(device_id) orelse {
        std.log.info("could not open device {d}", .{device_id});
        return false;
    };
    bulk_in = device.findEndpoint(usb.transfer_type_bulk, true) orelse {
        _ = logging.write("/system/drivers/usb-storage: no bulk-IN endpoint\n");
        bring_up_failed = true;
        return false;
    };
    bulk_out = device.findEndpoint(usb.transfer_type_bulk, false) orelse {
        _ = logging.write("/system/drivers/usb-storage: no bulk-OUT endpoint\n");
        bring_up_failed = true;
        return false;
    };
    // Shareable, so each buffer's capability can be handed to the controller: usb-storage
    // owns no device, so its buffers are not auto-bound anywhere — the controller reaches
    // them only once attached. (No-op binding when no IOMMU is enforcing.)
    command_wrapper = memory.dmaAlloc(4096, memory.dma_coherent | memory.dma_shareable) orelse return false;
    status_wrapper = memory.dmaAlloc(4096, memory.dma_coherent | memory.dma_shareable) orelse return false;
    command_data = memory.dmaAlloc(4096, memory.dma_coherent | memory.dma_shareable) orelse return false;
    for ([_]memory.DmaRegion{ command_wrapper, status_wrapper, command_data }) |region| {
        if (region.handle) |handle| {
            if (!device.attachDma(handle)) {
                _ = logging.write("/system/drivers/usb-storage: could not attach a DMA buffer to the controller\n");
                bring_up_failed = true;
                return false;
            }
            _ = ipc.close(handle); // the binding holds its own reference now
        }
    }

    // Bring the LUN up: wait for it to be ready (clearing the initial unit-attention
    // with REQUEST SENSE), identify it, and read its capacity.
    var tries: u32 = 0;
    while (tries < 10) : (tries += 1) {
        const ready = scsi.testUnitReady();
        if (transact(&ready, false, 0, 0)) break;
        const sense = scsi.requestSense(18);
        _ = transact(&sense, true, command_data.physical, 18);
        time.sleepMillis(50);
    }
    const inquiry = scsi.inquiry(36);
    _ = transact(&inquiry, true, command_data.physical, 36);

    const capacity_command = scsi.readCapacity10();
    if (!transact(&capacity_command, true, command_data.physical, 8)) {
        _ = logging.write("/system/drivers/usb-storage: READ CAPACITY failed\n");
        bring_up_failed = true;
        return false;
    }
    var capacity_bytes: [8]u8 = undefined;
    const capacity_source: [*]const u8 = @ptrFromInt(command_data.virtual);
    @memcpy(&capacity_bytes, capacity_source[0..8]);
    const capacity = scsi.parseCapacity(capacity_bytes);
    block_size = capacity.block_size;
    block_count = @as(u64, capacity.last_lba) + 1;
    std.log.info("ready ({d} blocks x {d} bytes)", .{ block_count, block_size });

    // Self-check: read block 0 and log its trailing signature (0x55AA for a boot
    // sector) — proof READ(10) works end to end over the bulk path.
    const read0 = scsi.read10(0, 1);
    if (block_size <= 4096 and transact(&read0, true, command_data.physical, block_size)) {
        const sector: [*]const u8 = @ptrFromInt(command_data.virtual);
        std.log.info("block 0 signature 0x{x:0>2}{x:0>2}", .{ sector[510], sector[511] });
    }
    return true;
}

/// Serve the block protocol: geometry, and whole-block read/write to/from the
/// caller's DMA buffer (named by physical address).
fn onMessage(message: []const u8, reply: []u8, sender: u32, arrived: *ipc.Arrival) usize {
    _ = sender;
    if (message.len < block_protocol.request_size) return 0;
    const request = std.mem.bytesToValue(block_protocol.Request, message[0..block_protocol.request_size]);
    switch (request.operation) {
        @intFromEnum(block_protocol.Operation.attach) => {
            // The filesystem's DMA buffer: forward its capability to the controller
            // so the device can reach it. Never claimed — the binding holds its own
            // reference, so our copy is the turn's to close, on this path and on the
            // refusal above it alike.
            const handle = arrived.peek() orelse return writeReply(reply, .{ .status = -1, .block_size = 0, .block_count = 0 });
            const ok = device.attachDma(handle);
            return writeReply(reply, .{ .status = if (ok) 0 else -1, .block_size = 0, .block_count = 0 });
        },
        @intFromEnum(block_protocol.Operation.geometry) => {
            return writeReply(reply, .{ .status = 0, .block_size = block_size, .block_count = block_count });
        },
        @intFromEnum(block_protocol.Operation.read) => {
            const count: u16 = @intCast(request.count);
            const cdb = scsi.read10(@intCast(request.lba), count);
            const ok = transact(&cdb, true, request.physical, request.count * block_size);
            return writeReply(reply, .{ .status = if (ok) 0 else -1, .block_size = block_size, .block_count = if (ok) request.count else 0 });
        },
        @intFromEnum(block_protocol.Operation.write) => {
            const count: u16 = @intCast(request.count);
            const cdb = scsi.write10(@intCast(request.lba), count);
            const ok = transact(&cdb, false, request.physical, request.count * block_size);
            return writeReply(reply, .{ .status = if (ok) 0 else -1, .block_size = block_size, .block_count = if (ok) request.count else 0 });
        },
        @intFromEnum(block_protocol.Operation.flush) => {
            // SYNCHRONIZE CACHE: commit the device's write cache to flash. No data
            // stage. Makes prior writes durable before a caller (init at shutdown)
            // cuts power. A device without a volatile cache reports success anyway.
            const cdb = scsi.synchronizeCache10();
            const ok = transact(&cdb, false, 0, 0);
            return writeReply(reply, .{ .status = if (ok) 0 else -1, .block_size = block_size, .block_count = 0 });
        },
        else => return 0,
    }
}

fn writeReply(reply: []u8, value: block_protocol.Reply) usize {
    const bytes = std.mem.asBytes(&value);
    @memcpy(reply[0..bytes.len], bytes);
    return bytes.len;
}

pub fn main(init: process.Init) void {
    const argument = init.arguments.get(1) orelse {
        _ = logging.write("/system/drivers/usb-storage: missing device id (argv[1])\n");
        return;
    };
    device_id = std.fmt.parseInt(u64, argument, 10) catch {
        std.log.info("malformed device id '{s}'", .{argument});
        return;
    };
    service.run(block_protocol.message_maximum, .{
        .service = "block",
        .init = initialise,
        .on_message = onMessage,
    });
    // A failure exit (nonzero -> .aborted) tells the device manager to restart
    // us with backoff; a clean return means there was nothing to serve.
    if (bring_up_failed) process.exit(1);
}